If you're tired of censorship and dystopian threats against civil liberties, subscribe to Reclaim The Net. On May 1st, President Donald Trump posted an AI-generated picture of himself to Truth Social. He is floating in the reflecting pool on the National Mall on a gold inner tube, shirtless, giving a thumbs up. J.D. Vance, Marco Rubio and Doug Burgum are in the water beside him, also shirtless. A woman in a checked bikini reclines at one edge of the picture. The joke was about the money being spent repairing the pool. From August 1st, making that picture in Minnesota could expose the company whose software produced it to a civil penalty of $500,000. Make ten of them and the exposure is $5 million. The people depicted could sue separately for triple damages, punitive damages and legal fees. That image appears on page 19 of a complaint xAI filed on 27 July in the U.S. District Court for the District of Minnesota, asking a federal judge to stop the state’s attorney general, Keith Ellison, from enforcing House File 1606. The law is the first of its kind in the United States. It targets the software, not the people who make deepfakes or the people who spread them. The complaint shares this example of an image that would be banned under the wording of Minnesota’s new law. We obtained a copy of the complaint for you here.  Minnesota has a problem it is trying to solve but statute the legislature actually wrote reaches an enormous amount of ordinary, protected speech. What HF 1606 does The operative text is now Minn. Stat. § 325E.91. It says that a person who owns or controls a website, application, software, program or other service must not “allow a user to access, download, or use” that service “to nudify an image or video,” and must not nudify an image on a user’s behalf. A separate subdivision bans advertising or promoting such a service. The violation belongs to the owner. The conduct belongs to the user. The person who makes the image, the person who posts it to a group chat, the person who emails it to the subject’s employer: subdivision 2 touches none of them. The statute’s entire enforcement weight lands on whoever built the tool. “Nudify” is defined as altering or generating an image so that it depicts “an intimate part not depicted in an original unaltered image or video of an identifiable individual,” where the result is realistic enough that a reasonable person would believe the body part belongs to that person. The whole statute turns on what counts as an intimate part. And here the legislature made a choice that will probably decide the case. The definition that swallowed the law For “intimate part,” HF 1606 borrows a definition from Minn. Stat. § 609.341, subdivision 5, part of Minnesota’s criminal sexual conduct code. That statute defines intimate parts to include “the primary genital area, groin, inner thigh, buttocks, or breast of a human being.” That definition was written to determine when unwanted touching becomes criminal sexual contact. There it makes obvious sense: grabbing someone’s thigh or breast without consent is an assault regardless of what they were wearing. Transplanted into a statute about images, the same list produces something else entirely. Inner thighs are visible in shorts. Buttocks are visible in swimwear. Men’s “breasts” are visible any time a man takes his shirt off. The definition is also open-ended since the statute says the term “includes” those areas rather than limiting it to them. The shirtless reflecting pool image is covered. So is an image a user made of a former and current governor from opposite sides of the political spectrum in a sumo match, which xAI reproduces on page 20 of its filing; both individuals’ breasts and inner thighs have been “depicted” where they were not before. So is a viral picture of Trump, Xi Jinping, Elon Musk and Tim Cook eating skewers on a Chinese street in vests and shorts. The legislature knew about the alternative. As introduced in February 2025, HF 1606 cross-referenced Minnesota’s existing deepfake statute, which uses a much tighter list: the genitals, pubic area, anus, or a partially or fully exposed nipple. That version names discrete anatomical features rather than whole regions of the body. Lawmakers considered it and adopted the broader one instead. A court asked to save the statute by reading it narrowly will have to explain why the legislature’s deliberate rejection of the narrow definition should be undone by judicial construction. The second definitional term is nearly as loose. An “identifiable individual” is someone identifiable “from the image itself, by the person depicted in the image, or by another person,” or from personal information displayed alongside it. The only genuine limit in the statute is realism, which means photorealistic output is regulated and cartoons are not. The statute is silent on consent. An adult editing a photograph of themselves triggers the same liability as a stranger targeting a classmate. The omission was deliberate. When a Senate Judiciary and Public Safety Committee staffer flagged during a February hearing that the prohibition “applies to consensual images,” the bill’s Senate sponsor, Erin Maye Quade, explained “that is intentional.” Why “just build better filters” is not an answer The law contains no knowledge requirement, no intent requirement and no safe harbor. Liability attaches the moment a user succeeds, whatever the provider knew, prohibited or built, and no matter how hard the user worked to get around it. Senator Kreun asked during the same hearing whether