❌

Normal view

Received today — 17 October 2026 ⏭

Pluralistic: Israeli ad-tech company was a delivery system for "mercenary spyware" (17 Oct 2026)

✇Pluralistic: Daily links from Cory Doctorow
By: Cory Doctorow
17 October 2026 at 12:47


Today's links


A lonely country road with a large roadside billboard. Thrusting out of the billboard is a punching fist with bloody, spiked brass knuckles; it is surrounded by scabrous craters. The sky is a psychedelic roil of red-brown clouds, from behind which loom indistinct, vast tropical flowers.

Israeli ad-tech company was a delivery system for "mercenary spyware" (permalink)

More than half of all internet users have installed an ad-blocker; Doc Searls calls it the largest consumer boycott in history. As large as that boycott is, everyone – yes, everyone – should block every "programmatic" ad, because the entire system is so insecure that failing to do so could result in the total compromise of any or all of your digital devices.

That's the inescapable conclusion of Citizen Lab's latest blockbuster investigative report, "Exposing AdFection," which reveals how the largest ad-tech companies in the world, including Google and Facebook, allowed themselves to be hijacked by a "mercenary spyware" company that used the ad system to locate targeted individuals and serve "zero-click malware" that took over their computers and phones without them having to take any action:

https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/

These tech giants amassed detailed surveillance dossiers on virtually every internet user, and they've assigned each of us unique, persistent identifiers, like a Social Security Number for spying. These companies also allow advertisers – or anyone pretending to be an advertiser – to serve blobs of code (which is all an ad is) to anyone based on those identifiers.

This allowed an Israeli spyware company called Discover-Tech (which masquerades as an ad-tech company) to sell totalitarian governments and sleazy corporate mercenaries the ability to pluck individual internet users out of the billions who log in every day and then serve "malicious ads" (that is, blobs of arbitrary code) to those targeted users. These malicious ads contained "no-click, zero-day" attacks, which meant that they exploited previously unknown vulnerabilities to take over devices without any user interaction. The mere act of loading a web-page or opening an app that relied on one of these gigantic ad-tech companies to serve ads was enough to compromise your device. No clicks needed, and no warning.

Among the targets of this attack campaign were the computers of workers at Al Jazeera. They were attacked with malware from the mercenary spyware company Candiru (which now calls itself "Integrity Labs" because irony is not dead). Beyond Candiru, Discover-Tech also facilitates attacks by numerous criminal mercenary spyware companies, serving ads on hundreds of thousands of sites and apps.

Discover-Tech was "certified" as a safe supplier by Google, Yandex, Microsoft, Beeswax (a division of Comcast) and IAB, the ad-tech industry's leading professional association. Ironically, Discover-Tech even attacked users by serving them malicious GDPR notices that appeared to let users opt out of commercial surveillance.

Because Discover-Tech was certified by all these industry bodies and firms, it had access to more than four billion ad-auctions, meaning that on billions of occasions, it was able to collect the identities of users loading apps and visiting websites, check them against the list of targets, and attack any victims it discovered through this dragnet.

Discover-Tech is an Israeli company with ties to other Israeli spyware and hacking companies, including through its board, whose members included Eric Banoun ("One of the pioneers of offensive cyber in Israel" –Haaretz). They have overlaps, relationships and affiliations with a rogue's gallery of Israeli companies, including the notorious NSO Group, who routinely sell cyber-weapons to the world's worst governments and whose products have been used to attack journalists, embassy workers, and activists.

The whole incident highlights the monumental insecurity of the ad-tech industry, whose indiscriminate and voracious surveillance and manifestly insufficient vetting and security auditing now exposes every internet user in the world to terrifying targeted attacks. These companies – including Google, a thrice-convicted monopolist whose surveillance tendrils are wrapped around the whole world – claim that they operate their networks with prudence and oversight. But the proof is in the pudding: for years, they've played host to a murderer's row of cyber-mercenaries who used their infrastructure to attack journalists and others.

The only way to avoid this is to block ads. This is easy enough to do in a browser (which is why the majority of internet users have installed an ad-blocker in their browsers), but it's illegal to reverse-engineer and modify an app so you can block the ads in it:

https://pluralistic.net/2026/07/21/dickovers/#block-element

Many websites run anti-ad-block scripts that push out nagging, guilt-tripping notices that call you a thief and a cheapskate for blocking ads. Ignore those notices: if a website is running "programmatic" ads that allow arbitrary third parties to spy on billions of people and target individuals for malicious device takeovers, they are charging too high a price to see their content.

Some sites go further: their notices demand that you either turn off your ad-blocker or pay for a subscription. This "pay or okay" scheme is illegal in Europe, California and other territories with strong privacy laws, and they are morally bankrupt besides. Privacy shouldn't be a luxury item and everyone deserves to be secure from cyber-attacks:

https://noyb.eu/en/noybs-pay-or-okay-report-how-companies-make-you-pay-privacy

This report also provides the most comprehensive rebuttal to a dangerous idea that refuses to die: that we should improve competition in the ad-tech sector by assigning every internet user a mandatory, government-issued advertising ID to "democratize" ad-targeting and followup (which the sector calls "attribution"):

https://pluralistic.net/2024/08/07/revealed-preferences/#extinguish-v-improve

Despite all this, none of it is an indictment of ads per se. The problem here isn't advertising, it's surveillance. The ad-tech sector has convinced advertisers that targeting ads to users rather than content will massively improve ad performance. The evidence for this is very poor: targeted ads improve clickthrough rates by less than 5% (relative to content-based ads that relate to the substance of the page you're looking at), and they're incredibly expensive (and very dangerous!) to serve.

