What the rise, fall, and rapid rebirth of eXch tells us about the real shape of crypto crime in 2026

Every few months, a crypto exchange gets “shut down.” Headlines run. LinkedIn fills with hot takes. And then, quietly, the money keeps moving. That’s the story I want to walk through today — not as a hypothetical, but as a documented pattern, backed by the two firms that actually trace this money for a living: TRM Labs and Chainalysis.

Throughout my career in technology governance, cyber risk, enterprise transformation, and technology leadership, this case study has become one of the clearest examples of a lesson every risk leader eventually learns: shutting down a bad actor is not the same as dismantling the capability behind it.

The Exchange That Wouldn’t Stay Dead:

eXch was a no-questions-asked crypto swap service. No ID verification. No meaningful compliance program. It marketed that absence as a feature — a “privacy project,” as it called itself — rather than what regulators would call it: a gap.

That gap became national news in February 2025, when North Korea’s Lazarus Group pulled off the largest crypto theft in history: roughly $1.4–1.5 billion in Ethereum (ETH), stolen from the Bybit exchange.1 Bybit and blockchain investigators — Elliptic, TRM, and independent researcher ZachXBT — all pointed to the same off-ramp: eXch allegedly helped launder more than $90 million of it.2

eXch’s owner, publicly known only as “Johann Roberts,” denied it, then partly admitted it, then blamed a slow compliance data feed. For what it’s worth, I looked for a verified real identity behind that name while researching this piece. I couldn’t find one. Treat it as an alias until proven otherwise.

In April 2025, eXch announced it was shutting down — citing, of all things, a DOJ whistleblower and a “transatlantic law enforcement operation.” Here’s the part almost nobody covered: it didn’t actually stop. TRM Labs found that eXch pulled its public website but kept serving business partners through an API, with the same laundering fingerprints continuing right past its own announced shutdown date.3

This Isn’t One Bad Exchange; it’s a Lineage:

If eXch feels like an isolated case, look at what happened to Garantex, the Russian exchange sanctioned back in 2022 for laundering funds tied to darknet markets and ransomware groups like Conti and Hydra. Law enforcement finally seized it in March 2025 — after it had processed an estimated $96 billion since 2019, with at least $1.3 billion of that tied directly to criminal activity.4

What happened next is the whole point of this article. Garantex didn’t disappear. It became Grinex — same liquidity, same users, same money, new name. Then Chainalysis and TRM traced the same pattern into ABCeX and its rebrand AEXBit (identical backend infrastructure, shared hot wallets), the A7/A7A5 payment network ($93.3 billion in on-chain volume and counting), and Heleket — a “new” service that received its opening liquidity directly from Garantex’s own wallets.5

TRM’s own read on this, stated plainly in their 2026 report: this wave of rebrands is likely coordinated — an attempt to keep Russia’s crypto liquidity flowing while insulating the actual operators from further sanctions.1 For what it’s worth, Grinex itself reportedly went dark in April 2026 after a $13.7 million cyberattack. I’d bet money there’s already a successor.4

The Bigger Story Nobody’s Talking About Enough:

Here’s what I think most crypto-crime coverage still misses: individual rogue exchanges, however dramatic, are no longer the main event.

Both TRM and Chainalysis now point to something structurally different — Chinese-language money laundering networks, or CMLNs. In 2025 alone, these networks moved an estimated $16.1 billion — about $44 million a day — across nearly 1,800 active wallets. That’s not a typo: Chainalysis measured CMLN growth at roughly 7,325 times the growth rate of illicit inflows to centralized exchanges since 2020.6

The anchor of this ecosystem is Huione Group, a Cambodian conglomerate that took in over $98 billion in crypto between August 2021 and January 2025 — more than $4 billion of it confirmed illicit. In October 2025, the U.S. Treasury’s FinCEN designated Huione under Section 311 of the Patriot Act as a primary money laundering concern. Huione is also directly tied to Prince Group, the Cambodia-based criminal network behind a sprawling web of scam compounds across Southeast Asia.7

Why does this matter more than another exchange takedown? Because CMLNs aren’t one company you can seize. They’re a marketplace — fragmentation services, OTC desks, “guarantee” platforms like Huione and Xinbi that connect buyers and sellers of laundering capacity without necessarily touching the illicit funds themselves. Sanction one vendor, and the marketplace barely notices.6

Ransomware Isn’t Slowing Down — It’s Diversifying:

A few numbers that stuck with me from Chainalysis’s ransomware-specific analysis: data-leak-site-claimed ransomware incidents grew 50% year-over-year in 2025, an all-time high, even as enforcement intensified. The Ransomware-as-a-Service market itself has fragmented into as many as 85 active independent extortion groups — harder to track as a whole, even as their individual laundering habits become more identifiable on-chain.8

Final-stage laundering increasingly runs through no-KYC exchanges (up 82%) and “guarantee” aggregators like Tudou Danbao (up 87%). Interestingly, North Korean state actors use no-KYC exchanges noticeably less than independent cybercriminals do — a sign that DPRK runs its own specialized, tightly controlled pipeline through CMLNs and bridge protocols, rather than mixing in with the same rogue exchanges everyone else uses.8

And enforcement is starting to catch up to the infrastructure layer, not just the exchanges. OFAC, alongside the UK and Australia, sanctioned Zservers and Aeza Group in 2025 — Russian “bulletproof hosting” providers that knowingly host ransomware infrastructure. Zservers alone funneled at least $5.2 million through high-risk channels including Garantex.4

What This Actually Means:

If you take one thing from this: the “shut it down” model of enforcement works — temporarily. eXch kept running through its own back door. Garantex became Grinex became ABCeX became AEXBit. The harder, more important fight is against the marketplace model — CMLNs, guarantee platforms, and the hosting infrastructure underneath all of it — which doesn’t have one throat to choke.

