Brandmauer Report

Darth Vader Speaks Up Against Surveillance Cameras in San Diego
Surveillance control · 21.08.2026

The best illustration of the surveillance debate in recent years is Darth Vader showing up at a San Diego city council meeting to defend Flock cameras. Literally: a man in the costume, breathing through the meeting room's microphone in his signature style.

It happened on Wednesday at a public safety committee meeting. The speech opened with the claim that the technology would help "find rebel scum and the hidden base on Hoth," and ended with an admission that the cameras are needed "to keep an eye on an ex-girlfriend." In between came a separate jab: the system doesn't just track license plates — it tracks kids moving "from the playground to the pool, from the pool to the gym." And council member Jennifer Campbell got advice from the character to work on her Jedi mind tricks — since she's voting for surveillance that, in his words, keeps people caged.

While some are staging Star Wars at the podium, reality is more mundane and no less troubling for it. SDPD has around 500 Flock camera points across the city — that's the official figure from the 2025 surveillance report. Plus there's the independent DeFlock project map, which shows even more points, though it isn't an official registry.

Meanwhile, in December 2025 the police signed a year-long pilot agreement for Flock Nova — a platform for merging data from various sources. Then they claimed they're actually not using it and have no plans to feed license plate reader data into it. Convenient: sign a surveillance contract and immediately claim you're not involved.

Police insist access to the license plate database is limited to authorized staff, that data is kept for a maximum of 30 days, and is automatically deleted unless needed as evidence. Activists and some officials aren't reassured by this and keep demanding alternatives — there's no shortage of reasons to criticize these cameras nationwide.

The good news: the empire, it seems, hasn't quite figured out what it wants Flock Nova for. The bad news: the Vader costume isn't even the main absurdity here.

Source: https://www.foxnews.com/us/darth-vader-uses-dark-side-mock-controversial-surveillance-cameras-emperor-fan-flock

Weekly digest: Surveillance outpaces the law, while banks dodge sanctions faster than Apple can ban them
Weekly digest: surveillance is being built with no laws in place, banks dodge sanctions via fake kitchen apps, and internet freedom declines for the 15th year running

— Freedom House recorded a record decline in internet freedom — and IoT infrastructure found itself on the front line of this hit
— Sanctioned T-Bank once again snuck into the App Store disguised as a kitchen planner — using a shell British company
— Belarusian independent media have been working in exile for the sixth year, but have learned to build mirrors that can't be selectively blocked
— The Nigerian state of Enugu built thousands of cameras and an airport-level surveillance center — with no law whatsoever to regulate it
— The victims are already here: 50 days in pretrial detention over a post, 271 days of torture without evidence — the real price of surveillance without legal frameworks

📖 Full breakdown: https://telegra.ph/Brandmauer-Report-weekly-digest-170823082026-08-24

❤️ Reactions under posts are votes: what makes it into the digest is what you read and like.

Browser fingerprinting hides in the most unlikely places
Monitoring orgs · 23.08.2026

Online surveillance stopped being just about cookies a long time ago. A far less visible but much more persistent tool is browser fingerprinting: a set of technical device characteristics combined into a unique user "fingerprint." The technology was created mainly for commercial purposes — fraud prevention, scoring, targeted advertising. But it can just as easily serve political surveillance — states and intelligence agencies benefit from tracking people regardless of whether they clear cookies or not. A fresh example of what this looks like in practice was found by a developer digging into a mysterious bug with his headphones.

You open the AliExpress homepage — and the music on your phone cuts out. Not a video, not an ad, just silence. One developer decided to figure out why, and found something more interesting than an ordinary bug.

The issue was with his multipoint Bluetooth headphones: normally the PC has priority, and the phone plays music when the computer is quiet. But as soon as he opened AliExpress in Firefox or Chrome, the music from the phone would go silent within seconds. Close the tab — everything came back. Muting the tab, the browser, or the sound in Windows didn't help. There were no audio or video tags on the page, and Media Session showed the status "none." Formally, there was nothing to play.