On top of all that, surveillance-based ads shift power away from publishers (who know more about the materials they publish than any ad-tech company ever will) to spying ad-tech companies (who can spy on users in ways that no publisher could ever match). Whatever minor additional revenues surveillance advertising can wring out of the market are totally swamped by the cost of the ad-tech sector's own operations, which the ad-tech sector makes up for by grossly underinvesting in security and by colluding to cheat publishers and advertisers, charging more for ads and paying less to the websites that run them:

https://en.wikipedia.org/wiki/Jedi_Blue

If we want to improve competition in advertising services, the answer isn't to facilitate spying (which also allows the world's scummiest cyber-mercenaries to stage and serve targeted attacks). We should ban surveillance advertising altogether, restoring context-based ads to their role as the way that publishers make an honest living without selling out their audiences:

https://pluralistic.net/2023/05/31/context-ads/#class-formation

Hey look at this (permalink)


A shelf of leatherbound history books with a gilt-stamped series title, 'The World's Famous Events.'

Object permanence (permalink)

#25yrsago Linux on a Big Mouth Billy Bass https://web.archive.org/web/20010927153043/http://bigmouth.here-n-there.com/

#20yrsago No-Fly lists even stupider than suspected https://web.archive.org/web/20061019002553/http://rawstory.com/showoutarticle.php?src=http%3A%2F%2Fwww.cbsnews.com%2Fstories%2F2006%2F10%2F05%2F60minutes%2Fmain2066624.shtml

#20yrsago Canadian MP booted for his blog https://web.archive.org/web/20061026153747/http://www.cbc.ca/canada/story/2006/10/18/turner-caucus.html

#20yrsago Recording industry shuts out Brazilian legal scholars https://web.archive.org/web/20061103225020/http://www.a2kbrasil.org.br/ENG/SIGN-A-PETITION-FOR-AMENDING-THE

#20yrsago How pickpockets work https://web.archive.org/web/20070110023812/http://www.kiplinger.com/magazine/archives/2006/11/mystory.html

#15yrsago Why are more people opting for legal name-changes than ever before? https://web.archive.org/web/20111020163908/http://www.bbc.co.uk/news/magazine-15333140

#15yrsago Advice to the 1% from Lemony Snicket https://occupywriters.com/works/by-lemony-snicket/

#15yrsago Proposed Australian law makes it an offense to insult Gaming Minister Michael O’Brien https://web.archive.org/web/20120507161803/http://www.heraldsun.com.au/news/more-news/surely-this-is-a-joke/story-fn7x8me2-1226167552466

#15yrsago Aloha From Hell: Sandman Slim goes back to Hell and kicks more ass https://memex.craphound.com/2011/10/18/aloha-from-hell-sandman-slim-goes-back-to-hell-and-kicks-more-ass/

#10yrsago California DMV thinks “INFOS3C” is a dirty word https://www.techdirt.com/2016/10/17/california-dmv-rejects-1nfos3c-vanity-plate-because-sexual-connotation/

#10yrsago Howard Stern won’t release Trump tapes https://www.billboard.com/music/music-news/howard-stern-on-replaying-his-donald-trump-interviews-it-would-be-a-betrayal-7542079/

#10yrsago Kim Stanley Robinson says Elon Musk’s Mars plan is a “1920s science-fiction cliché” https://web.archive.org/web/20161018043554/http://www.bloomberg.com/news/articles/2016-10-17/why-elon-musk-s-mars-vision-needs-some-real-imagination

#10yrsago UK’s Investigatory Powers Tribunal says GHCQ illegally spied for 17 years https://www.theverge.com/2016/10/17/13305270/uk-illegal-surveillance-gchq-investigatory-powers-tribunal

#10yrsago Project Include cuts off Y Combinator because Peter Thiel is a part-time investor there https://web.archive.org/web/20161019043240/https://motherboard.vice.com/read/horrified-by-trump-silicon-valley-leaders-debate-cutting-ties-to-peter-thiel

#10yrsago Islamophobic terrorist cell planned a “bloodbath” in Kansas, wanted to kill Muslim babies https://web.archive.org/web/20161018144035/https://www.washingtonpost.com/news/post-nation/wp/2016/10/15/it-will-be-a-bloodbath-inside-the-kansas-militia-plot-to-ignite-a-religious-war/?utm_term=.a9d769256cf6

#10yrsago Everything Belongs to the Future: a tale of pharmadystopian, immortal gerontocrats https://memex.craphound.com/2016/10/18/everything-belongs-to-the-future-a-tale-of-pharmadystopian-immortal-gerontocrats/

#10yrsago UK government proposes issuing Britons with unique porn-viewing ID numbers https://www.openrightsgroup.org/blog/a-database-of-the-uks-porn-habits-what-could-possibly-go-wrong/

#10yrsago Donald Trump’s mail-servers are running Windows 2003 https://pluralistic.net/2021/10/18/labor-shortage-discourse-time/#core

#5yrsago Copyfraudster censors investigation of implausible covid gadget https://pluralistic.net/2021/10/18/labor-shortage-discourse-time/#copyfraud

#5yrsago Corporatism made John Deere ripe for a strike https://pluralistic.net/2021/10/18/labor-shortage-discourse-time/#deere-dash

Upcoming appearances (permalink)

A photo of me onstage, giving a speech, pounding the podium.


