Nathaniel Rich, author of the novel “Cloudthief”, in a non-fiction retelling for New York Times Magazine of a 2007 heist of a London data centre by Terry Ellis and others:

The fixer — Ellis called him Ray and won’t reveal his name — met him in North London near Hampstead Heath for coffee and cakes. When it came time to discuss business, to avoid being overheard, they strolled into the park.

Ray had brought Ellis a few jobs before. But this job, he warned, was of an entirely different order. As Ellis claims in “The Art of Robbery,” a self-published memoir written after his release from prison, he eventually learned that Ray had been contacted by a consultant employed by “some influential bankers from America.” The bankers “were involved in prime mortgages” and had “circumnavigated” certain regulations. Damning evidence of these circumnavigations could be found in banking files held in the King’s Cross area in a giant building known as a data center.

This is a dramatic story, and one I think should be read with a heavy dose of skepticism. It seems that most of the criminal details have been shared by Ellis. For a start, the claim that some bankers ostensibly contracted with “Ray” is just a little too perfect for a recession-era tale. These bankers are pretty much universally loathed, and this justification makes this theft seem more palatable than a simple financial motive. For example, there was a similar data centre theft in October 2006, which would be unrelated to the lending crisis in the following years.

Another problem is that Rich says crimes like these are covered-up in part by a data centre operator because they are loathe to “admit to flaws in its security, [which] would only encourage additional attacks and scare away its clients”. Therefore, the lack of evidence for the specific circumstances of this crime is supposed to be a buttress for its likelihood, not a weakness, which is not reassuring.

The story of the theft was, as far as I can tell, broken by Here is the City, then a gossipy financial news site:

The data center itself is thought to be used by a number of companies, including JPMorgan, which is believed to have told staff that some of its systems could be off-line for parts of the day today as a result of the theft. Fortunately the thieves are thought to have got away with just the computer hardware, and not any sensitive information which may also have been stored at the facility.

Tom Espiner, of ZDNet, a few days later:

Reports circulating on the Internet last week that JPMorgan, a customer of Verizon Business, had been affected by the burglary were incorrect, according to a source at the investment bank. There has been no loss of service or data, said the source.

On the one hand, of course all these parties tried to cover this up. The reading-between-the-lines story implied by these early reports and Rich’s telling is that some banking higher-ups, perhaps from JPMorgan, wanted to cover up some crimes, and denying any meaningful effect is just more cover-up. But little of this is substantiated by contemporary or current reporting — which is, of course, the whole problem with using a lack of evidence as the foundation for a story.

Rich, in the Times:

“The banks knew they were sending mortgages to people who couldn’t pay back,” he says today. “That’s what broke the whole system. That was the big con.” Ellis remains convinced that the bankers who paid for the Verizon job wanted to destroy evidence of their involvement in fraudulent subprime mortgages — the inside information that Ellis received about the data center, he believes, “would have had to come from the top” — but he can’t prove it. He never saw what was on the servers.

“Our job was to get the motherboards,” he says. “We were paid quite handsomely. Whatever happened after that was none of our concern.”

In contemporaneous reports, the Metropolitan Police noted the theft of motherboards and processors. But if these bankers wanted to cover up their fraudulent practices, surely the hard drives would have been the target, right? In Rich’s version, entire servers were taken, so perhaps this is just a misunderstanding.

This story smells fishy. I believe the theft happened, of course, and Ellis’ involvement, but I am not as convinced this had anything to do with covering up some white collar crime. (By the way, the Guardian in 2018 published an interview with Ellis about the interesting prison where he was transferred and which led to his rehabilitation.)

The heist element is only about half of Rich’s story; much of it is a discussion about data centre secrecy:

The public fogginess about data centers is not an accident. It is the product of a willful strategy by the world’s largest tech corporations, whose business models rest on the public assumption that the internet, and all the data it holds, is as immaterial as air — or as a cloud, to borrow the metaphor commonly used to describe the sum of information stored on servers. As the digital-media scholar Tung-Hui Hu writes in “A Prehistory of the Cloud,” the cloud “hides its physical location by design.”

[…]

It was a lot easier to defend data when people didn’t know it existed. The more people learn about data centers, the more they hate them. […]

If you read a website like this one, you were probably aware that data centres were commonplace twenty or more years ago. Like the one near King’s Cross, some were hidden in plain sight, while others were purpose-built facilities that look like hangars stuffed with servers. But the A.I. boom has meant rapid increases in the speed, scale, and quantity of data centres. People quickly learned not only of their existence, but how much pressure they put on local resources. Tech companies, it seemed, were caught by surprise; and as someone who spends a lot of time immersed in this world, so was I.