The answer was found through the Web Audio API. The page was quietly creating two AudioContext instances — from scripts apparently belonging to Alibaba's anti-fraud toolkit. Both built a chain: a sawtooth oscillator → an analyzer → a script processor → a gain node set to zero → all connected to system audio output. The volume was zero, but the browser was diligently and continuously processing the audio graph, as if live sound processing were happening. This, apparently, was what kept the Bluetooth channel open, preventing the headphones from switching to the phone. The regular mute button was powerless here: there was nothing to mute, since there was no element. There's already an open bug report about this in Firefox's Bugzilla.

But that's just the tip of the iceberg. The same scripts contained checks for canvas and WebGL, screen size, pixel density, number of CPU cores, device memory, installed plugins, supported formats, WebRTC behavior, mouse movements, scrolling, device tilt, and signs of browser automation. In other words, the audio trick is just one of dozens of parameters used for full-fledged device fingerprinting: different browsers, OSs, and hardware process the same audio signal slightly differently, and these micro-differences can identify a device even without cookies. The collected data is encrypted and sent to Alibaba's servers — the author couldn't find out exactly what happens to it afterward, but suspects it's either a persistent device identifier or one of the signals for anti-fraud scoring.

AliExpress's logic is understandable: the platform is fighting account takeovers, fake registrations, scraping, automated purchasing, payment fraud, review manipulation, and abuse of new-user promo codes. At the same time, like any large business, the company also uses this data for marketing. Cookies are unreliable for these purposes — they can be cleared, replaced, copied. But a fingerprint assembled from dozens of independent technical measurements of a device is much harder to fake or erase — and that's the whole crux of the problem. Technology that makes the internet "safer" for business simultaneously makes the user far more transparent — without their knowledge or consent, covertly exploiting even such unexpected channels as a device's audio system. And if it's used for anti-fraud purposes today, what guarantee is there that far less benign clients won't adopt the same method tomorrow?

Source: https://blog.laserphile.com/2026/08/aliexpress-webpage-keeping-multipoint.html

Enugu builds mass surveillance without a law to govern it
Surveillance control · 22.08.2026

In Enugu, authorities built a command center for surveillance that, by description, operates like an airport control room — except instead of planes, it tracks people, cars, and entire neighborhoods. Over a thousand cameras, drones with thermal imaging, facial recognition — an ICIR journalist was captured on camera at the airport, and two days later at the center they showed him that exact footage. Impressive? You bet. The project costs billions of naira: the 2024 budget alone allocated 4.657 billion for surveillance, and 2025 added another 10 billion for AI-powered cameras with facial recognition. The stated goal is to reduce crime and attract investors.

But here's the catch: there's simply no law regulating this entire system. Who has access to the recordings, how long they're stored, how a citizen would even find out they're being watched — there are no answers, because there's no document at all. The state's Attorney General honestly admits: "we're working on a draft bill." The Speaker of the parliament hasn't answered calls for two weeks, and an assembly member says they haven't even seen any such bill yet.

While the legal vacuum exists on paper, in practice there are already victims. A blogger was arrested over a post quoting an official — 50 days in pretrial detention for "cyberbullying." A journalist says he was tracked through the airport without any charges being filed. A human rights defender was detained without a warrant, held incommunicado without access to a lawyer, tortured — and after 271 days in prison, the court acquitted him because the prosecution couldn't prove anything at all.

The state insists: surveillance isn't about politics, it's about safety. Although other Nigerian states — Lagos, Kaduna, Ekiti — somehow managed to pass data protection laws before hanging up cameras. Enugu decided that cameras come first, and the law can wait. There's a logic to it, of course: why regulate something that already works perfectly fine without rules.

Source: https://www.icirnigeria.org/inside-gov-mbahs-multi-billion-naira-surveillance-centre-with-no-oversight-law/

Internet Freedom Keeps Falling, and IoT Feels It First
Censorship blocking · 21.08.2026

Интернет вещей построен на допущении, что интернет свободен и связывает всё со всем.