A screenshot of me at my desk, doing a livecast.

Recent appearances (permalink)


A grid of my books with Will Stahle covers..

Latest books (permalink)


A cardboard book box with the Macmillan logo.

Upcoming books (permalink)

  • "The Post-American Internet," a geopolitical sequel of sorts to Enshittification, Farrar, Straus and Giroux, 2027

  • "Unauthorized Bread": a middle-grades graphic novel adapted from my novella about refugees, toasters and DRM, FirstSecond, April 20, 2027

  • "Enshittification, Why Everything Suddenly Got Worse and What to Do About It" (the graphic novel), Firstsecond, 2027

  • "The Memex Method," Farrar, Straus, Giroux, 2027


Colophon (permalink)

Today's top sources:

Currently writing:

  • “Once Is Enemy Action,” a science fiction novel about the origins of modern technofascism. Today's words: 563 (26602 total).

  • "The Post-American Internet," a sequel to "Enshittification," about the better world the rest of us get to have now that Trump has torched America. Fourth draft completed. Submitted to editor.

  • A Little Brother short story about DIY insulin PLANNING

This work – excluding any serialized fiction – is licensed under a Creative Commons Attribution 4.0 license. That means you can use it any way you like, including commercially, provided that you attribute it to me, Cory Doctorow, and include a link to pluralistic.net.

https://creativecommons.org/licenses/by/4.0/

Quotations and images are not included in this license; they are included either under a limitation or exception to copyright, or on the basis of a separate license. Please exercise caution.

How to get Pluralistic:

Blog (no ads, tracking, or data-collection):

Pluralistic.net

Newsletter (no ads, tracking, or data-collection):

https://pluralistic.net/plura-list

Mastodon (no ads, tracking, or data-collection):

https://mamot.fr/@pluralistic

Bluesky (no ads, possible tracking and data-collection):

https://bsky.app/profile/doctorow.pluralistic.net

Medium (no ads, paywalled):

https://doctorow.medium.com/

Tumblr (mass-scale, unrestricted, third-party surveillance and advertising):

https://mostlysignssomeportents.tumblr.com/tagged/pluralistic

"When life gives you SARS, you make sarsaparilla" -Joey "Accordion Guy" DeVilla

READ CAREFULLY: By reading this, you agree, on behalf of your employer, to release me from all obligations and waivers arising from any and all NON-NEGOTIATED agreements, licenses, terms-of-service, shrinkwrap, clickwrap, browsewrap, confidentiality, non-disclosure, non-compete and acceptable use policies ("BOGUS AGREEMENTS") that I have entered into with your employer, its partners, licensors, agents and assigns, in perpetuity, without prejudice to my ongoing rights and privileges. You further represent that you have the authority to release me from any BOGUS AGREEMENTS on behalf of your employer.

ISSN: 3066-764X

EU faces growing pressure to plug Ukraine’s Starlink gap

✇POLITICO
By: Mathieu Pollet
16 October 2026 at 19:43

BRUSSELS — The European Union is under pressure to keep Ukrainian troops fully online after Elon Musk’s Starlink was restricted amid volatile U.S. support for Kyiv.

“It was a very dangerous and unpleasant surprise,” Ukrainian President Volodymyr Zelenskyy told reporters after EU leaders met in Brussels, referring to Starlink speed limitations experienced by military troops in recent days. “We were using Starlink to intercept jet-powered Shaheds [combat drones] that are attacking our civilian infrastructure and killing our families … When the speed limits were lowered, we became incapable of shooting [them] down.”

Ukraine has long relied critically on Musk’s satellite constellation for wartime efforts. Reuters reported Friday that the order to slow Ukraine’s military-grade Starshield service came from the White House, days after Washington pressed Kyiv to halt strikes on Russian refineries, amid soaring energy prices and ahead of November’s midterm elections.

“It is unacceptable for Ukraine’s defense — and therefore Europe’s security — to depend on the goodwill of a single American billionaire or on Donald Trump’s decisions,” French centrist Member of the European Parliament Christophe Grudler told POLITICO.

Ahead of Thursday’s high-level meeting, European lawmakers had been calling on the EU executive to fast-track Kyiv’s access to satellite capabilities already pooled under the bloc’s Govsatcom program — which gives participating governments secure communications capabilities.

Negotiations between the EU executive and Ukraine over this access have been ongoing since March, with no breakthrough. Norway and Iceland secured such an agreement earlier this year.

