Tech

I’ve read enough government letters to recognize the genre: calm stationery, urgent verbs, and an implied deadline that always seems to favor more power, sooner.

This week, about 50 former national security officials urged Congress to quickly pass a “clean” reauthorization of Section 702 of the Foreign Intelligence Surveillance Act. They want an 18-month extension with no reforms attached, and they want lawmakers to stop mixing the 702 debate with fights over data brokers and other privacy concerns.

What the letter asks for

• Date and coverage: The letter is dated April 6, 2026 and was reported April 7.
• Policy request: Reauthorize Section 702 for 18 months, as the Trump administration has proposed.
• Legislative warning: Avoid attaching “unrelated policy debates” that could slow passage.
• Notable signers: Former DNI James Clapper and former FBI Director Christopher Wray.

Why Section 702 is a domestic liberty story anyway

Section 702 is built to target non-U.S. persons reasonably believed to be outside the United States, often using U.S. telecom and internet infrastructure. The friction starts when Americans get incidentally swept up by communications with a lawful foreign target, and the government can later query what it collected. The argument in Washington is not whether foreign adversaries exist. It is what happens to the American side of the wire once the net is in the water.

The Orwell check: “clean” as a euphemism

In a functioning democracy, “clean” should mean narrow, readable, and accountable. In modern Washington dialect, it often means: do not touch the machinery, just keep it running. The letter’s vocabulary points in one direction: “clean” renewal, “unrelated” debates, “separate” consideration. Translation: later, later, later.

The Paine test and the liberty ledger

The Paine test: does this expand liberty, or concentrate power? If the government can search holdings using U.S. person identifiers under standards short of a traditional warrant, the program becomes a liberty issue the moment it touches domestic life.

The liberty ledger: a clean renewal benefits agencies and leaders who never want to be caught without a tool. The public pays in privacy, especially the people democracy claims it protects: journalists, activists, religious minorities, and political weirdos of every stripe.

The tradeoff: renew it, but price it like power

Yes, Section 702 can produce valuable foreign intelligence. The PCLOB staff report (April 2, 2026) calls it one of the country’s most valuable tools and says 2024 reforms appear, so far, to have improved compliance and privacy protections. But it is also a staff report published under a sub-quorum policy, not voted on by a fully seated board.

If Congress wants an 18-month extension, fine. Just stop calling it “clean.” Call it conditional, and put the conditions on paper: clear limits and reporting on U.S. person queries; an enforceable rule that the government cannot buy its way around protections by purchasing Americans’ sensitive data from brokers; and meaningful independent oversight that is not one resignation away from silence. If lawmakers insist on a short extension, sunset it sharply and come back with a real debate and real consequences for misuse.

Question worth asking out loud: if Section 702 is as essential as its defenders say, why are they so allergic to writing the privacy price tag into the law?

I like free markets. I like American ingenuity. I even like a good tech gadget. But I do not like the idea that the digital steering wheel for water and energy infrastructure can be accessed like it is Wi-Fi at a county fair. This is not abstract cybersecurity. When industrial controls get messed with, real operations get thrown off, and the bill shows up in the real world.

Federal agencies warned about Iranian government-affiliated hackers targeting internet-facing PLCs

The warning, as described by reporters, ties Iranian government-affiliated advanced persistent threat actors to targeting internet-facing programmable logic controllers, or PLCs, used in critical infrastructure. The authoring agencies include the FBI, the National Security Agency, CISA, the Environmental Protection Agency, the Department of Energy, and U.S. Cyber Command.

This is the villain: disruption, not a harmless prank

According to the advisory summary, the attackers go after industrial process controls, including programmable logic controllers made by Rockwell Automation, with references to Allen-Bradley models. In bar-stool talk: they are poking the heart of the machine with the confidence of a guy who treats safety barriers like decoration.

The mechanism matters. The warning says the hackers cause PLC disruptions through malicious interactions with the project file and through manipulation of data shown on human-machine interface and SCADA displays. That means operators might be shown information that looks normal on the screen while the physical world is behaving differently. Smoke, mirrors, and the wrong sign on the highway pointing you toward the ditch.