The good news, and it’s real: blockchain transparency is still the investigators’ structural advantage. The same on-chain fingerprinting — shared wallets, co-spending patterns, infrastructure overlap — that unmasked ABCeX as a Garantex clone will eventually do the same to whatever comes after Grinex, and whatever comes after that.

This case study reflects the type of governance-under-adversarial-pressure challenge I frequently research and write about: how do we design governance, oversight, and risk management frameworks for ecosystems that are intentionally engineered to evade them? Addressing that challenge will require a coordinated, multi-layered approach — including end-to-end mapping of cryptocurrency transaction chains, stronger Know Your Customer (KYC) and Anti-Money Laundering (AML) controls, improved multinational cooperation among regulators and law enforcement, more robust misuse-case modeling to anticipate adversarial behavior, and broader identification and blacklisting of high-risk exchanges, wallets, and tokens that repeatedly facilitate illicit finance.

References:

1. TRM Labs, “2026 Crypto Crime Report” (TRM Labs, 2026), https://www.trmlabs.com/reports-and-whitepapers/2026-crypto-crime-report.

2. Decrypt, The Block, and CryptoRank.io, contemporaneous news coverage of the Bybit hack and eXch’s role in laundering stolen funds, February–March 2025.

3. TRM Labs, “eXch Remains Active Despite Shutdown: How the Bybit Hack-Linked Exchange Continues to Enable Laundering of CSAM Funds” (TRM Labs Blog, May 2, 2025), https://www.trmlabs.com/resources/blog.

4. Chainalysis, “OFAC Sanctions Tracker: How Sanctions Impact Crypto Crime” (Chainalysis Blog), https://www.chainalysis.com/blog/ofac-sanctions/.

5. TRM Labs, “2026 Crypto Crime Report” (TRM Labs, 2026), https://www.trmlabs.com/reports-and-whitepapers/2026-crypto-crime-report.

6. Chainalysis, “The Chinese-Language Underground Crypto Money Laundering Ecosystem” (Chainalysis Blog, January 27, 2026), https://www.chainalysis.com/blog/2026-crypto-money-laundering/.

7. Chainalysis, “Crypto Sanctions: 2026 Crypto Crime Report” (Chainalysis Blog, 2026), https://www.chainalysis.com/blog/crypto-sanctions-2026/.

8. Chainalysis, “Crypto Ransomware: 2026 Crypto Crime Report” (Chainalysis Blog, March 4, 2026), https://www.chainalysis.com/blog/crypto-ransomware-2026/.

From Mythos to Mechanics: How Frontier AI Policy Shifts Are Rewriting Enterprise Governance

Fig. 1. Infographic Title: From Mythos to Mechanics, Generic/Rights Free, Jeremy Swenson, 2026.

The recent decision to lift restrictions on advanced model deployments from Anthropic represents more than a policy adjustment or regulatory softening. It signals a deeper transition in how frontier AI systems are being treated by governments, enterprises, and oversight bodies: not as static technologies that can be approved or denied once, but as dynamic systems whose behavior, risk profile, and operational impact evolve continuously over time. The significance of this shift is not fully captured in headlines focused on access restoration. Instead, it lies in the subtle but consequential rebalancing of responsibility—from centralized gatekeepers to distributed operators embedded inside enterprise systems.¹

This shift is unfolding alongside a broader geopolitical reclassification of AI systems as controlled strategic infrastructure. As reported by Forbes, the U.S. administration recently lifted export controls on Anthropic’s Mythos 5 and Fable 5 models following a period of heightened national security concern and temporary suspension of access.² Reuters similarly reports that this pattern reflects a new regulatory rhythm: rapid restriction, negotiated mitigation, and conditional restoration rather than permanent prohibition.³ These oscillations are not anomalies—they are becoming the governing structure itself.

At the same time, this policy volatility is occurring against a broader global consolidation of scientific consensus on AI risk. The International AI Safety Report 2026 emphasizes that AI capabilities are advancing faster than safety practices and institutional governance can reliably track.⁴ The report highlights that frontier systems are increasingly autonomous in workflow execution, capable of multi-step reasoning, and difficult to evaluate using static benchmarks alone.⁴ Importantly, it concludes that governance systems are now largely reactive rather than anticipatory, with safety controls lagging behind deployment realities.⁴

More critically, the report identifies a structural mismatch between capability growth and institutional oversight capacity. It notes that frontier AI systems are not improving linearly, but through discontinuous capability jumps driven by scaling, tool use, and inference-time computation.⁴ This creates evaluation blind spots where systems appear safe in testing environments but exhibit materially different behaviors once deployed.

At the core of this transition is a change in what “control” means. Earlier governance models around frontier AI were built on relatively familiar assumptions drawn from software regulation, export controls, and cloud security certification regimes. If a system passed evaluation thresholds, it could be deployed; if it failed, it was restricted or segmented. That logic worked reasonably well when system behavior was stable, deterministic, and tightly scoped. However, frontier AI systems increasingly violate those assumptions. Their outputs are probabilistic, their capabilities shift with prompting techniques, and their risk surfaces expand as they are embedded into broader enterprise ecosystems.⁴

The International AI Safety Report explicitly warns that pre-deployment evaluation alone is insufficient for safety assurance, particularly in systems with tool access, memory, or agentic capabilities.⁴ It recommends continuous post-deployment monitoring as a core governance requirement rather than an optional enhancement.

What emerges instead is a governance posture that resembles continuous assurance rather than static certification. Access becomes conditional, contextual, and dynamic. The report emphasizes the importance of real-world monitoring systems capable of detecting behavioral drift and emergent capabilities after deployment, reinforcing the idea that governance must move into runtime systems rather than remain in pre-release gates.⁴

As these systems return to broader availability, another structural shift becomes visible: the migration of governance responsibility away from regulators and model developers and into enterprise architecture itself. Historically, AI safety and capability constraints were enforced upstream. That separation is eroding rapidly.