Much of the consternation I have seen in more general audiences has been about data centres in general. People simply were not aware that Amazon has warehouses full of products, and other warehouses full of computers. As Rich writes, this is deliberate, for business secrecy reasons, security, and environmental costs. But, also, I think some of that unawareness is because of just how boring it is. If nobody wants to know hidden information, is it really a secret? It only became one when the information these companies were hiding had real-life effects.

It does seem that public awareness is putting pressure on corporations to improve data centres and make them more efficient. But that is not a standard. New data centres are powered by petroleum with a pinky promise of renewable offsets. In some regressive regions, like Alberta, new power plants for data centres must be powered by methane gas. In a further complication, Meta’s proposed data centre is scheduled to be completed before the power plant is ready, meaning it will be dependent on existing grid power for perhaps years. Meta’s is just one of the data centres proposed for Alberta. Another one, a gigawatt cluster, would also require a dedicated gas-fired power plant, while Kevin O’Leary’s questionable project is supposed to require over three times the combined power of those other two.

For years, the tech industry told us we did not need to have much concern for how digital products and services worked, and many of us did not bother to find out. But it turns out the demands of our email and Netflix subscription were comparatively easy to hide. At the very least, what we ought to demand from projects with the scale and ambition of these data centres is open disclosure of their power consumption, water use, and emissions.

But we ought to demand more than the bare minimum. Transparency does as much good as a big banner reading we are destroying the planet but we are also creating a lot of value for shareholders. When a single data centre is projected to use about as much power as the entire city of Calgary is currently — Enmax says 1,260 megawatts as of writing — we should have a say in whether that makes sense. A.I. remains a thing that is happening to us rather than with or for us. It is built on assuming consent and asking forgiveness, which has more-or-less worked for the industry and gave it way too much confidence. Tech companies could have spent decades being better corporate citizens. Data centres are just one part, but they are representative of the difference between the stories told by tech companies and the things we can actually know.

The Office of the Privacy Commissioner of Canada:

An investigation by the Privacy Commissioner of Canada has found that Grok’s AI image-generation tool was launched without proper safeguards or sufficient consideration of potential privacy harms.

This lack of protections allowed users around the globe to create and share non-consensual, sexualized deepfakes, many targeting women and children.

In a report released today, Commissioner Philippe Dufresne found that X Corp. and xAI violated Canada’s federal private-sector privacy law.

According to the full report, while a privacy impact assessment was completed of the previous version of Grok’s image generation model, one was not done for Grok Imagine until March, well after its July 2025 launch. Even then, the assessment “did not accurately reflect […] risks to security, safety and privacy”.

Grok is now owned by SpaceX, which is going public tomorrow in extraordinary fashion. It is still generating abusive imagery.

⌥ Permalink

Andrew Kenney, Denverite:

It was Sgt. Jamie Milliman [at the door], a police officer with the Columbine Valley Police Department who covers the town of Bow Mar, which begins just south of [Chrisanna] Elser’s home.

[…]

“You know we have cameras in that jurisdiction and you can’t get a breath of fresh air, in or out of that place, without us knowing, correct?” he said.

“OK?” Elser, a financial planner in her 40s, responded in a video captured by her smart doorbell and viewed by Denverite.

“Just as an example,” the sergeant told her, she had “driven through 20 times the last month.”

This story is a civil liberties rollercoaster. Milliman was relying on a nearby town’s use of Flock license plate cameras and Ring doorbells — which may also be connected to the Flock network — to accuse Elser of theft and issue a summons. Elser was able to get the summons dropped by compiling evidence from, in part, the cameras and GPS system on her truck. Milliman’s threats were recorded by a doorbell camera, too. The whole thing is creepy, and all over a $25 package stolen off a doorstep.

I have also had things stolen from me, and I wish the police officers I spoke to had a better answer for me than shrugging their shoulders and saying, in effect, this is not worth our time. But this situation is like a parallel universe ad for Amazon and its Ring subsidiary. Is this the path toward “very close to zero[ing] out crime”? It is not worth it.

⌥ Permalink

Jennifer Pattison Tuohy, of the Verge, interviewed Ring founder Jamie Siminoff about a new book — which Tuohy has not read — written with Andrew Postman about the success of the company. During this conversation, Tuohy stumbled into Siminoff making a pretty outrageous claim:

While research suggests that today’s video doorbells do little to prevent crime, Siminoff believes that with enough cameras and with AI, Ring could eliminate most of it. Not all crime — “you’ll never stop crime a hundred percent … there’s crimes that are impossible to stop,” he concedes — but close.

