->->->->->->->->->->->->->->->->->->->->->->->->->->->->-> Top Sources: None -->

Today's links

• Bundestrojaner: You can't make people more secure by making them less secure.
• Hey look at this: Delights to delectate.
• Object permanence: 9/11 sitcom; Jon Norman v Philcon; Bruce Sterling's post-9/11 geopolitics; Polaroid bankrupt; David Mamet x Shel Silverstein; "Great Big Beautiful Tomorrow"; Canadian government calls abortion doctors "terrorists"; Shanghai Ikea kicks out lonely, loitering seniors; Black Panther self-care.
• Upcoming appearances: Paris, Vancouver, Victoria, Ottawa, Vienna, Kilkenny, Oxford, Sheffield, Oxford, Montreal.
• Recent appearances: Where I've been.
• Latest books: You keep readin' em, I'll keep writin' 'em.
• Upcoming books: Like I said, I'll keep writin' 'em.
• Colophon: All the rest.

---

Bundestrojaner (permalink)

Every morning, I revisit my blog headlines from this date, going back 25 years, 20 years, 15 years, 10 years, 5 years, and one year. I publish the most interesting ones in a section of my newsletter that I call "object permanence," and I think it's the most useful part of my day.

"Object permanence," of course, is a reference to the stage in an infant's development when they acquire the ability to connect events in the past to events in the present, which is why it's the point at which babies cease to be amazed by peek-a-boo. I've been blogging for more than a quarter century, and these daily trawls through the things I considered important enough to share are an unexpectedly powerful way to connect the events of the past to the events of the present.

Take cybersecurity, subject that is filling today's headlines, primarily due to a spate of poorly understood (and criminally poorly explained) incidents in which AI companies' hacking tools broke into various servers on the internet, sometimes trashing them:

https://pluralistic.net/2026/09/12/god-in-the-box/#llms-are-fake

In my discussions of this subject, I've been at pains to tease apart two different aspects of these incidents: first, that it's wrong to speak of bots "going rogue" here (they're doing what they're designed to do); but second, that the alarming thing about these incidents is that they illustrate how deeply unserious our approach to information security has been, and remains.

This is important context, and context is what gives us the object permanence we need to both understand and address real problems, like the two related facts that a) our IT systems are poorly constructed and indifferently maintained; and b) the people who are supposed to be fixing this keep making it worse.

The worst culprits here are governments, though the private sector is also terrible (in truth, our cybersecurity nightmare is something of a private-public partnership from hell). Governments are deeply compromised when it comes to digital security because they have an irreconcilable conflict of interest: on the one hand, they want to defend their countries' administrative systems, firms and households from digital attacks. But on the other hand, they really want to be able to launch attacks on their adversaries, both foreign and domestic.

Worse: because governments don't know who those adversaries might be (or might become at some later date), the state security apparatuses of the world's governments keep insisting that all working computer security must be dismantled, so they can spy on all of us in order to figure out whom among us is a Bad Guy, and then "travel back in time" through each newly discovered "bad guy's" communications to identify their confederates and detail their nefarious plots.

This is an old, old, old fight. It was arguably the first policy fight of the digital era: the fight over whether we could have working encryption at all. Old hands call this era "the crypto wars" (from when "crypto" meant "cryptography"), when the NSA classed working encryption code as a "munition" and criminalized civilian access to it. That was a very hard-fought fight, and it was won decisively by the Electronic Frontier Foundation and our just-retired executive director Cindy Cohn, who, as a young lawyer, litigated the "Bernstein case" that established that code was a form of expressive speech protected by the First Amendment. If you're interested in learning more about this, you should read Cindy's newly published memoir, Privacy's Defender (all profits go to EFF):

https://mitpress.mit.edu/9780262051248/privacys-defender/

Before Cindy came on the scene, the crypto wars were being fought primarily by the "cypherpunks," a motley gang of computer security enthusiasts of many political stripes who were unified by their conviction that the most important aspect of security was defensive. The fact that the NSA wanted to be able to read the private messages and files of their adversaries (the "Four Horsemen of the Infocalypse": terrorists, drug traffickers, child pornographers and organized crime) must not be allowed to trump the fact that any encryption that the NSA could pierce could also be pierced by bad guys: corporate spies, state-sponsored spies, griefers, petty criminals, stalkers, identity thieves and other creeps.

This argument was so indisputable, it's a tautology: "You cannot make a computer user more secure by making their computers less secure." We don't know how to make a computer that only "good guys" can break into, but which "bad guys" bounce off of. Either we make computers more secure, or we don't.

We didn't.

In the decades since the crypto wars, governments have embarked upon an uninterrupted program to weaken the security of our computers, with catastrophic effect. The most spectacular example is unquestionably the spy agencies' doctrine called "NOBUS," which stands for "no one but us"; as in "No one but us is smart enough to find this bug, which means that we can withhold its discovery from the manufacturer, which will allow us to weaponize this bug and use it to attack our enemies. Because no one but us is smart enough to find this bug, none of those enemies will ever discover it, weaponize it, and use it to attack the people who pay our salaries, who expect us to keep them safe."

This turns out to be both catastrophically wrong and catastrophically dangerous. A series of leaks of computer vulnerabilities hoarded by both the NSA and CIA under NOBUS confirmed that these bugs were independently rediscovered by criminals and state actors at the rate of about 20% per year. Worse, though, is that these bugs don't need to be independently rediscovered, because the NSA and CIA both leaked them.

