How does AI make you feel? Are you excited to “vibe-code” your smart home? Or anxious about all the added pollution and billions of gallons of water used by data centers? Dig a little deeper and you’ll start to question the actual value of the GPUs that underpin all the leaps and promises of generative AI.  

Right now, GPUs, hundreds of thousands of them, are being crammed into data centers around the world to power the AI boom. These chips are also found in everything from smartphones to cars to gaming PCs. Nvidia — once a niche chipmaker that has become the world’s most valuable company — still brags about releasing what it calls “the world’s first GPU” and a “gaming breakthrough” in 1999, although some trace the origins of the GPU back to at least the ’70s with graphics hardware used in arcade games. 

“There are massive hardware developments that start because of games,” says Catherine Flick, a professor of ethics and games technology at University of Staffordshire. And whether it’s a testbed for new graphics processing units or the development of virtual reality and AI, “all these sorts of things that have quite significant ethical issues, a lot of these start with games,” Flick says. So since its inception, the GPU has been at the root of some of the biggest ethical questions new technologies pose. What impact do games, and now AI chatbots, have on how we interact with the world around us?

Whether mining for raw materials or exposing workers to toxic chemicals in semiconductor factories, GPU manufacturing can leave behind a big mess. Collectively, GPUs warehoused in data centers burn through an enormous amount of water and energy, which can lead to more air pollution and greenhouse gas emissions causing climate change. And at the end of its life, a GPU can do even more damage in the form of e-waste.  

What’s worth taking those risks? Do potential AI-driven advances in weather forecasting or wildlife conservation justify the environmental footprint of a data center? And what about the GPUs in a gaming PC or iPhone — do they deserve just as much scrutiny? 

Hitting close to home 

While GPUs have been around for a long time, AI has thrust them into the spotlight in a way that, quite literally, hits close to home for many Americans. The US has far more data centers than any other country and has plans to build many more. As tech companies race to expand a new generation of hyperscale data centers for AI, communities are grappling with the prospect of having these hulking warehouses full of servers as their neighbors. 

“Isn’t it nice to have the environment as a scapegoat?”

As an environmental journalist, I sometimes get comments on my stories about whether these data centers or AI models are being unfairly portrayed as the menacing new bogeyman, especially when other industries — like fast fashion, for example — exacerbate climate change and pollute the environment. And as for GPUs, they’re not just found in data centers, but also in consumer electronics. So why single out AI for its sustainability issues? 

Some venture capitalists have blamed AI’s slow consumer uptake on the bad press surrounding its environmental impact. To that, Flick can’t help but chuckle: “Isn’t it nice to have the environment as a scapegoat?” 

A similar sentiment is bubbling up on social media. Ashley Striblet, who works in product strategy and consumer AI, recently published a video on TikTok pushing back on those VCs for “blaming consumers” for their own failures to invest in products people actually want. Many people understand that fast fashion or consumer technology can be bad for the environment, Striblet says, but they still buy these things because they feel like they’re getting value from the products.

“I think most people know that ordering clothes from Shein or Amazon is not the most environmentally conscious thing to do,” Striblet tells me. “We also know Gen Z at some point were big consumers of these brands that provide really cheap clothing.” The cost savings from buying cheap clothes turns out to be enough of a tradeoff to justify the purchase for many consumers, Flick adds. 

On the other hand, many people just aren’t yet seeing the benefits to their lives that VCs and CEOs are promising with AI, Flick and Striblet each tell me. “It’s just rubbish what they’re saying that their technology can do,” Flick says. “It’d be nice if we all had personalized butlers or whatever it is. But how do you get from point A to point B? It’s not with what we’ve got.” 

And while the average American has yet to see the kinds of big leaps forward that are being promised, they’re increasingly likely to see the costs of a new AI data center moving next door. For years, hubs for fast fashion or semiconductor manufacturing have been concentrated in Asia. Now, an explosion of data centers springing up in the US is making headlines for raising utility bills and creating more pollution. It’s not happening in some faraway country, but in the same places where big American tech companies are courting more affluent consumers.  

To be sure, even in the US, data centers are landing in some places where low-income neighborhoods and communities of color have long had to fight against the environmental injustice of polluters setting up shop at their doorsteps. The NAACP, for example, has sued xAI (now doing business as SpaceXAI) over air pollution from gas generators the company installed on-site to power its massive data centers. (SpaceXAI didn’t respond to emails from The Verge.) The civil rights group had already warned tech companies to “be on alert” as it helps local groups across the nation mount their campaigns. 

---

Growing globally, impacting locally

Shaolei Ren has witnessed the costs communities often pay in the name of progress. He’s a researcher who has broadened the study of data centers’ environmental impact beyond climate change to focus on air pollution and water scarcity near the facilities. Having grown up in a coal-mining region of northern China in the 1980s, Ren remembers keeping the windows shut 24/7 to keep out the black carbon accumulating on the streets outside. And with limited water infrastructure in the province, his family stored water in tanks to ration throughout the day.

More powerful GPUs are demanding ever more energy, creating air pollution and greenhouse gas emissions in the process.

Ren, who is now an associate professor of electrical and computer engineering at the University of California, Riverside (UCR), leads research into the impact data centers have on air quality and water resources for nearby communities — costs that are often invisible each time a user enters a query into a chatbot. 

Sitting in his office at UCR on a rare gloomy Southern California afternoon just before a rainstorm, Ren tells me he’s optimistic about the benefits AI can ultimately bring, including aiding scientific discovery. But those gains shouldn’t be made at the expense of local communities, he says. The whiteboard behind him is covered with equations scrawled in blue marker for his research exploring how to tweak data center operations in order to use fewer resources and minimize pollution. Ren has a vision of what he calls a “community-integrated data center approach” to prevent these facilities from harming nearby residents. “It’s definitely doable,” he says. 