Reuters reporting on export control reversals underscores how government decisions are now shaping model availability in near real time, creating a governance environment defined by rapid policy iteration rather than stable regulation.³ Meanwhile, the International AI Safety Report highlights that this instability is mirrored in deployment environments, where inconsistent governance maturity across organizations and jurisdictions creates asymmetric risk exposure.⁴

This downstream shift places new pressure on enterprise functions simultaneously. Cybersecurity teams must model AI behavior as part of threat landscapes. Third-party risk teams must evaluate emergent model behavior, not just vendor controls. Data governance teams must account for indirect leakage pathways through prompts and outputs. Product teams now actively shape risk through interface design, workflow orchestration, and agentic integration choices.

The International AI Safety Report reinforces this transformation by documenting how frontier AI systems are increasingly deployed in agentic configurations, where models execute multi-step tasks, use external tools, and operate with partial autonomy.⁴ These systems blur the line between software and actor, fundamentally altering traditional control assumptions.

Compounding this challenge is the fact that frameworks such as NIST AI RMF and ISO/IEC 42001 assume bounded, testable system behavior. The International AI Safety Report directly challenges this assumption, noting that emergent behaviors often appear only after real-world deployment under complex and shifting conditions.⁴

In cybersecurity contexts, this shift is already visible. The report documents growing evidence of AI systems being used for vulnerability discovery, phishing automation, and large-scale social engineering.⁴ These are not hypothetical risks—they are operational realities emerging in parallel with deployment expansion.

One of the most important but least discussed consequences of this shift is the transformation of AI systems into dynamic or “living” risk surfaces. Unlike traditional software, which changes primarily through version updates, AI systems can change behavior based on context, tool access, and input distribution.⁴ A retrieval-augmented system, for example, may introduce entirely different risk profiles than a base model operating in isolation.

The International AI Safety Report characterizes this as a form of non-stationary risk, where the system being evaluated is not stable over time.⁴ This fundamentally breaks traditional assumptions of static risk modeling. This introduces a shift in security thinking itself. Organizations must move from vulnerability-centric models to behavior-centric models. Weaknesses are no longer purely code-based—they are emergent, interaction-driven, and context-dependent.⁴

From a strategic perspective, the most important implication of expanded frontier model availability is not technical—it is competitive. Organizations that successfully integrate continuous AI governance into operational systems will deploy faster, scale broader, and take more strategic risk safely. Those that treat governance as a bottleneck will slow precisely when speed becomes advantage.

The International AI Safety Report explicitly identifies governance maturity and institutional readiness as key limiting factors in safe AI adoption at scale.⁴ This makes governance capability—not model access—the primary differentiator in enterprise AI maturity.

The next evolution of this landscape is the emergence of an AI control plane architecture: a unified layer that governs model access, routing, policy enforcement, behavioral monitoring, and auditability across environments. In this model, governance becomes infrastructure rather than documentation.

This represents a deeper shift in control theory itself. Static rules give way to continuous negotiation between capability and constraint. Periodic review gives way to continuous observation. Tools become ecosystems.

The lifting of restrictions on advanced models is therefore not an endpoint, but an early signal of a broader transition toward normalized frontier AI deployment under continuous governance conditions. The International AI Safety Report makes clear that this transition is already underway, driven by accelerating capabilities, uneven institutional readiness, and widening oversight gaps.⁴ The organizations that adapt early will not simply comply with this environment—they will define it.

Mitigation & Operational Readiness Playbook:

To translate the governance shift described in this analysis into actionable enterprise capability, organizations must move beyond fragmented controls and toward continuous, behavior-aware AI governance. The first priority is implementing continuous AI behavior monitoring. Rather than treating model evaluation as a pre-deployment checkpoint, enterprises need to track model outputs over time to detect drift, anomalies, and unexpected capability emergence. This effectively reframes AI telemetry as a core security signal, similar in importance to identity logs or network activity, rather than a secondary analytics layer.

In parallel, organizations must establish AI-specific threat modeling practices. Traditional cybersecurity frameworks are insufficient on their own because they assume deterministic system behavior. AI systems introduce new threat vectors such as prompt injection, tool misuse, data exfiltration through outputs, and unintended agentic behavior. These must be explicitly integrated into threat models, extending existing methodologies to account for probabilistic and context-sensitive system responses.

A critical structural requirement is the deployment of an AI control plane architecture. This layer should centralize governance across all models, vendors, and deployment environments. It should enforce consistent policy controls governing access, tool usage, and data exposure while enabling dynamic routing of model requests based on sensitivity, risk tier, and operational context. Without this unified control layer, organizations will struggle to maintain coherent governance across increasingly distributed AI systems.

Data boundary enforcement for large language model interactions also becomes essential. Sensitive information must be prevented from entering prompts unless properly classified and authorized, and all prompt and response flows should be logged to ensure auditability. In practice, this requires extending data loss prevention (DLP) concepts into generative AI pipelines, where the boundary between input, processing, and output is far more fluid than in traditional systems.

Organizations should also adopt post-deployment evaluation frameworks that move beyond static approval cycles. Instead of relying on one-time certification, AI systems must undergo continuous reassessment through red-teaming, adversarial testing, and behavior evaluation in production-like conditions. This allows organizations to identify emergent risks that only appear after models are exposed to real-world inputs, evolving workflows, and integrated toolchains.

Third-party risk management functions must also evolve. Vendor assessment can no longer focus solely on security posture, compliance checklists, or infrastructure controls. It must incorporate behavioral risk—how models actually perform once deployed in dynamic environments. This includes understanding update cycles, tool integrations, and the degree of transparency vendors provide around model behavior and safety limitations.

Agentic workflows represent another critical area of hardening. As models increasingly perform multi-step tasks and interact with external systems, organizations must enforce least-privilege principles on tool access and require human-in-the-loop controls for high-risk actions. These workflows should also be fully logged and treated as security-relevant events, enabling retrospective analysis of autonomous or semi-autonomous decision paths.

