June warned you the anti-freedom dragnet was widening. July showed you the border is where the Constitution is sent to die. August was the month they criminalised the act of keeping a secret. September is the month they tried to give their machine a new name, and a university enforced a sentence no jury had returned, against a man who had not been convicted of anything.
To me this is personal. I have spent decades in this work, after my family fled a system that treated wrongthink as a matter of national security. And I certainly didn’t escape that Bolshevik police state to simply stand by as they rebuild it around you.
What is being done to you is not “child protection.” It is not “public safety.” It is contempt for your correspondence, your associations, your movement, and the base-principle that the state must justify itself before it strip-searches you.
Private enterprise builds the eye. The statute tells it where to look. When you blink, a committee calls your punishment “Public Safety.“.
Jump To Section:
- North America
- European Union & Britain
- Pegasus Spyware
- What They Are Doing To You
- Practical Steps You Can Take
North America: Speech, Travel, And Everyday Privacy At Risk
United States: They couldn’t open his phone. So the university took his job.
Samuel Tunick already faces five years for handing Customs a GrapheneOS duress PIN at Atlanta rather than a readable life. The publicly produced justification for the watchlist entry-search remains association with the movement against Cop City.
No bomb. No plot. Just “Association.“
In September the punishment for his non-compliance was enforced externally. Six hours before his first Geosciences lab, Georgia State University told him he had failed a background check. The teaching post is gone. The tuition waiver tied to the Master’s is gone. Emails he shared with 404 Media show a committee, a dean, and the legal office running a “risk assessment” with no written rules that his department head could be shown.
A pending charge was enough. He is still waiting for a trial. What the university documented as its “reasoning” is thinner and worse: no concrete policy, indictment as verdict; guilty until proven innocent.
The Rapid Signal of 21 September set out the chain. A ruling on the motion to suppress is still not expected before the end of October.
On 16 September 404 Media and WIRED published the images a collective called “stegan0gram” pulled off a Flock unit via an encryption key left on an unencrypted partition; about 50,200 vehicles and 1.6 million images in twenty-one days; software that scores people and bicycles, not just plates. More than 150 localities have paused or ended Flock contracts. Texas barred state money. Florida ordered the cameras off state-highway rights of way. On 23 September the chief executives of Flock, Axon, Motorola and Verkada were invited to a Senate hearing. They sent a letter.
Congress will not solve this for you. If your town still rents the pole-camera, it’s your fight, not anyone else’s.
At the border the secondary-search is no longer made in a room. On 15 September Customs sought walk-through facial arches at 38 terminals so Global Entry members need not stop. The same week the agency did not deny using facial recognition to hunt foreign sex workers. Clearview’s InquiryIQ prototype (a face search that then researches your life and your associates) is being shopped into Border Patrol. You do not have to be on a list. You only have to walk through.
A federal judge in Utah enjoined the VPN piece of SB 73. That clause treated a user as in Utah if they were actually there, even behind a VPN or proxy, and would have held sites liable for failing to see through the mask. Judge David Barlow blocked Utah Code § 78B-3-1002(3) on September 24, 2026, finding it likely violates the dormant Commerce Clause because the text demands perfect geolocation and none exists. The rest of the age-gate statute stays in force. Do not read this as a check on the age-gate wave it sits inside.
FISA 702 still “lapsed” on June 12 but runs into March 2027 under the court’s existing certifications. This means even if you are not the foreign target, you are still in the incidental data collection pile.
Canada and Mexico did not need a new September law. Bill C-8 already lets a minister cut a named person off the network, often under a gag order. Bill C-22 still sits in the Senate. Mexico’s SIM-to-identity window still runs to 31 December, though there’s significant public non-compliance.
European Union And Britain: Give The Scan A New Name. Then take yours.
The scan? what scan?
Here is what “they tried to rename the scan” means. The system is scanning already. Chat Control 1.0, revived in July and in force from August, lets the large platforms “voluntarily” read unencrypted private messages and call it “compliance.” It runs until 3 April 2028. End-to-end encryption is currently exempted on paper, but that doesn’t mean you should trust Whatsapp anymore because of that paper.
Chat Control 2.0 was supposed to replace that temporary regime. The EU regime did not want a replacement that scanned less than what is currently implemented. Leaked Council papers, published by Patrick Breyer and heise, showed the surveillance upgrade receiving a new label: “Search Plans.”
Essentially, an authority would be able to “licence” a platform to scan your chats and your mail for months, without ever naming you as a suspect of anything.
Same mass scan. New stationery header.
On 29 September the sixth trilogue did not land that deal. The Parliament’s team blocked the private-chat scan. Negotiators reached a preliminary deal on scanning of public content. Private detection moves to technical talks through October.
They just postponed the licence. They did not repeal the scan already on your inbox.
This is “A hold, not a victory.“
After they fail to scan the message, they take your name.
On 17 September the Commission tabled the EU KIDS Act. No social accounts under age 13. Parent-gated accounts at 13 and 14. Own accounts from 15. Self-declared age forbidden. Certified age assurance, later the Digital Identity Wallet, as the doorman. Age checks were stripped out of the CSA Regulation in June so they could be legislated somewhere else.
The justification? “To treat a child differently from an adult, the platform must know who you are.“
Germany did not wait for Brussels. A classified Zollkriminalamt order, published by Netzpolitik in early September, shows “account cloning” by officials: Adding the investigator’s machine as a second device on WhatsApp, Signal and Telegram, moved from a 2023 pilot to current standing practice.