But for now, that’s not what’s typically happening. More powerful GPUs are demanding ever more energy, creating air pollution and greenhouse gas emissions in the process. Running them around the clock while keeping the hardware from overheating requires lots of water. It all adds up over the lifespan of a GPU, which might only be several years in a data center. 

The energy needed to train a model as large as Meta’s Llama 3.1 can lead to as much air pollution as 10,000 round trips by car between Los Angeles and New York City, Ren and colleagues at UCR and Caltech estimated in a 2024 preprint study. (Meta declined to comment on the record and instead referred The Verge to its sustainability report and webpage on data centers.) Public health costs associated with growing adoption of AI could reach more than $20 billion by 2028 and 1,300 premature deaths annually from air pollution by 2030, the study found. 

AI is quickly surpassing the energy use and climate impact of other applications for GPUs. Gaming used roughly 34 terawatt-hours (TWh) per year in the US and led to carbon dioxide emissions equivalent to about 5 million cars on the road (about 24 million tons of CO2), according to a comprehensive study published in 2019. Since then, newer consoles have become more energy-intensive, although their climate impact depends a lot on user behavior and how dirty the electricity grid is wherever they’re playing.

For a rough comparison, the energy use of GPU-accelerated AI servers in data centers grew from 2TWh in 2017 to more than 40TWh in 2023 in the US, according to a 2024 study by the Lawrence Berkeley National Laboratory. Now, with all the hype, AI servers’ annual power consumption could grow to between 165 and 326TWh by 2028, the study predicted. The lower estimate would be roughly equivalent to the energy more than 8.7 million homes in the US might use in a year.

In 2025, AI likely exceeded the power consumption of Bitcoin mining, accounting for nearly half of all the electricity data centers used around the world, according to a study by Alex de Vries-Gao, a PhD candidate at Vrije Universiteit Amsterdam Institute for Environmental Studies. The resulting carbon emissions likely reached between 32.6 million and 79.7 million tons annually, he estimates. For comparison, New York City’s climate pollution reaches around 50 million tons of CO2 annually.

In Southern California, where both Ren and I live and work, massive warehouses storing and sorting Americans’ e-commerce orders increasingly define the region. Goods from Asia arrive by ship in the nearby Port of Los Angeles before making their way inland to the “dry ports” made up of Amazon fulfillment centers and similar facilities buzzing with big rigs around the clock. 

“When we use AI we tend to forget that this has an impact on the real world around us. This goes beyond carbon [emissions], and it’s kind of out of sight, out of mind.”

The boom in new data centers reminds me of some of the same challenges these warehouses brought. National environmental groups rally around the climate impact of fast fashion and online shopping, while residents mount campaigns over local air pollution. Retirees suddenly see their quiet neighborhoods transformed by blocks of noisy industrial complexes. The pollution and noise complaints just come from the whirring of generators and cooling systems at data centers rather than truck traffic surrounding warehouses. But data centers raise an added concern, especially in dry regions out west. 

Powering AI is an incredibly thirsty business, requiring water for electricity generation and cooling systems at data centers. De Vries-Gao estimates that AI could have used between 312.5 billion and 764.6 billion liters of water in 2025, in the range of how much people consume globally in water bottles each year. It could be an even bigger jump in water demand than Ren predicted in a 2023 study, when he and his colleagues estimated that water use could climb to as high as 600 billion liters in 2027.

As eye-popping as those numbers can be, looking at an annual total can still be an incomplete picture, Ren asserts. That’s because the amount of water a facility uses is “spikey.” They tend to use the most water for cooling when temperatures rise — a demand spike that can suddenly put a ton of stress on a local water district at a time when the community might also be more prone to drought and water scarcity. 

During water demand peaks, a home might use 1.5 to 2.5 times more water than it typically would. A data center, on the other hand, might use 6 to 10 times as much — with some massive new data center projects potentially needing 30 times more water, Ren says. If these trends continue, US data centers could require up to 1,451 million gallons per day of new peak water capacity through 2030, according to a recent preprint paper Ren coauthored. Meeting that demand would cost as much as $10 billion. Those are difficult costs to swallow for small community water systems that are often underfunded and may struggle to upgrade their infrastructure without additional support.

Even tech companies’ pledges to recycle water at data centers or replenish water sources nearby miss the mark, Ren argues. The public needs more transparency about water usage during peak demand so they can plan ahead. Communities should be able to work with tech companies to build up the infrastructure needed to increase capacity, he says, making sure residents aren’t left with the tab. 

---

From the cradle

In order to better understand the environmental impact of GPUs, Sophia Falk, a PhD candidate at Bonn University, David Ekchajzer, a PhD student at the Université Paris-Saclay, and their colleagues have thrown tens of thousands of dollars’ worth of the chips into industrial blenders. They’re still hoping for more donated graphics cards to study what they’re made of and the footprint they have on the planet.

While data centers have been in the spotlight lately, they’re far from the only way GPUs can take an environmental toll. There are the metals and chemicals used to manufacture them, and pollution across the entire supply chain. 

“When we use AI we tend to forget that this has an impact on the real world around us,” Falk says. “This goes beyond carbon [emissions], and it’s kind of out of sight, out of mind.” 

Falk has studied the material footprint of the Nvidia A100, 90 percent of which she and her coauthors found to be composed of heavy metals — primarily copper, iron, tin, and nickel — as well as silicon. Copper, a material that conducts electricity well and is widely used in power lines and electronics, makes up the biggest chunk. All the hype around generative AI and the wave of new data centers being built is exacerbating a global shortfall in copper supply (also fueled by the electrification of homes, buildings, and transportation). 

Demand for the material could grow by 24 percent over the next decade, and new mines would have to open twice as fast as they did a decade ago, Wood Mackenzie estimates. One of the biggest risks with large-scale metal mines, including copper, is acid drainage that can contaminate nearby water sources. Sulfides exposed during the mining process react with water and air to form sulfuric acid.