At a structural level, AI governance ownership must be elevated to the architectural tier of the enterprise. Responsibility should not be fragmented across cybersecurity, compliance, and product teams, but instead unified within enterprise architecture or security engineering functions that can enforce consistent governance patterns across systems. This alignment is necessary to avoid gaps created by siloed decision-making in highly interconnected AI environments.

Finally, organizations must develop dedicated AI incident response capabilities. These playbooks should define clear escalation paths for model misuse, anomalous behavior, or data leakage events involving AI systems. They should also include operational mechanisms for rapid rollback of model versions, disabling of tool integrations, and containment of affected workflows. In an environment where AI systems are continuously evolving, response speed becomes a critical determinant of organizational resilience.

Endnotes:

  1. Anthropic, frontier model deployment and safety policy communications, 2026.
  2. Siladitya Ray, “Trump Administration Lifts Export Controls on Anthropic’s Mythos 5 and Fable 5 AI Models,” Forbes, July 1, 2026, https://www.forbes.com/sites/siladityaray/2026/07/01/trump-administration-lifts-export-controls-on-anthropics-mythos-5-and-fable-5-ai-models/.
  3. Reuters, “U.S. Lifts Export Controls on Frontier AI Models Following Security Review,” June 2026.
  4. International AI Safety Report, International AI Safety Report 2026 (London: DSIT and international expert consortium, 2026), https://internationalaisafetyreport.org/.
  5. Siladitya Ray, Forbes reporting on U.S. frontier AI policy shift and export control reversal, 2026.

From Mythos to Fable: What Business Leaders Must Learn from the New AI Governance Crisis

Anthropic Claud Mythos InfoSec Infographic, generic rights-free, 2026.

The Mythos Moment Just Got Bigger

A few weeks ago, Anthropic’s Mythos model was being celebrated as a breakthrough in AI-enabled cybersecurity. Reports suggested it could identify software vulnerabilities at unprecedented speed, accelerate remediation efforts, and potentially transform how organizations secure critical infrastructure. Some observers described it as one of the most capable cyber-focused AI systems ever developed.¹

Today, the conversation looks very different. The White House has ordered Anthropic to suspend access to Mythos 5 and Fable 5 for foreign nationals, citing national security concerns. Reports indicate that government officials were concerned not only about potential jailbreak vulnerabilities but also about the possibility that a China-linked group may have accessed the models.² The administration reportedly fears that advanced frontier models could be reverse-engineered through model distillation techniques, allowing strategic competitors to replicate key capabilities.³

Whether those concerns ultimately prove justified is almost beside the point. For business leaders, the real lesson is not about Anthropic. It is about the future of AI itself. The Mythos controversy signals that AI governance is rapidly evolving from a technology management issue into a business resilience, geopolitical risk, and digital supply chain challenge.⁴

The New Reality: AI Is Becoming Strategic Infrastructure

For years, organizations treated cloud computing as utility infrastructure. Access was largely assumed. The same cloud services were available whether you were in Minneapolis, Mumbai, London, or Singapore. Artificial intelligence appeared to be following a similar trajectory.

That assumption may no longer hold. The government’s restrictions on Mythos and Fable represent one of the first major examples of an advanced AI model being treated more like sensitive defense technology than commercial software.⁵ In effect, policymakers are beginning to ask whether some AI systems should be governed similarly to advanced semiconductors, encryption technologies, or military capabilities.

If that trend continues, organizations may find that access to critical AI capabilities can be restricted, delayed, licensed, monitored, or even revoked based on national security considerations.⁶ That should concern every executive currently building long-term business strategies around AI-enabled operations.

Why Business Leaders Should Care

Many executives may be tempted to dismiss the Mythos controversy as a dispute between Anthropic and the federal government. That would be a mistake. The more important story is not whether Anthropic’s safeguards were sufficiently robust or whether a jailbreak vulnerability actually existed. The real story is that organizations are rapidly becoming dependent on AI systems they do not own, cannot fully inspect, and may not always be able to access.

Imagine investing millions of dollars to integrate a frontier AI model into cybersecurity operations, software development, customer service, fraud detection, or enterprise decision-making, only to discover that access has been restricted due to a government directive, geopolitical concerns, export controls, or actions taken by the model provider itself. What appeared to be a stable technology platform can quickly become a strategic dependency.⁷

This is precisely why the Mythos situation deserves attention from boards, executives, and risk leaders. The disruption was not caused by a system outage, ransomware attack, or cloud failure. Instead, it emerged from a combination of national security concerns, policy decisions, and uncertainty surrounding advanced AI capabilities. These are risks that many organizations have not yet incorporated into their enterprise risk management programs.⁸

Historically, leaders worried about disruptions involving suppliers, cloud providers, telecommunications carriers, or critical software vendors. Frontier AI models now belong in that same category. Organizations increasingly depend upon a relatively small number of providers for advanced AI capabilities, creating concentration risks that may become more significant as AI becomes embedded in core business processes.⁹

Endnotes

  1. Anthropic, Project Glasswing Technical Findings, June 2026.
  2. Terrence O’Brien, “China May Have Accessed Mythos,” The Verge, June 14, 2026.
  3. Ibid.
  4. Kristian McCann, “Why the US Restricted Anthropic’s Mythos and Fable and What It Means for AI Access,” June 15, 2026.
  5. Hadas Gold, “Anthropic Suspends All Access to Mythos Model After US Government Bans Foreign Nationals Use,” CNN, June 13, 2026.
  6. McCann, “Why the US Restricted Anthropic’s Mythos and Fable.”
  7. Gold, “Anthropic Suspends All Access to Mythos Model.”
  8. O’Brien, “China May Have Accessed Mythos”; Gold, “Anthropic Suspends All Access to Mythos Model.”
  9. McCann, “Why the US Restricted Anthropic’s Mythos and Fable.”

