Notices by Joseph Lorenzo Hall, PhD (joebeone@techpolicy.social)

Damn, RIP PGN, the Sean Connery of computer security. I learned a number of valuable lessons about composability from Peter (voting systems are hard). He was always asking shrewd, careful questions, like a bright ray of sunshine.

The Salt Typhoon hack ended the debate on safe lawful access. State-sponsored attackers didn't just breach networks; they explicitly targeted mandated wiretap systems. Backdoors don't just weaken security; they become the ultimate prize for advanced adversaries. 1/2

Add AI to the equation and the danger multiplies. Mythos-like models autonomously find vulnerabilities and write exploits, collapsing the time-to-exploit to hours. Mandating backdoors while defenders face machine-speed attacks is a severe national security risk. 2/2

Repurposing the Internet's naming system for public policy is blunt, costly, and counterproductive. It breaks legitimate services, undermines authenticated DNS, and does not actually remove targeted content from the Internet.

"Mandated DNS Blocking: A Guide for Legal Professionals" is an in-depth reference detailing the collateral damage of these measures. It outlines how blocking fragments the Internet and forces significant costs on operators. https://www.internetsociety.org/wp-content/uploads/2026/03/Mandated-DNS-Blocking-Full-Paper.pdf

Carl Gahnberg has a new post highlighting ISOC's new resources for legal professionals on mandated DNS blocking. If you need to explain the technical realities of the Domain Name System to courts or policymakers, start here:
https://www.internetsociety.org/blog/2026/04/dns-blocking-mind-the-unintended-consequences/

There are simply no words for how awesome this is for EFF and for Nicky! "Nicole Ozer Named as Electronic Frontier Foundation’s Executive Director" https://www.eff.org/press/releases/nicole-ozer-named-electronic-frontier-foundations-executive-director

@dalias modern iOS devices support up to 192kHz sample rates (lossless stuff). That pushes the limit to 96kHz, so the DAC filter should pass 60kHz. these apps rely on the voice coil's magnetic field at 60kHz, not the acoustic speaker cone pushing air

@dalias totally fascinating!

@dalias that's the third harmonic of the EM wave, which makes it extra trippy (not the audio!)

@dalias yes, it plays a 20kHz square wave and the third harmonic is the 60kHz sync signal.

Want exact network time on a wall clock? Apps like Clock Wave (iOS) grab the network time from the Internet and play a 60kHz audio tone. The phone's speaker coil creates a pulsing magnetic field that mimics the official (WWVB) radio signal, forcing the clock to sync.

Think your proprietary AI is safe behind closed doors? Xiao et al. introduce ModelSpy, a side-channel attack that steals complete neural network architectures from up to six meters away just by listening to a GPU's electromagnetic leakage through a wall. https://www.ndss-symposium.org/ndss-paper/peering-inside-the-black-box-long-range-and-scalable-model-architecture-snooping-via-gpu-electromagnetic-side-channel/

Think your burner number keeps you anonymous? Kang et al. reveal a severe privacy threat, a cross-platform linking attack targeting messaging apps. Using contact discovery and SSO, it deanonymizes users and pinpoints their physical locations. https://www.ndss-symposium.org/ndss-paper/connecting-the-dots-an-investigative-study-on-linking-private-user-data-across-messaging-apps/

Why is the Internet carrying traffic that shouldn't exist? Anghel et al. reveal widespread hygiene failures in IP routing. Using eight years of BGP data, they show over 15k networks are actively forwarding invalid, spoofed, or private IP addresses. https://www.ndss-symposium.org/ndss-paper/aliens-among-us-observing-private-or-reserved-ips-on-the-public-internet/

How do you prove an AI was trained correctly without exposing its weights and training data? Liao et al. introduce VeriLoRA, a framework integrating zero-knowledge proofs to guarantee secure, verifiable fine-tuning for massive models. https://www.ndss-symposium.org/ndss-paper/verilora-fine-tuning-large-language-models-with-verifiable-security-via-zero-knowledge-proofs/

@joncallas recently shared a sharp insight that made me stop and think: "A stopped clock is correct twice a day, and a clock running backwards is correct four times a day."

Verifying your age means that when your face scan is inevitably stolen, you can't just reset it like a password. You end up with a new, permanently compromised biometric identity! No thanks, UK.

Verifying your age tells a 25-year-old that they can't access legal content because a notoriously biased facial recognition algorithm believes they look too young. ...

Verifying your age shows tech-savvy kids how to use a VPN to bypass the system completely, while creating a honeypot of personal data from the adults who actually follow the rules. ...