While a single A100 GPU might require about 1.4 kilograms of copper, the impacts multiply when used to train or run a generative AI model. Training GPT-4, for example, could have required between 1,174 and 8,800 A100 GPUs. That much hardware could ultimately mean extracting and eventually dumping up to 7 tons of toxic elements, according to a recent preprint study by Falk and other researchers.

Falk and Ekchajzer also coauthored a study along with a group of other researchers assessing the environmental costs of training GPT-4 using Nvidia’s A100 GPU. They considered 16 different environmental impacts training can have — ranging from high-profile issues like data centers’ energy use and carbon emissions to chemicals that escape into the environment from producing and discarding chips. The GPU chip itself dominated 10 categories, with manufacturing accounting for a majority of public health risks posed by toxic chemicals and nearly all of the cancer risk. 

Since the very first computer chips were manufactured, they’ve left behind a toxic legacy. It’s why Santa Clara County in the heart of Silicon Valley has more Superfund sites than any other in the US. These are places so polluted by the chemicals used in manufacturing — some of which leaked out of underground storage tanks at chip factories to contaminate drinking water — that the federal government has put them on the National Priorities List for cleanup. 

“Do we have enough energy to go around? My answer is no.”

Some of the chemicals used in chipmaking linked to miscarriages among workers were phased out in the US in the 1990s as the harms came to light. Around the same time, chip manufacturing was moving to Asia, where some of the same health risks showed up decades later. Now, generative AI is driving a rush to develop ever more powerful chips. New semiconductor factories are cropping up as a result, turning growing manufacturing hubs like Phoenix into the next silicon valley. 

TSMC started producing Nvidia’s coveted Blackwell chips at its new factory (called a fab in industry speak) in Arizona last year. The facility rises suddenly from the desert landscape around Phoenix when I drive by in October. It’s still expanding, flanked by red cranes that loom taller over the construction site and surrounding brush than anything other than power lines that connect it to the rest of the region.

Electricity demand is climbing in the US after more than a decade of flatlining — not only because of energy-hungry data centers, but also because of a resurgence of domestic manufacturing. In places like the US where fossil fuels still dominate the electricity mix — and where President Donald Trump is on a crusade to prop up coal and gas over wind and solar — soaring electricity demand also means more air pollutants and planet-heating emissions. 

Globally, the amount of electricity that AI chipmaking consumed jumped 350 percent from 2023 to 2024, according to a report de Vries-Gao coauthored with Greenpeace last year. That resulted in a fourfold rise in carbon pollution, reaching about 453,600 metric tons, more than the annual emissions from a gas-fired power plant. Most of the GPUs are still manufactured in East Asia, where power grids are similarly heavily reliant on fossil fuels.  

The energy crunch was top of mind at Semicon West, the annual trade conference that was held in the new chip manufacturing hub of Phoenix last October. “Do we have enough energy to go around? My answer is no,” Ajit Manocha, president and CEO of the industry group SEMI that organized the conference, said during his keynote talk at the event. A diagram of “unprecedented obstacles” the industry faces includes two resources crucial to making semiconductors: energy, and per- and polyfluoroalkyl substances (PFAS), also known as “forever chemicals” linked to kidney and testicular cancer and other health risks. 

The risk of forever chemicals escaping from industrial facilities sprouting up to support chip manufacturing in Arizona was a big worry for some of the residents I met there last fall. The prospect of chemicals contaminating already drought-vulnerable water sources in the region only raises the stakes. 

“It’s terrifying,” Cheryl Orosco tells me in October, chunky turquoise and silver jewelry dangling from her ears and neck. She’s retired and joined neighbors in pushing developers to build a chip packaging plant farther away from homes and schools in their community. “This is our forever home,” she says, placing her hands over her heart. 

---

To the grave 

De Vries-Gao, who gained notoriety tracking the energy consumption and carbon pollution of crypto mining on the website Digiconomist, thought his work studying the environmental impact of data centers was coming to a close. 

He started the website thinking, “There’s no nutrition label on digital applications,” he says. “There’s real-world impact for sure, but it’s not tangible and I think it’s really important that people are at least informed that, hold up, you know, when you’re using these applications, there is a cost.” But research by de Vries-Gao and others had already called a lot of attention to energy-hungry data farms used for crypto mining. The largest cryptocurrency after Bitcoin, Ethereum, had already switched to a vastly less energy-intensive way of operating — showing that it was possible to slash carbon emissions if crypto networks were willing. 

Then as the hype around generative AI grew, his focus shifted. “One thing that crypto mining and AI have in common is the ‘bigger is better’ dynamic,” he says. Data centers for AI posed many similar environmental challenges to crypto mines. But housing more powerful hardware, those risks can be even greater. Whereas specialized chips used for crypto mining perform the same repetitive task — solving puzzles to validate transactions — GPUs used for AI perform far more complex computing. 

One unseen consequence is even more e-waste, including larger and more complex components used in AI data centers. De Vries-Gao’s latest study, published in February, estimates that AI servers could create between 0.131 million and 0.225 million tons of e-waste each year by 2030. He says that’s comparable to all the e-waste produced by a country the size of Denmark, Norway, or Austria. It’s also a much more conservative estimate compared to a 2024 study by other researchers, which predicted that e-waste from AI could reach between 1.2 million and 5 million tons by the end of the decade. 

De Vries-Gao estimates a smaller amount of waste after factoring in supply chain constrictions, and because he sees the lifespan of a server growing beyond the three years that other researchers have used as a benchmark. But the amount of e-waste he projects will build up as a result of AI is still a lot, he tells me. “The total impact is significant,” he says. “Whether you’re talking about crypto miners or whether you’re talking about the big tech companies, they don’t take responsibility.”