The highest-profile leak was an NSA-hoarded vulnerability in Windows they codenamed "Eternal Blue." Eternal Blue leaked in 2017, whereupon cybercriminals hybridized it with some otherwise undistinguished ransomware to create Wannacry, a devastating piece of malware that took down hospitals, banks and oil pipelines, as well as the entire city government of Baltimore and the British Library:

https://cdn.sanity.io/files/v5dwkion/production/99206a2d1e9f07b35712b78f7d75fbb09560c08d.pdf

But NOBUS isn't the only example of spy agencies making our computers less secure in the name of making us more secure. Perhaps the most egregious example of that are the Bundestrojaners, malicious software purchased by the German government, whose customs agents secretly installed it on the computers of unsuspecting people during border inspections. This "lawful interception" software was hugely invasive: it could grab your screen, plunder your hard drive, and install and execute software on your computer, all with the utmost stealth, intended to keep you from knowing it was installed and operating on your computer. But it wasn't merely invasive – it was insecure, so anyone (rival spies, criminals, stalkers) could scan the internet for infected computers and take them over:

https://www.ccc.de/en/updates/2011/staatstrojaner

You really couldn't ask for a more perfect example of the maxim that you can't make computer users more secure by making their computers less secure. Despite this, governments continue to demand the introduction of grave, universal secure vulnerabilities into our digital lives. Take "chat control," a proposal to force every device manufacturer to install software that continuously scans your devices for child sex abuse material (AKA "child porn"):

https://www.eff.org/deeplinks/2026/04/eu-parliament-blocks-mass-scanning-our-chats-whats-next

There are plenty of things wrong with this, starting with the fact that it requires your device to secretly grab and transmit sensitive images from your phone, which might include sensitive images of your kids that were requested by their doctors. This isn't a hypothetical: it's something that happened to a dad who subsequently lost his email, his login to every other account, his phone number, all of his files (including his tax records and his business data), and every photo he had ever taken of his family, without appeal, after Google automatically detected a photo he took of his son to send to the family pediatrician. Google also falsely accused this man of sexually abusing his child and sicced the SFPD on him:

https://pluralistic.net/2022/08/22/allopathic-risk/#snitches-get-stitches

But even if you're not worried about this, you should still have the object permanence to recall the lessons of NOBUS and the Bundestrojaner. We can't make computer users more secure by making their computers less secure, and it's hard to imagine something more insecure than a computer that you entrust with every sensitive detail of your life that is designed to run computer code in secret that you can neither inspect nor terminate (let alone delete).

Hardly a day goes by without some country demanding that your computer's security be weakened in the name of protecting you. For years, both Conservative and Labour UK governments have been steaming towards a total ban on working encryption in the name of catching bad guys:

https://pluralistic.net/2023/03/05/theyre-still-trying-to-ban-cryptography/

It's happening in Canada, too, where somehow "digital sovereignty" means "making every device used in Canada vulnerable to foreign spies so that our own spies can access our private communications":

https://www.eff.org/deeplinks/2026/05/canadas-bill-c-22-repackaged-version-last-years-surveillance-nightmare

Then there's the "age verification" laws proliferating all around the world. Remember, there's no such thing as "age verification," there's only "spying on everyone, all the time, to figure out who the kids are":

https://pluralistic.net/2026/06/23/destroy-the-village/#to-save-it

Age verification requires multiple entities to assemble vast corpuses of the kinds of sensitive identification papers that would allow identity thieves to destroy the finances and lives of everyone in the country, and (as foretold) every time it's tried, these files leak. Someday, this will lead to doxing whole countries:

https://arstechnica.com/tech-policy/2026/02/discord-faces-backlash-over-age-checks-after-data-breach-exposed-70000-ids/

Age verification is the latest and worst stage in governments' fraught relationship with private sector data-collection. The USA is the worst offender here: it is the largest, richest country in the world that has essentially no privacy protections. The last time the US updated its federal privacy law was in 1988, when the Video Privacy Protection Act banned the disclosure of your VHS rentals. Tech companies spy on you for the same reason your dog licks its balls – because they can, and no one stops them:

https://pluralistic.net/2026/03/10/ice-tech/#foreseeable-outcomes

Which raises an obvious question: why hasn't Congress updated privacy law? And why hasn't the EU figured out how to force the US companies that pretend to be Irish to obey European privacy law? The answer is that governments love private sector data-collection, because it gives them a cheap, off-the-books source of warrantless access to information they aren't legally allowed to acquire:

https://pluralistic.net/2021/04/13/public-interest-pharma/#axciom

From Flock cameras to ICE's use of Google data in its ethnic cleansing campaign, the US government and the commercial surveillance industry have created a public-private partnership from hell, where governments refuse to block commercial spying and companies hand their commercial surveillance data over to governments in return.

From there, it was a short leap to governments insisting that the private sector gather our data. That's the right way to think about age verification, chat control, and other mandates for corporations to spy on us using our devices and our accounts: a government requirement for private-sector mass surveillance.

I have plenty of hostility to corporate overreach, but to have any hope of fighting that overreach, we need governments to be on our side. But for our governments, it comes to cybersecurity, we are the enemy, and spying corporations are our governments' allies.

Sometimes, that's utterly, literally true. Governments around the world are addicted to buying spyware from cyber-arms dealers, mostly headquartered in Israel and the UAE (with the odd Italian and British company for variety). These arms-dealers practice NOBUS-by-proxy, wherein they discover or pay bounties for bugs in widely used hardware, operating systems and applications and – rather than reporting them to the manufacturer – hoard them and weaponize them, and then sell the weapons to criminals, corporations, and our governments, who give them billions of our money to ensure that our computers have huge, glaring defects in them that leave us terribly vulnerable:

https://citizenlab.ca/focus-area/targeted-surveillance/

In a world where our governments' national security apparatuses were genuinely committed to our safety and security, they would criminally prosecute these companies, not make their owners into billionaires.

This is the context we should all be thinking about when it comes to these "rogue AI hacking agents." The IT systems that these irresponsibly deployed software products have trashed were already terrifyingly vulnerable…by design. Rather than fix these systems, our governmental "security" agencies have spent the past 40 years making them less secure, in order to make it easier for them to catch "bad guys," who now find it trivial to attack us through systems we are all totally reliant upon.

In every way, in every area of law, governments fail to take our security seriously. That even includes copyright law. All over the world, the US Trade Representative has ensured that every country has an "anti-circumvention" law that makes it a crime to reverse-engineer and modify software without permission:

https://pluralistic.net/2026/01/01/39c3/#the-new-coalition

From the very start, these have been a security nightmare. Remember the "Sony Rootkit?" Between 2005-2007, Sony-BMG Music distributed over 6m CDs that were deliberately infected with a piece of malicious software called a "rootkit" that was used to disable your computer's ability to rip (copy) music CDs.

