AI & Code | AI Explorer & Creator | AI Brand Partnerships | Personal Branding | Ghostwriter for Founders | Partnerships: [email protected]
South Korea
Joined October 2026
- Tweets64
- Following6
- Followers7
- Likes90
Pinned Tweet
In December 2024, the FBI told Americans to stop sending ordinary text messages and switch to encrypted apps.
The same agency had spent thirty years arguing that encryption lets criminals hide.
Something changed in between, and almost nobody read the document that explains it.
A 1994 law that ordered phone companies to build a wiretap system.
A 2024 intrusion that took it.
Nine carriers. Over a million people’s call records.
Here’s what a telecom security engineer would tell you if they could speak freely:
“Read the statute. 47 U.S.C. §1004 — CALEA’s own text — says interception may be activated ‘only in accordance with a court order or other lawful authorization’ and requires the ‘affirmative intervention of an individual officer or employee of the carrier.’ Congress ordered the door and ordered it guarded. For thirty years nobody enforced the second half. In 2024, US courts authorised 2,297 wiretaps in the entire country. That same year, intruders sitting inside the systems built to serve those warrants took call and text metadata on over one million people.”
Roughly 435 people’s records for every wiretap a judge actually signed.
“A lock that opens for one key opens for whoever is holding it.”
Here are the 7 keys that got handed out:🧵
Key 4 is the backdoor that was stolen rather than used — and nobody knows who holds it.
Tweet 8
Key 7 — What happened next, which almost nobody followed.
4 December 2024. The FBI and CISA held a press call and told Americans to use end-to-end encrypted messaging and encrypted calls. CISA’s Jeff Greene: “Encryption is your friend, whether it’s on text messaging or if you have the capacity to use encrypted voice communication.” An FBI official recommended “responsibly managed encryption”, a phone receiving timely OS updates, and phishing-resistant MFA. Officials said the intruders had not been fully evicted.
16 January 2025. The FCC released a Declaratory Ruling finding that CALEA requires carriers to secure their networks from unlawful access, with a proposed rule requiring cybersecurity risk-management plans. Section 105’s forgotten sentence, enforced for the first time in thirty years.
20 November 2025. The FCC rescinded it. Order on Reconsideration FCC 25-81, PS Docket No. 22-329, adopted 2–1 — Chairman Carr and Commissioner Trusty in favour, Commissioner Gomez dissenting. The FCC called the prior ruling “unlawful and ineffective”, said it misread CALEA, cited providers’ “strengthened cybersecurity posture” since Salt Typhoon, and withdrew the proposed rules as “ineffective cybersecurity requirements.”
Ten months. Found, fixed, unfixed.
And in the opposite direction at the same time. In January 2025 the UK Home Office served Apple a Technical Capability Notice demanding access to encrypted iCloud data; court documents later confirmed it reached users anywhere in the world. Apple withdrew Advanced Data Protection from UK customers rather than comply, saying it was “gravely disappointed.” On 19 August 2025 the US said the UK had dropped the demand. In September 2025 the Home Office issued a new notice, narrowed to British citizens. Apple is challenging it at the Investigatory Powers Tribunal alongside Privacy International and Liberty, heard from January 2026.
Apple’s position has not moved: “we have never built a backdoor or master key to any of our products or services.”
Tweet 9
7 keys. A 1994 statute that ordered the door and ordered it guarded. A Greek switch that was tapped despite never having bought the wiretap licence. A surveillance target list stolen as counterintelligence. A constant in firewall firmware that nobody can account for to this day. Fifteen cryptographers describing 2024 in 2015. Nine carriers and a million call records. And a security ruling that lasted ten months.
Now the honest part.
Lawful interception is not illegitimate, and I’m not going to pretend otherwise. Those 2,297 warrants in 2024 included kidnapping and trafficking investigations; 49% cited narcotics; the courts recorded 5,463 arrests and 717 convictions. The capability does real work.
CALEA’s drafters were not reckless. Section 105 proves they foresaw precisely this. The statute was better than its enforcement.
And Salt Typhoon mostly didn’t defeat the wiretap design. It walked in through unpatched routers and weak network hygiene — including a vulnerability published in 2018. A properly run carrier under the same mandate might have held.
The FCC’s stated reason isn’t empty either. Carriers genuinely did harden after 2024, and a vague obligation can be worse than a precise one. I think rescinding it was wrong. I don’t think it was unarguable.
What survives all of it. The argument has always been framed as privacy versus safety. Athens, Juniper and Salt Typhoon say the real trade is different: the same door that serves 2,297 warrants is the door that loses a million records, and you cannot order one without accepting the other.
“A lock that opens for one key opens for whoever is holding it.”
“The compliance system was a bigger prize than the compliance.”
“Ten months. Found, fixed, unfixed.”