Only about 22 percent of the 68.3 million tons of e-waste accumulating annually worldwide is collected and recycled, according to the last comprehensive count published in 2024. That rate is higher, 30 percent, in the Americas, where there are the most data centers. The rest of that e-waste enters the shadowy “informal” sector, often in lower-income countries where waste management facilities are less likely to meet high environmental, health, and safety standards. Sometimes called “backyard recycling,” people — and potentially child laborers — manually dismantle discarded electronics with little or no personal protective equipment. They might burn or melt devices down to extract raw materials that they can resell. Servers used for large language models hold valuable materials like gold, silver, and platinum, but also toxic materials including lead and the carcinogen chromium. Burning or burying those toxic substances can release harmful pollutants into the air or allow them to seep into groundwater.

Around 58 percent of e-waste coming from AI data centers is generated in North America, where there is a higher formal collection rate. And experts tell me that data center operators often work with subcontractors to toss out old GPUs. But the US has not ratified the Basel Convention that limits the international trade of hazardous wastes, including e-waste. Investigations have found US recyclers sending e-waste abroad, where it might fall into the black hole of backyard recycling.

---

Gaming out the way forward 

Some of the researchers I talked to for this story say they also encounter questions about the need to focus on the environmental impact of AI when data centers globally only made up 1.5 percent of global electricity consumption in 2024.

“Of course on a global scale, it’s not that much,” Falk says. But it’s important to scrutinize AI, she says, because of “the exponential growth in energy consumption of data centers,” especially in comparison to other sectors.

Ekchajzer points to the ways in which AI is also changing the environmental footprints of other industries. “For instance, if we want to electrify the transport system, now it is being jeopardized by the fact that we are using additional electricity for AI rather than for transport,” he says. The environmental consultancy Hubblo, which Ekchajzer cofounded, recently launched a new online tool that compares the environmental impacts of different graphics cards, starting with nine different Nvidia designs.

The question to ask with generative AI, as with other emerging technologies, is whether it’s providing benefits that outweigh the costs to society. “Generative AI is totally one of those classic solutions looking for a problem,” says Flick, the ethics and games technology professor. That mentality feeds the risky hype cycle of companies pushing for any way to justify and continue scaling up the investments they’ve made in the technology.

“The way we kind of pull this back a little bit is to say, ‘Okay, well, what is usable from this and how can we scope it back down again so that it’s going to be worth the [societal] cost?’” she says. 

Using a GPU longer before throwing it out, dismantling and reassembling an obsolete graphics card so it can be downcycled for other uses, and similar waste-cutting measures could reduce e-waste from generative AI by up to 86 percent, according to the 2024 study.

Tech companies can also design chips and AI models to be more energy-efficient. Nvidia points out in an email to The Verge that its Blackwell Ultra is 50 times more efficient than its previous Hopper GPU architecture, and that the company has improved inference throughput per megawatt by 1,000,000x over the past six architecture generations. 

“If the average fuel efficiency of a car had improved as swiftly as chips over a similar time period, one gallon of gas would suffice for a trip to the moon and back,” Nvidia head of sustainability Josh Parker says in the email.

But increased efficiency can become a double-edged sword that incentivizes companies to burn through even more resources overall. That’s where it gets important to challenge the “bigger is better” mentality within the tech industry, some of the researchers I spoke with say.

An AI model might double in size just to achieve a 2 percent gain in capability — is that worth the added environmental toll, Falk posits during our Zoom call. “I have a question of sufficiency, that we should say like, ‘OK, that’s enough, the model is good enough.’ Where do we stop?” Falk says.  

Microsoft is building out a network of new AI data centers it’s calling Fairwater sites, each able to scale to “hundreds of thousands of NVIDIA Blackwell GPUs.” The company declined to comment on the record for this story, instead pointing to blogs it’s published on Microsoft’s research into techniques like using superconducting materials and liquid cooling to make data centers more energy-efficient.

“Generative AI is totally one of those classic solutions looking for a problem.”

Environmental groups want more accountability. Since other companies manufacture the chips Nvidia designs, Greenpeace East Asia is pushing Nvidia to clean up its supply chain by investing in more renewable energy capacity where they operate. And it doesn’t discriminate between GPUs made for AI or gaming or any other purpose. The organization and other local groups have called attention to the health and environmental impacts semiconductor manufacturing has had in Taiwan and Korea for years. 

All of the hype around AI is just bringing the issue to the forefront. “The whole AI boom accelerates and intensifies this kind of phenomenon in East Asia,” says Katrin Wu, Greenpeace East Asia’s supply chain project lead. 

And even though the GPU is the “backbone” of that boom, she says, and Nvidia has a market cap of $4 trillion, the chip designer doesn’t get the same pushback that more consumer-facing companies like Microsoft or Google might have over their environmental footprint. “Somehow they can avoid the public and social scrutiny,” she says, adding, “We’re not, like, completely against AI development.” Greenpeace just wants it to happen more sustainably.

TSMC, which makes chips for Nvidia, points to investments it’s made in renewable energy, water reclamation, and waste reduction in an email to The Verge. In Arizona, for example, TSMC is building an industrial water reclamation plant at its manufacturing site “to achieve near-zero liquid discharge, substantially reducing dependence on local water sources,” according to TSMC deputy spokesperson Nina Kao. 

Intel, which is also expanding its fabs in Arizona to produce powerful GPUs for AI, points to commitments the company has made to achieve zero waste to landfill, replenish more water than it uses, and match electricity use with renewable energy in an email to The Verge. “We believe that corporate responsibility and innovation go hand in hand. This belief has guided our work for decades – from setting ambitious sustainability aspirations to embedding responsible practices across our global operations, supply chain, and product design,” Madison West, head of sustainability at Intel, said in the email. 

Sure, environmental concerns don’t often influence consumers’ purchases. And much of the pushback against AI stems from other moral quandaries. But consumers can play a role in advocating for more accountability from tech companies. Some game developers have already faced fierce criticism over their use of generative AI, albeit largely over the prospect of AI replacing people’s jobs and artistry. “What do we do when we make games? It’s a human story that we tell, right?” Flick says. “Games are very powerful tools for narrative and telling stories, and shaping how people think about things.”