The way this rootkit did so was depraved in its indifference to the security of Sony-BMG's customers: at the same time as Sony-BMG's malware installed its secret anti-ripping program, it also altered their computers' operating systems to make them incapable of detecting any program or file whose name started with $SYS$. Immediately, malicious software authors started adding $SYS$ to the start of all their filenames, and that malicious software was therefore undetectable to millions of users' computers. It was even invisible to anti-virus software. Worse: Sony-BMG's rootkit infected 200,000-300,000 US government and military networks:

https://www.schneier.com/blog/archives/2005/11/sonys_drm_rootk.html

Even worse: after the scandal broke, security researchers all over the world came forward to say that they'd discovered the Sony Rootkit months before it became common knowledge, but their lawyers had told them they weren't allowed to disclose its existence because doing so would fall afoul of anti-circumvention law. For months, this official, deliberate malware epidemic spread in secret because of anti-circumvention law.

It's been more than 20 years since the Sony Rootkit, and anti-circumvention law is now worse than it was in the oughts: now it applies to far more devices from far more vendors. Today, it's common for corporations to threaten their own customers with civil and criminal liability if they have the temerity to hire outside auditors to evaluate the software they entrust their businesses to for security defects. And oh God, it's even worse, because the worst offender is Oracle, who are now the de facto IT czars of America:

https://arstechnica.com/information-technology/2015/08/oracle-security-chief-to-customers-stop-checking-our-code-for-vulnerabilities/

I'm not saying that these are the only problems with our IT security. What I am saying is that the hacking bots everyone's freaking out about didn't appear out of nowhere. If you have just a little object permanence, you can see that they are the terminal stage of a pathology that governments have only ever worsened: by hoarding and weaponizing vulnerabilities; by paying others to hoard and weaponize vulnerabilities; by criminalizing security audits; by insisting that every computer we rely on be equipped with deliberate vulnerabilities in software we can't inspect, terminate or delete.

Yeah, there should be criminal and civil liability for OpenAI, Amazon, Anthropic and every other company whose bots "went rogue" and attacked servers. But that will do nothing to fix our IT.

The table-stakes for a secure digital world are: public agencies that try to make our computers as secure as possible, including by administering the corporate death-penalty to any company that hoards and weaponizes information about bugs in our computer. We should protect and reward individuals and firms who come forward with true disclosures about bugs in systems we rely upon. We should not give companies the right to silence and punish those critics who want to warn us about their defective products. And we should not require that companies make us less secure in the name of making it easier for spies and cops to catch the bad guys.

(Image: Pmk58, CC BY-SA 4.0; Wikipedian Prolific, CC BY-SA 3.0; modified)

---

Hey look at this (permalink)

• Inside The Failed Fight To Unionize One Of Gaming’s Most Idealized Studios https://kotaku.com/inside-the-failed-fight-to-unionize-one-of-gamings-most-idealized-studios-2000742755

• How Trump Enforcers are Sabotaging Efforts to Bring Down Drug Prices https://www.thebignewsletter.com/p/how-pharma-middlemen-turned-the-federal

• How Porter, Newsom, and so many others are wrong about Proposition 40 https://48hills.org/2026/10/who-porter-newsom-and-so-many-others-are-wrong-about-proposition-40/

• Raspberry Pi puts digital handcuffs on RAM upgrades https://www.fsf.org/blogs/community/2026-raspberry-pi

• We Infiltrated a Police Union Convention in Las Vegas https://www.hamiltonnolan.com/p/we-infiltrated-a-police-union-convention

---

Object permanence (permalink)

#25yrsago CBS sitcom about couple who meet in the WTC rubble https://web.archive.org/web/20011014082646/http://dailynews.yahoo.com/h/eo/20011012/en/cbs_considers_wtc_comedy_1.html

#25yrsago Jon Norman not invited to Philcon https://www.locusmag.com/2001/Departments/Letters10Norman.html

#25yrsago Bruce Sterling's post-9/11 geopolitics predictions https://web.archive.org/web/20011102212150/https://www.edge.org/documents/whatnow/whatnow_sterling.html

#25yrsago Polaroid files Chapter 11 https://web.archive.org/web/20011107181428/http://www.polaroid.com/polinfo/press_releases/october01/101201a.html

#25yrsago David Mamet's tribute to Shel Silverstein https://www.nytimes.com/2001/10/14/theater/theater-a-beloved-friend-who-lived-life-the-chicago-way.html

#15yrago Great Big Beautiful Tomorrow: a chapbook in PM Press’s Outspoken Authors series https://craphound.com/category/gbbt/

#15yrsago Canadian government advice defines abortionists as terrorists https://www.jezebel.com/canadian-government-lists-abortionists-as-terrorists-u-5849963

#10yrsago Ikea Shanghai to elderly, lonely Chinese people: buy something or get out https://qz.com/806990/lonely-shanghai-seniors-now-have-to-buy-something-if-they-want-to-cruise-all-day-in-ikeas-cafeteria

#5yrsago Facebook shows mall ninja gear ads on insurrection articles https://pluralistic.net/2021/01/14/10-point-program/#monetizing

#5yrsago The Black Panther self-care method https://pluralistic.net/2021/01/14/10-point-program/#panthers

---

Upcoming appearances (permalink)

• Paris: Slow Tech Summit, Oct 15
  https://slowtechsummit.com/

• Vancouver: Read, Resist, Repair, Rejoice (Vancouver Writers Festival), Oct 19
  https://writersfest.bc.ca/festival-event-2026/01

• Victoria: Munro's Books, Oct 20
  https://www.munrobooks.com/events/6113620261020

• Vancouver: Life After AI (Vancouver Writers Festival), Oct 22
  https://writersfest.bc.ca/festival-event-2026/46

• Ottawa: Life After AI (Ottawa Writers Festival), Oct 24
  https://writersfestival.org/event/life-after-ai

• Vienna: TED AI, Oct 28-30
  https://tedai-vienna.ted.com/

• Kilkenny (Kilkenomics), Nov 6-8
  https://kilkenomics.com/

• Vancouver: Enshittification (Sid Williams Theatre Society), Nov 10
  https://www.sidwilliamstheatre.com/events/cory-doctorow-talks-enshittification/