The internet of things is built on the assumption that the internet is free and connects everything to everything. Smart city sensors send data to dashboards, medical devices transmit patient readings, industrial IoT coordinates logistics in real time. And then the state steps in and says: not today.

Freedom House's Freedom on the Net 2025 report records the 15th consecutive year of declining internet freedom. Out of 72 countries surveyed, conditions worsened in 28 and improved in only 17. China has held the top spot as the worst environment for internet freedom for over a decade now. The most systemic deterioration across all 15 years of observation is state manipulation of online information.

For IoT, this isn't an abstract political debate — it's a concrete engineering problem. Blocks, traffic filtering, and internet shutdowns strike directly at the infrastructure connected devices depend on. Traffic lights, environmental sensors, parking systems — all of them exist on the assumption that data can move freely. Cut the network, and smart infrastructure simply stops working, taking emergency alert systems down with it.

Russia has repeatedly shut down mobile internet across entire regions, hitting digital payments and commerce tied to IoT. A vivid demonstration of how quickly a lack of connectivity can paralyze a digital economy.

Censorship and surveillance often run on the same infrastructure: technologies used for blocking (deep packet inspection, DNS spoofing) require intercepting and analyzing traffic — which makes them just as suitable for surveillance. Smart cameras for traffic management start tracking people, utility meters reveal who's home and who isn't. IoT generates an unprecedented surveillance surface — geolocation, health metrics, behavioral patterns — and in countries with weak privacy protections, all of it is readily appropriated by the state.

Blockages push users toward proxies and VPNs, and every new node in the network is a potential new vulnerability, especially given how shaky IoT device security already is, with default passwords and unpatched firmware. Essentially, state interception of traffic is the same as a man-in-the-middle attack, just at the ISP level.

A VPN solves a specific task: it encrypts traffic and routes it through servers outside the blocked zone, letting devices reach the cloud APIs they need. But according to EFF's Surveillance Self-Defense, effectiveness depends on logging policy, the provider's jurisdiction, encryption strength, and resistance to DPI — not all VPNs are equally reliable. In some places VPN traffic itself gets blocked, requiring Tor bridges or domain fronting. And age restrictions or app-level blocks aren't bypassed by a VPN at all.

For those designing IoT systems, tools like Proton's censorship simulator let you check in advance which services are blocked in a given country — and build resilience to connectivity disruptions into the architecture from the start, rather than patching it after the fact.

Source: https://www.iotforall.com/internet-censorship-iot

Belarus' Exiled Press Fights a War of Attrition
Monitoring orgs · 19.08.2026

Belarus' independent press has been living in exile for six years now — and that's not a metaphor, it's a literal fact: more than 20 media outlets and up to 1,000 journalists were forced to leave after the crackdown on the 2020 protests. Natallia Belikova of Press Club Belarus hasn't been home since 2019 — she even had to miss her father's funeral, because returning would have meant arrest.

Inside the country, the independent press is simply outlawed: authorities classify any dissent as extremism or terrorism. At least 21 people are currently imprisoned in Belarusian jails for journalistic work, according to CPJ. In late June, Kiryl Pazniak was sentenced to 3.5 years for "creating an extremist group" and "discrediting Belarus." Tellingly, while some journalists were released earlier this year thanks to US efforts, others were immediately jailed. The conveyor belt never stops.

The state wages its war through blocking: it publishes a blacklist of websites and social networks, and blocks independent media's mirror sites. In response, Press Club Belarus built a mirror system on cloud infrastructure that can't be blocked selectively — you'd have to ban the entire cloud. Readers don't even need a VPN, just click the link. A nice detail for anyone who believes in the omnipotence of censorship: to block one mirror, you'd have to take down half the internet.

Money, meanwhile, is a separate headache. The closure of USAID a year ago dealt a serious blow to funding — it paid not only for content but also for access to technology. European donors have partially filled the gap, but not entirely.

Belikova believes time is working against exiled media — the longer the separation from the audience inside the country, the weaker the connection. And that connection, she says, directly shapes worldviews: those who listen to independent voices tend to be anti-war and pro-Europe, while those who follow state media lean toward Russia. This is a battle for minds, not just for traffic.