anything in the bill would protect a company making best efforts to prevent prohibited generations. According to xAI’s account of the recording, the sponsor did not answer. A modern image model has no single switch for nudity. These are diffusion or autoregressive systems, and what they produce is governed by a chain of imperfect controls: filters that scan the prompt before generation, filters that scan the input image, classifiers that inspect the output before it reaches the user, plus reinforcement training that pushes the model away from certain outputs. Those controls are all statistical, and all of them can be attacked by rephrasing, by encoding the request obliquely, by chaining innocuous edits, or by feeding the system an image that is already borderline. Even a perfect nudity classifier would not help here, since the statute is not about nudity. A filter tuned to block explicit content will pass a picture of a man in swim trunks every time. To comply with HF 1606 as written, a provider would need a classifier that reliably detects newly visible inner thigh in photorealistic output, and it would need that classifier to be right on the first attempt, forever, across every user in Minnesota, at half a million dollars per miss. xAI’s response has been to announce that it will restrict Grok Imagine’s editing features for Minnesota users before the law takes effect. Smaller developers would do the same, or fold. Geographic feature-blocking is the cheap option, and it is exactly what the First Amendment’s chilling-effect doctrine is meant to prevent. The Supreme Court held in Counterman v. Colorado (2023) that even unprotected categories of speech require a subjective mental-state requirement before liability can attach, and the Eighth Circuit held in Video Software Dealers Ass’n v. Webster that a statute chilling First Amendment activity must contain a knowledge element. There is one carve-out: the prohibitions fall away where the service “requires the technical skill of a user to nudify an image,” with technical skill defined as substantial individualized technological or artistic skill and judgment by a human creator in directing, shaping or controlling the output. Photoshop, in other words, is fine. A tool anyone can use is not. Minnesota has written a statute in which the identical image is lawful when produced by someone with training and unlawful when produced by someone without it. What the state has regulated is the democratization of image-making itself. Whatever else that is, it is a law that favors one class of creators over another, and content-based laws that sort speakers this way start at a serious constitutional disadvantage. The case for the law, made properly Molly Kelley learned in 2024 that a close family friend had used a nudification site to make nonconsensual deepfakes of her and other women in his life. Around 80 women in Minnesota were affected by the same perpetrator. She spent two years pushing for this bill. The Senate passed it 65-0. Governor Walz signed it. The ACLU of Minnesota, which is supposed to spend its time opposing speech restrictions, backed HF 1606 and calls it a win. Laws keyed to distribution arrive after the harm has happened. By the time a nonconsensual image is circulating in a school, the removal process under the federal TAKE IT DOWN Act can take the image down but cannot undo its spread. Minnesota’s existing criminal deepfake statute and its civil counterpart both require the plaintiff to prove dissemination, non-consent and knowledge, which is difficult when the maker is anonymous and the distribution happens in closed groups. Targeting the tool tries to stop the image from being made at all, rather than chasing an anonymous maker after the fact. HF 1606 cannot be enforced without examining what an image depicts. Under Reed v. Town of Gilbert (2015) that makes it content-based and presumptively unconstitutional, and it must then be narrowly tailored, serving an interest of the highest order through the least restrictive means available. Minnesota’s interest in stopping nonconsensual sexual deepfakes clears that bar, and xAI concedes it in the complaint. Tailoring is where the state runs into trouble. What is actually at stake Texas and California have already passed laws aimed at nudification services, but the model Minnesota chose, strict liability on the toolmaker with per-image penalties, is the most aggressive available. If it survives, it becomes the template. The people who lose under that template are not xAI, which can afford to geofence a feature and go to court. The losers are the open-source image model with four maintainers, the small photo-editing startup that adds a background-removal feature and finds it has acquired unlimited liability, and the Minnesota user cut off from tools that everyone else in the country can use for satire, restoration of damaged family photographs, virtual staging or teaching material. RAINN, a main force behind the bill, says it consulted numerous technology companies to keep the law from creating unintended consequences for general products. The statute it produced still offers no safe harbor for a developer acting in good faith. HF 1606 takes effect on 1 August 2026. xAI’s motion seeks preliminary and permanent injunctive relief. If you're tired of censorship and dystopian threats against civil liberties, subscribe to Reclaim The Net. The post xAI Challenges Minnesota’s Broad “Nudification” Law as a First Amendment Violation appeared first on Reclaim The Net: Free Speech, Privacy, Digital Rights.