• Vancouver: BC Policy Solutions Gala, Nov 12
  https://bcpolicy.ca/gala/

• Oxford: Ministry of the Future, Nov 23
  https://ministryforthefuture.co.uk/events.html

• Sheffield: Reverse Centaur at Juno Books, Nov 25
  https://www.outsavvy.com/event/40274/cory-doctorow-in-conversation

• Oxford: Bennett Oxford Symposium on Open Code in Science, Dec 9
  https://www.bennett.ox.ac.uk/events/2026-bennett-institute-symposium/

• Montreal: World Science Fiction Convention, Sep 2-6
  https://montreal2027.ca/en

---

Recent appearances (permalink)

• Terms of Service with Clare Duffy (CNN)
  https://www.cnn.com/audio/podcasts/terms-of-service-with-clare-duffy/episodes/458ce968-af5d-11f0-b539-13ed2afe25f8

• AI, Work, and Power (Software Engineering Daily)
  AI, Work, and Power https://softwareengineeringdaily.com/podcasts/cory-doctorow-on-ai-work-and-power/

• AI, Corporate Power, and the Fight for Worker Control (Plutopia)
  https://plutopia.io/cory-doctorow-ai-corporate-power-and-the-fight-for-worker-control/

• How to Think About AI—Before It’s Too Late (Daniel Solove)
  https://www.youtube.com/watch?v=_0xR3uEgGcc

• Could Tech Bosses Destroy Life As We Know It? (Politics JOE)
  https://www.youtube.com/watch?v=PL4VktU0SgY

---

Latest books (permalink)

• "The Reverse-Centaur's Guide to AI," a short book about being a better AI critic, Farrar, Straus and Giroux, June 2026
  https://us.macmillan.com/books/9780374621568/thereversecentaursguidetolifeafterai/

• "Canny Valley": A limited edition collection of the collages I create for Pluralistic, self-published, September 2025 https://pluralistic.net/2025/09/04/illustrious/#chairman-bruce

• "Enshittification: Why Everything Suddenly Got Worse and What to Do About It," Farrar, Straus, Giroux, October 7 2025
  https://us.macmillan.com/books/9780374619329/enshittification/

• "Picks and Shovels": a sequel to "Red Team Blues," about the heroic era of the PC, Tor Books (US), Head of Zeus (UK), February 2025 (https://us.macmillan.com/books/9781250865908/picksandshovels).

• "The Bezzle": a sequel to "Red Team Blues," about prison-tech and other grifts, Tor Books (US), Head of Zeus (UK), February 2024 (thebezzle.org).

• "The Lost Cause:" a solarpunk novel of hope in the climate emergency, Tor Books (US), Head of Zeus (UK), November 2023 (http://lost-cause.org).

• "The Internet Con": A nonfiction book about interoperability and Big Tech (Verso) September 2023 (http://seizethemeansofcomputation.org). Signed copies at Book Soup (https://www.booksoup.com/book/9781804291245).

• "Red Team Blues": "A grabby, compulsive thriller that will leave you knowing more about how the world works than you did before." Tor Books http://redteamblues.com.

• "Chokepoint Capitalism: How to Beat Big Tech, Tame Big Content, and Get Artists Paid, with Rebecca Giblin", on how to unrig the markets for creative labor, Beacon Press/Scribe 2022 https://chokepointcapitalism.com

---

Upcoming books (permalink)

• "The Post-American Internet," a geopolitical sequel of sorts to Enshittification, Farrar, Straus and Giroux, 2027

• "Unauthorized Bread": a middle-grades graphic novel adapted from my novella about refugees, toasters and DRM, FirstSecond, April 20, 2027

• "Enshittification, Why Everything Suddenly Got Worse and What to Do About It" (the graphic novel), Firstsecond, 2027

• "The Memex Method," Farrar, Straus, Giroux, 2027

---

Colophon (permalink)

Today's top sources:

Currently writing:

• “Once Is Enemy Action,” a science fiction novel about the origins of modern technofascism. Today's words: 574 (7730 total).

• "The Post-American Internet," a sequel to "Enshittification," about the better world the rest of us get to have now that Trump has torched America. Fourth draft completed. Submitted to editor.

• A Little Brother short story about DIY insulin PLANNING

---

This work – excluding any serialized fiction – is licensed under a Creative Commons Attribution 4.0 license. That means you can use it any way you like, including commercially, provided that you attribute it to me, Cory Doctorow, and include a link to pluralistic.net.

https://creativecommons.org/licenses/by/4.0/

Quotations and images are not included in this license; they are included either under a limitation or exception to copyright, or on the basis of a separate license. Please exercise caution.

---

How to get Pluralistic:

Blog (no ads, tracking, or data-collection):

Pluralistic.net

Newsletter (no ads, tracking, or data-collection):

https://pluralistic.net/plura-list

Mastodon (no ads, tracking, or data-collection):

https://mamot.fr/@pluralistic

Bluesky (no ads, possible tracking and data-collection):

https://bsky.app/profile/doctorow.pluralistic.net

Medium (no ads, paywalled):

https://doctorow.medium.com/

Tumblr (mass-scale, unrestricted, third-party surveillance and advertising):

https://mostlysignssomeportents.tumblr.com/tagged/pluralistic

"When life gives you SARS, you make sarsaparilla" -Joey "Accordion Guy" DeVilla

READ CAREFULLY: By reading this, you agree, on behalf of your employer, to release me from all obligations and waivers arising from any and all NON-NEGOTIATED agreements, licenses, terms-of-service, shrinkwrap, clickwrap, browsewrap, confidentiality, non-disclosure, non-compete and acceptable use policies ("BOGUS AGREEMENTS") that I have entered into with your employer, its partners, licensors, agents and assigns, in perpetuity, without prejudice to my ongoing rights and privileges. You further represent that you have the authority to release me from any BOGUS AGREEMENTS on behalf of your employer.