A 2024 study in the US found that gamers were more likely to want to take collective action on climate change than people who don’t play video games. Marina Psaros, one of the authors of the study, wasn’t exactly surprised. After all, gaming isn’t a passive form of entertainment, she says. 

“You’re actually directly responsible for the experience that you have with that game. Often, that’s the joy of it, is that you’re driving the narrative and you’re discovering how to do new things,” Psaros says. In that way, games — and the GPUs powering them — offer people a way to envision a different, better world. 

“That’s one that I think is exciting,” she says. “[It’s] the opportunity for us to be able to use the imagination and the visualization aspect of games to think about how we want our communities to function differently.”

And when it comes to facing the issues that hold up consumer adoption of AI, “really the ideal solution for this is to actually just directly address and be empathetic to consumers’ concerns,” says Striblet. “So that you’re able to actually develop the solutions.”

This reporting was supported by a grant from the Tarbell Center for AI Journalism.

Additional reporting by Sean Hollister.

This article is a bit of a technical one, but no less important than any other I’ve posted so far. Maybe even more important as it’s THAT insidious!

Subscribe now

His name is Peter Stokes, and for a hacker, he did mostly everything right.

He had his VPN up the whole time. Traffic was tunnelled through ngrok. IP addresses were hopping between Tallinn, New York and Bangkok like a man working three frequent-flyer schemes at once.

Nineteen years old, dual US-Estonian, and allegedly running with Scattered Spider, an extortion crew that’s pulled in over $100 million across a hundred-plus breaches.

Didn’t matter. one. single. bit.

Maybe first a few technical terms out of the way for the people unaware of those:

IP: See this as your home-address, but online. If the gov has your IP, they know who you are (more or less - not going into too much detail here so stop nitpicking - yes yes, talking to my fellow nerds here :wink:).

VPN: this is (mostly) a software solution that encrypts your traffic and shoves it through someone else’s server first, so whoever’s watching sees that server, not you.

ngrok: a legitimate tool developers use to expose a local server to the internet. Also, apparently, popular with people running extortion schemes who need their traffic to look like it’s coming from nowhere in particular. Purely coincidental, I’m sure.

IP hopping: bouncing your connection through different countries so each request looks like it came from a different place.

On May 12 last year, at 19:21 UTC, someone opened ngrok’s signup page and created the account later used to break into a US jeweller for an $8 million ransom.

Microsoft’s own logs, quoted in the federal complaint, show which machine opened that page, down to the minute. NOT the address the VPN was busy disguising. The machine itself.

That’s more or less the whole article.
So you can stop reading now if you want.

The why and how, THAT is what got me all wired up today.

If you’re using a VPN, you’re supposed to be protected as your real IP isn’t known. So the FBI didn’t know it. VPN is still secure. It’s equally useless now this secret is out in the open.

So pray tell… How did they get to this guy’s name?

They called Microsoft.

Windows has something called a GDID - the Global Device Identifier. It comes straight from Microsoft’s telemetry, and if you have Windows 10 or 11, you have been quietly reporting your own details this whole time. No matter where you are, or hop to in this case.

So pray tell… What IS this GDID?

Glad you asked… I would have never told you otherwise /s

A GDID is, without diving into that acronym soup, is something that every Windows installation gets. It’s not a hardware ID, because hardware can change, it’s passed down the first time your computer reports back to Windows (and oh boy, they REALLY like to call back!!).

Each fresh Windows installation gets a new GDID. Which stays with you forever and ever until the end of time (or until you erase that spyware masking as an operating system).

Think about it like a membership card you never asked for and can’t send back.

And no matter what you do, updates, change a harddrive, add more memory, whatever… It sticks. ONLY that clean reinstall will get you a new one. And even then Microsoft’s side of the ledger still keeps the old one, history attached. So if your reinstallation happens to be from the same IP as the old history? It still can get traced back to you.

Now every time you boot into Windows, a background service registers your device into Microsoft’s internal directory. One user’s own support thread has that service shovelling 250 to 300 megabytes home on a single startup.

Per boot. For a name tag. I’m pretty sure it’s more than a name tag which gets sent.

Separately, there is this update-sharing service that reports the exact same number next to your IP and rough location. Another diagnostics pipeline uploads batches on its own schedule. And if your telemetry sits anywhere that is not equal to “turned completely off”, those batches can carry the web addresses of your browser and the URLs your Defender has been checking against Microsoft in real time.

The GDID rides along with every lookup.

Which brings me back to our (unfortunate) hacker… Those background services are almost certainly how “opened ngrok’s signup page” got a timestamp accurate to the minute. They didn’t even had to guess. Windows knew who you were all along.

Nobody asked you to opt in to any of those channels.

There’s not even an off-switch for this, and no, it’s not what the “Diagnostic data” slider controls. That slider is the digital equivalent of asking the universe to pretty please be quiet. The universe remains annoyingly chatty anyway. Much like Windows.

Normally when you install Windows they ask you to register with a Microsoft account, but there is a workaround: a local account.

However, this doesn’t save you either. There’s a fallback baked in that registers the device anyhow. No human interaction necessary.

Now if you’re curious, you can find this via regedit at HKCU\SOFTWARE\Microsoft\IdentityCRL\ExtendedProperties.

That value converts to the exact format that turned up in the indictment.

Good you know that it’s there. But don’t go pasting this anywhere public: that specific number, plus your account, plus a device detail or two, is PRECISELY the combination that gets someone found.

You don’t go posting your ID card either right?

None of this is hidden, exactly. It’s in Microsoft’s own Azure documentation, described in one flat sentence as an identifier “used by Microsoft internally”.