Follow the incentives: leverage, power, and delay

Here is where the motive shows up. The goal of this kind of intrusion is leverage. It creates political pressure without a uniform. It forces defenders to scramble, patch, and re-check things they believed were under control. If a regime cannot out-muscle the United States on a conventional field, it tries the asymmetric route and tests whether it can intimidate the systems people rely on to live normally.

And yes, companies and agencies can get dragged into geopolitics even when everyone is trying to do the right thing. But it raises a hard American question: why are the doors staying cracked open? If internet-facing industrial gear is the weak link, then the weak link is not just the hardware. It is the whole pipeline of accountability that shrugs and says, we will handle it later.

What this means for America: treat OT security like national security

The joint alert urges urgent review of tactics, techniques, and procedures and the indicators of compromise, then applying mitigation steps to reduce risk. The takeaway is simple: organizations have to treat OT security like national security, not like a side project. That means isolating what must be isolated, locking down what must be locked down, and verifying what must be verified, even when it is inconvenient and even when it costs money up front.

So here is the challenge for everyone watching: will you back faster, harder OT security, or will we keep arguing about everything except the systems that keep the lights and water on while the adversary does quiet work?

The newsroom coffee tastes like burned pennies and regret. The scanner spits the same old static: another corporate “incident,” another boardroom learning, live, that passwords are not a strategy. Outside, always-on commerce keeps humming while the guts of the machine get picked clean.

This week, Hasbro disclosed it found unauthorized access to its network and took certain systems offline while it investigates. The company warned investors that interim measures could run for several weeks and may cause delays. Not a vibe. A public company admitting the digital plumbing under a major consumer business can be kicked hard enough to wobble.

What Hasbro actually disclosed

Here’s what we can say without guessing because it’s in Hasbro’s own SEC filing. Hasbro identified unauthorized access on March 28, 2026. It activated incident response, implemented containment measures, and proactively took certain systems offline. It hired third-party cybersecurity professionals. The investigation is ongoing, and the company says it is still determining the full scope of impact.

Hasbro also says it is reviewing potentially impacted files and will provide any legally required notifications. And it is trying to keep the warehouse doors open while the internal lights flicker: it is using business continuity plans to continue taking orders and shipping product, but warns this posture may last several weeks and may cause delays.

What is not confirmed in the public record yet is what everyone wants first: who did it, whether data was stolen, whether ransomware was involved, what systems were hit, what kinds of records were exposed. Coverage notes those details have not been disclosed.

Translation: the jargon is a shield

Translation: “We identified unauthorized access” means an intruder was inside, and the company is not ready to say how long, how deep, or how expensive. Translation: “We took certain systems offline” means containment beat elegance, so they yanked plugs. Translation: “Files potentially impacted” means they do not yet know which drawers were opened, but they know the cabinets exist.

Read the Safe Harbor boilerplate like an auditor, not a fan. It’s a preemptive shield: forward-looking statements, uncertainties, remediation might not work, impacts unknown. That’s corporate governance speaking in the only language it respects when it cannot yet price the damage.

Here is the mechanism: security loses until the attackers and the SEC start billing

Here is the mechanism: cybersecurity competes with quarterly targets and executive bonus math. Security reads like overhead. Shipping product reads like glory. The spreadsheet shrugs at preventing a thing that “hasn’t happened yet,” right up until it happens.

When Hasbro says it proactively took systems offline, that is not just technical. It’s a business confession: the systems are interconnected enough that to stop the bleeding, you may have to stop the business.

Follow the money: the breach tax lands on everyone else

Follow the money: customers pay in risk and hassle. Workers pay in chaos because “continuity plans” often mean manual workarounds under pressure. Shareholders pay in volatility, sometimes. Meanwhile, breach response becomes “managed cost” instead of moral crisis.

The quiet part: the lag is the model

The quiet part: corporate America wants you to treat breaches like weather. But the filing’s core truth is the lag: the scope is still being determined, the timeline stretches into weeks, and notifications may come later. That delay is not an accident. It’s the governance model.

Accountability is not vibes. It’s audits with teeth, mandatory standards, fast and specific disclosure, and consequences that hurt more than cleanup budgets.

Power in America rarely kicks down the door. It hands you a glossy binder and tells you the adults are finally in charge. I have read enough executive-branch prose in stale committee rooms to recognize the scent: confidence, urgency, and a quiet request that the public stop asking for line items.