ISSN: 3066-764X

->->->->->->->->->->->->->->->->->->->->->->->->->->->->-> Top Sources: None -->

Today's links

• How labor rights rescued Ultima from a monopolist: If you care about labor justice and artists' rights, stop focusing on copyright.
• Hey look at this: Delights to delectate.
• Object permanence: China unblocks Wikipedia; CCC cracks the Bundestrojaner; "Children of the Sky"; "Messy"; Every top Icelandic banker is guilty; Climate activism x digital activism; Gene Kan on P2P's future; Larry Ellison x mass surveillance; W3C v patents; "Work from home" in the cybercrime supply-chain; "Nursery Rhyme Comics"; Glitchy tea-set; Tourist Guy; Vista v reinstallation; Ryanair v your bladder; Wells Fargo CEO loves "sales culture"; "Attention Merchants"; Orban v free press; AI v GIGO; Dylan wins the Nobel; India's starving kids app; Adobe's spyware copyfraud; Charter blackmails customers with bad credit threats; Fix UK housing.
• Upcoming appearances: Paris, Vancouver, Victoria, Ottawa, Kilkenny, Sheffield, Oxford, Montreal.
• Recent appearances: Where I've been.
• Latest books: You keep readin' em, I'll keep writin' 'em.
• Upcoming books: Like I said, I'll keep writin' 'em.
• Colophon: All the rest.

---

How labor rights rescued Ultima from a monopolist (permalink)

If you work in the media, you have doubtless had a lifetime of encouragement to treat copyright as your primary source of economic protection, and doubtless you've been told that this protection arises from the fact that copyright is a property right – specifically, it's a subspecies of "intellectual property":

https://locusmag.com/feature/cory-doctorow-ip/

Property rights are capitalism's holy sacrament, so of course, it's natural to treasure any property right you can lay claim to. But this is a trap. Creative workers aren't asset speculators, we're workers. When we bargain with a media company to sell them our copyright, we're just bargaining to sell our labor, not our property.

This is a distinction with a difference. Property rights are alienable. When you negotiate to sell your property to someone else, you propose to transfer the title to that property. If you sell your house, you don't get to move back in if you change your mind later. Sell your car, and you must not get in and drive it away.

Nominally, creative workers only bargain away some of their copyright, because copyright is also divisible. You can sell US English print rights to a novel, a one-month license to synch a song to an advertisement, or the right to display a painting for a year.

But here's the thing about property rights: the most reliable predictor of how many property rights you must give up in a sale isn't how many property rights you started with – it's how much bargaining power you have. For 50 years, governments have expanded copyright in every way, making it last longer, cover more works and restrict more uses, all backstopped by ever-steepening penalties. 50 years later, media companies – our bosses – are larger and more profitable than they've ever been, and we're poorer than we've ever been. The share of the money generated by our labor has declined, even as our rights over the product of that labor have expanded.

How to make sense of this? It's easy, once you factor in power. In a world of five publishers, four studios, three labels, two app companies and a single ebook/audiobook company, getting more copyright to bargain with just means getting more copyright to bargain away. When copyright's term expanded from "life plus 50 years" to "life plus 70 years," our bosses simply demanded the entirety of the new term, and didn't offer us a dime more.

This is the thesis of Chokepoint Capitalism, the book on Big Tech, Big Media, and creative labor markets Rebecca Giblin and I published in 2022:

https://www.beacon.org/Chokepoint-Capitalism-P2020.aspx

Chokepoint Capitalism is broken into two parts: the first half of the book is a series of pitiless, plain-language dissections of the baroque scams that media companies have used to make themselves richer from our work, from Spotify to Amazon to Livenation and beyond. From reader feedback, I can tell you that these chapters will make you very angry, because once you strip away all the deliberate obfuscation, all you're left with is one screw-job after another, each of which makes the creators you love poorer even as you pay more for their work.

But then there's the second half of the book. This section is devoted to "shovel-ready" policy solutions, each of which is designed to change the "distribution" of the spoils of the media industry, putting more money in workers' pockets at the expense of our bosses. None of these are things you can do as a "conscious consumer." The monopolistic destruction of creators' livelihoods is a systemic problem and you can't solve it by shopping better.

The point of these chapters is to lay out what we must demand from our policymakers when (inevitably), they propose to "solve" the problem of worsening straits for creative workers – and to help creative workers understand that when our bosses demand more copyright, that's not there to benefit us.

One of these systemic solutions is "termination of transfer," a simple and radical idea that has a proven track-record of making creative workers richer at our bosses' expense. Simply put, "termination of transfer" is the statutory right to void any contract you've signed to transfer your copyright to someone else. In the USA, the 1976 Copyright Act introduced a 35-year termination right. 35 years after you sign any copyright contract, you can file some paperwork with the US Copyright Office and get that copyright back, no matter what your contract says.

Now, most creative works don't have a commercial life after 35 years (very few works are commercially viable even after the original US copyright term of 14 years), but for those that do, termination of transfer is a reliable way to address the extremely common situation in which a creator signs away their rights for a low price, not knowing that it will become a lasting hit. Once you've scored that hit, you can probably get a better deal from your next work, but the deal for that hit is done and can't be altered.

Termination solves this. From The Babysitters Club to the early Stephen King novels to George Clinton's entire catalog, termination of transfer has put lots of money into creative workers' pockets at the expense of corporations that ripped them off at the start of their careers.

From the start, there was no question whether termination of transfer would make it into Chokepoint Capitalism. Rebecca is one of the world's leading experts on the subject, having co-authored the definitive study of termination:

https://pluralistic.net/2021/09/26/take-it-back/

In the book, we note that – unlike longer copyright terms – termination has a proven track record of putting groceries on creators' tables, braces on their kids' teeth, and a roof over their heads. We go over the legislative history of termination in the 1976 Act, noting that it was originally supposed to be automatic and kick in after just 20 years. If we want to make creative workers richer, changing the 35-year administrative right into an automatic 20-year termination right is a no-brainer amendment to copyright law.

How did an automatic right that kicked in after 20 years turn into a right you have to apply for after 35 years? Simple: our bosses hate termination. How much do they hate it? Well, take Mitch Glazier, the head of the Recording Industry Association of America, where he draws a $1.3m annual salary to represent the record labels.