Source: https://www.washingtonpost.com/press-freedom-desk/2026/08/19/with-journalists-exile-belarus-independent-press-exists-outside-its-borders/

India Bans Film, Proves Its Own Point
Circumvention tools · 19.08.2026

Indian authorities banned a film — and in doing so proved exactly what the film was trying to show.

The story is simple. "Satluj" is a biopic about Jaswant Singh Khalra, an activist who in the '90s compiled a list of roughly 2,000 young men killed by Punjab police during the conflict with Sikh separatists, and tried to seek justice through the courts. In 1995, he disappeared from his own home. His body was never found. Ten years later, a court found six police officers guilty of his abduction and murder.

The film sat in the censorship committee for four years — it never received a theatrical release certificate. When it was finally released on the Zee5 streaming platform, the platform pulled it after just two days, citing vague "current circumstances." It's no longer available there.

And here's where the best part begins: instead of quietly disappearing, the film got a grassroots release across Punjab. Sikh leaders urged people to watch it, activists held rallies in Amritsar, and in villages like Bandala the film was screened right in temple courtyards — with juice in plastic cups and kids allowed to stay up late. Pirated copies spread across WhatsApp and YouTube faster than officials could come up with an official explanation for the ban — which, incidentally, never came: the Ministry of Information and Broadcasting simply didn't respond to inquiries.

An official spokesman for the ruling party in Punjab admitted outright that one film won't turn anyone into a separatist overnight. But, he said, "it's a long game" — the idea needs to "seep into the psychology." In other words, what's being blocked isn't propaganda for violence, but the memory of it.

For Ranjit Singh Babbar, a Bandala resident whose father was killed by police when he was three years old, the conclusion is shorter and blunter: the attempt to erase Khalra's story signals to Sikhs that they're second-class citizens. A state that fears a biopic more than its own unread history is itself confessing what it's ashamed of.

Source: https://www.npr.org/2026/08/19/g-s1-138787/how-indias-blocking-of-a-film-exposing-real-life-police-abuses-backfired

Nigerian Journalist Beaten for Filming a Demolition Raid
Surveillance control · 19.08.2026

Pinnacle Daily editor Sunday Michael Ogwu was filming on his phone the demolition of structures in Lugbe, a district of Abuja. Just a regular evening stroll, a regular joint raid by police and vigilantes. What happened next was not regular: his phone was seized and his colleagues were ordered to beat him.

Ogwu asked who was in charge of the operation. No one answered. Instead, he was asked whether he had permission to film what was happening. His response was straightforward: "This is a public event, and if you're doing everything legally, you have nothing to fear from a journalist." For that, he got a few blows and an order to leave.

He still posted the video on social media. After that, police sent people after him. One of the pickup trucks involved in the raid had "Lugbe Police Station" written on it — a detail that seems to hint at something, but FCT police spokeswoman Josephine Adeh claimed those couldn't have been their officers because "we don't handle demolitions at all, contact the FCTA." Logic on the level of "it wasn't us, but if it was, go find the culprits yourself."

Ogwu recorded a voice message in case he got detained: "If there's no word from me, I'm at the Lugbe police station." This isn't paranoia — it's statistics: since Tinubu took office in May 2023, CPJ has documented at least 91 cases of attacks, arrests, and harassment against journalists across the country. Abuja tops the anti-rating with 30 incidents, 22 of them physical assaults. Kano has 13 assaults, Borno 9 arrests. Among the victims are three journalists from ICIR.

Meanwhile, Vice President Kashim Shettima claimed back in February that no journalists had been harmed since Tinubu took office. CPJ's Africa director Angela Quintal called this an attempt to erase documented facts of violence and demanded accountability.

Who exactly conducted the demolition and on what grounds remains unknown. What is known is who got hit with a baton for trying to find out.