If you're tired of censorship and dystopian threats against civil liberties, subscribe to Reclaim The Net. A row of peers has gathered in Westminster to decide whether the Online Safety Act has been cruel enough to the internet yet. After some hours of evidence, the verdict came back: not nearly. The Communications and Digital Committee has been quizzing stakeholders about how the law is going, and the charities it called have a grievance: Ofcom is too soft. Andy Burrows of the Molly Rose Foundation put it like this: “I do not get the impression that the companies are quaking in their boots at Ofcom’s enforcement approach.” The boots, by every account, stood steady. The censorship law, for anyone who missed its arrival, will make Britain the safest place in the world to be online. It says so itself. The maximum fine runs to £18 million ($24M) or a tenth of worldwide revenue, whichever bites harder, which for the biggest platforms would reach into the billions. And still, no boots. So the room reached for the obvious cure. More of it. Baroness Kidron of the 5Rights Foundation, defending Ofcom and filleting it in the same breath, allowed that “the act is wrong in certain places and does leave certain gaps, and will need some more work.” Some more work. The gaps, you understand, all run in the one direction. Look at the machinery already bolted on. A platform that performs “Ofcom’s 44 measures, or whichever number it is now” — Kidron’s phrase — is safe. Do the 44 things, claim your safe harbor, go home. Try something cleverer and you forfeit the protection. The law rewards the box-tick over the better idea. A bold design. And the boxes do get ticked. Nearly two-thirds of daily visits to Britain’s adult sites now pass through an age check. Lord Vaizey told the Lords that Ofcom had begun investigating 47 sites for non-compliance. Ofcom’s own spokesperson said 69. Enforcement is one of those two numbers. Ofcom says the picture is better than that. Change was already happening, its spokesperson offered; platforms held to account, fast enforcement launched, more protections put forward. Burrows allowed that some of the action already under way might be supervisory, Ofcom working with a firm rather than fining it, though the process is opaque enough that nobody could say how industrious it was. Meanwhile, the children the whole edifice was raised to protect. On the risk it already knew well, child sexual abuse, Burrows granted Ofcom was doing a good job. His worry was the newer harms. He kept returning to the Com groups; networks largely of teenage boys, whose reported numbers rose sixfold between 2022 and 2024, running a new kind of grooming pointed at suicide and self-harm. The Molly Rose Foundation carries the name of Molly Russell, fourteen, who viewed thousands of images promoting suicide and self-harm before she took her own life. Rani Govender of the NSPCC laid out the trap: when a platform spots a harm the codes of practice never named, it carries no obligation to act on it. The law covers what the law already wrote down. More scope. More codes. More measures numbered 44, or whichever it is now. One problem stayed off the agenda. The Act treats two hard engineering questions as things a statute can order into being. The first is reliable age estimation; in the opening days of the new rules, people strolled past the checks using video game avatars to pass as adults. The second is reading encrypted messages without breaking the encryption, which cannot be done, a point Signal made by offering to leave the country rather than build the back door. “If the choice came down to being forced to build a backdoor, or leaving, we’d leave,” its president wrote. A mandate is a wish with a fine attached. The public has been voting with its downloads. When the age checks landed on July 25, Proton VPN clocked an hourly sign-up increase of over 1,400 percent. Ofcom’s answer was to tell the BBC it would be illegal for platforms to encourage VPN use. To Ofcom, a loophole to close. The verdict in it went unheard. And the petition to repeal the whole thing has passed 550,000 signatures. Having heard all of this (the avatars, the VPN stampede, the third of a million names) the committee asked whether the age-check regime might also be extended to VPN providers. If you're tired of censorship and dystopian threats against civil liberties, subscribe to Reclaim The Net. The post UK Committee Hears Calls to Expand the Online Safety Act’s Powers appeared first on Reclaim The Net: Free Speech, Privacy, Digital Rights.