Before Glazier got the RIAA gig, he was an obscure Congressional staffer, but he was forced out of the job after he snuck a clause into an otherwise unrelated bill that killed termination of transfer for recording artists. This was so outrageous that Congress actually convened a special session so they could rip out Glazier's amendment, and Glazier got a new job as a millionaire lobbyist for the recording industry:

https://pluralistic.net/2026/03/03/its-a-trap-2/#inheres-at-the-moment-of-fixation

Termination is hugely useful and quite radical. Last year saw Gary K Wolf, creator of the novel Who Censored Roger Rabbit? (later adapted by Disney as Who Framed Roger Rabbit?) claw back his rights to the book and its characters, in order to continue the series:

https://pluralistic.net/2025/11/18/im-not-bad/#im-just-drawn-that-way

In 2023, Bill Willingham terminated the transfer of his wildly successful graphic novel series Fables from DC and released the copyright into the public domain:

https://pluralistic.net/2023/09/15/fairy-use-tales/#sampling-license

And now, Richard Garriott, AKA "Lord British," has claimed back the rights to the groundbreaking Ultima series of computer role-playing games, which he sold to Electronic Arts in 1992:

https://www.videogameschronicle.com/news/richard-garriott-is-officially-regaining-control-of-the-ultima-series/

On the Techjess podcast, Garriott marveled at how easy the process was: "there’s a really weird United States copyright law that says if you are the original holder of a copyright and you assign it or sell it to any publisher or any other entity, after 35 years, you can just take it back":

https://www.youtube.com/watch?v=2El7VtPuSzs

EA killed off Ultima in 2000, and it has languished since, despite an ardent fandom. Garriott has vowed to reissue the old games and is mulling new ones.

All this brings me back to property rights. Property rights are uniquely unsuitable to this kind of arrangement. You don't get to move back into the house your parents sold 35 years ago, and if you did, the photographer who took the family portrait in the hallway wouldn't be allowed to break in and take it away 35 years after you sat for it.

Termination of transfer isn't an "IP right" – it's a labor right. It belongs to the large class of rights that are far more important and useful than mere property rights, such as privacy rights and human rights:

https://pluralistic.net/2026/09/28/cost-of-everything/#value-of-nothing

If copyright were just about property rights, then termination of transfer would be inconceivable. Termination is a vestigial labor right at the very periphery of copyright. It protects artists, and it can only do so because it is not a property right.

This is one of the themes in The Bezzle, my 2024 historical technothriller, starring my two-fisted forensic accountant hero Martin Hench who uses termination to help an artist claw back his rights from an unscrupulous former manager who forged his signature decades before (this plotline is based on the true story of Parliament/Funkadelic's George Clinton!):

https://craphound.com/bezzle/

If you signed away your rights 35 years ago and want to get them back, check out the Authors Alliance, a nonprofit whose advisory board I volunteer for. We produced a tool that automates all the hardest parts of terminating your transfers and getting your rights back:

https://www.authorsalliance.org/resources/termination-of-transfer/

Some of our most ardent fans are academics, whose publicly funded papers are published in journals dominated by a cartel of giant companies that do not pay the authors, nor the editors, nor the reviewers, but still claim all rights and charge the institutions that funded the research they publish tens of thousands of dollars per journal to access that research:

https://pluralistic.net/2024/08/16/the-public-sphere/#not-the-elsevier

But it's not just academics who have an interest in termination of transfer. It's video game authors, novelists, musicians – and maybe you, someday!

(Image: Reda Kerbouche, CC BY-SA 4.0; Thegreenj, CC BY-SA 3.0, modified)

---

Hey look at this (permalink)

• The 15 best Luddite horror films https://www.bloodinthemachine.com/p/the-15-best-luddite-horror-films

• Enshittification https://scrollart.org/artwork/enshittification/

• Mamdani’s “Richard Scarry Socialism” Can Make City Life Simple Again https://www.currentaffairs.org/news/mamdanis-richard-scarry-socialism-can-make-city-life-simple-again

• The people holding up the internet https://sheets.works/data-viz/holding-up-the-internet

• Workers behind Dungeons & Dragons vote to unionize https://www.avclub.com/dungeons-dragons-magic-the-gathering-union

---

Object permanence (permalink)

#25yrsago Tourist Guy https://web.archive.org/web/20011009234007/http://www.touristofdeath.com/

#25yrsago Gene Kan on Open Web Services https://web.archive.org/web/20011031234135/http://www.openp2p.com/pub/a/p2p/2001/08/02/openservices.html

#25yrsago Larry Ellison wants to spy on everyone https://web.archive.org/web/20011206002725/http://www.oracle.com/corporate/index.html?digitalid_comp.html

#25yrsago W3C ponders patents in web standards https://lists.w3.org/Archives/Public/www-patentpolicy-comment/2001Oct/1488.html

#25yrsago Adobe updates the ebook reader that Syklarov cracked https://web.archive.org/web/20011107145015/http://www.vnunet.com/News/1126057

#20yrsago Hungarian airport proposes “nonremovable” RFIDs for every passenger http://news.bbc.co.uk/2/hi/technology/6044310.stm

#20yrsago China unblocks Wikipedia, even though it won’t censor https://web.archive.org/web/20061016133232/http://www.editorandpublisher.com/eandp/departments/online/article_display.jsp?vnu_content_id=1003251388

#20yrsago Eudora going open source, to be based on Thunderbird https://web.archive.org/web/20061014163143/http://www.qualcomm.com/press/releases/2006/061011_project_collaboration_mozilla.html

#20yrsago Vista license only lets you reinstall your OS on new PCs twice https://web.archive.org/web/20061022161256/http://www.techweb.com/wire/software/193300234

#15yrsago Why handmade keys? https://makezine.com/article/maker-news/rebuilt-keys-jimmy-diresta/

#15yrsago Ryanair declares war on bodily fluids, vows to remove toilets https://www.the-independent.com/travel/news-and-advice/ryanair-unveils-its-latest-plan-to-save-money-remove-toilets-from-the-plane-2369232.html

#15yrsago Comic about the complexity and decline of copyright https://web.archive.org/web/20111014201558/http://www.mediademocracyfund.org/about/mdf-voices/appropriart-a-graphic-about-copyright-susie-cagle-co-produced-mdf-and-gia