Technically true. Technically a shark is a fish.

Stokes handed over the rest for free. So maybe not the smartest guy in the room, but give him some slack, he’s only 19…

Snapchat photos of cash, watches and a diamond chain spelling “HACK THE PLANET”.

A selfie from an Estonian police station, captioned about how the feds had no idea what they’d just let walk.

He did great with the VPN, and ngrok. But then couldn’t help but post his own location to the internet with a taunt attached.

Once the GDID tied his device to that ngrok account, the rest was bookkeeping: Apple, Facebook, Snapchat, even a Growtopia login, all lining up on the same IPs, cross-checked against his State Department travel records. Tallinn in one window. New York in another. Thailand after that.

The VPN hid where the traffic came from. But it never mattered.

I think it’s good riddance as those people are not innocent. I mean, they drained businesses for millions!

But the tool that caught him doesn’t check anyone’s intentions. It’s always-on on every Windows 10 and 11 machine on the planet.

There’s no published policy on when Microsoft hands that data to a government, no opt-out for anyone who’d rather not be found, and no report telling you how often this already happened quietly, to people who never make the news.

Oh, and before you go rushing off to the nearest Apple Store. Mac ain’t a refuge.

Because GDID was already taken, they called it DSID (Directory Services Identifier). Similarly, it’s a permanent number welded to your Apple ID. And Apple has your full name, phone number, birth date, email address, …

Their analytics send this number to the home turf every tap you make in the App Store or Music, even when told not to send it. “Share Analytics” is basically lipstick on a pig. Doesn’t do jack shit.

If you’re interested: search for Tommy Mysk.

The only place that can help you is Linux. It DOES have an ID too (/etc/machine-id), but the difference is fundamental. That machine ID is generated from a random source during system installation or first boot - on your box, not handed down by a vendor’s server, and no company keeps a copy.

The manual itself says it should be considered “confidential”, and must not be exposed in untrusted environments, in particular on the network.

Don’t like it? rm the file, reboot, and you got a new one.

No OS-level phone-home by default.

Caveat though: the OS isn’t watching in this case, but the apps you install (Chrome, Spotify, a Google login) still phone home on any OS.

Which ties me to my article from yesterday, as this becomes so much more than a self-incriminating teenager. And where things go with the EU, so they go with the US. Just you wait!

A persistent identifier tied to a real person is personal data under EU law.

There’s no debate even anymore about that. The European Court of Justice settled it years ago, ruling that even a dynamic IP address counts, as long as whoever holds it has a realistic way to link it back to you.

A device ID, plus years of IP history, plus three linked accounts, is well past realistic.

Windows telemetry has already lost this fight here.

Twice.

The Dutch regulator found the collection unlawful in 2017, forced changes, then came back a year later and found Microsoft still running “new, potentially unlawful” processing.

They did updates. Turned out they were doing the wrong homework. I’m sure it’s all a conspiracy theory…

Another government-commissioned assessment went even further: there’s absolutely NO legal basis for most of the diagnostic data, and even worse if you’re forced to use Windows at work, you can’t say the employee consented, because an employee can’t very well tell their employer they’d rather not use Windows today.

Hesse banned Office 365 from its schools outright. Seems children can’t consent to being exposed to possible access by US officials.

So the collection is already on thin ice in the EU. But nothing changed in the decade since this came to light.

But wait… There’s more… There’s always more… This gathered data doesn’t even stay in the EU. It goes straight to the servers in the United States. I mean, I trust the US more than I would trust China or Russia, but it’s a very close competition…

In 2015 the EU struck down “Safe Harbor” because data in the US was gobbled up immediately by the intelligence services once the data landed.

Now they’re calling it “Privacy Shield”. Sounds fancy. Sounds trustable. Struck down in 2020, same reasonings. (and I paraphrase: “the US is not trustworthy with our plebs data”)

So not to be deterred - and to employ at least some creative talent - they came up with a new name: “the EU-US Data Privacy Framework” (born 2023). Copy/pasted the whole damn thing, adjusted the font.

It’s basically Microsoft self-certifying, promising that the American body overseeing this, the FTC, is independent enough that Europe can trust it.

I’m guessing Peter has some objections right about now.

The US Supreme Court ruled a bit ago that the president can fire FTC commissioners whenever he likes, no cause required.

That decision that the US’ protection is “adequate” leans on that independence. Repeatedly. Which is kind of awkward when the decision is in the hands of just one person.

Max Schrems noticed. He tends to. The Austrian who killed the previous two frameworks wrote to the Commission the day after, arguing the ground under this one had gone the way of the dodo.

He’s now filing a third challenge. People are already calling it Schrems III, at this point less a lawsuit than a release cycle.

The redress side is even worse.

The thing meant to let an ordinary European complain when their data is misused runs through a “Data Protection Review Court”, which sounds pretty judicial but ain’t.

It’s just an office inside the US Justice Department, set up by executive order, and its judges are appointed by the Attorney General and removable by the president. Yup, the same one that can fire FTC commissioners.

“Independent”, right?

The current administration already fired all Democratic members early last year, leaving it short of the numbers to rule on anything at all.

The complaints desk was already broken for over a year before the enforcement desk tripped over its own laces this week.

None of this will be switched off tomorrow.

Adequacy decisions die slowly, in court, over time, much like the last two.

The lawyers are now saying what they said before the last two failed: don’t panic, keep the paperwork current. Courts in the meantime, start to notice those recurring plots. Even they get it by version three.

Stokes wasn’t caught because the system has a flaw. He was caught because it works exactly as built, and it was never built to ask first. It was built to know.

That GDID is the ONE identifier that survives a VPN, a proxy, a new IP, a new country… It was carefully built on illusions.

It survives right up until you wipe the disk. And even then Microsoft keeps the old number, because deleting history is hard and keeping it is easy.

The hacker was only the first name on the list.