The Mythos Moment: Why AI Cyber Capabilities Just Crossed the Governance Rubicon

Fig. 1. How Mythos Evolved to Become a Recursive Threat, ChatGPT and Jeremy Swenson, 2026.

In April 2026, a quiet but profound shift occurred in cybersecurity—one that many organizations are still underestimating. Anthropic’s Claude Mythos Preview did not simply advance AI capability. It crossed a threshold. For the first time, a commercially developed model demonstrated the ability to autonomously discover and exploit software vulnerabilities at a near-expert level, including executing multi-step attack chains end-to-end.¹²

This is not incremental progress. It is a structural break. And with that break comes a new reality: the governance, security, and policy frameworks we have relied on are no longer theoretical exercises. They are operational requirements.

From Capability to Consequence—The End of the “Future Risk” Debate:

For years, discussions about AI-enabled cyber offense lived in the realm of hypotheticals—what could happen if models became sufficiently capable. That debate is now over. Mythos achieved a 73% success rate on expert-level capture-the-flag challenges and became the first AI system to complete a full 32-step enterprise network attack simulation.¹ What previously required elite human operators over many hours can now be partially automated.

At the same time, real-world testing has already shown that similar systems can uncover large volumes of previously unknown vulnerabilities. Reports indicate thousands of zero-day findings—including flaws that persisted undetected for decades—are now within reach of AI-assisted discovery.⁹ External validation reinforces this trajectory. A collaboration involving Mozilla used Mythos-like capabilities to identify hundreds of vulnerabilities in Firefox, demonstrating how quickly defensive gains—and offensive risks—can scale simultaneously. This dual-use dynamic is the defining characteristic of the Mythos moment: the same system that strengthens defense can accelerate exploitation.

The Government Contradiction—Risk, Reliance, and Reality:

What makes this moment even more consequential is not just the technology, but the policy response. In March 2026, the U.S. Department of Defense designated Anthropic as a supply chain risk after the company refused to allow unrestricted use of its models for autonomous weapons and surveillance applications.³ This effectively barred Anthropic from Pentagon contracts.

Yet within weeks, reporting confirmed that the National Security Agency—which operates within the same defense ecosystem—was actively using Mythos under controlled access.⁵⁶ At the same time, the Office of Management and Budget began negotiating a framework to deploy a modified version of the model across civilian agencies, including energy and financial regulators.⁷

This creates a striking contradiction:

  • One part of government labels the system a national security risk.
  • Another part actively deploys it.
  • A third is designing policy to scale its adoption.

This is not just bureaucratic inconsistency—it is a preview of how difficult governing frontier AI will be.

The Real Precedent—Governing AI as a Cyberweapon:

What is being negotiated right now matters far beyond Mythos itself. The White House–led framework under development is effectively the first attempt to govern an AI system with cyberweapon-level capabilities, not just data privacy or model safety.

Three emerging principles define this model:

1. Data Sovereignty Sensitive code and infrastructure data must remain within isolated government-controlled environments.

2. Model Integrity Inputs cannot be used to retrain or improve the underlying model, preventing unintended knowledge transfer.

3. Human-in-the-Loop Oversight No autonomous execution—human validation remains mandatory before action.

These are not minor guardrails. They represent the likely baseline for how governments—and eventually regulated industries—will manage high-capability AI systems. If history is any guide, these standards will propagate outward, much like FedRAMP reshaped cloud security procurement. Within 12–18 months, similar requirements are likely to appear in enterprise contracts, regulatory expectations, and audit frameworks.

The Industry Signal—This Is Already Scaling:

The private sector is not waiting. Through Project Glasswing, Anthropic has already deployed Mythos capabilities to a controlled group of major technology and infrastructure organizations, including cloud providers, semiconductor firms, and financial institutions.²

At the same time, companies like Microsoft are moving to integrate similar AI-driven vulnerability discovery into their secure development lifecycles, signaling that this capability will become embedded—not optional—in modern engineering practices. The implication is clear. AI-assisted vulnerability discovery is becoming a standard feature of cybersecurity—not an edge capability.

The Hard Truth—Containment Is Likely Temporary:

Perhaps the most important—and uncomfortable—reality is this:

Containment will not hold indefinitely. History shows that advanced AI capabilities diffuse rapidly. Model architectures leak, competitors replicate breakthroughs, and open-weight alternatives emerge. Even today, non-frontier models can replicate meaningful portions of Mythos-like capability at far lower cost and with fewer restrictions.¹⁴ That means the current environment—where only a limited set of organizations have access—is a temporary window. Organizations that treat this as a policy issue rather than an operational priority are making a critical mistake.

What This Means for Enterprise Leaders:

The Mythos precedent is not a niche technical development. It is a strategic inflection point. Three implications stand out:

1. The Attack Surface Is No Longer Static:

AI compresses the timeline between vulnerability discovery and exploitation from weeks or months to hours. Legacy assumptions—especially around “safe” unpatched systems—are no longer valid.

2. Patch Velocity Becomes a Board-Level Issue:

Organizations with slow remediation cycles are structurally exposed. If critical vulnerabilities can be identified and weaponized faster, governance processes must accelerate accordingly.

3. Defense Must Become Structural, Not Reactive:

Emerging approaches like confidential computing—hardware-isolated execution environments—offer a path to reducing the impact of exploits regardless of discovery speed.

In other words, the goal shifts from “find and fix everything” to “limit what can be compromised at runtime.”

The Strategic Window—Act Before the Curve Flattens:

There is still a narrow window of advantage. Today, frontier capabilities are relatively concentrated. Tomorrow, they will not be. Organizations that move now—by modernizing vulnerability management, accelerating patch cycles, and adopting structural defenses—can get ahead of the curve. Those who wait for regulatory clarity or broader market adoption will likely find themselves reacting under pressure.