#15yrsago Chaos Computer Club cracks Germany’s illegal government malware, a trojan that spies on your PC and lets anyone off the street hijack it https://www.ccc.de/en/updates/2011/staatstrojaner

#15yrsago Vernor Vinge’s Children of the Sky: bootstrapping high-tech civilization from hive-mind Machiavellis https://memex.craphound.com/2011/10/11/vernor-vinges-children-of-the-sky-bootstrapping-high-tech-civilization-from-hive-mind-machiavellis/

#15yrsago Facebook’s misleading “log out” button and the future of privacy legislation https://www.eff.org/deeplinks/2011/10/facebook’s-hotel-california-cross-site-tracking-and-potential-impact-digital-privacy

#15yrsago How online crooks use “work from home” patsies to launder goods and forward them offshore https://krebsonsecurity.com/2011/10/shady-reshipping-centers-exposed-part-i/

#15yrsago Nursery Rhyme Comics: Great comic illustrators do Mother Goose https://memex.craphound.com/2011/10/12/nursery-rhyme-comics-great-comic-illustrators-do-mother-goose/

#15yrsago 3D printed “glitchy” tea-set https://www.plummerfernandez.com/works/glitch-reality/

#10yrsago Meet the WWI women who pretended to be rocks for the war effort https://www.atlasobscura.com/articles/why-women-pretended-to-be-creepy-rocks-and-trees-in-nyc-parks-during-wwi

#10yrsago Bernie Sanders’ touching video endorsing his brother’s candidacy for David Cameron’s old Parliamentary seat https://www.youtube.com/watch?v=VAH8FJ3g49g

#10yrsago Messy: When automated anti-disaster systems make things worse, and what to do about it https://memex.craphound.com/2016/10/11/messy-when-automated-anti-disaster-systems-make-things-worse-and-what-to-do-about-it/

#10yrsago Icelandic Supreme Court: all nine top bankers are guilty of market manipulation https://icelandmonitor.mbl.is/news/politics_and_society/2016/10/06/iceland_finds_all_guilty_in_banker_market_abuse_cas/

#10yrsago When “reputation management” becomes perjury, forgery and fraud against America’s federal courts https://web.archive.org/web/20161011055317/https://www.washingtonpost.com/news/volokh-conspiracy/wp/2016/10/10/dozens-of-suspicious-court-cases-with-missing-defendants-aim-at-getting-web-pages-taken-down-or-deindexed/?utm_term=.379bd5b35a91

#10yrsago If you bail on Yahoo Mail, forget about having your email forwarded https://web.archive.org/web/20161012182945/https://hosted.ap.org/dynamic/stories/U/US_TEC_YAHOO_BREACH?SITE=AP&SECTION=HOME&TEMPLATE=DEFAULt

#10yrsago The clumsy, amateurish IoT botnet has now infected devices in virtually all of the world’s countries https://web.archive.org/web/20161012150926/https://motherboard.vice.com/read/internet-of-things-mirai-malware-reached-almost-all-countries-on-earth

#10yrsago Wells Fargo whistleblower: once I complained, they started denying me bathroom breaks https://web.archive.org/web/20161014180455/https://money.cnn.com/2016/10/11/investing/wells-fargo-intimidation-bathroom-breaks/index.html

#10yrsago The astounding story of Iceland’s constitution – and its government’s failure https://www.youtube.com/watch?v=C1qk-BQwNlA

#10yrsago Wells Fargo’s new CEO previously denied that the bank’s sales culture had any problems https://web.archive.org/web/20161014023238/https://consumerist.com/2016/10/13/new-wells-fargo-ceo-recently-denied-overbearing-sales-culture-that-created-fake-account-fiasco/

#10yrsago The Attention Merchants: a deep dive into the origins of the surveillance economy https://memex.craphound.com/2016/10/13/the-attention-merchants-a-deep-dive-into-the-origins-of-the-surveillance-economy/

#10yrsago AI’s blind spot: garbage in, garbage out https://web.archive.org/web/20190429032014/https://www.nature.com/news/there-is-a-blind-spot-in-ai-research-1.20805

#10yrsago Hungary’s Prime Minister shuts down opposition press, then goes after everyone else https://www.theguardian.com/commentisfree/2016/oct/13/hungary-future-europe-far-right-viktor-orban

#10yrsago Using the science of group conflict to understand Trump’s campaign https://thesocietypages.org/socimages/2016/10/12/trumps-brilliant-manipulation-of-the-science-of-group-conflict/

#10yrsago Bob Dylan is the first songwriter to win the Nobel Prize for literature https://www.csmonitor.com/Arts-Culture/Books/2016/1013/Bob-Dylan-lyrics-as-literature-First-songwriter-to-win-a-Nobel-Prize

#10yrsago Poland’s outrageous abortion law is back https://globalvoices.org/2016/10/13/new-abortion-ban-proposals-in-poland-mean-the-black-protest-movement-isnt-over-yet/

#10yrsago Hate crimes spike after Brexit https://www.bbc.com/news/uk-politics-37640982

#5yrsago India funded a starving kids' app, but not food https://pluralistic.net/2021/10/13/theres-an-app-for-that/#solutionism

#5yrsago Adobe uses copyfraud to preserve spyware https://pluralistic.net/2021/10/13/theres-an-app-for-that/#gnash

#5yrsago Charter uses bad credit threats to corral ex-subscribers https://pluralistic.net/2021/10/13/theres-an-app-for-that/#thugs-charter

#1yrago The curious, intertwined history of climate and digital rights activism https://pluralistic.net/2025/10/11/cyber-rights-now/#better-late-than-never

#1yrago How to fix the UK housing crisis https://pluralistic.net/2025/10/13/castles-not-assets/#steve-keen

---

Upcoming appearances (permalink)

• Paris: Slow Tech Summit, Oct 15
  https://slowtechsummit.com/

• Vancouver: Read, Resist, Repair, Rejoice (Vancouver Writers Festival), Oct 19
  https://writersfest.bc.ca/festival-event-2026/01

• Victoria: Munro's Books, Oct 20
  https://www.munrobooks.com/events/6113620261020

• Vancouver: Life After AI (Vancouver Writers Festival), Oct 22
  https://writersfest.bc.ca/festival-event-2026/46