“I think that in most normal, average neighborhoods, with the right amount of technology — not too crazy — and with AI, that we can get very close to zero out crime. Get much closer to the mission than I ever thought,” he says. “By the way, I don’t think it’s 10 years away. That’s in 12 to 24 months … maybe even within a year.”

If this sounds ridiculous to you, congratulations, you are thinking harder than whomever wrote the headline on this article:

Ring’s CEO says his cameras can almost ‘zero out crime’ within the next 12 months

The word “almost” and the phrase “very close” are working very hard to keep the core of Siminoff’s claim intact. What he says is that, by this time next year, “normal” communities with enough Ring cameras and a magic dusting of A.I. will have virtually no crime. The caveats are there to imply more nuance, but they are merely an escape hatch for when someone revisits this next year.

The near-complete elimination of crime in “normal” areas — whatever that means — will very obviously not happen. Tuohy cites a 2023 Scientific American story which, in turn, points to articles in MIT Technology Review and CNet. The first debunks a study Ring likes to promote claiming its devices drove a 55% decline in burglaries in Wilshire Park, Los Angeles in 2015, with cameras on about forty homes. Not only does the public data does not support this dramatic reduction, but:

Even if the doorbells had a positive effect, it seemed not to last. In 2017, Wilshire Park suffered more burglaries than in any of the previous seven years.

The CNet article collects a series of reports from other police departments indicating Ring cameras have questionable efficacy at deterring crime on a city-wide level.

This is also something we can know instinctually, since we already have plenty of surveillance cameras. A 2019 meta analysis (PDF) by Eric Piza, et al., found CCTV adoption decreased crime by about 13%. That is not nothing, but it is also a long way from nearly 100%. One could counter that these tests did not factor in Ring’s A.I. features, like summaries of what the camera saw — we have spent so much energy creating summary-making machines — and finding lost dogs.

The counterargument to all of this, however, is that Ring’s vision is a police state enforced by private enterprise. A 2022 paper (PDF) by Dan Calacci, et al., found race was, unsurprisingly, a motivating factor in reports of suspicious behaviour, and that reports within Ring’s Neighbors app was not correlated with the actual frequency of those crimes. Ring recently partnered with Flock, adding a further layer of creepiness.

I will allow that perhaps an article about Siminoff’s book is not the correct place to litigate these claims. By the very same logic, however, the Verge should be more cautious in publishing them, and should not have promoted them in a headline.

⌥ Permalink

Robert Graham, clarifying the bad reporting of the big SIM farm bust in New York:

The Secret Service is lying to the press. They know it’s just a normal criminal SIM farm and are hyping it into some sort of national security or espionage threat. We know this because they are using the correct technical terms that demonstrate their understanding of typical SIM farm crimes. The claim that they will likely find other such SIM farms in other cities likewise shows they understand this is a normal criminal activity and not any special national security threat.

One of the things we must always keep in mind is that press releases are written to persuade. That is as true for businesses as it is for various government agencies. In this case, the Secret Service wanted attention, so they exaggerated the threat. And one wonders why public trust in institutions is falling.

⌥ Permalink

The U.S. Secret Service:

The U.S. Secret Service dismantled a network of electronic devices located throughout the New York tristate area that were used to conduct multiple telecommunications-related threats directed towards senior U.S. government officials, which represented an imminent threat to the agency’s protective operations.

This protective intelligence investigation led to the discovery of more than 300 co-located SIM servers and 100,000 SIM cards across multiple sites.

That sure is a lot of SIM cards, and a scary-sounding mix of words in the press release:

• “[…] telecommunications-related threats directed towards senior U.S. government officials […]”

• “[…] these devices could be used to conduct a wide range of telecommunications attacks […]”

• “These devices were concentrated within 35 miles of the global meeting of the United Nations General Assembly […]”

Reporters pounced. The New York Times, NBC News, CBS News, and even security publications like the Record seized on dramatic statements like those, and another said by the special agent in a video the Service released: “this network had the potential to […] essentially shut down the cellular network in New York City”. Scary stuff.

When I read the early reports, it sure looked to me like some reporters were getting a little over their skis.

For a start, emphasizing the apparent proximity to the U.N. in New York seems to me like a stretch. A thirty-five mile area around the U.N. looks like this — and that is diameter, not radius. If you cannot see that or this third-party website goes away at some point, that is a circle encompassing just about the entire island of Manhattan, going deep into Brooklyn and Queens, stretching all the way up to Chappaqua, and out into Connecticut and New Jersey. That is a massive area. One could just as easily say it was within thirty-five miles of any number of New York-based landmarks and be just as accurate.