Source: https://www.icirnigeria.org/breaking-pinnacle-editor-beaten-phone-seized-by-police-in-abuja/

Roanoke Surveillance Cameras Track Their Own Critics
Surveillance control · 17.08.2026

Roanoke, Virginia: people came to a meeting about surveillance overreach — and ended up in a surveillance database themselves. That's exactly what happened to attendees of a gathering at South County Library. Criminology professor Steven Keener told the crowd bluntly: the license plates and vehicle details of the cars they used to get to a discussion about excessive government surveillance were immediately logged into a police database. The irony is thick enough to belong in a textbook.

This is about Flock cameras, used by more than 6,000 police departments across the country. As of April, Roanoke had 27 of them installed along roads. Over the past 30 days, local police collected 418,035 unique license plates and ran 378 searches against that database. Officially, this is only for active investigations, with limited access and regular audits. The cameras supposedly don't capture faces or racial or gender characteristics, and they're prohibited from being used for immigration enforcement.

Legally, things aren't as clear-cut as police would like. A federal judge in Norfolk ruled in January that collecting license plates without a warrant doesn't violate the Fourth Amendment. But he immediately added that technology keeps evolving, and at some point surveillance could become excessive. Asked exactly when that point would be reached, the judge gave the most honestly lawyerly answer possible: "not yet, for now." The ruling is being appealed — the precedent could spread to four more states.

While the courts philosophize, some cities are simply opting out: Charlottesville, Harrisonburg, and Staunton have all rejected the cameras. And Henry County Sheriff Wayne Davis suspended his office's access to the system on Friday while he decides whether to cancel the contract entirely. His statement reads almost like a manifesto: you can fight crime while still respecting the Constitution, and that's not weakness — it's a sign of responsible law enforcement.

On Monday, opponents of the cameras will hold a rally ahead of the Roanoke City Council meeting. Worth noting: the data is stored for 21 days — plenty of time to piece together a complete picture of someone's ordinary life: work, school, the library, a protest meeting.

Source: https://www.govtech.com/public-safety/flock-safety-opponents-pack-community-meeting-in-virginia

Mexico's "freest press ever" claim lacks any evidence
Censorship blocking · 19.08.2026

Mexico, it turns out, is living through "the freest and most democratic moment in its history." Who says so? Not journalists, not media organizations — but a letter to the WSJ, apparently written by someone quite unhappy with Mary O'Grady's column titled "Sheinbaum Muzzles the Mexican Press."

The argument is ironclad: President Claudia Sheinbaum answers press questions every weekday and spends weekends traveling the country to listen to people. That's the entire body of evidence for "press freedom" — the president's meeting schedule with journalists.

Yet the letter's author himself admits that a single party once controlled the airwaves and set the rules for the chosen few for nearly a century. So the baseline is rock bottom — there's really nowhere lower to go. Against that backdrop, regular press conferences are presented as a flourishing of democracy.

And here's the line: "censoring the press isn't a matter of rhetoric, it's a matter of evidence" — a fine thesis, except the letter itself contains exactly zero evidence. No numbers on shuttered outlets, no statistics on lawsuits against journalists, no facts about laws restricting the media — just generic phrases about the "freest moment ever."

The irony is that the line about evidence instead of rhetoric appears in a text that is itself pure rhetoric. If the press in Mexico is truly free — show the numbers. For now, what we're watching is a classic case: those in power praising themselves for answering questions they themselves choose to take.

Source: https://www.wsj.com/opinion/mexicos-press-is-still-free-under-sheinbaum-fd6d260b

Google's New Android Verification Maze
Surveillance control · 19.08.2026

Google is preparing Android for a bright future where sideloading is technically alive, but buried under so much bureaucracy that any bureaucrat would be envious.

Starting September 2026, installing apps not from Google Play will only be possible from "verified" developers. To get this verification, a developer needs to provide documents, upload a copy of their signing keys, and pay $25. Simply to make apps without Google's blessing — quite the entry fee.

But it turns out Google has a conscience — there's an "advanced flow" to bypass verification. It's hidden, of course, not in plain sight, but deep in developer settings. Here's the hero's journey: tap the build number seven times, find "Allow Unverified Packages," confirm you're not being coerced, enter a PIN, restart your phone, wait 24 hours, come back, scroll through more warnings, and choose "allow for 7 days" or "forever." Ten steps total, just for the right to install a file from your own computer.