“What I don’t understand is why the European Commission and the Member States have not done everything possible to quickly reach an agreement that would allow Ukraine to benefit from it,” added Christophe Grudler, who wrote to EU leaders.

He also called on them to speed up work on IRIS² — the EU’s in-house, planned satellite network and full-fledged match to Starlink, which is only expected to come online in 2030.

Commission spokesperson Thomas Regnier confirmed in a statement that it is “currently in talks with Ukraine to fully associate” the country with the EU’s Govsatcom program. “The war in Ukraine shows that our security also depends on space. And the EU has been doing quite a lot. We are ready to support Ukraine where we can support Ukraine,” he added.

Calls to crack down on dependence on foreign providers and boost alternatives to Starlink also come at a time when legislators are negotiating a series of laws that could tame Musk’s ambitions in Europe.

“Ukraine’s dependence on Starlink highlights the vulnerability of European defence systems that rely on U.S. technology, Another reminder that Europe must reduce its dangerous technological dependencies — ASAP,” center-right Finnish lawmaker Aura Salla said on social media.

Policymakers across Europe have been joining forces to curb Starlink’s dominance in low-Earth orbit, where satellites fly close to Earth to deliver faster connections.

“As legislators, we must ensure that European operators are well positioned in the market and limit the dominance of foreign players,” German center-left lawmaker Matthias Ecke said. In Brussels, lawmakers, including Ecke, are backing European telcos gunning for prized satellite frequencies, currently licensed to U.S. operators until next year and eyed by Starlink.

Meanwhile, Zelenskyy said Ukraine was working bilaterally with EU countries to secure more capabilities, citing France. He also expressed hopes that Starlink restrictions could be lifted. “My partners told me there were signals from the White House that they would return these capabilities.”

SpaceX — Starlink’s parent company — didn’t respond to POLITICO’s request for comment.

Received — 15 October 2026 ⏭

Von der Leyen floats EU ‘strategic reserves’ for gas amid winter supply fears

✇POLITICO
By: Ben Munster · Zoya Sheftalovich
15 October 2026 at 18:53

BRUSSELS — European Commission President Ursula von der Leyen wants EU leaders to look into the idea of developing bloc-wide strategic gas reserves amid concerns the continent faces a winter shortage, three diplomats and two EU officials told POLITICO.

Europe’s existing gas storage caverns — which are typically refilled over the course of the year by commercial actors — are running at record lows this year after high summer prices linked to the war in Iran undercut market incentives to restock, leaving the bloc underprepared for winter.

While it wasn’t immediately clear to diplomatic officials what form the reserve idea would take, one senior EU official described it as a long-term measure to cushion the bloc against future supply risks, as countries already do with oil and refined products. The Commission president’s comments came at a major summit of European leaders in Brussels on Thursday.

Documents detailing November plans to revamp the bloc’s gas security architecture, seen earlier this year by POLITICO, include plans to encourage better crisis management by companies. However, they stop short of explicitly endorsing strategic reserves that governments would have to fill to a set level to offset supply shortages, regardless of market conditions.

Countries that typically rely on commercial refilling have already been forced to change tack this year as the limits of the existing model became clear. The Netherlands has moved to subsidize energy purchases, costing it almost €1 billion, while Germany is exploring whether to develop its own strategic stockpile.

A separate Commission proposal to set up an EU-wide mechanism to carry out joint energy purchases was received without enthusiasm by EU leaders on Thursday, two diplomats said.

Friends don’t let friends feed their data to AI agents

✇The Verge - All Posts
By: Janus Rose
15 October 2026 at 18:21
Muse mascot with red eyes

There's a growing trend in the consumer tech world: gadgets designed to spy on everything and everyone around you, regardless of whether or not anyone else actually consented to it. Now, with the advent of "AI personal assistants" like Meta's Muse, you're being cheerfully asked not just to give up your own data, but also the information of your friends, family, the person you went on a Hinge date with five years ago - and virtually anyone else you've ever come in contact with.

Since Muse was released last month, the agent has already been downloaded millions of times and hit No. 1 on Apple's App Store. With the help of its creepy virtual av …

Read the full story at The Verge.

An Israeli firm is sending spyware through online ads, researchers say

✇The Verge - All Posts
By: Emma Roth
15 October 2026 at 16:10
A laptop surrounded by green and pink message boxes that say “warning.”

An Israeli ad tech firm worked with spyware companies to infect devices, including at Al Jazeera, by simply showing users an online ad, according to a joint investigation by security researchers at Citizen Lab and Confiant. It's the first time researchers have found technical evidence of a zero-click attack - a form of hacking that requires no action by users - delivered through targeted advertising, as reported earlier by NBC News.

The ad firm, called Discover-Tech, presents itself as a typical online advertising agency, but researchers say it actually provides a pipeline for hacking groups to plant malicious ads across the web. It operat …

Read the full story at The Verge.

‘We give back’: Zelenskyy replies to Le Pen’s pledge to cut aid

✇POLITICO
By: Laura Kayali
15 October 2026 at 16:26

PARIS — Ukrainian President Volodymyr Zelenskyy replied to French far-right presidential hopeful Marine Le Pen’s pledge to cut financial aid with a message: Europe is benefitting from Ukraine.