Final Thoughts—How to Mitigate These Risks Now:

Here are the most practical, high-impact actions organizations can take right now to mitigate risks associated with advanced AI systems, data exposure, and model misuse—especially in light of incidents like large-scale leaks or “model mythos” exposures:

1) Lock Down Data at the Source:

The most immediate risk reducer is controlling what goes into AI systems in the first place.

  • Classify and tier data (public, internal, confidential, restricted).
  • Prohibit sensitive data (e.g., IP, credentials, client info) from being entered into external AI tools.
  • Implement data loss prevention (DLP) policies across endpoints, SaaS, and APIs.
  • Tokenize or anonymize sensitive datasets before AI usage.

2) Enforce Strong Access Controls:

AI systems often inherit weak identity governance from the broader environment.

  • Apply least privilege access to AI tools, datasets, and model pipelines.
  • Require multi-factor authentication (MFA) everywhere AI is accessed.
  • Monitor and restrict API key usage (rotate keys frequently).
  • Segment environments (dev/test/prod) to prevent lateral movement.

3) Introduce AI-Specific Governance:

Traditional IT governance is not sufficient for AI risk.

  • Stand up a lightweight AI governance council (security, legal, data, business).
  • Define acceptable use policies for generative AI tools.
  • Maintain an AI system inventory (models, vendors, datasets, use cases).
  • Require risk assessments before deploying AI into production.

4) Monitor for Data Leakage and Model Abuse:

You can’t protect what you don’t observe.

  • Log all prompts, outputs, and API interactions (where legally permissible).
  • Deploy behavioral analytics to detect unusual model usage patterns.
  • Scan outputs for sensitive data leakage (prompt injection, exfiltration attempts).
  • Red-team models with adversarial testing scenarios.

5) Harden Third-Party and Vendor Risk:

Many AI risks enter through vendors, not internal builds.

  • Conduct AI-focused vendor due diligence (data handling, training sources, retention policies).
  • Require contractual clauses on: Data ownership Model training boundaries Breach notification timelines.
  • Prefer vendors offering private model instances or zero data retention.

6) Implement Prompt and Output Controls:

The interface layer is a major attack surface.

  • Use prompt filtering and sanitization to block injection attempts.
  • Apply output guardrails to prevent harmful or sensitive responses.
  • Restrict high-risk capabilities (e.g., code execution, system access).
  • Use retrieval-augmented generation (RAG) with vetted internal sources only.

7) Train Employees (Fast, Not Perfect):

Human behavior is still the biggest variable.

  • Roll out short, targeted training on: Safe AI usage, Data handling do’s and don’ts, Prompt injection awareness.
  • Provide approved AI tools so employees don’t default to shadow AI.
  • Reinforce “don’t paste what you wouldn’t email externally”.

8) Prepare for Incident Response:

Assume exposure will happen—speed matters.

  • Update incident response plans to include AI-specific scenarios.
  • Define playbooks for: Data leakage via prompts, Model compromise or abuse, Third-party AI breaches.
  • Run tabletop exercises simulating AI-related incidents.

9) Control Model Inputs and Training Data:

What shapes the model shapes the risk.

  • Vet training datasets for: Sensitive information, Copyright/IP exposure, Bias and integrity issues.
  • Maintain data provenance tracking.
  • Avoid uncontrolled fine-tuning on raw internal data.

10) Start Small with Secure Architectures:

Don’t boil the ocean—secure what’s already in motion.

  • Use private or on-prem AI deployments for sensitive workloads.
  • Isolate AI systems within secure cloud environments.
  • Gate external model access through controlled middleware or APIs.
  • Adopt a “human-in-the-loop” approach for high-risk decisions.

Endnotes:

  1. UK AI Security Institute, “Our Evaluation of Claude Mythos Preview’s Cyber Capabilities,” April 2026.
  2. Anthropic, “Project Glasswing: Securing Critical Software for the AI Era,” April 2026.
  3. CNBC, “Judge Presses DOD on Why Anthropic Was Blacklisted,” March 24, 2026.
  4. CNBC, “Anthropic Loses Appeals Court Bid to Temporarily Block Pentagon Blacklisting,” April 8, 2026.
  5. TechCrunch, “NSA Spies Are Reportedly Using Anthropic’s Mythos,” April 20, 2026.
  6. Axios, “NSA Using Anthropic’s Mythos Despite Defense Department Blacklist,” April 19, 2026.
  7. CSO Online, “White House Moves to Give Federal Agencies Access to Anthropic’s Claude Mythos,” April 2026.
  8. Fortune, “Anthropic Acknowledges Testing New AI Model,” March 26, 2026.
  9. TechCrunch, “Anthropic Debuts Preview of Powerful New AI Model Mythos,” April 7, 2026.
  10. Axios, “Anthropic to Have Peace Talks at White House,” April 17, 2026.
  11. CNBC, “Trump Says He Had ‘No Idea’ About White House Meeting,” April 17, 2026.
  12. Washington Post, “Anthropic CEO Visits White House Amid Hacking Fears,” April 17, 2026.
  13. Council on Foreign Relations, “Six Reasons Claude Mythos Is an Inflection Point,” April 2026.
  14. Evron, Mogull, Lee et al., “The AI Vulnerability Storm: Building a Mythos-Ready Security Program,” CSA/SANS/OWASP, April 2026.

Russia’s Sanctions-Busting Cryptocurrency Empire: Architecture, Actors, and the Future of Financial Conflict

Fig. 1. Russia’s Sanctions-busting Cryptocurrency Empire Infographic, Jeremy Swenson via ChatGPT, 2026.