Why the 24-hour wait? According to Android ecosystem president Sameer Samat, this is protection against scammers who pressure victims with "install this now or your account gets blocked." In 24 hours, a person supposedly has time to find out their relative isn't actually in jail and no one's stealing money from their account. There's logic to it — it's just a shame it's wrapped in a quest with seven taps and a flashlight in the basement.

Google insists that app content won't be reviewed — this is only about verifying the developer's identity. An alternative ad-free YouTube client won't get caught in the crackdown — Samat explicitly says that's not the kind of harm the company cares about.

And here's where it gets interesting. Digital rights advocates worry that a database of verified developers could become a convenient target for legal requests. Google promises not to create a permanent identity registry and to push back against unlawful requests, but details are scarce. There's also a simpler question: what about developers in sanctioned countries who may simply have no way to pay the fee?

Source: https://arstechnica.com/gadgets/2026/03/google-details-new-24-hour-process-to-sideload-unverified-android-apps/

Hungary's Anti-SLAPP Law: Minimum Compliance, Maximum Loopholes
Censorship blocking · 17.08.2026

Hungary is opening a window of opportunity for reform — and immediately trying to slam it half shut.

The new Tisza government has decided to rewrite the SLAPP laws — lawsuits that the rich and powerful use to crush journalists through courts instead of arguments. The deadline for transposing the EU Anti-SLAPP Directive expired back on May 7, 2026, and the European Commission has already opened an infringement procedure against Hungary — so there's plenty of incentive to hurry up.

And the government did hurry. So much so that public consultations on the draft law lasted exactly five working days. Not five weeks, not five months — five days to discuss a law meant to protect freedom of speech in a country where that freedom hasn't been doing so well in recent years.

The result is a bare-minimum document: a literal translation of the EU directive without a single thought beyond what's mandatory. The problem lies in the details — this version only protects journalists from cross-border lawsuits. So if a Budapest oligarch sues a Budapest journalist — the law stays silent. Yet it's exactly these purely domestic lawsuits that make up the majority of SLAPP cases in Hungary.

For comparison: Poland, Greece, and Belgium recently passed laws that went beyond the EU minimum and closed the loophole for domestic lawsuits. Hungary, meanwhile, is choosing the path of "technically complied, conscience clear."

The CASE coalition, together with ARTICLE 19, RSF, Index on Censorship, and a dozen other organizations, has written a letter to the ministers of justice and culture asking them to: extend the law to domestic cases, include criminal and administrative proceedings as well, and — here's an unexpectedly bold request — hold real consultations with civil society instead of a box-ticking exercise.

Parliament won't vote before September, so there's still time to think it over. The only question is whether the government wants to write a law that actually protects journalists, or one that simply checks a box in a report to Brussels.

Source: https://www.article19.org/resources/hungary-draft-anti-slapp-bill-needs-improvement/

Leaked source code exposes China's censorship-as-a-service
Circumvention tools · 17.08.2026

The leak of the century happened back in September 2025, but only now have researchers picked it apart brick by brick: 100,000 documents from Geedge Networks — a Chinese DPI company closely tied to the Great Firewall — including source code, over 500 Git repositories, and five years of commit history. This is the first-ever leak of commercial censorship system code, and a team from Michigan, GFW Report, Paderborn, UMass Amherst, and Colorado Boulder didn't hesitate to assemble this Frankenstein locally and run it.

A bit of context that makes you want to sit down: the company was founded in 2018 by Fang Binxing — yes, that Fang Binxing, the man called "the father of the Great Firewall." Apparently he decided one firewall per country wasn't enough, time to scale the business. And scale he did: the TSG (Tiangou Secure Gateway) product was shipped to Kazakhstan, Myanmar, Pakistan, and Ethiopia — with the full turnkey package: integration, operator training, tech support. A straight-up censorship franchise.

