Weekly Privacy Insights: February 9, 2026 – February 16, 2026

Weekly Privacy Insights

A week dominated by the collision of AI threats, surveillance overreach, and biometric privacy battles. The “promptware kill chain” introduces a formal framework for a new class of AI-targeted attacks, while government agencies and tech companies continue expanding surveillance infrastructure under the guise of safety. Meanwhile, the EU pushes back on attempts to weaken GDPR, and I2P survives its worst attack in history.

Weekly Analysis / My Opinion

The promptware kill chain paper from Schneier deserves serious attention. We’ve been talking about prompt injection as a vulnerability for years, but this seven-step framework — from initial access through persistence and exfiltration — treats it with the same rigor as traditional malware attack chains. That’s the right approach. If your organization uses LLMs that retrieve external content, you now have a structured threat model to work from.

On the surveillance front, the pattern is consistent and escalating. Vendors and federal agencies are funneling “free” surveillance tech to local police departments, bypassing community oversight entirely. These tools create direct data pipelines to ICE and other federal agencies. Meta’s leaked plans to add real-time face recognition to Ray-Ban smart glasses — timed for when civil society groups are “focused on other concerns” — is cynical even by Meta’s standards. The $2 billion they already paid for Facebook face scanning should have been a deterrent, not a cost of doing business.

Discord’s mandatory age verification is another case of platform power being exercised without adequate safeguards, especially troubling given their recent data breach. And New York’s proposed 3D printer surveillance — requiring hardware-level scanning of print files for firearm components — represents a new frontier in pre-crime manufacturing restrictions.

Risks: Promptware attacks target the trust boundary between LLMs and external data sources. “Free” surveillance tech creates invisible data pipelines to federal agencies. Age verification mandates force identity data collection from millions of users. Hardware-level manufacturing surveillance sets dangerous precedents.

Recommendations: Audit any LLM deployments that fetch external content for promptware exposure. Support community oversight of law enforcement surveillance acquisitions. Use privacy-preserving alternatives to Discord for sensitive communications. Track the NY 3D printer bill’s progress — if it passes, other states will follow.

Featured Articles

The Promptware Kill Chain A new paper proposes a structured seven-step attack framework for LLM systems, modeled after Lockheed Martin’s cyber kill chain. The framework maps how attackers can embed malicious instructions in content that LLMs retrieve, progressing from initial access through reconnaissance, persistence, and data exfiltration. This gives security teams a concrete threat model for evaluating LLM deployments that interact with external data. Read more

I2P 2.11.0 Ships Post-Quantum Crypto After Botnet Siege On February 3, the Kimwolf botnet flooded I2P’s anonymity network with 700,000 hostile nodes — 39 times the network’s normal size of 15,000-20,000 nodes — while attempting to establish backup command infrastructure after researchers destroyed their primary servers. I2P developers responded within six days by releasing version 2.11.0, which deployed post-quantum encryption by default alongside additional Sybil protections. The incident is the largest attack on an anonymity network in recent memory. Read more

Discord Voluntarily Pushes Mandatory Age Verification Despite Recent Data Breach Discord has begun rolling out mandatory age verification across its platform, requiring users to submit government ID or biometric face scans to access age-restricted content. EFF criticizes the move as disproportionate, noting that Discord recently suffered a data breach that exposed user information — making the collection of even more sensitive identity data particularly reckless. The policy creates a surveillance infrastructure that could be repurposed for content moderation or law enforcement requests. Read more

3D Printer Surveillance New York’s executive budget bill includes language requiring 3D printers to include “blocking technology” that scans print files for potential firearms or components before allowing a print to proceed. Schneier highlights the technical infeasibility and civil liberties implications — this would require every 3D printer to contain government-approved scanning software capable of analyzing arbitrary 3D models, creating a pre-crime manufacturing surveillance system with no judicial oversight. Read more

DHS Subpoenas Big Tech for ICE Critics’ Identities The Department of Homeland Security issued hundreds of administrative subpoenas to Google, Meta, Reddit, and Discord, demanding identifying information on users who publicly criticized ICE online. Google complied in at least one case, handing over the full account data, IP addresses, phone numbers, and bank information of a British student journalist. EFF and the ACLU published an open letter demanding tech companies require court orders before complying and provide advance notice to affected users. Read more

Additional Highlights

• Seven Billion Reasons for Facebook to Abandon its Face Recognition Plans — Leaked Meta documents reveal plans for a “Name Tag” feature on Ray-Ban smart glasses that would identify strangers in real time. Meta previously paid $2 billion to settle similar lawsuits. Read more

• Ring’s Surveillance Nightmare — Amazon’s Super Bowl ad previewed a “Search Party” feature using AI to scan across neighborhood Ring cameras. EFF notes Ring already runs “Familiar Faces” recognition on a default-on basis. Following backlash, Amazon dropped its Flock Safety police surveillance partnership. Read more

• “Free” Surveillance Tech Still Comes at a High and Dangerous Cost — EFF documents how surveillance vendors and federal agencies funnel equipment to local police, bypassing oversight and creating covert data pipelines to ICE. Read more

• EU Data Protection Authorities Reject Digital Omnibus Proposals — The EDPB and EDPS issued a joint opinion opposing the Commission’s proposed GDPR amendments, particularly the narrowing of personal data definitions. Authorities argue the changes would primarily benefit large US tech companies. Read more

• Whonix 18.1.4.2 Patches a VM Fingerprinting Flaw — Security update addresses a vulnerability that could allow host-side fingerprinting of Whonix virtual machines. Read more

• FBI Took 20 Years to Kill a Router Botnet — A long-running botnet embedded in consumer routers finally taken down, highlighting the persistence of IoT security threats. Read more

• Homeland Security Wants Names | EFFector 38.3 — EFF’s newsletter covers DHS demands for critic identification and broader surveillance overreach. Read more

Weekly Privacy Insights is a curated digest of the most important privacy and digital rights news, published every Sunday on djeditech.com.

AIL-3 | AI Transparency: This digest is AI-assisted. Articles are aggregated from RSS feeds, ranked by source authority, and summarized using a local LLM (Ollama). All content is human-curated and reviewed before publication. Original reporting belongs to the linked authors and publications.