“Ukraine will give back security. It’s security and experience, the price is not so high as people’s lives, that’s why I think that Madame Le Pen is not deeply [acquainted] with some details,” he told the Financial Times. “We give back and this is very important.”

Le Pen has repeatedly said, including to POLITICO, that she would stop financial aid to Ukraine if she’s elected as French president next year — but suggested France could keep training Ukraine’s military and provide non-financial assistance. Le Pen, the National Rally candidate, is currently leading the polls.

Zelenskyy stressed that European armed forces and defense industries, including France’s, were benefiting from Ukraine’s battlefield experience. “It’s win-win,” he said. `

He argued that Le Pen should keep supporting Ukraine because it’s helping the Franco-Italian air defense system SAMP/T, which is currently deployed in the war-torn country, be more efficient. “We made a lot of different changes together with French guys, because they saw how it worked and how it works now.”

“The French industry only wins with these technologies, cooperation, co-production,” he added. “I will not vote for her … because I’m Ukrainian,” he also joked.

Russian security service detains Swedish citizen for espionage

✇POLITICO
By: Daria Zakharova
15 October 2026 at 16:09

Russia’s Federal Security Service (FSB) has detained a Swedish citizen in the Pskov region near the Estonian border on Thursday.

The man is accused of crossing the border illegally, according to a press release published by the FSB. The accused also faces allegations of “organizing activities of a terrorist organization” and “mercenarism”.

The FSB also published videos of the Swedish citizen, in which he confirms his identity and says he is 35 years old. He also states that he signed a contract with the Armed Forces of Ukraine’s Aidar Battalion in order to carry out acts of sabotage in Russia.

The Aidar Battalion and the Ukrainian army have so far not commented on the allegations, but his relatives confirmed to Swedish television that he had visited Ukraine sporadically and fought there.

“The Ministry for Foreign Affairs and the Embassy in Moscow are investigating these reports,” the Swedish Foreign Ministry said in comments.

The Armed Forces of Ukraine did not respond to a request for comment by the time of publication.

In the meantime, the Swedish embassy in Moscow advised its citizens against visiting Russia as “a sharp deterioration in the security situation may limit the Embassy’s ability to provide consular support.”

Earlier this week, the FSB detained a correspondent for Japan’s Hokkaido Shimbun in Sakhalin on suspicion of espionage, accusing him of gathering information about Russia’s defense capabilities.

Japanese Prime Minister Sanae Takaichi rejected Russia’s allegations. “There is no such fact,” she told reporters.

Your secrets aren’t safe with this cute robot toy — they’re on Chinese servers ready to be hacked

✇The Verge - All Posts
By: Sean Hollister
15 October 2026 at 13:00
Holding an Eiliko robot toy between my thumb and forefinger in front of my workbench.
Eiliko. | Photo by Sean Hollister / The Verge

There's a new digital pet in town - a cute little marshmallow of a robot that can change its cartoony expressions to match your mood. But if you or your kids talk to "Eiliko" over Wi-Fi, it'll phone home to China. Its AI companion can store literally everything you tell it on Chinese servers, where hackers can easily gain access or even hijack its personality. And the company that made it, Energize Lab, doesn't seem to care.

I bought an Eiliko from Amazon on August 29th. During a 10-minute conversation on August 30th, I asked the little bot: "Do you ever tell anybody else what I'm saying?"

"Your secrets are safe with me," it replied.

With …

Read the full story at The Verge.

Why Ukrainian strikes on data centers are a real problem for Russia — and beyond

✇POLITICO
By: Antoaneta Roussi
15 October 2026 at 04:00

Ukraine’s strikes on data centers inside Russia aimed to disrupt military planning and communication services. There were also reports of another kind of disruption: to customers waiting for their dinner from food-delivery apps.

Kyiv’s drone strikes on three Yandex data centers in Sasovo, Kaluga and Vladimir saw delays and interruptions for thousands of businesses and households that rely on Yandex’s cloud infrastructure, including e-commerce, digital payment platforms and apps of food delivery and car services. Ukrainian drones on Wednesday targeted a major Sberbank data center in Russia’s Saratov region, though a senior company executive said it hadn’t affected operations.

After the strikes on Russian data centers, Kyiv noted that Moscow has already repeatedly targeted its digital infrastructure. “Ukrainians wanted to show Russians that two can play this game,” a senior official familiar with the operation told POLITICO, granted anonymity to discuss sensitive matters.

The attacks and counter-attacks point to a new frontline in war: the infrastructure powering the digital economy.

The attacks on the buildings that supply compute power are akin to striking a power plant supplying the electricity, heating and fuel that both militaries and civilians depend on. It may weaken an enemy’s war effort but can also bring everyday life to a standstill.

Experts say the cost of rebuilding in Russia will be particularly high as the centers require scarce materials that must be imported. “Obtaining a large amount of equipment to replace what was destroyed is not going to be easy,” said Oleg Shakirov, a cyber policy and international security researcher, noting that most hardware needs to be imported and that is complicated by high global demand and sanctions on Russia.