What's inside. TSG can block VPNs and obfuscation via JA3/JA4 fingerprints, packet length, and certificates — in the signature log, 21 out of 29 tools are flagged with the maximum risk level 5, including ExpressVPN, NordVPN, Psiphon, and Tor. Yet two out of three traffic-recognition modules are simply borrowed code: the open-source library libprotoident and the proprietary Qosmos ixEngine. So even a state-backed vendor with money didn't bother building DPI from scratch — easier to just grab something ready-made.

Separately, the Jira tickets are a delight. The Myanmar customer complained that Signal with censorship circumvention enabled couldn't be blocked, while Ethiopia was upset that blocking Psiphon also knocked out TikTok, BBC, and CNN — forcing the team to cobble together a "whitelist" of popular domains so as not to be so obviously caught causing collateral damage.

And the cherry on top: cross-referencing the extracted code with real traffic measurements, the authors found an almost perfect match with DNS engineering—

Source: https://www.usenix.org/system/files/usenixsecurity26-ablove.pdf

Weekly digest: Surveillance is everywhere, protection is nowhere
Weekly digest: surveillance without accountability, filtering without transparency, and rare victories of common sense

— Nigeria spends billions on surveillance systems, but police will only search for a stolen phone for cash
— Malaysia and Indonesia are building world-class digital infrastructure — alongside two different mechanisms for total content control
— Taiwan deliberately shut down part of its mobile internet — to practice living without it
— Mozambique's Constitutional Council overturned a decree allowing the government to cut off the internet at its own discretion
— A data leak affecting 600,000 households in Gaza — the largest in humanitarian aid history, and it could have cost lives

📖 Full breakdown: https://telegra.ph/Brandmauer-Report-weekly-digest-100816082026-08-17

❤️ Reactions under posts are votes: what makes it into the digest is what you read and like.

Taiwan Rehearses Life Without the Internet
Shutdowns · 13.08.2026

Тайвань устроил себе учения по добровольному отключению интернета — и это, кажется, первый в мире случай, когда страна сама тренируется жить без сети, чтобы потом не растеряться, если это сделает кто-то другой.

Wait, let me provide the actual English translation:

**Taiwan Rehearses Life Without the Internet**

Taiwan just ran a drill in voluntarily shutting down the internet — and this appears to be the first time in the world a country has practiced living without the network on its own, so it won't be caught off guard if someone else does it instead.

On Thursday, in 14 cities and counties across the north and center of the island — home to about 70% of the 23 million residents — internet speeds were deliberately throttled to simulate a coordinated attack. TikTok wouldn't load at all for eighteen-year-old Chen Hui-xuan, Facebook barely functioned, and Instagram messages took about thirty seconds to arrive. Apparently, the apocalypse in Taiwan will come with an endless spinning loading icon.

While some people cursed at their stories failing to load, others were already gearing up seriously. Wang Chen-wen climbs to the roof of his 25-story building, connects his phone via Bluetooth to a palm-sized radio, and sends messages through an open platform — no internet required, just long-range radio waves. It works: messages from the Beitou district reach neighboring Xinyi within minutes.

The reason behind all this isn't abstract anxiety. Taiwan has 16 international and 10 domestic undersea cables — an "irreplaceable digital lifeline," as local authorities call them. In 2025, a Chinese ship captain was convicted of deliberately damaging a cable between the main island and the Penghu archipelago, and another captain was sentenced for damaging a cable near Matsu — this time through negligence. The coast guard calls this a "gray zone" — causing harm without crossing the line into open war.

Hence the reliance on backup communication channels — from radios to low-orbit satellites. Parliament has already approved amendments opening the local market to Starlink, though Musk's extensive business interests in China do little to inspire confidence in the idea.

As the drill's organizers themselves admit, the inconvenience is the whole point: let people feel firsthand what it's like, and learn to use the backup plan before they actually need it.