This week, the White House released a legislative blueprint for artificial intelligence and urged Congress to move quickly, including by preempting state AI laws it views as too burdensome. The pitch is familiar: one national standard, fewer headaches, more innovation, less chaos.

I do not panic at the phrase national standard. I panic at the phrase trust us.

One rulebook, fifty states: what the blueprint says

Reporting on the framework describes an administration push for a uniform federal approach and an end to what it calls a patchwork of state rules. The blueprint also flags a grab bag of priorities: protecting children, avoiding energy and electricity-cost blowouts, navigating intellectual property fights, and taking a posture against censorship while promoting free speech and innovation.

That is a lot of nouns. The verbs are what matter: who gets watched, who gets profiled, who gets denied, and who gets told “the machine made the call” with no real appeal.

The Paine test: liberty or power?

A single rulebook can civilize. It can also become a velvet rope. If federal preemption means states cannot add protections for consumers, workers, students, tenants, patients, or voters, then the “national standard” becomes a national ceiling. And ceilings tend to land on the public first.

Yes, states are messy. They are also where harms surface early. Some state laws are clumsy; some are clever; some deserve to fail in plain sight. That laboratory function matters when technology moves faster than Congress can find a working microphone.

The Orwell check: “prevent censorship” by what mechanism?

When a document promises to prevent censorship and protect free speech, I ask: whose speech, enforced how? If Washington starts writing rules about how AI systems moderate content, rank speech, or detect misinformation, we risk a federal speech thermostat. If it is code for forcing private platforms to carry or not label certain speech, we are just swapping one centralized lever for another and calling it freedom because the press release does.

The liberty ledger and the tradeoff

Who gains? Large AI developers get predictability. Big companies with compliance departments get one checklist instead of fifty. Federal agencies get a clearer runway to procure and deploy AI tools, including for enforcement and security.

Who loses? People living under weak federal privacy law, which is most of us, especially if stronger state rules get knocked out. And children lose too if “protecting kids” stays a talking point rather than enforceable duty.

The tradeoff is not patchwork versus paradise. It is speed versus due process, convenience versus contestability, competitiveness versus the right to know why an automated system flagged you, scored you, or shut a door in your face.

Guardrails for the next draft, not the next scandal

• A federal privacy baseline with teeth: real rights and hard limits, not vibes.
• Due process for automated decisions: notice, meaningful explanation, and a human appeal when AI affects core life outcomes.
• Transparency by default: model cards, impact assessments, and security testing summaries, with narrowly tailored redactions.
• Security as a requirement, not a roommate: secure development, independent testing, and procurement rules that stop rewarding sloppy vendors.

The next steps are boring on purpose: hearings with hostile questions, statutory sunsets and reporting requirements, inspector general audits, court challenges when rights get squeezed, and state attorneys general refusing to be preempted into silence without a demonstrably stronger federal deal. If Washington wants one AI rulebook, are we getting a constitution for the machine age, or just a faster permit for power?

I smelled it before I finished the first paragraph: that warm, electrical data-center tang, plus the old stink of regulators sharpening their stamp pads like they are fixing to brand your brain. Somewhere, a cardigan got buttoned, a clipboard got lifted, and America’s least comforting phrase got whispered: “we are here to help.”

One national AI standard, not 50 different rulebooks

On Friday, March 20, 2026, the White House unveiled a national AI legislative framework and urged Congress to set one U.S. standard. The message was plain: stop letting the country get carved into a patchwork of conflicting state laws that undercut innovation and our ability to lead the global AI race.

That is not a “policy vibe.” That is a flare shot over the swamp, because a state-by-state AI maze is how you turn progress into paperwork and competition into compliance theater.

Free speech is not a side dish here

The framework explicitly puts free speech on the table. It calls for preventing censorship, protecting First Amendment protections, and warns against AI becoming a vehicle for government to dictate “right and wrong-think.” That line lands like a tailgate speaker blasting the anthem while a Prius alarm cries in the distance.

Patchwork rules become choke collars on the internet

Here is the F-150 logic: if I drive from Texas to Tennessee, my truck does not have to become a different truck at every state line. But a patchwork AI regime makes apps and developers “transform” every time they cross a border, multiplying compliance paperwork and feeding lawyers like it is county-fair day.