I. Origins of a Parallel Financial System:

The roots of Russia’s sanctions-busting cryptocurrency ecosystem can be traced to the intersection of geopolitical pressure and technological opportunity. While Russia experimented with cryptocurrency policy ambiguity throughout the 2010s, it was the aftermath of the 2022 invasion of Ukraine—and the subsequent exclusion from key parts of the global financial system, including SWIFT—that triggered a structural change. Lacking dollar liquidity and limited by Western banking restrictions, Russian policymakers and aligned financial actors started rapidly developing alternative methods for cross-border settlement (1).

Early efforts were fragmented, consisting of informal networks of exchanges, darknet markets, and capital flight channels. Platforms such as Garantex, founded in 2019, became foundational nodes in this system, allowing users to convert rubles into stablecoins and move funds internationally while avoiding traditional compliance mechanisms (6). Despite sanctions imposed by the U.S. Treasury in 2022, these platforms adapted rapidly, shifting wallets, rebranding, and integrating with crypto mixers to obscure transaction flows (1).

By 2024, Russia had formally embraced cryptocurrency for international trade, legalizing its use in cross-border transactions while maintaining domestic restrictions. This dual posture—restrict internally, exploit externally—laid the groundwork for a state-tolerated, if not state-enabled, shadow financial architecture that would mature rapidly in the years that followed (9).

II. The Rise of A7A5 and the Industrialization of Evasion:

The emergence of the ruble-backed stablecoin A7A5 marked a turning point from opportunistic evasion to industrial-scale financial engineering. Developed through networks linked to sanctioned Russian financial institutions and offshore intermediaries, A7A5 was designed explicitly to bypass Western oversight by enabling direct conversion from rubles into crypto assets and then into globally usable currencies (6).

Unlike decentralized cryptocurrencies such as Bitcoin, A7A5 represents a hybrid model: centralized issuance combined with decentralized transaction pathways. This design allows Russian actors to maintain monetary control while leveraging blockchain’s opacity and global reach. Within its first year, the token processed tens of billions of dollars in transactions, with some estimates approaching $100 billion in cumulative volume—evidence of rapid adoption across trade networks and sanctions-affected industries (4).

Crucially, this system extended beyond simple financial transfers. It became embedded in supply chain logistics, enabling the procurement of dual-use goods—technology with both civilian and military applications—through intermediaries in regions such as Central Asia and the Middle East. Crypto-enabled payments allowed these transactions to bypass traditional banking scrutiny, effectively creating a parallel trade infrastructure insulated from Western enforcement mechanisms (3).

III. Decentralization as Strategy, Not Ideology:

In Western culture, decentralization is often seen as a libertarian ideal—an escape from centralized power. However, in the Russian sanctions-evasion model, decentralization is not about ideology but strategy. It is used selectively to reduce visibility, make enforcement harder, and spread operational risk.

This system operates as a layered network rather than a single platform. Exchanges such as Bitpapa and others flagged by blockchain intelligence firms function alongside mixers, peer-to-peer marketplaces, and offshore entities, creating a fluid ecosystem in which assets can be rapidly converted, transferred, and obfuscated (7).

Moreover, decentralization enhances resilience. When Western authorities sanction one node—such as Garantex—activity shifts to successor platforms or newly created entities, often staffed by the same personnel. This phenomenon mirrors adaptive systems: disruption leads not to collapse but to evolution. The result is a sanctions-resistant architecture that thrives on redundancy and ambiguity.

Academic research supports this point by showing that sanctions enforcement in crypto is structurally reactive, while illicit actors are fast and adaptive. Studies find that once wallets or platforms are sanctioned, actors quickly shift funds to new addresses, exchanges, or networks—often within hours—well before regulators can complete attribution and enforcement cycles (12). Because blockchain systems allow unlimited address creation and operate across jurisdictions, enforcement actions tend to disrupt specific nodes rather than the broader network. As a result, the research consistently demonstrates that sanctions evasion persists not despite enforcement, but because the system’s design enables rapid migration and continuity.

IV. The Ransomware Nexus: Criminal Infrastructure and State Alignment

At the heart of Russia’s crypto ecosystem lies a symbiotic relationship between cybercriminal groups and financial infrastructure. Ransomware organizations such as REvil and Ryuk-linked networks have long relied on cryptocurrency to receive and launder payments, targeting Western corporations, critical infrastructure, and supply chains (2).

The connection between these groups and sanctioned exchanges is well-documented. Platforms like Garantex have been identified as facilitating transactions tied to ransomware proceeds, effectively serving as financial clearinghouses for cybercrime (5). This relationship extends beyond mere tolerance. Investigations such as Operation Destabilise have uncovered networks in which cryptocurrency exchanges, money laundering operations, and state-linked actors intersect. In some cases, these networks have been used not only for financial gain but also to support espionage activities and strategic objectives aligned with Russian interests (11).

The implication is clear: ransomware is not simply criminal activity but a component of a broader hybrid warfare strategy. By targeting Western institutions and funneling proceeds through crypto networks, these groups generate revenue, disrupt adversaries, and reinforce Russia’s alternative financial ecosystem.

V. Extraction from the West: Mechanisms of Digital Theft:

The Russian crypto-sanctions ecosystem extracts value from the West through multiple channels, blending cybercrime, financial engineering, and trade manipulation. Ransomware attacks represent the most visible vector, with payments often demanded in cryptocurrency and subsequently laundered through exchanges and mixers (2).

However, a less visible but equally significant mechanism is trade-based money laundering facilitated by crypto. Russian entities purchase restricted goods through intermediaries, paying in stablecoins that are difficult to trace. These goods are then re-exported into Russia, effectively bypassing export controls (3).

Additionally, capital flight and asset concealment play a major role. Wealthy individuals and sanctioned entities move funds into crypto assets to protect them from seizure, leveraging decentralized wallets and offshore exchanges. The cumulative effect is a steady outflow of value from regulated Western systems into a shadow economy that operates beyond their reach.

By 2025, illicit cryptocurrency flows had surged dramatically, with tens of billions of dollars linked to sanctions evasion and state-aligned networks (10).