To put that into context. WhatsApp can expose up to a year of history to investigators this way; Signal about 45 days; Telegram has a permanent cloud archive. They do not need to break your lock if they can become the second key.
NOBODY EVER voted for this.
IMPORTANT: Check your linked devices.
Britain left the Union and kept the appetite. Five East Midlands police forces dropped Palantir’s Project Nectar. The same month Palantir’s NHS Federated Data Platform moved into GP records, and on 30 September more than 44,000 people filed Article 21 objections to their health data on the platform. The £330 million contract’s break point is early next year.
Putting the UK’s sick under a US intelligence contractor whose products have walked with Israeli military surveillance and with ICE is not a software upgrade.
If you are in that system, file your objection now.
The British under-16 social ban shares Brussels’ calendar. The government fact sheet, updated 18 September, changed “facial recognition” to “facial age estimation.” Regulations expected before Christmas. Live in spring 2027.
As it turns out, Orwell was a starry-eyed optimist.
The Pegasus Export Licence Did Not Keep Its Promise
Pegasus is a surveillance product. NSO Group, an Israeli firm, builds it and sells it to governments. Israel’s Defence Ministry licenses the sale. NSO’s own counsel says the company does not pick the targets.
On 2 September Citizen Lab confirmed the first Pegasus infection of 2026: A member of Serbia’s student protest movement, taken over by an iMessage zero-click, which is to say there’s no link, no tap, no user action before activation. The infection window ran from December 2025 into January. SHARE Foundation counted at least fourteen people targeted since January, students and opposition figures. Amnesty confirmed a new NoviSpy on a student device: not NSO’s, but the Serbian spyware previously planted with Cellebrite tools during detention. Two surveillance products, one protest.
On 10 September NSO’s general counsel told the Thai Civil Court the company line: “Sold only to governments who promise not to misuse it.” The case was brought by Jatupat Boonpattararaksa, one of at least thirty-five Thai activists infected in 2020–21. A verdict is expected on 21 November.
NSO’s promise is hollow, following the Belgrade infection.
A student before an election is not a terrorist, yet the surveillance licence was granted anyway.
What They Are Doing To You
Association becomes the watchlist. The watchlist becomes a windowless room. The room becomes a demand for the plaintext of your life. Answer with a lock, and that lock becomes the crime. The campus dismissal email becomes the sentence served before trial.
Then they force an identity layer onto you: EU wallets, British age estimation, Australian “papers-please,” Mexican CURP phone registration.
When the credential is mandatory, anonymity is a right they withdrew.
Flock, Facewatch, Clearview, LexisNexis, Palantir and NSO are the factory.
You are not the customer. You are the inventory.
Practical Steps You Can Take
You do not need to be technical. You need to stop handing them the easy copy.
- Lock the accounts you already have.
A proper passphrase is a short sentence only you would write, not a pet’s name plus a digit. Use a different one for mail, banking, and your messenger.
A password manager is a locked notebook on the phone that remembers them for you; a paper notebook in a drawer is more secure if you will not lose it. Two-factor authentication means a second check after the password.
Do not use the text-message kind. A thief who talks your phone company into moving your number gets those texts. Use an app such as Aegis, or the code generator inside your manager, or a small hardware key you plug in.
Full instructions and guides are available to our members.
- Travel as if they WILL ask.
The phone in your pocket should not hold the photos, chats, and logins you cannot rebuild. Before a border entry, copy what you need onto a drive you leave at home, then wipe the handset or carry a cheap spare with nothing on it but a map and a boarding pass.
After you are through, restore from that copy. A duress PIN, on GrapheneOS, wipes the phone when you type it. Keep that PIN only on a phone whose loss does not end your employment or your degree.
The second interview may be a dismissal email from a university, not a room at the airport.
- Stop feeding the factory.
A “VPN” from an advert is often a listening post with a padlock drawn on it. Use a tool whose code other people can read: Signal for messages, Session if you want no phone number on the account, Proton or mail you run yourself, Tor when you do not want the network to see the site. A hardware key is a small token that proves it is you. GrapheneOS is a replacement phone system for a Google Pixel; it is the one with the wipe PIN in this story. If your city still rents Flock cameras, object at the next council meeting. One hundred and fifty towns already did.
- Use the objection, not only the petition.
In Britain, Article 21 of the UK GDPR is a right to say: “Stop processing my data, unless you can show a compelling reason.” The 44,000 wrote to NHS England and said the Palantir platform may not handle their records. You can do the same in ordinary sentences. Keep a copy.
A petition asks a minister to feel something. An objection makes them answer.
- Keep the rooms separate.
Work mail, political chats, money, and the phone that crosses a border do not share an account or a login. If one room is taken, the rest of the house should still lock.
This is the public warning. DO NOT COMPLY.
Compliance is how they finish the job.
This briefing is the map. The playbooks, the setup guides, and the deeper freedom instruction (Digital, Mental, Economic, Strategic) sit in The Arsenal, for members. If you want the steps done to your own accounts rather than described, that is where they live.
And finally, what is most urgent for you? The search plan, the empty lab, the camera that skipped court, or the objection the NHS must now answer? Tell me and I’ll deal with it in detail.
Stay sovereign and stay informed.