The White House warning is simple: this does not buy safety. It buys toll roads, compliance cartels, and a moat that favors whoever can afford the fattest lobbyists.

Not “states can never act,” but “stop the Frankenstein stack”

To keep it honest, reporting on the framework notes the administration is not arguing for preempting all state power. It still recognizes room for general laws that protect kids, prevent fraud, and protect consumers. Fine. Nobody wants AI-powered scam calls multiplying like gremlins in a microwave.

The target is the state-by-state AI rulemaking pileup that turns America into a regulatory junk drawer.

Follow the money: who loves chaos?

• Bureaucrats, because power is their oxygen.
• Lobbyists and compliance grifters, because 50 regimes mean 50 contracts, audits, and binders.
• Some Big Tech players, because they can afford the compliance army while smaller competitors cannot.

America does not need an AI babysitter. America needs a Constitution.

The framework also touches protecting children and empowering parents, strengthening communities, electricity costs and data centers, intellectual property and creators, innovation, and an AI-ready workforce. Those are real issues. But none of that requires turning lawful speech into a regulated substance or building 50 different speech codes with an AI hall pass at every door.

Now Congress has to decide: bring the heat for one national standard, or fold the second the compliance lobby starts rattling the tip jar.

The printer in my head has been jammed for years. Receipts everywhere. Neon leaking through the blinds. Scanner hiss, then silence, then hiss again. And under it all, the same boring catastrophe: your life diced into data and sold like loose cigarettes.

This week, the U.S. House did something rare in the age of donor-drenched paralysis. It passed a bill that admits, out loud, that data brokers are a national security problem. The Protecting Americans’ Data from Foreign Adversaries Act passed the House on March 20, 2024 by a vote of 414-0. Unanimous. That is what Washington sounds like when you staple “foreign adversary” to a folder.

What the bill says, and what it avoids saying

The headline version is straightforward: data brokers should not be allowed to sell Americans’ sensitive personal data to countries designated as foreign adversaries, or to entities controlled by them. The bill text sets up the prohibition and ties enforcement to penalties under IEEPA, the same legal machinery used for sanctions.

Translation: Congress is finally saying the quiet part into a microphone. Location trails, health hints, political leanings, and bedroom breadcrumbs are not just “personalized advertising.” They are intelligence. In the wrong hands, they are leverage.

So far, so good.

Now ask the question that makes committee rooms suddenly develop allergies: if it is dangerous for Beijing to buy this data, why is it fine for Washington to buy it?

“Foreign adversary” as a moral alibi

When Congress says “protect Americans’ data,” it is not promising you privacy. It is promising you a different buyer.

Unanimity is easy when the target is overseas. It gets harder when the target is the domestic revenue model of half the internet and the quiet procurement habits of U.S. agencies that do not want warrants slowing down their appetite.

Senators, including Ron Wyden, have been publicly trying to close what they call the “data broker loophole,” where the government buys Americans’ data from brokers without a warrant. A March 2026 press release tied to FISA Section 702 reform includes a ban on federal purchases of Americans’ data from brokers without a warrant. That is not a rhetorical flourish. It is an admission of a practice.

Here is the mechanism: law is supposed to set a price for intrusion. A warrant makes the government pay in paperwork, time, and judicial oversight. Data brokers offer a clearance rack. Agencies can swipe a card, download a dossier, and bless it as “commercially available information.”

Follow the money: a surveillance industry with a clean suit

Data brokers sit in the glass tower between the apps on your phone and the institutions that want you legible. They vacuum up streams from ad tech, apps, purchases, and inferred behavior, then package it into products with names that sound like insurance forms. They sell “audiences.” They sell “insights.” They sell you.

And because the U.S. still lacks a comprehensive federal privacy law, the industry gets to operate like a casino with no regulator at the door. Some sector rules exist, sure. But no national line that says: stop collecting so much, stop retaining it forever, stop selling it to anyone with a budget.

The quiet part: this fight is not just about which governments buy the data. It is about whether anyone gets to keep extracting it in the first place.

So yes, pass the bill. Put “broker” on the congressional record. But do not mistake a headline for a firewall. Accountability is audits with teeth, inspectors general who subpoena contracts, courts that treat warrantless data purchases like the constitutional end-run they are, and organizing that drags this issue out of the tech-policy basement and into elections and procurement fights.