If you're tired of censorship and dystopian threats against civil liberties, subscribe to Reclaim The Net. Around 11 PM, Eastern time, on Sunday, a server in a data center somewhere fell over. It’s becoming routine, really. Xbox’s status page logged it the way you’d log rain. By Monday morning it had grown teeth. People lost their logins. Apps stayed shut, the store stayed dark, plenty of downloaded games stayed frozen. Fine. That’s the bargain you strike for digital, and everyone struck it with eyes open. Then came the part nobody struck. The disc games balked too. The disc. The physical object. The one in the tray, spinning, bought with actual money at an actual shop. Xbox’s own status page conceded that players “may have problems” with disc games, and the internet duly confirmed it. The license, it said, couldn’t be verified. The console, you see, phones home before it will let a disc spin. The disc is a pass that works only when a building three states away agrees to open the door for you. Xbox was making progress on recovery. It said so itself at 5:26 PM, on X, assuring everyone that most players “should be able to launch titles and complete purchases again.” GamesRadar clocked the support account at 7:54 AM, “just checking in” on the sign-in and game-launch business. By 9:43 AM it had “identified the issue,” resolution “pending.” Pending pulled a long stretch that day. The company stayed silent on requests for comment. It had a lot goin on. Days earlier, PlayStation had suffered an outage of its own. And back on the first of July, Sony had already posted the destination: physical disc production for new PlayStation games stops in January 2028. Senior director Sid Shuman put it down to “shifting trends in consumer preference.” After that date, new games arrive as downloads. Sony describes killing the disc as a chance to “align more closely with how most of our community prefers to access and play games today,” which is press-release for: we checked the register, and you’d mostly stopped buying them. Digital already brings in 20% of the company’s gaming revenue. The discs were the rounding error. The numbers dig the grave regardless. Physical is 3% of Sony’s gaming revenue now, half what it was in 2020, the year the PS5 turned up with a drive still in it. TechRadar counted seven PlayStation games that sold more than 100,000 physical copies in the US this year. Seven. There is a holdout. Shawn Layden, who used to run the place, reckons the PS6 won’t completely drop discs, on the theory that going all-digital might irritate the customers across 170-odd countries who still enjoy owning a thing. By Monday evening the disc games came back, though Xbox warned that digital and backward-compatible titles might still stall. The tray whirred, the license got verified, the door swung open. And the disc you paid for went back to being what it had been around 11 PM: a shiny promise that a company somewhere will go on letting you use the thing you bought. Own nothing, the slogan goes, and be happy. It’s half right. If you're tired of censorship and dystopian threats against civil liberties, subscribe to Reclaim The Net. The post Xbox Outage Stops Players From Launching Physical Disc Games appeared first on Reclaim The Net: Free Speech, Privacy, Digital Rights.

