More than 600 organisations across 80 countries since 2019, including US carriers and the lawful-intercept systems they run. The metadata was always the point.
Content tells you what a known person said. Metadata tells you who the people are — and it is the one that scales.
Lodging looks out of place on that sector list. It is not — hotels, transport and telecom metadata resolve a person’s movement over time.
A hotel record is the join key that turns location-adjacent data into confirmed physical presence. No DPIA has a field for that.
Nobody attacks a satellite. Every practical route to a constellation runs through a building with a remote management link.
The vulnerability was not a defect in the implementation. It was the specification — and the thirty-year exceptional-access debate now has an empirical entry.
Sanctions work against organisations that need the financial system. A state intelligence service has no revenue to interdict.
Advice to change your own behaviour is what a defender issues when it cannot change the thing that is broken.
Nothing in the design distinguishes a lawful request from an unlawful one. That distinction lives entirely in the process wrapped around it.
There is no moment at which the attacker chooses to be seen — which is the moment most of this database is built around.