Next time someone tells you a backdoor can be built for the good guys only, don’t argue the principle. Ask them who currently knows the discrete logarithm of Juniper’s Q. Nobody has an answer, and the firmware shipped for three years.
And the four minutes worth spending tonight. Your cross-platform texts are the exposed part — an iPhone-to-Android message falls back to SMS, which is not encrypted and which is exactly what was being read. Move those conversations to Signal or WhatsApp. On iPhone, turn on Settings → your name → iCloud → Advanced Data Protection (still unavailable in the UK, for the reason in Key 7). On Android, open Google Messages and confirm your chats show the lock icon. That is the FBI’s own December 2024 advice, and it costs you one evening.
Why this one is worth knowing rather than just reading. Everything above is checkable by anyone, without a leak or a source. PS Docket No. 22-329 on the FCC’s own website holds both the January 2025 ruling and its November 2025 rescission, in public, side by side. You can read the government deciding the thing mattered and then deciding it didn’t, ten months apart, in its own words.
Your browser trusts a list of organisations that can create a valid certificate for any website on earth — including your bank’s.
You have never seen the list. You did not vote on it. It shipped with your operating system.
And I pitched this thread with the wrong number, so I’ll start by correcting myself.
~150 root certificates in Firefox.
Nearly 3,000 intermediate CAs chaining up to them.
Any one of them can vouch for any domain.
Here’s what a PKI engineer would tell you if they could speak freely:
“The figure people quote is the root count, and it’s the least interesting one. Mozilla’s own security blog puts it plainly: nearly 3,000 publicly trusted intermediate CA certificates chain up to approximately 150 roots embedded in Firefox. The padlock does not mean ‘this is your bank.’ It means ‘one of several thousand authorities asserted that this name belongs to whoever holds this key.’ And the names are not partitioned — nothing in the design restricts a Latvian or Panamanian CA to Latvian or Panamanian domains. In 2011 one Dutch authority issued at least 531 fraudulent certificates, and about 300,000 Gmail users in Iran had their traffic exposed as a result.”
A system where every authority can impersonate every site, and one failure is enough.
“Trust that cannot be partitioned cannot be revoked in time.”
Here are the 7 trust failures on record:🧵
Trust 3 is the company that was bankrupt two months after its press release called its certificates among the most reliable in the field.
Tweet 8
Trust 7 — The two minutes that make this concrete.
Everything above is abstract until you look at your own name in the logs.
Go to crt.sh and type a domain you control — your company’s, your blog’s, your employer’s. It queries the public Certificate Transparency logs.
You will see every publicly logged certificate ever issued for that name: which CA issued it, when, what other hostnames were bundled onto the same certificate, and when it expires.
What people actually find. Certificates from a hosting provider they left years ago. Subdomains they forgot existed — staging., old., vpn., test. — each one a live hostname someone can resolve. And occasionally a certificate nobody in the organisation remembers requesting.
Then check your CAA record, with dig CAA yourdomain.com or any online CAA lookup. Most domains have none. Adding one takes a single DNS entry and means a CA that isn’t on your list is required to refuse.
This is the part of the thread you can act on, and it’s small. You cannot audit 3,000 intermediate authorities. You can read the complete public issuance history of your own domain in about ninety seconds, and then spend thirty more telling the world which authorities are allowed to speak for you.
Tweet 9
7 trust failures. A list of thousands of issuers nobody has read. Five organisations deciding who’s on it. A Dutch CA bankrupt two months after calling itself among the most reliable. The largest CA on the web losing its business over a disputed number. One removed for its ownership, after a newspaper noticed. Two fixes that worked. And a default from the 1990s that never changed.
Now the honest part.
This system mostly works, and the alternative was worse. Before it, most of the web ran unencrypted. Billions of connections are secured correctly every hour by exactly this machinery.
The failures I listed span fourteen years — and in all three cases the authority was removed, two of them fatally. That is slow, but it is not nothing. The incentive is real: lose the root stores and you have no company.
And I corrected my own number in Trust 1 for a reason. The alarming version of this story — “150 companies can read your bank traffic” — is both wrong and lazy. A fraudulent certificate still needs the attacker to intercept your traffic. It isn’t a remote read of your account; it’s one necessary component of a network attack.
Certificate Transparency genuinely changed the mathematics. A 2011-style attack held quietly for weeks is now very hard. The 2011 story could not happen the same way today, and I’d be misleading you if I implied otherwise.
What survives all of it. The remaining flaw is not cryptographic and not even really technical. It is that the namespace was never partitioned. Every authority can still vouch for every name by default, which means the system’s security is the security of its weakest member — and its membership is decided by five private organisations reacting to whatever gets discovered.
“Trust that cannot be partitioned cannot be revoked in time.”