The neon off my monitor has that late-night courthouse sheen. Every spreadsheet looks like Exhibit A. My coffee tastes like a corporate compliance memo. And then the filing lands: Google and Epic Games have submitted a settlement proposal to a federal court in San Francisco to end their app store antitrust war, with Google offering lower Play Store commissions and a new path for alternate app stores, as long as they get registered and approved.

That wording is the whole case. Registered. Approved. Stamped.

It is the sound of a gate creaking open while the gatekeeper keeps the keys.

The deal: fee cuts, alternate stores, and a court-supervised reset

Here is what is on the record: Epic sued in 2020 over Play Store fees and restrictions. A 2023 jury found Google abused monopoly power in ways that violated antitrust law. Now Google is pitching a package that changes Play Store economics and Android distribution rules, including lowering fees and creating a registration program for alternative app stores.

Multiple reports describe Google also agreeing to share the Play Store app catalog with registered rival stores, a central piece of the remedies fight. Epic is celebrating publicly, framing it as Android opening up to competition, and says Fortnite will return to Google Play worldwide.

On paper, it reads like consumer-friendly progress. Lower fees. More stores. More choice.

In hearing-room air, it reads like controlled change designed to keep the structure standing.

Translation: “Lower fees” is not “less power”

Translation: when Google lowers commissions, it is adjusting the tax rate on the same private road.

If you build for Android, Google Play is not just a store. It is visibility, trust prompts, defaults, and distribution muscle. A lower toll matters, but it does not turn a tollbooth into a public highway. It can also be a pressure valve when court scrutiny is real.

And “registration” is not neutral paperwork. It is the power to decide who gets to be legitimate. That is not competition. That is licensing.

Here is the mechanism: competition inside a compliance cage

Here is the mechanism: Google can reframe a court-driven antitrust correction as a voluntary update, then design the plumbing so the market still runs through Google-controlled valves.

Catalog-sharing matters because access to what people actually use is a distribution equalizer. But if catalog access and install pathways depend on being “registered,” and if Google retains meaningful discretion over what that means, the gatekeeper survives with better signage.

The lobbyist hallway soundtrack writes itself: safety, security, user trust. Real concerns, and also easy weapons for a platform that can turn “protection” into friction for rivals.

Follow the money: the commission is the revenue, the gate is the model

Follow the money: the commission is not just a fee. It is a private tax enforced by control over access.

Google’s cut is not merely payment processing. It is monetizing dependency created by technical integration, contracts, and design choices that steer behavior. Google has every incentive to keep remedies from becoming a reusable template that makes the platform era governable.

Epic has incentives too. It wants lower tolls and better distribution for Fortnite and its store. That can be a win for Epic without automatically becoming a public-interest antitrust program.

The quiet part: Google wants to regulate its own monopoly

The quiet part: Google wants to be the agency, the court, and the appeals panel for everyone who needs Android distribution.

If Google can decide which rival stores are “registered,” and can tune warnings, prompts, friction, and defaults, then it can run competition like a supervised playground. You can walk around, but exits stay controlled.

Accountability is not a press release. It is courts enforcing remedies, agencies auditing compliance, and independent technical monitoring that answers to the public, not to a product roadmap.

I have this old habit of trusting the machine I’m holding. A book stays a book. A toaster stays a toaster. A car, in the American imagination, is supposed to be a rolling declaration of independence.

But the modern car has joined the rest of our gadgets in the great civic conversion: from tool to informant. And when you try to make it stop informing, you can end up doing the digital equivalent of canceling a gym membership run by Houdini.

California fines Ford over opt-out friction

On March 5, the California Privacy Protection Agency (CalPrivacy) announced a settlement requiring Ford Motor Company to pay a $375,703 fine and change practices after the agency found Ford added “unnecessary friction” to the opt-out process under the California Consumer Privacy Act.

The friction was clean, modern, and predictably annoying: Ford required consumers to verify an email address before they could opt out, and it did not process opt-out requests unless that step was completed. CalPrivacy’s message is simple: opting out is supposed to be easy. So do I.

Bloomberg Law adds a timeline detail that matters for accountability: CalPrivacy found Ford required identity confirmation before processing opt-out requests between July 2023 and March 2024. That is not a one-off glitch. That is a system.