Source: https://www.newsweek.com/taiwan-disrupts-internet-access-during-china-airstrike-drill-12317651

Mozambique Court Strikes Down Internet Shutdown Decree
Shutdowns · 14.08.2026

Мозамбикское правительство написало себе указ, разрешающий отключать интернет, если где-то "предполагается" мошенничество — так начиналась эта история. А вот и перевод целиком:

The Mozambican government wrote itself a decree allowing internet shutdowns whenever fraud was "suspected" somewhere. The Constitutional Court looked at this wording and rightly wondered — where exactly is parliament in this picture?

The outcome: on July 31, the court ruled key provisions of the December Decree on Regulating Telecommunications Traffic Control unconstitutional. The document allowed authorities to monitor communications, collect user data, shut down the internet, and technically interfere with operator networks — simply by enforcing their own decisions. The court pointed out that only parliament can approve such rules, not the cabinet acting on its own authority.

The decree's wording deserves special mention. Article 5 allowed network shutdowns in cases of "existence or imminent risk" of fraud — interpret that however you like. Under the same provision, "fraudulent traffic" could be interrupted based on "reasonable suspicion" of a crime or a threat to national security. A rubber-stamp formula for any occasion.

The decree was challenged by the Center for Democracy and Human Rights (CDD), which filed a petition with the ombudsman back in January. And this wasn't their first win: CDD had previously won a case against operators who restricted internet access during protests following the 2024 elections — a move that, according to the organization, damaged access to information, freedom of communication, and civic participation.

Here's the telling part: instead of learning from the protest episode, the government simply issued a new decree, trying to retroactively legalize the same restriction of rights. CDD explicitly called this an attempt to create a legal basis for curtailing fundamental freedoms.

The Committee to Protect Journalists called the court's ruling an encouraging example of how the judiciary can defend human rights, even as governments around the world increasingly disregard constitutional guarantees.

Source: https://cpj.org/2026/08/mozambique-court-nullifies-decree-allowing-government-to-shut-down-internet/

Two new Internet Atlas reports: Malaysia and Indonesia

Southeast Asia's two heavyweight digital economies. Both building serious infrastructure. Both arriving at the same destination by completely different roads.

Malaysia reads like a success story until you get to the legal chapters. 5G past 82% population coverage, IPv6 adoption above 70%, median mobile download speed near 200 Mbps, 34th in the world, Johor filling up with hyperscale data centres. Then September 2024: MCMC ordered every ISP to run transparent DNS proxies and hijack all queries, including those pointed at 8.8.8.8 and 1.1.1.1. Sinar Project and OONI documented it, the scandal went public, the directive was withdrawn.

The lesson the government took away was not to stop — it was to stop doing it at the network layer. The Online Safety Act 2024 plus the deeming provisions of Section 46A CMA now let the minister unilaterally declare WhatsApp, Telegram, Facebook and TikTok licensed operators, whether they ever applied or not. Any platform above 8 million local users needs an ASP(C) licence, eKYC and industrial-scale moderation. The ceiling on fines went from 50,000 to 1,000,000 ringgit. Censorship has been outsourced to the platforms, and it is cheaper and much quieter that way.

Indonesia went the opposite direction and built the filter into the pipes. The Trust Positif blacklist is pushed to every ISP through RPZ. Port 53 has been forcibly redirected to filtering resolvers since 2015. A 2024 directive funnels all international traffic through a short list of licensed Tier-1/NAP nodes, so smaller providers cannot quietly decline to comply. Steam, Epic Games, PayPal and Yahoo were blocked in 2022 over a registration deadline. DuckDuckGo followed in July 2024. In autumn 2024 the government confirmed it had blocked at least 30 free VPN services, blaming online gambling. Papua's 2019 shutdown was ruled illegal by a Jakarta court in 2020, after which outages in the province began to be explained by damaged cables.

The irony is in the numbers: roughly 3,900 ASNs, 57 exchange points, up to 80% of traffic staying domestic. One of the most decentralised networks in the region, with a single centralised chokepoint bolted on top.

Both reports cover 2019–2026 — infrastructure, ASN and connectivity dynamics, IPv6, legislation, blocking practice, prosecutions, civil society, VPN usage.

https://ozi-ru.net/en/atlas.html