Internet Freedom Weekly: News Recap, August 3rd–7th, 2026
It’s been a busy week! We found 180,724 smart home message brokers open to anyone on the internet with no authentication — 86% with devices actively connected, one South Korean provider accounting for two-thirds of the global total.
Separately, the US Senate Commerce Committee convened on five internet safety bills at once, including a law that would require age verification on almost every website online. The EU passed Chat Control again, but MEPs managed to enshrine encryption protections in the process.
Apple challenged the UK's second secret backdoor demand. Russia launched what may be its biggest VPN blocking campaign in history. And Zambia heads into elections on August 13 with a documented history of shutting the internet down on voting day.
Our Research Found 180,724 Smart Homes Open to Anyone
The Mysterium VPN Research Team scanned the internet and found 180,724 smart home MQTT brokers — the nervous systems of smart homes, through which every sensor reports and every device takes orders — accepting connections from anyone with no authentication. 138,607 sit on consumer home and mobile networks. 86% had at least one device actively connected. The median broker had been exposed for 67 days; the top 10% for more than 500. One South Korean internet provider, SK Broadband, accounts for 66.7% of all exposed brokers globally — pointing to a systemic deployment issue, not individual error. An open broker doesn't just leak data outward. It accepts commands inward.
KOSA Is Back Before the Senate — the Problems Haven’t Gone Away
The Kids Online Safety Act returned to the Senate Commerce Committee alongside four companion bills. KOSA's "duty of care" provision only works if platforms know which users are minors, creating structural pressure toward age verification for everyone. The EFF's position is unchanged: KOSA doesn't protect privacy. It creates new privacy problems, new incentives for platforms to preemptively remove lawful speech, and new databases of sensitive identity data vulnerable to breach. It may also cut teenagers off from the online communities — addiction support, mental health forums, peer groups — that the bill claims to protect them in.
The SCREEN Act Would Require Age Verification on Almost Every Website Online
Also heading to Senate markup: the SCREEN Act, introduced by Senator Mike Lee, which would require every website containing even one piece of content deemed "harmful to minors" to verify users' ages. Unlike existing laws that target sites where adult content makes up at least a third of material, SCREEN removes that threshold entirely — sweeping in most user-generated content platforms and mainstream services like Netflix. It also directly attacks VPN use by requiring age verification based on IP addresses. The bill is backed by Heritage Action, a sister organization to the Heritage Foundation that authored Project 2025, whose stated goal is to redefine pornography as outside First Amendment protection.
Chat Control Passed the EU Parliament — but Encryption Protections Came With It
The ePrivacy derogation allowing Big Tech to mass scan private messages passed for the third time in four months, after EPP president Roberta Metsola used a procedural maneuver that counted absent MEPs as votes in favor. Despite the structural disadvantage, MEPs passed two amendments protecting end-to-end encrypted communications against client-side scanning — and both the European Commission and Council accepted them. The new derogation runs from August 3, 2026 to April 2028. The signal to Chat Control 2.0 negotiators is now on the record: no majority exists for mass surveillance. Only a proportionate approach can close the deal.
Apple Is Challenging the Uk’s Second Secret Demand for an iCloud Backdoor
Apple filed a complaint last month at the UK's Investigatory Powers Tribunal after the government issued a second "technical capability notice" — a secret legal order demanding access to encrypted iCloud data belonging to British users. Apple is challenging not just this specific order but the UK's broader power to issue TCNs under the Investigatory Powers Act. Privacy International and Liberty have parallel complaints. UK users have been without iCloud's Advanced Data Protection since January 2025, when Apple removed it following the first order. There is no such thing as a backdoor only governments can use.
Russia Is Running What May Be Its Biggest VPN Blocking Campaign in History
More than 20 VPN services have been hit simultaneously, with restrictions targeting IP addresses and entire subnets belonging to major hosting providers. Leonid Volkov of the Anti-Corruption Foundation called it "the biggest attack in history." The mechanism: Russian apps track user IPs, giving Roskomnadzor the data to map and block VPN infrastructure at scale. The campaign coincides with plans by Russia's Digital Development Ministry to introduce continuous monitoring of corporate VPN exemption lists. When legitimate VPNs are blocked, users don't stop wanting to reach the open internet. They turn to whatever works — which is usually less safe.
Zambia Votes August 13. Digital Rights Groups Are Urging Authorities to Keep the Internet On.
Access Now and the #KeepItOn coalition — 370 organizations from 106 countries — published an open letter urging Zambian authorities to guarantee uninterrupted internet access during elections on August 13. Zambia shut down social media during its 2021 election and experienced similar disruptions in 2020 and 2016. In June, Zambia's Ministry of Technology and Science committed publicly not to do so this time. The coalition is calling on President Hichilema to personally affirm and enforce that commitment. An election-day shutdown doesn't just silence social media — it silences accountability for everything that happens while connectivity is cut.
Brazil’s Supreme Court Received Its First Challenge to Biometric Age Verification
Partido Missão filed a constitutional challenge (ADI 7999) with the Supreme Federal Court against the biometric verification requirement in ECA Digital — Brazil's child online safety law that explicitly accepts facial recognition, fingerprints, iris scans, and voice verification as compliance methods. The challenge argues the law collects disproportionately sensitive biological data for its stated goal. The filing arrived as the law entered broader enforcement, creating legal uncertainty for hundreds of platforms in compliance planning. ANPD guidelines due this month may determine whether zero-knowledge cryptographic proofs — which can verify age without collecting biometric data — satisfy the law's reliability standard.
Decentralized Tech Defeated State Censorship in India
When Indian authorities blocked the Cockroach Janta Party's domain and social media handles, volunteers mirrored the site across dozens of alternative domains faster than regulators could issue takedowns. When authorities cut mobile internet at protest sites, supporters switched to BitChat — an off-grid Bluetooth mesh messaging protocol requiring no cell towers, no internet connection, and no central server. When GitHub was ordered to remove BitChat's source code, the code had already been cloned and distributed. The Cockroach Effect is a demonstration of what decentralized architecture does to the censorship model: it removes the choke points state orders depend on.
When the State Won’t Recognize You, the Internet Locks You Out Too
For the tens of millions of stateless people worldwide, every new digital verification requirement — banking apps, employment platforms, government services, age verification systems — is another wall. The Apatride Network facilitated a gathering in Malta in March 2026, bringing together stateless communities to document these experiences collectively. Their conclusion: states may control legal status, but they don't control identity or belonging. The digital world increasingly acts as though they do — and as verification requirements expand, the people hit hardest are those who have no documentation to provide even if they wanted to.
Indigenous Languages Are Disappearing Online, Too
Today is International Day of the World's Indigenous Peoples. Of the roughly 7,000 languages spoken worldwide, the internet actively supports only a fraction — and most of the endangered ones are Indigenous. A language without digital infrastructure has no search visibility, no content moderation, no AI assistance, and no realistic path into the spaces where public life increasingly takes place. The Māori language in New Zealand shows what intentional digital investment looks like over decades of sustained effort. For the vast majority of the world's approximately 3,000 endangered languages, no equivalent investment exists or is planned. Digital inclusion isn't an added feature for language survival. According to UNESCO's International Decade of Indigenous Languages framework, it's a requirement.
Be part of the resistance, quietly.
Get Mysterium VPN
Gintarė is a cybersecurity writer at Mysterium VPN, where she explores online privacy, VPN technology, and the latest digital threats in editorial pieces. With hands-on experience researching and writing about data protection and digital freedom, Gintarė makes complex security topics accessible and actionable.
Related Articles
.png)
.png){kind=small}