“The padlock means someone vouched for this name. It does not say who, or why.”
Next time someone says HTTPS means a site is safe, don’t argue about encryption. Ask them which authority issued the certificate, and whether the site’s owner authorised that authority. Both answers are public. Almost nobody has ever looked up either.
And the ninety seconds worth spending. Open crt.sh, type in a domain you’re responsible for, and read the list. Then run a CAA lookup on it. Whatever you find — a forgotten staging subdomain, a certificate from a provider you left, or no CAA record at all — you’ll have learned something true about your own infrastructure that no scanner told you.
Why this one matters beyond security. Certificate Transparency is the single best working example we have of a fix that didn’t try to make a system trustworthy — it made it auditable instead, and let anyone check. That idea is worth more than the certificates. It’s the pattern to ask for every time someone tells you to trust a list you can’t see.
You’ve probably never read the itemized part of a bill your devices generate. Almost nobody in America has.
You pay the internet bill. You pay the phone bill. You tap through the app store prompt. You’ve got photos in three clouds, a subscription you can’t name, and a modem in a closet that you’ve been renting since you moved in.
Here’s what a former telecom billing analyst would tell you if they sat down with your statements for twenty minutes:
“You’re not being overcharged. You’re being charged exactly what you agreed to — on terms you never read, for equipment you could own, on a plan the company stopped selling years ago and never moved you off. Americans guess they spend about $86 a month on subscriptions. When they’re made to sit down and itemize it, the real number comes back at $219. One survey found 89% of consumers underestimate their own monthly total. That gap isn’t fraud. It’s just nobody ever counting.”
Seven charges. The arithmetic is brutal when you stretch it over the years you’ve actually been paying them.
A $14-a-month modem rental is $168 a year for a device that sells for about $75. A phone protection plan at $19 a month is $228 a year, and across four years of ownership it runs to roughly $1,011 once you add a deductible — against about $245 for simply paying for a screen and a battery yourself. CNET found Americans spend around $1,080 a year on subscriptions, with roughly $205 of it on services they rarely or never open.
Stretch a single household across seven years and you’re looking at something close to $4,500 — none of it stolen, all of it agreed to.
“Every one of these charges survives on the same thing: it’s small enough to ignore monthly, and it renews without asking. The companies aren’t hiding them. They’re counting on the fact that nobody adds them up.”
Here are the 7 tech charges quietly draining your bank account:🧵
Fee 6 is the one to check tonight — there’s a decent chance the card already in your wallet does the same job for free, and you’ve been paying a monthly premium alongside it for years.
Tweet 8
Fee 7 — The document that itemizes all of this, which you have a right to and have never requested.
Since April 10, 2024 (October 10, 2024 for small providers), every US internet provider has been required to publish an FCC Broadband Consumer Label for each plan — modelled deliberately on a nutrition label.
It must show:
— the monthly price, including both the promotional rate and the standard rate it jumps to
— additional charges, explicitly including one-time installation or activation fees and monthly equipment rental fees
— typical download speed, upload speed and latency during peak hours
— whether there’s a data cap, and what happens when you exceed it
— network management practices like throttling or blocking
Two details that make it a weapon rather than a curiosity: providers must make your label available in your online account, and they must provide it to existing customers on request. It’s not just a shopping tool.
What to do: pull the label for your current plan, then pull labels for competing plans in your area, and compare them like-for-like including fees. That’s an apples-to-apples price comparison that marketing pages are designed to prevent.
One honest caveat: in October 2025 the FCC voted to propose removing six of the label requirements — machine-readable format, in-store physical copies, display of state and local taxes, and some formatting rules among them. That was a proposal, not a final rule, and a decision is expected later in 2026. Until then the current requirements stand. Use it now.
Tweet 9
7 charges. Same devices. Same companies. Nothing stolen, all of it agreed to.
Stop renting the modem — $168 a year for a $75 box. Sit down and itemize the subscriptions, because the honest answer is usually two and a half times the guess. Collapse three clouds into one and pay for the tier you actually use. Ask your carrier what plans exist that you’re not on, then ask for retention. Find out what your “free” phone’s payoff figure really is. Check whether the card in your wallet already insures the phone you’re paying $19 a month to insure. And pull the FCC label for your own plan — you’ve had the right to it since April 2024.
“Americans guess $86 a month. Itemized, it’s $219. Eighty-nine percent underestimate.”
“A protection plan can cost $1,011 across four years against $245 of actual repairs.”
“$168 a year, forever, to rent a modem that costs $75 to buy.”
“None of this is hidden. It’s just small enough monthly that nobody ever adds it up.”
If this was useful, repost the first post — then do only the first step tonight: write down what you think you spend on subscriptions, then go and count. Nearly everyone is wrong, and the size of the gap is what makes people finally cancel something.