Second, the ability to “facilitat[e] anonymous, encrypted communication between potential threat actors and criminal enterprises” is common to basically any internet-connected device. The scale of this one is notable, but you do not need a hundred-thousand SIM cards to make criminal plans. And the apparent possibility of “shut[ting] down the cellular network in New York” is similarly common to any large-scale installation. This is undeniably peculiar, huge, and it seems to be nefarious, but a lot of this seems to be a red herring.

Andy Greenberg, Lily Hay Newman, and Matt Burgess, Wired:

Despite speculation in some reporting about SIM farm operation that suggests it was created by a foreign state such as Russia or China and used for espionage, it’s far more likely that the operation’s central focus was scams and other profit-motivated forms of cybercrime, says Ben Coon, who leads intelligence at the cybersecurity firm Unit 221b and has carried out multiple investigations into SIM farms. “The disruption of cell services is possible, flooding the network to the degree that it couldn’t take any more traffic,” Coon says. “My gut is telling me there was some type of fraud involved here.”

These reporters point to a CNN article by John Miller and Celina Tebor elaborating on the threat to “senior U.S. government officials”: they were swatting calls targeting various lawmakers. Not nothing and certainly dangerous, but this is not looking anything like how many reporters have described it, nor what the U.S. Secret Service is suggesting through its word choices.

⌥ Permalink

Kurt Wagner and Katie Roof, Bloomberg:

Elon Musk said his xAI artificial intelligence startup has acquired the X platform, which he also controls, at a valuation of $33 billion, marking a surprise twist for the social network formerly known as Twitter.

This feels like it has to be part of some kind of financial crime, right? Like, I am sure it is not; I am sure this is just a normal thing businesses do that only feels criminal, like how they move money around the world to avoid taxes.

Wagner and Roof:

The deal gives the new combined entity, called XAI Holdings, a value of more than $100 billion, not including the debt, according to a person familiar with the arrangement, who asked not to be identified because the terms weren’t public. Morgan Stanley was the sole banker on the deal, representing both sides, other people said.

For perspective, that is around about the current value of Lockheed Martin, Rio Tinto — one of the world’s largest mining businesses — and Starbucks. All of those companies make real products with real demand — unfortunately so, in the case of the first. xAI has exactly one external customer today. And it is not like unpleasant social media seems to be a booming business.

Kate Conger and Lauren Hirsch, New York Times:

This month, X continued to struggle to hit its revenue targets, according to an internal email seen by The New York Times. As of March 3, X had served $91 million of ads this year, the message said, well below its first-quarter target of $153 million.

This is including the spending of several large advertisers. For comparison, in the same quarter in the pre-Musk era, Twitter generated over a billion dollars in advertising revenue.

I am begging for Matt Levine to explain this to me.

⌥ Permalink

Enron is not really back. Someone managed to grab the Enron.com URL and put up an inspirational faux corporate video and a Shopify merch store. It is all very funny.

What is more amusing to me is stumbling across a preserved-in-amber Enron website. There is an earnings press release from July 2001, mere months before the whole thing went to hell in public. There are descriptions of the company’s vast products.

But this, too, is unofficial. It was created by Facundo Pignanelli to preserve this noteworthy chapter in corporate fraud. There is even an Instagram account. This is all very strange.

⌥ Permalink

I am not much of a true crime podcast listener, but the first three episodes of “Kill List” — Overcast link — have transfixed me.

Jamie Bartlett:

Besa Mafia was a dark net site offering hitmen for hire. It worked something like this: a user could connect to the site using the Tor browser and request a hit. They’d send over some bitcoin (prices started from $5,000 USD for ‘death by shotgun’). Then they’d upload the name, address, photographs, of who they wanted killed. Plus any extra requests: make it look like a bungled robbery; need it done next week, etc. The website owner, a mysterious Romanian called ‘Yura’ would then connect them with a specialist hitman to carry out the commission.

[…]

In the end, Carl investigated one hundred and seventy five kill requests. Each one a wannabe murderer. Each one a potential victim — who Carl often phones and break the crazy news. “The hardest calls I’ve ever made” Carl tells me. “How do you explain that someone wants you dead?!” (Carl would be indirect, gentle. He tried to make sure the victim felt in control. But often they hung up. “They didn’t believe me. They thought I was a scammer”).

I am not sure I agree with Bartlett’s conclusion — “more and more complex crimes will be solved by podcast journalists” is only true to the extent any crime is “solved” by any journalist — but it does appear this particular podcast has had quite the impact already. What a fascinating and dark story this is.

⌥ Permalink