If you're tired of censorship and dystopian threats against civil liberties, subscribe to Reclaim The Net. The Justice Department is asking a federal court in Atlanta to treat a man’s erasure of his own phone as destruction of property, in the first known US prosecution built on a phone’s duress password. Samuel Tunick faces one count under Title 18, Section 2232(a), a statute covering the destruction of property to stop the government from taking it. Prosecutors say he handed Customs and Border Protection officers a passcode that deleted the contents of his Google Pixel instead of unlocking it. His lawyers appeared before the court for the first time on Monday, arguing that officers ran a custodial interrogation without Miranda warnings, denied him a lawyer, and searched him unlawfully. They want everything obtained from the encounter suppressed. CBP pulled Tunick into secondary inspection at Hartsfield-Jackson on January 24, 2025, as he returned from the Dominican Republic. An FBI Joint Terrorism Task Force officer and an FBI special agent had coordinated with CBP in advance to question and search him on arrival. The account comes from the defense filing, which draws on the government’s own reports. Officers from CBP’s Tactical Terrorism Response Team opened by telling him they were “looking for people who are pedophiles.” Officers never read Tunick his Miranda rights. He said early in the interview that he did not want to keep talking without a lawyer, then asked to call one repeatedly. Questioning continued. One officer told him his refusal to talk gave them authority to go through his phone. When he asked again about his attorney, an officer told him customs and immigration work was a different matter, “and we have search authority, we don’t need a warrant.” Tunick eventually provided a password for his phone and his e-reader. The screen “went blank, flashed several times and the phone appeared to restart,” according to the government’s report. Officers seized the devices anyway and told him they would be returned after thirty days. A third officer took him to another room for a pat-down that was not recorded. A DHS agent then told him he was free to leave once the other agents were finished with him. The government’s reports contain no indication that anyone suspected Tunick of carrying illegal images, his lawyers wrote. The reports record an interest in his association with Defend the Atlanta Forest, the movement opposing the clearing of the South River Forest for the Atlanta Public Safety Training Center. Opponents call the 85-acre, $115 million police facility Cop City. Federal documents label the movement an “Anti-Government, Anti-Authority Violent Extremist Group.” Tunick has not been charged with any offense connected to it. Eleventh Circuit precedent favors the government. Its 2018 ruling in United States v. Touset permits forensic searches of electronic devices at the border with no warrant, no probable cause, and no individualized suspicion. Tunick’s lawyers cite decisions from the First, Fourth, and Ninth Circuits going the other way, including a Fourth Circuit holding that warrantless border searches of devices cannot be used to hunt for evidence of domestic crime. They also argue that surrendering a passcode is testimonial, relying on a 2012 Eleventh Circuit decision that decrypting and producing the contents of a hard drive triggers Fifth Amendment protection. Courts allow suspicionless border searches to keep contraband out of the country. The accusation here is that data left a phone rather than entered the United States, and digital files move across borders over the internet anyway. A ruling on the motion is not expected before the end of October. GrapheneOS, the hardened Android build that replaces the stock software on Pixel devices, lets an owner set a second PIN or password that irreversibly wipes the device and any installed eSIMs when entered at a credential prompt. No confirmation dialog appears, and nothing distinguishes it from a normal unlock. Bill Budington, senior staff technologist at the Electronic Frontier Foundation, and Runa Sandvik, founder of the security firm Granitt, both said they had seen no comparable prosecution. Sandvik said she had discussed the scenario with activists and journalists for years and advised travelers to leave sensitive data off devices they carry across borders rather than count on wiping it. Christophe Boutry told the Guardian the prosecution “sends the message that [GrapheneOS] is criminal by default.” Matthew Dodge, an assistant federal public defender on Tunick’s legal team, said the statute is rarely seen in an indictment. Tunick was arrested about ten months after the airport stop. His crowdfunding page says he was pulled over for a purported tail light fault and cuffed by FBI and DHS officers when he stepped out of the car. He has pleaded not guilty. The single-count indictment  accuses him of acting to delete the digital contents of a Google Pixel to impair the government’s lawful authority to take it, in violation of Title 18 of what the document calls the “Untied States Code.” If you're tired of censorship and dystopian threats against civil liberties, subscribe to Reclaim The Net. The post GrapheneOS Wipe at Airport Leads to Federal Charge in Atlanta appeared first on Reclaim The Net: Free Speech, Privacy, Digital Rights.

This Post is for Paid Supporters Reclaim your digital freedom. Get the latest on censorship and surveillance, and learn how to fight back. Subscribe Already a supporter? Sign In. The post Can You Escape the Device Identifiers? appeared first on Reclaim The Net: Free Speech, Privacy, Digital Rights.