Crypto-Gram
January 15, 2026

by Bruce Schneier
Fellow and Lecturer, Harvard Kennedy School
schneier@schneier.com
https://www.schneier.com

A free monthly newsletter providing summaries, analyses, insights, and
commentaries on security: computer and otherwise.

For back issues, or to subscribe, visit Crypto-Gram's web page.

Read this issue on the web

These same essays and news items appear in the Schneier on Security blog, along
with a lively and intelligent comment section. An RSS feed is available.

** *** ***** ******* *********** *************

In this issue:

If these links don't work in your email client, try reading this issue of
Crypto-Gram on the web.

Against the Federal Moratorium on State-Level Regulation of AI
Chinese Surveillance and AI
Deliberate Internet Shutdowns
Someone Boarded a Plane at Heathrow Without a Ticket or Passport
AI Advertising Company Hacked
Microsoft Is Finally Killing RC4
Denmark Accuses Russia of Conducting Two Cyberattacks
Urban VPN Proxy Surreptitiously Intercepts AI Chats
IoT Hack
Are We Ready to Be Governed by Artificial Intelligence?
Using AI-Generated Images to Get Refunds
LinkedIn Job Scams
Flock Exposes Its AI-Enabled Surveillance Cameras
Telegram Hosting World's Largest Darknet Market
A Cyberattack Was Part of the US Assault on Venezuela
The Wegman's Supermarket Chain Is Probably Using Facial Recognition
AI & Humans: Making the Relationship Work
Palo Alto Crosswalk Signals Had Default Passwords
Corrupting LLMs Through Weird Generalizations
1980s Hacker Manifesto
Upcoming Speaking Engagements
Hacking Wheelchairs over Bluetooth
** *** ***** ******* *********** *************

Against the Federal Moratorium on State-Level Regulation of AI

[2025.12.15] Cast your mind back to May of this year: Congress was in the throes
of debate over the massive budget bill. Amidst the many seismic provisions,
Senator Ted Cruz dropped a ticking time bomb of tech policy: a ten-year
moratorium on the ability of states to regulate artificial intelligence. To
many, this was catastrophic. The few massive AI companies seem to be swallowing
our economy whole: their energy demands are overriding household needs, their
data demands are overriding creators' copyright, and their products are
triggering mass unemployment as well as new types of clinical psychoses. In a
moment where Congress is seemingly unable to act to pass any meaningful consumer
protections or market regulations, why would we hamstring the one entity
evidently capable of doing so -- the states? States that have already enacted
consumer protections and other AI regulations, like California, and those
actively debating them, like Massachusetts, were alarmed. Seventeen Republican
governors wrote a letter decrying the idea, and it was ultimately killed in a
rare vote of bipartisan near-unanimity.

The idea is back. Before Thanksgiving, a House Republican leader suggested they
might slip it into the annual defense spending bill. Then, a draft document
leaked outlining the Trump administration's intent to enforce the state
regulatory ban through executive powers. An outpouring of opposition (including
from some Republican state leaders) beat back that notion for a few weeks, but
on Monday, Trump posted on social media that the promised Executive Order is
indeed coming soon. That would put a growing cohort of states, including
California and New York, as well as Republican strongholds like Utah and Texas,
in jeopardy.

The constellation of motivations behind this proposal is clear: conservative
ideology, cash, and China.

The intellectual argument in favor of the moratorium is that "freedom"-killing
state regulation on AI would create a patchwork that would be difficult for AI
companies to comply with, which would slow the pace of innovation needed to win
an AI arms race with China. AI companies and their investors have been
aggressively peddling this narrative for years now, and are increasingly backing
it with exorbitant lobbying dollars. It's a handy argument, useful not only to
kill regulatory constraints, but also -- companies hope -- to win federal
bailouts and energy subsidies.

Citizens should parse that argument from their own point of view, not Big
Tech's. Preventing states from regulating AI means that those companies get to
tell Washington what they want, but your state representatives are powerless to
represent your own interests. Which freedom is more important to you: the
freedom for a few near-monopolies to profit from AI, or the freedom for you and
your neighbors to demand protections from its abuses?

There is an element of this that is more partisan than ideological. Vice
President J.D. Vance argued that federal preemption is needed to prevent
"progressive" states from controlling AI's future. This is an indicator of
creeping polarization, where Democrats decry the monopolism, bias, and harms
attendant to corporate AI and Republicans reflexively take the opposite side. It
doesn't help that some in the parties also have direct financial interests in
the AI supply chain.

But this does not need to be a partisan wedge issue: both Democrats and
Republicans have strong reasons to support state-level AI legislation. Everyone
shares an interest in protecting consumers from harm created by Big Tech
companies. In leading the charge to kill Cruz's initial AI moratorium proposal,
Republican Senator Masha Blackburn explained that "This provision could allow
Big Tech to continue to exploit kids, creators, and conservatives? we can't
block states from making laws that protect their citizens." More recently,
Florida Governor Ron DeSantis wants to regulate AI in his state.

The often-heard complaint that it is hard to comply with a patchwork of state
regulations rings hollow. Pretty much every other consumer-facing industry has
managed to deal with local regulation -- automobiles, children's toys, food, and
drugs -- and those regulations have been effective consumer protections. The AI
industry includes some of the most valuable companies globally and has
demonstrated the ability to comply with differing regulations around the world,
including the EU's AI and data privacy regulations, substantially more onerous
than those so far adopted by US states. If we can't leverage state regulatory
power to shape the AI industry, to what industry could it possibly apply?

The regulatory superpower that states have here is not size and force, but
rather speed and locality. We need the "laboratories of democracy" to experiment
with different types of regulation that fit the specific needs and interests of
their constituents and evolve responsively to the concerns they raise,
especially in such a consequential and rapidly changing area such as AI.

We should embrace the ability of regulation to be a driver -- not a limiter --
of innovation. Regulations don't restrict companies from building better
products or making more profit; they help channel that innovation in specific
ways that protect the public interest. Drug safety regulations don't prevent
pharma companies from inventing drugs; they force them to invent drugs that are
safe and efficacious. States can direct 
--- FMail-lnx 2.3.2.6-B20251227
 * Origin: TCOB1 A Mail Only System (618:500/1)