“To be honest, no one really knows what’s the actual damage. Since two data centers are still offline, we can assume that it’s significant,” said Shakirov.

Joseph Jarnecki, a senior research fellow at the Royal United Services Institute, warned that normalizing strikes to data centers could have a new set of dangerous consequences.

“These strikes likely breach International Humanitarian Law and it’s a big risk when global populations increasingly rely on digital services,” he told POLITICO.

When servers become targets

Data centers have entered the crosshairs of other recent armed conflicts. During the U.S.-Israeli conflict with Iran earlier this year, drone strikes hit three Amazon Web Services (AWS) facilities in the United Arab Emirates and Bahrain.

Since data centers can serve civilian and military purposes simultaneously, the legal status of targeting them is far from straightforward.

Kubo Mačák, an expert on international humanitarian law, said a data center must meet two conditions to qualify as a military objective under the Geneva Conventions: it must make an effective contribution to military operations and destroying it must offer a “definite military advantage.”

A delivery robot from Russian tech giant Yandex moves through Moscow. | Alexander Nemenov/AFP via Getty Images

“If you know that they are storing military intelligence or that they’re using the data center to power military artificial intelligence tools,” Mačák said, there could be grounds to consider it a military objective.

Following the most recent strikes of the Yandex data centers, users on social media platform X reported a sudden drop in automated bot activity, including from accounts associated with pro-Russian, pro-Trump and Germany’s far-right Alternative for Germany (AfD) narratives.

Ukrainian President Volodymyr Zelenskyy seized on the reports to boast that the strikes had made social media less toxic, even as independent researchers and national research institutes found no evidence they specifically disrupted any Russian disinformation campaigns.

Mačák said that even if a data center is being used to “let’s say, run some trolls or these bot farms to interfere with elections abroad … that would not be sufficient.” In other words, hosting propaganda bots does not, by itself, make a data center a lawful military target.

The dual-use quandary has often focused on the targeting of energy infrastructure, which has been frequent in the Russia-Ukraine war. On Saturday, U.S. President Donald Trump urged Ukraine to stop striking Russian oil refineries, blaming the attacks for rising fuel prices. He has since called for both sides to halt attacks on energy infrastructure, although the existence of any ceasefire agreement remains disputed.

As data centers become increasingly central to national economies, they will become more consequential targets. A senior NATO official granted anonymity to discuss the matter told POLITICO that data centers are already considered potential targets and that the alliance is factoring their vulnerability into its planning.

NATO allies recognize that their data centers could come under attack in a conflict, the official said: “We would get it in a fight.”

Veronika Melkozerova in Kyiv contributed to this report.

How to watch the EU leaders’ summit like a pro

✇POLITICO
By: Gerardo Fortuna
14 October 2026 at 18:41

BRUSSELS — European leaders came for the budget. They’re staying for everything else.

A two-day European Council starting Thursday was supposed to be all about the money. Instead, leaders of the 27 EU member countries are heading into one of their most crowded summits in years, with a succession of geopolitical crises threatening to hijack the EU’s carefully laid plans.

European Council President António Costa originally wanted the gathering to accelerate negotiations on the bloc’s next seven-year budget, hoping to seal a deal before elections in France, Italy and Poland in 2027 make an already difficult agreement even harder.

But the world had other plans. Soaring energy prices, tensions with China, Russia’s war in Ukraine (and U.S. President Donald Trump’s ambiguity over it), migration and turmoil in the Middle East have all elbowed their way onto the agenda.

The result is a two-day marathon covering virtually every major challenge facing the EU, from keeping European factories competitive to ensuring the world’s most important shipping lanes stay open.

For anyone trying to follow the action without spending 48 hours glued to Brussels, here’s your guide to what matters.

With the usual warning: EU leaders are notorious for letting discussions drag on or reshuffling the agenda — that’s what our liveblog is for.

Thursday at dawn: The pre-match warm-up

Before the summit even starts, Europe’s political families will gather at the crack of dawn.

The European People’s Party meets from 7:30 a.m. at the Sofitel Brussels Europe — the place to be if you can get in, given how many center-right leaders will be at the summit table.

The Socialists gather from 8:30 a.m. at PES headquarters, with Costa, Spain’s Pedro Sánchez and Denmark’s Mette Frederiksen expected.

Renew kicks off at 8 a.m. at the Palais d’Egmont, with French President Emmanuel Macron and top EU diplomat Kaja Kallas among those expected.

Even without leaders in the summit room, the far-right Patriots got a head start Wednesday, with Marine Le Pen delivering a scathing attack on the state of the EU.

Thursday morning: The energy blame game and China

Leaders kick off with discussions on Europe’s struggle for economic competitiveness, starting with energy — potentially the most politically explosive debate.

Governments want immediate relief from soaring energy prices as a result of the war in Iran, and will push the Commission to introduce new measures on top of the wide-ranging but somewhat toothless package it announced back in March.

Expect finger-pointing between capitals and Brussels over who should act, and for climate policies like the upcoming Emissions Trading System on heating and transport to come under fire.