I’m pretty sure Microsoft will get busy with court requests after govs find out about this VPN-busting method of pinpointing dissidents.

Niemöller never had a device ID.

Lucky bastard.

Subscribe now

My other publications:
[Daily Digest] → The news in 5 minutes, without the forty open tabs.
[Portfolio] → What I do with my own money

A recent report in the Wall Street Journal describes a tense meeting among European leaders early this year, convened after Donald Trump threatened to use military force to seize Greenland from Denmark. According to the Journal,

heads of government were venting so emotionally about the 47th president that some of the nearly 30 leaders present would later call the session “therapy night.”

Yesterday, soon after he arrived in Ankara for the NATO Summit, Trump reiterated his demand that Denmark hand him control of Greenland. But reactions were subdued. As far as I can tell, our erstwhile allies are now treating Trump as the senile uncle who says crazy, outrageous things, but shouldn’t be taken seriously.

What has changed? According to the Journal, European leaders have largely given up on hopes that they can bring back the America they used to know, and are quietly, in effect, declaring independence:

American allies have begun pushing the gas pedal on an unprecedented experiment in de-Americanization. Authorities from France to the Netherlands are quietly removing American tech from their systems, adopting European open-source software and urging civil servants to no longer use Microsoft Teams or Office. Belatedly, they are spending hundreds of billions of dollars to try to boost Europe’s own private space firms, AI companies, and data centers, to avoid leaning on U.S. juggernauts.

Europeans are running studies on where they would store their data or process their payments should friction with the U.S. escalate, and how well their American-made weaponry would operate without Washington’s authorization. Nations whose empires once spanned the globe are now stuck trying to extricate themselves from their humbling dependency on American technology and military power, without provoking the U.S.

Their willingness to de-Americanize partly reflects recognition that reconciliation is hopeless: Trump is who he is, and a nation that elected him twice simply can’t be trusted.

However, Europe’s turn away from Trump also reflects plummeting perceptions of his power. At one time the world feared Trump although it never respected him. The silence that met his renewed demand for Greenland shows that the world no longer takes him seriously.

America remains an economic superpower with an enormous military budget. And the combination of a supine Republican Party, along with a Supreme Court that shamelessly greenlights Trump’s authoritarianism, has given this president more control over U.S. policy than any president has ever had, or ever should have. But while Trump is able to run roughshod over Americans, he can no longer bully the rest of the world. Thanks to Trump, the U.S. has seen its global influence plunge.

There are three big reasons for that precipitous decline.

First, there is the debacle in Iran. Not only did Trump’s war of choice fail in all its objectives, it revealed that U.S. military power is far more limited than almost anyone realized. The insistence by Trump and his lackeys that this humiliating defeat was a great victory shows that American foreign policy only serves to pander to Trump’s fragile ego. And when his ego meets reality, it slithers away.

In addition to showing the limits of U.S. military power, the war also showed the limits of U.S. financial power: It is increasingly easy for nations to bypass U.S. banks and the dollar using cryptocurrency — and Chinese yuan.

A second, in its way equally important, blow to U.S. prestige and influence has been Trump’s failure to deliver Ukraine to Vladimir Putin.

For make no mistake: everyone at that summit in Ankara knows that Trump, JD Vance and company both expected and hoped that their betrayal of Ukraine would lead to Russian victory. Surely, they imagined, Ukraine would be unable to hold off the onslaught from its much bigger neighbor without U.S. aid. To America’s everlasting shame, Trump told Volodymyr Zelenskyy that he didn’t “have the cards.”

Yet after Trump cut U.S. aid to Ukraine by 99 percent, Ukraine not only survived but began gaining the upper hand. Europe has stepped up financially, more or less replacing the lost American dollars. And Ukrainian military innovation has largely made up for the loss of American weapons.

The result has been to make the U.S. increasingly irrelevant. Put it this way: Iran taught foreign governments not to fear American might; China, along with the crypto industry, has taught rogue countries that they needn’t fear American financial control; and Ukraine has taught foreign governments that they don’t need American support.

Finally, Trump’s global power play rested on economics even more than on military force, above all on his belief that other nations would cower in fear at the prospect of facing U.S. tariffs. But Trump’s attempt to weaponize international trade has been a bust. Most notably, China’s economy has powered right through the Trump tariffs. Furthermore, it turns out that China has escalation dominance in the trade war: we need their rare earths more than they need access to our consumers.

And other nations — even Canada and Mexico, which have historically been highly dependent on the U.S. market — are moving to reduce their dependence. Canada’s move to build a new pipeline that will let it sell Alberta oil to Asia rather than the Midwest is just a highly visible symbol of a general world move toward bypassing America now that we have become an unstable, unreliable economic partner.

The combined effect of these humiliations for Trump and his minions has been a drastic reordering of America’s place in the world. For most of last year foreign leaders kept trying, desperately, to appease Trump. These days they’re mostly just humoring him, building a world in which his sundowning won’t matter.

It’s extremely unlikely that anything substantive will come out of this NATO meeting. And a year ago the prospect of a failed summit would have been a source of deep concern. Now it will be met with a shrug: Nobody expects anything but chaotic bluster from Trump, and what he does matters less and less.

Note: I’ll be doing a Substack Live at noon with Heather Cox Richardson

A New York service books a stranger to mourn at your funeral and vanish without explanation.

Visit Uncrate for the full post.

This here is not a personal diatribe about Taylor Swift and Travis Kelce. I got no beef with either of these two crazy kids. Swift is one of the hardest-working entertainers in show business, and Kelce is one of the greatest tight ends to ever play pro football. They’re more than welcome to fall in love, and Swift is more than welcome to pen songs about her man’s girthy member. The pair are also free to tie the knot anytime, and anywhere, they like. Except for …

One of the biggest events of the summer has been a mystery: When and where are Taylor Swift and Travis Kelce getting married? And when does everyone get to celebrate?