• Ottawa: Life After AI (Ottawa Writers Festival), Oct 24
  https://writersfestival.org/event/life-after-ai

• Kilkenny (Kilkenomics), Nov 6-8
  https://kilkenomics.com/

• Vancouver: Enshittification (Sid Williams Theatre Society), Nov 10
  https://www.sidwilliamstheatre.com/events/cory-doctorow-talks-enshittification/

• Vancouver: BC Policy Solutions Gala, Nov 12
  https://bcpolicy.ca/gala/

• Sheffield: Reverse Centaur at Juno Books, Nov 25
  https://www.outsavvy.com/event/40274/cory-doctorow-in-conversation

• Oxford: Bennett Oxford Symposium on Open Code in Science, Dec 9
  https://www.bennett.ox.ac.uk/events/2026-bennett-institute-symposium/

• Montreal: World Science Fiction Convention, Sep 2-6
  https://montreal2027.ca/en

---

Recent appearances (permalink)

• Terms of Service with Clare Duffy (CNN)
  https://www.cnn.com/audio/podcasts/terms-of-service-with-clare-duffy/episodes/458ce968-af5d-11f0-b539-13ed2afe25f8

• AI, Work, and Power (Software Engineering Daily)
  AI, Work, and Power https://softwareengineeringdaily.com/podcasts/cory-doctorow-on-ai-work-and-power/

• AI, Corporate Power, and the Fight for Worker Control (Plutopia)
  https://plutopia.io/cory-doctorow-ai-corporate-power-and-the-fight-for-worker-control/

• How to Think About AI—Before It’s Too Late (Daniel Solove)
  https://www.youtube.com/watch?v=_0xR3uEgGcc

• Could Tech Bosses Destroy Life As We Know It? (Politics JOE)
  https://www.youtube.com/watch?v=PL4VktU0SgY

---

Latest books (permalink)

• "The Reverse-Centaur's Guide to AI," a short book about being a better AI critic, Farrar, Straus and Giroux, June 2026
  https://us.macmillan.com/books/9780374621568/thereversecentaursguidetolifeafterai/

• "Canny Valley": A limited edition collection of the collages I create for Pluralistic, self-published, September 2025 https://pluralistic.net/2025/09/04/illustrious/#chairman-bruce

• "Enshittification: Why Everything Suddenly Got Worse and What to Do About It," Farrar, Straus, Giroux, October 7 2025
  https://us.macmillan.com/books/9780374619329/enshittification/

• "Picks and Shovels": a sequel to "Red Team Blues," about the heroic era of the PC, Tor Books (US), Head of Zeus (UK), February 2025 (https://us.macmillan.com/books/9781250865908/picksandshovels).

• "The Bezzle": a sequel to "Red Team Blues," about prison-tech and other grifts, Tor Books (US), Head of Zeus (UK), February 2024 (thebezzle.org).

• "The Lost Cause:" a solarpunk novel of hope in the climate emergency, Tor Books (US), Head of Zeus (UK), November 2023 (http://lost-cause.org).

• "The Internet Con": A nonfiction book about interoperability and Big Tech (Verso) September 2023 (http://seizethemeansofcomputation.org). Signed copies at Book Soup (https://www.booksoup.com/book/9781804291245).

• "Red Team Blues": "A grabby, compulsive thriller that will leave you knowing more about how the world works than you did before." Tor Books http://redteamblues.com.

• "Chokepoint Capitalism: How to Beat Big Tech, Tame Big Content, and Get Artists Paid, with Rebecca Giblin", on how to unrig the markets for creative labor, Beacon Press/Scribe 2022 https://chokepointcapitalism.com

---

Upcoming books (permalink)

• "The Post-American Internet," a geopolitical sequel of sorts to Enshittification, Farrar, Straus and Giroux, 2027

• "Unauthorized Bread": a middle-grades graphic novel adapted from my novella about refugees, toasters and DRM, FirstSecond, April 20, 2027

• "Enshittification, Why Everything Suddenly Got Worse and What to Do About It" (the graphic novel), Firstsecond, 2027

• "The Memex Method," Farrar, Straus, Giroux, 2027

---

Colophon (permalink)

Today's top sources:

Currently writing:

• “Once Is Enemy Action,” a science fiction novel about the origins of modern technofascism. Today's words: 562 (24528 total).

• "The Post-American Internet," a sequel to "Enshittification," about the better world the rest of us get to have now that Trump has torched America. Fourth draft completed. Submitted to editor.

• A Little Brother short story about DIY insulin PLANNING

---

This work – excluding any serialized fiction – is licensed under a Creative Commons Attribution 4.0 license. That means you can use it any way you like, including commercially, provided that you attribute it to me, Cory Doctorow, and include a link to pluralistic.net.

https://creativecommons.org/licenses/by/4.0/

Quotations and images are not included in this license; they are included either under a limitation or exception to copyright, or on the basis of a separate license. Please exercise caution.

---

How to get Pluralistic:

Blog (no ads, tracking, or data-collection):

Pluralistic.net

Newsletter (no ads, tracking, or data-collection):

https://pluralistic.net/plura-list

Mastodon (no ads, tracking, or data-collection):

https://mamot.fr/@pluralistic

Bluesky (no ads, possible tracking and data-collection):

https://bsky.app/profile/doctorow.pluralistic.net

Medium (no ads, paywalled):

https://doctorow.medium.com/

Tumblr (mass-scale, unrestricted, third-party surveillance and advertising):

https://mostlysignssomeportents.tumblr.com/tagged/pluralistic

"When life gives you SARS, you make sarsaparilla" -Joey "Accordion Guy" DeVilla

READ CAREFULLY: By reading this, you agree, on behalf of your employer, to release me from all obligations and waivers arising from any and all NON-NEGOTIATED agreements, licenses, terms-of-service, shrinkwrap, clickwrap, browsewrap, confidentiality, non-disclosure, non-compete and acceptable use policies ("BOGUS AGREEMENTS") that I have entered into with your employer, its partners, licensors, agents and assigns, in perpetuity, without prejudice to my ongoing rights and privileges. You further represent that you have the authority to release me from any BOGUS AGREEMENTS on behalf of your employer.

ISSN: 3066-764X