Next comes China. European Commission President Ursula von der Leyen will brief leaders on efforts to tackle the EU’s enormous trade imbalance with Beijing, following trade chief Maroš Šefčovič’s negotiations with Chinese officials.

Leaders are expected to renew their demand for Brussels to “urgently” tool up with further trade defenses to prevent further deindustrialization of the bloc and to shield further industrial sectors from Chinese competition.

There’s also time for the familiar fight over EU red tape, with calls for Brussels to stop legislating.

Thursday afternoon: Costa’s budget gamble

This was supposed to be the main event. Leaders will discuss Ireland’s negotiating proposal for the EU’s 2028–2034 budget slashed by €159 billion from the Commission’s original proposal.

The positions are well known: The self-styled “modernists” — essentially the old frugals in disguise — want to contain costs, while countries benefiting from EU spending are determined to defend their allocations, under the less glamorous banner of “friends of cohesion.” Positions on new EU-wide taxes are similarly entrenched.

But the real story is timing.

Governments have watered down a commitment to secure an agreement by December, according to draft conclusions seen by POLITICO. Costa wants a deal before a series of high-stakes elections in 2027 complicate negotiations; capitals fear a deadline could weaken their bargaining power.

Most importantly, Costa is moving into the driving seat as budget talks enter their most politically sensitive stage. Watch for clues about a possible extraordinary summit in late November — and whether December remains a credible deadline or leaders quietly start preparing for negotiations to spill into 2027.

Thursday dinner: Making room for new members

Over dinner, leaders will tackle enlargement and the EU reforms needed to accommodate new members — after all, October’s summit has historically been devoted to the bloc’s hopefuls.

Montenegro is edging closer to completing accession negotiations, while progress elsewhere raises questions about whether the bloc is institutionally and financially ready to grow.

The Commission has outlined proposals to prepare the EU for enlargement, and leaders will discuss how internal reforms should accompany the accession process. Watch for a positive signal to Montenegro and commitments on reforming the bloc itself.

Friday morning: Ukraine’s wish list

The second day begins with Ukraine and an expected appearance by President Volodymyr Zelenskyy. Declarations of European solidarity are all but guaranteed. The more interesting question is what leaders are actually prepared to do.

Kyiv needs air defense systems, interceptors and financing as Russian attacks intensify. Leaders could discuss tougher action against Moscow’s shadow fleet and visa restrictions for Russians. And while EU financing for Ukraine has already been agreed for 2026, the country’s needs beyond that remain an increasingly pressing issue.

Could this mean reopening the debate on using frozen Russian assets to plug future funding gaps? That remains a question mark — although no immediate breakthrough is expected.

Friday pre-lunch: Defense and three dangerous waterways

Before breaking for lunch, leaders will turn to Russian hybrid attacks, maritime security and the Middle East.

In the Black Sea, recent attacks on civilian shipping threaten Ukraine’s crucial grain export route. Turkey has floated new protected shipping corridors, while countries including Romania and Bulgaria are pushing to give the issue more attention.

Will leaders back concrete measures or stop at condemnation? That’s the question.

Discussions then turn to the Middle East and two other critical shipping routes: the Strait of Hormuz and the Red Sea. The fallout from the Iran–U.S. war, increased Iranian attacks around Hormuz and renewed Houthi threats in the Red Sea have disrupted global trade and energy flows.

The EU’s Aspides naval mission is short of vessels, and Kallas wants governments to contribute more. Watch whether leaders put ships behind their promises.

The broader Middle East discussion will also touch on Iran, Yemen, the West Bank and Lebanon.

Friday lunch: The migration showdown

Spain’s Pedro Sánchez, Italy’s Giorgia Meloni and Denmark’s Mette Frederiksen are worth watching as leaders discuss migration over lunch, following the crisis in Spain’s North African exclave of Ceuta.

Irregular arrivals have been declining, but disagreements remain over border crises, solidarity and tougher migration controls.

And with an election looming in Spain on Nov. 29, this could be Sánchez’s last tango — and a final chance to defend his government’s handling of the crisis while venting his frustration over the lack of European solidarity.

Watch whether the debate produces agreement or another political clash, as happened last time.

Bonus: Two pressers are better than one

With such a packed agenda, leaders won’t wait until the end of the summit for the usual joint press conference by von der Leyen and Costa. An additional one is planned for Thursday, after the budget debate.

On Thursday, watch Costa’s language on the budget deadline and whether von der Leyen offers any concrete measures on energy prices.

On Friday, look for promises of additional support for Ukraine, whether commitments on maritime security come with actual ships and resources — and commentary on how the migration showdown over lunch went.

Martina Sapio contributed to reporting.

Microsoft and Japan took down a cybercrime network behind over a billion scam messages

✇The Verge - All Posts
By: Stevie Bonifield
14 October 2026 at 22:03
A smartphone sits on top of a surface with red tape reading “DANGER.” Where one strip intersects the phone, it continues inside the phone’s screen.