New details confirmed by The New York Times suggest a multiple-day event at Madison Square Garden, which an entertainment industry executive said Ms. Swift had rented.

The entertainment industry executive and another person with knowledge of the matter described the anticipated festivities: On July 2, the plans call for an intimate gathering of about 100 people at the Garden. The next day on July 3, about 1,000 guests would gather there for a splashier celebration, with possible stage appearances.

Seriously? You two are getting married at Madison Square fucking Garden? YOU FUCKING ASSHOLES.

Never mind the Supreme Court upholding birthright citizenship — that was a foregone conclusion given that it is a totally unambiguous provision of the Constitution (although three Republican justices voted against it!). The important decision was handed down yesterday, when the Court, ruling on the Slaughter case — brought on behalf of an FTC commissioner arbitrarily fired by Donald Trump — overturned 90 years of precedent to give Trump dictatorial power over the regulatory machinery of the US government. The Court has now stripped regulatory agencies of their independence from Trump’s whims and corrupt practices. Even for an agency created by Congress with a specific mandate and responsibilities, Trump is now free to direct that agency to do something completely different, to fire any civil servants who don’t do whatever he wants, or to completely gut it so that it is unable to serve its function.

Notice that I said that Trump has been given dictatorial power. There have been many comments to the effect that a future Democratic president could make extensive use of these new powers, but this Court is utterly partisan. The moment a Democrat takes office, it will instantly decide that he or she has almost no discretionary power.

Various MAGA-adjacent parties, along with willfully blind centrists, are trying to sweep this ruling under the rug, hoping that the public doesn’t understand its meaning. In fact, even I am startled that the Wall Street Journal, whose reporting is normally excellent, barely mentions this astonishing act of Trump empowerment in its news section. Instead, it has posted only a misleading editorial, repeating the tendentious legal arguments of the Roberts radicals.

But you don’t have to take my word for how much this travesty matters. As the screenshot at the top of this post shows, the wannabe dictator is fully aware of how much the Roberts Court has undermined democracy in his favor. And he’s celebrating.

What I want to do in today’s post is enlarge on why Slaughter matters — and just how bad it is.

First, this decision is (almost) all about enabling corruption. Yes, there are ideological and policy aspects. But this Court decision is fundamentally about empowering Trump, not the presidency in general. And we know who and what Trump is. The normally soft-spoken Jared Bernstein says it clearly:

[G]iving this president such carte blanche is crazy. Name one firing or removal he’s made or attempted to make that was motivated by anything other than personal retribution, prejudice (it is not a coincidence that Lisa Cook is a Black woman), or personal greed.

The Court’s decision effectively eliminates government by professional civil servants who do their best to implement the law with government by henchmen and lackeys who will do whatever Dear Leader wants. And what he wants depends, above all, on who is most willing and able to enrich him, his family, and his cronies.

In my conversation with Lisa Graves posted yesterday, she gave the example of Jeff Yass, a billionaire who clearly purchased a complete reversal of Trump’s position on TikTok. The same has been true, on an even bigger scale, for policy toward cryptocurrency — which Trump denounced until it became clear that crypto was a way for corporations and super-rich individuals to funnel billions of dollars directly to him and his family.

Second, the Court’s sort-of carve-out for the Federal Reserve — for which, for the moment, the Court has preserved some of the protections the whole government had until now — looks even more hypocritical once we recognize the centrality of the issue of corruption.

As many people have noted, there is no conceivable argument under which the independence of monetary policy is somehow more sacred than the independence of regulation of critical areas such as antitrust policy, environmental policy, food and drug standards, and air safety.

Beyond that, Fed policy stands out as an arena in which the scope for corruption is relatively limited. While the Fed does play a role as a financial regulator, its key job is interest rate policy — and that’s basically choosing the setting on a single dial, with no room for favoritism. When the Fed raises rates, it raises rates for everyone, when it cuts rates it cuts them for everyone, with no way to exempt Trump cronies from rate hikes or give them selective rate cuts.

By contrast, the Federal Trade Commission can selectively reward some corporations by granting approval for the mergers they want while selectively punishing some corporations by denying approval for mergers. The Environmental Protection Agency can waive pollution regulations for some companies while enforcing them for others. And so on. And we know exactly what will determine which companies get favored treatment: It will be all about who greases Trump’s palm and puffs up his ego.

Why, then, give the Fed special treatment? Probably because the Court feared the market reaction if it allowed Trump to take immediate control. The Wall Street Journal editorial openly acknowledged this concern, explaining the carve-out for the Fed by saying: “the Chief and Justice Kavanaugh made the pragmatic judgment that they simply don’t trust Mr. Trump to run monetary policy.” But the last time I looked at the Constitution there wasn’t a special “unless it adversely affects the stock market” clause. Evidently, the Journal editorial board thinks it is only the little people who will be victims of Trump’s destruction of America’s regulatory institutions, while those who have big stock portfolios will be A-okay.

And they might be right given the trends in our economy. A headline in yesterday’s Journal:

“Resilient” is one way to put it. But who pays for this “resilience”? Profits have been soaring even as many workers’ wages fail to keep up with inflation. Indeed, profits as a share of national income keep rising:

It’s highly likely that a significant fraction of this rise reflects increased monopoly profits in an age of enshittification and the destruction of workers’ rights. And a major share of the rise in monopoly profits has, in turn, gone to enrich America’s oligarch class — the same class that is generously sharing some of its wealth with Trump and his family, in return for the favors. Now, thanks to the Supreme Court, he can grant those favors free from legal restraint, as he completes his evisceration of the Federal Trade Commission — which is supposed to limit monopoly power — and the National Labor Relations Board, which is supposed to protect workers’ rights.

The stench of corruption and dictator-worship is overpowering.

NONMUSICAL CODA

The next three days are the anniversary of the battle of Gettysburg — days that deserve to be remembered. July 1: