Image: EFF designer Hugh D'Andrade's "NSA eagle," which reworks the NSA seal into an eagle plugging its talons into the nation's telecom lines. From EFF's NSA spying work, licensed under CC BY 4.010.
This post is an anoni.net reading based on the EFF Deeplinks article:
At midnight on 12 June 2026, Section 702 of the Foreign Intelligence Surveillance Act lapsed1. EFF, which spent years arguing the program should require a warrant before the FBI reaches Americans' communications — or else expire — calls the lapse a victory1.
It is a real victory, and a narrow one. Section 702 was always built to collect the communications of non-US persons located abroad. That means everyone outside America — including readers in Taiwan, Hong Kong, mainland China, Macau, Singapore, and Malaysia — has always been a lawful target of this authority. The fight that just lapsed it was overwhelmingly a fight about protecting Americans. For the rest of us, the lapse changes much less than the headline suggests.
Image: a smartphone wrapped in a chain and padlock, standing in for a device locked down by outside rules. Photo by Towfiqu barbhuiya, via Pexels (Pexels License).
You paid for the phone, but what it can run and what it can install is increasingly not yours to decide. That question stays invisible until an app refuses to open because it "detected a non-stock OS," or an open-source OS you rely on gets harder to maintain because the hardware data behind it stops being public. Android 17 landed on 2026-06-16, and it pushed that question one step further.
For privacy-minded users, the OS in the middle of this is GrapheneOS: a hardened, de-Googled Android built on AOSP. It runs almost exclusively on Google Pixel hardware, and Google has spent the past year adjusting how open Android and the Pixel actually are.
This reads like a US/EU story about Google and Brussels, but it is close to home for readers across East and Southeast Asia and the Chinese-speaking world. Android 17's new sideloading "developer verification" flow is rolling out first in Brazil, Indonesia, Singapore and Thailand in 2026, expanding from there. Banking, payment and government apps across the region increasingly check whether a device is in "stock" state, and in mainland China that posture — device attestation plus real-name requirements — is already the norm. The losers are the same everywhere: people who want a phone they actually control.
We build on OONI's public dataset. Our own work tracks how well Taiwan and the wider APAC region are actually observed in that data, and our Run v2 census mapped how the whole Run v2 ecosystem gets used. So when OONI published a long engineering post on [how it detects and mitigates faulty measurements]1 — alongside a new anonymous-credential system now rolling into production — we read it not as OONI insiders but as people downstream who use this data to make claims about a thinly-observed part of the world.
Before a trip you check visas, plug types, and currency. Few people check how the internet is controlled where they are going, whether their work is legal there, or who to call if something goes wrong. For journalists, human-rights defenders, NGO staff, and researchers, those are the questions that actually affect their safety, and the hard part is that you usually don't know what to ask before you leave.
On 9 May 2017, the cross-border electronic payment service PayPal closed all domestic transaction functions in Taiwan. Two PayPal Taiwan accounts could no longer send money to each other. Cross-border transfers kept working. The streamer economy took the worst hit. Twitch Cheer, YouTube Super Chat, StreamLabs, and NightDev — tools that processed local audience tips through PayPal — went dark on the same day. Small organizations and independent media that relied on PayPal for domestic flows lost a payment rail overnight8.
The legal trigger was Article 3, Paragraph 1 of Taiwan's Electronic Payment Institution Management Act, passed in 2015. PayPal chose not to apply for a license and closed domestic functions instead9. Nearly nine years later, the U.S. online payment processor Stripe still does not allow individuals or companies in Taiwan to register. Stripe is the credit card collection layer behind Substack, many subscription SaaS products, and many open source sponsorship pages. Individual creators in Taiwan have to first register a U.S. LLC to use it10.
In Taiwan's payment conversation, these two facts have usually been filed under "compliance trade-offs" or "market size." EFF's former Activism Director Rainey Reitman, in her April 2026 book Transaction Denied12, compiles cases from 2012 onward across the U.S. and the Middle East. Stacked together, the cases reveal a cross-region, cross-issue pattern that's been running for more than a decade. Taiwan's two events belong in that record. So do parallel events from Hong Kong, mainland China, Macau, Singapore, and Malaysia, which Reitman's book — focused on U.S. and Middle Eastern material — does not yet cover.
Can you collect data from a large group of people while still protecting each individual's privacy? Differential privacy answers yes — with a mathematical proof to back it up. This article introduces the concept, traces its history from early anonymization failures to real-world deployments, and explores what it means for users and policymakers in Taiwan and the broader Chinese-speaking world.