We've all gotten a scam text about a nonexistent parking ticket or a fake package delivery, but hopefully you'll start seeing fewer of them. Microsoft says it helped dismantle a marketplace for scammers sending phishing messages like those around the world. Through an investigation with Japan's National Police Agency, it tracked scam activity back to a marketplace called YAM Store and a pair of phishing kits, CoGUI and Iron Man:

Since January 2026, YAM Store, CoGUI and Iron Man have collectively enabled more than one billion malicious messages targeting over 75,000 organizations worldwide, including more than 750 million messages geared to …

Read the full story at The Verge.

Received — 14 October 2026 ⏭

Deadly drone strikes in NATO waters raise stakes for Black Sea trade

✇POLITICO
By: Martina Sapio · Victor Jack · Agnes Rønberg
14 October 2026 at 17:27

The Ukraine war’s spillover into the Black Sea is creating a growing European security and commercial risk: Drones are hitting ships and killing sailors, grain routes are under strain, and insurers and investors are weighing the cost of operating through Ukraine’s ports.

Five commercial vessels have been hit in Bulgarian and Romanian waters over the past week alone, leaving at least four people dead, several sailors missing and others injured. In response, Black Sea countries Bulgaria, Romania and Turkey have raised the issue at NATO, asking for more focus toward the region and joint support, according to two alliance diplomats.

“The attack within Bulgaria’s exclusive economic zone is absolutely unacceptable. It constitutes a serious breach of maritime and international law and will further jeopardise safe navigation in the Black Sea,” Bulgarian Prime Minister Rumen Radev said on X after the attacks last week.

Russia has been attacking Ukrainian ports and cities in the area since the start of its full-scale invasion. But the recent strikes have brought the spillover into NATO territory. If they continue, EU leaders will face pressure to protect Black Sea shipping and keep Ukrainian trade moving.

Those questions will be top of mind at Thursday’s European Council summit. According to draft conclusions obtained by POLITICO, leaders are expected to discuss the “immediate restoration of safe passage for grain cargo ships.”

A wider problem

Russia is not the only country using naval drones in the Black Sea. Ukraine has also used them against Russian-linked shipping. In June, a Ukrainian sea drone exploded in Romania’s Constanța port after Kyiv said it had veered off course because of Russian electronic interference.

“The Black Sea situation is quite dangerous because attacks are coming from both [sides],” said an EU shipping representative, who was granted anonymity to speak freely. “You have to worry about both.”

Attribution can also be difficult. Bulgarian Prime Minister Rumen Radev said Wednesday that investigators still have not proven that Russia is behind the strikes — although some have attributed his reticence to his broadly softer approach toward the Kremlin.

Drone operations by both Russia and Ukraine are likely to continue as long as each has the money and production capacity to sustain them, said Cristian Vlas, assistant research manager for Eastern Europe at the think tank ACLED.

Oleksii Goncharenko, a Ukrainian lawmaker and founder of the Black Sea Security Forum, told POLITICO that a “serious diplomatic initiative” was needed, bringing together Ukraine, Russia and a third-party guarantor, such as Turkey, “to restore freedom of navigation in the Black Sea.”

Grain routes under pressure

The security risk is disrupting routes that carry Ukraine’s harvest to market, with consequences for EU transport links. Black Sea ports are Ukraine’s main export gateway, handling around 95 percent of the country’s grain exports, as well as significant volumes of iron ore. Shipping traffic has fallen as the security risk has grown.

Some cargo is being rerouted to the River Danube, but capacity there has been stretched in recent months as drought pushes water levels to record lows. Operators are trying to add rail capacity, but that risks moving the bottleneck westward to Romania.

Moving more Ukrainian grain overland also risks reviving tensions with farmers in neighboring EU countries, Vlas said. Romanian farmers have worried that Ukrainian produce meant only to transit could stay on the domestic market, he added, while transport operators are already juggling competing demands for capacity.

Ukraine’s Agriculture Minister Taras Vysotskyi has warned that millions of tons of unsold grain is piling up, and that farmers who can’t sell won’t be able to afford to resow all their land.

Bulgaria is working with Romania and Turkey on a joint initiative to protect freedom of navigation in the Black Sea, which Radev plans to bring to EU leaders on Thursday.

Following the Black Sea countries’ request at NATO, military officials are likely to look into possible options such as shifting counter-drone systems to the region, the two alliance diplomats said. Radev said Sofia will convene his counterparts in Ankara and Bucharest to examine further proposals, while a senior Bulgarian official called for new joint anti-drone systems with Romania, partly financed by the EU.

Investment at risk

The attacks also threaten what had started to look like a renewed bet on Ukraine’s ports. MSC, the world’s largest container line, was among the biggest and newest investors, reportedly acquiring a majority stake in a container terminal at a port near Odesa in May.

Ukraine has also been offering investors a long-term concession at the Chornomorsk terminal near Odesa. This terminal is one of Ukraine’s largest planned port public-private partnerships and part of what is expected to be a multibillion-euro reconstruction effort involving European companies.

But people who work in Ukraine’s ports say the case for rebuilding is collapsing.

“No one is ready to invest and rebuild, since you know that tomorrow there will be another missile, another pack of drones,” Oleg Grygoriuk, chairman of Ukraine’s Marine Transport Workers’ Trade Union, said.

❌