The settlement also goes beyond the fine. CalPrivacy says Ford must provide easy methods to submit opt-out requests with minimal steps, conduct an audit of tracking technologies on its website, and ensure compliance with opt-out preference signals, including the Global Privacy Control.

Plain English: a legal right met a software funnel

California law gives consumers the right to opt out of the sale or sharing of personal information. According to CalPrivacy, Ford inserted an email verification step into that flow, and if you did not complete it, your request did not get processed.

I understand verification for certain requests. If you’re asking for a copy of your data, or to delete it, you want the company to be sure it’s really you. But CalPrivacy treated verification here, for opt-outs from sale or sharing, as an unlawful barrier.

A tech-law recap puts the compliance failure in blunt, unromantic terms: sometimes the culprit is not a cigar-chomping villain. It is a dropdown menu. That is not an excuse. It is the point. Rights that depend on good menu design are not rights. They are vibes.

The Orwell check

“Friction” is the polite word we use when a company makes a customer do extra work so fewer customers do the thing the company dislikes. It is policy, expressed in user interface.

The liberty problem: a sensor with a steering wheel attached

This enforcement action grew out of CalPrivacy’s connected-vehicle review, which fits the moment: cars now generate steady data through apps, websites, and connected services.

The Paine test

Does this expand liberty or concentrate power? Making opt-out easy expands liberty. Making opt-out hard concentrates power in the hands of whoever profits from data flows, and whoever can later demand those data flows.

The liberty ledger

Who gains freedom, who loses it? If your opt-out becomes a pop quiz, the company gains freedom to monetize your life by default. You lose freedom to move through the world without leaving a purchasable shadow behind you.

If your car is now a data device, and opting out is a legal right, why should any company be allowed to turn that right into a pop quiz?

I could smell it before I even saw the headline. That burnt-plastic aroma of a fresh power grab, where lawyers rev their billable hours like a Camaro doing donuts in a church parking lot.

On March 5, 2026, the suits came screeching back in, waving paperwork and claiming it is all for your safety. Sure, pal. And I only bought the F-150 for the cupholders.

Trump and Pam Bondi sued over the TikTok deal that kept the app running

Reuters and other outlets reported that President Donald Trump and Attorney General Pam Bondi were sued over the government’s approval of a deal involving TikTok’s Chinese parent, ByteDance, and a majority American-owned joint venture intended to keep TikTok operating in the United States.

The filing was brought by the Public Integrity Project on behalf of two retail investors who hold shares in rival platforms. That is the setup: an app, a deal, and a courtroom full of folks who swear they are saving democracy while counting somebody else’s money.

The petition was filed in the U.S. Court of Appeals for the D.C. Circuit. The argument, in plain English, is that the deal allegedly does not meet the requirements of the 2024 TikTok law, because the plaintiffs say ByteDance still has too much operational involvement. In modern America, the holy temple is not the ballot box. It is the process. Paper over people. Forms over freedom. Bureaucracy over barbecue.

Yes, China is a problem. No, these people are not saints.

I am not here to sing lullabies to Beijing. China is not your friend. The Chinese Communist Party does not do friendship. It does leverage, pressure, and control. But I am also not going to pretend the loudest TikTok scolders are pure as fresh snow on a flagpole.

This lawsuit smells like “control,” not just “compliance”

Here is what makes my AM radio dial start smoking: the plaintiffs are investors in TikTok competitors, including Meta and Alphabet. The same Silicon Valley kingdoms that have spent years acting like unelected speech referees.

According to reporting on the case, the petition argues the TikTok arrangement still allows an ongoing operational relationship with ByteDance, including continued involvement around the recommendation algorithm and certain business operations. That is a serious claim. It deserves sunlight.

• If TikTok gets hamstrung, rivals benefit.
• If the rules get “interpreted” through courts and agencies, the permanent paperwork class benefits.
• If the administration gets blamed either way, the media gets a feast.

If it is a national security risk, handle it like adults

If TikTok is a threat, define it precisely, show what receipts can be shown, and impose enforceable, auditable protections. If the law requires clean divestiture, make the terms public enough for Americans to evaluate. Stop acting like citizens need a permission slip to hear the facts.

Let the courts sort out what the law actually requires, and let the facts land where they land. But do not ignore the incentive under the hood: control of platforms, control of speech, control of markets, control of you.