VII. Conclusion: The Future of Financial Warfare:

Russia’s sanctions-busting cryptocurrency empire represents a new phase in the evolution of financial conflict—not simply a workaround, but a scalable model for a decentralized, state-influenced financial system operating beyond traditional controls. What began as a reaction to Western sanctions has matured into a resilient ecosystem that blends state policy, criminal enterprise, and technological innovation. Its strength lies in its hybridity: centralized where control is necessary, decentralized where opacity provides advantage.

For the West, this presents a fundamental challenge. Traditional tools—sanctions, asset freezes, and banking restrictions—are increasingly limited in a world where adversaries can operate outside the formal financial system. Countering this shift requires more than incremental reform; it demands a transition from static enforcement to dynamic, intelligence-driven financial defense.

A central component of this approach is the expansion of blockchain analytics and real-time monitoring. On-chain intelligence has proven effective in tracing illicit flows and identifying high-risk actors, but its true value emerges when integrated into coordinated international enforcement frameworks. Moving beyond periodic sanctions designations toward continuously updated, intelligence-led responses will be critical to keeping pace with adaptive networks (7).

Equally important is targeting the infrastructure that enables liquidity. Cryptocurrency ecosystems depend on exchanges, stablecoin issuers, and fiat on-ramps and off-ramps to function. Coordinated regulation and enforcement against these access points—particularly across jurisdictions that facilitate intermediary flows—can significantly constrain the usability of sanctions-evading assets. While measures such as wallet blacklisting and exchange sanctions have had impact, they must evolve from reactive tools into part of a broader, proactive strategy (1).

At the same time, deterrence must be redefined. Financial penalties alone are insufficient against actors who operate in decentralized and jurisdictionally fragmented environments. Effective deterrence will require a combination of cyber operations, asset seizures, and coordinated disruption of ransomware and illicit financial infrastructure. Public-private collaboration will be essential, as much of the expertise and visibility into these networks resides within the private sector.

Beyond enforcement, the West must also compete. Developing secure, efficient, and transparent alternatives—such as regulated digital payment systems, central bank digital currencies, and compliant stablecoin frameworks—can reduce the relative attractiveness of shadow financial networks. If legitimate systems offer greater speed, cost efficiency, and accessibility, the incentive to rely on illicit alternatives diminishes.

Finally, this issue must be understood in its broader geopolitical context. Russia’s crypto ecosystem is not an isolated case but part of a wider movement toward financial fragmentation, in which states seek parallel systems to reduce dependence on Western institutions. Addressing this trend will require sustained international coordination, including strategic engagement with non-Western jurisdictions that play intermediary roles in these networks (4).

In this evolving landscape, success will not be measured by the elimination of illicit systems, but by the ability to constrain, outpace, and adapt to them. The future of financial warfare will belong to those who can align technological capability with strategic coherence—building financial architectures that are not only secure, but resilient against continuous disruption.

Bibliography:

  1. U.S. Department of the Treasury. “Treasury Sanctions Cryptocurrency Exchange and Network.” https://home.treasury.gov/news/press-releases/sb0225
  2. Chainalysis. Crypto Crime Report 2026. https://www.chainalysis.com
  3. Royal United Services Institute (RUSI). “The Shadow Crypto Economy Feeding Russia’s War Machine.” https://www.rusi.org
  4. Center for European Policy Analysis (CEPA). “A Crypto River Runs Through Russia.” https://cepa.org
  5. BankInfoSecurity. “U.S. Sanctions Crypto Exchange Tied to Russian Ransomware.” https://www.bankinfosecurity.com
  6. TRM Labs. “Garantex, Grinex, and the A7A5 Token.” https://www.trmlabs.com
  7. Elliptic. “Russia-Linked Crypto Platforms’ Ongoing Sanctions Evasion.” https://www.elliptic.co
  8. Reuters. “Sanctioned Russian Crypto Exchange Suspends Services.” https://www.reuters.com
  9. Business Insider. “Russia’s Crypto Shadow Economy.” https://www.businessinsider.com
  10. Financial Times. “Illicit Crypto Flows Surge to Record Levels.” https://www.ft.com
  11. National Crime Agency. “Operation Destabilise.” https://www.nationalcrimeagency.gov.uk
  12. Zola, Francesco et al. “Assessing the Impact of Sanctions in the Crypto Ecosystem.” https://arxiv.org/abs/2409.10031

Crypto, Conflict, and Capital Flight: What Iran’s On-Chain Shock Signals for Middle East Economics and U.S. Markets

In late February 2026, shortly after coordinated U.S.–Israeli airstrikes struck targets in Tehran, blockchain analytics firms observed an abrupt spike in cryptocurrency withdrawals from Iran’s largest digital asset exchange. Within minutes of the strikes, Nobitex reportedly experienced a roughly 700 percent surge in withdrawals, with millions of dollars in crypto leaving the platform in a compressed time window.¹ This episode, while modest in absolute global market terms, offers a revealing case study in how digital assets function during geopolitical stress—and what that may signal for Middle East economics and U.S. financial markets over the next year.

A Rapid Withdrawal Shock:

Reporting indicates that nearly $3 million exited Nobitex in a single hour following the strikes, with approximately $10 million leaving Iranian exchanges over several days.² Such flows are small relative to global crypto trading volumes but significant within the Iranian financial context, where capital controls, sanctions, and currency instability already shape economic behavior.

Iran’s domestic currency, the rial, has faced long-standing pressure from inflation, sanctions, and restricted access to global banking networks. In that environment, cryptocurrencies—particularly Bitcoin and dollar-denominated stablecoins—have increasingly served as alternative stores of value and channels for cross-border transfers.³ The surge in withdrawals appears consistent with crisis-driven capital preservation behavior rather than speculative trading alone.

Crypto as a Financial “Pressure Valve”:

The events underscore crypto’s evolving role as a decentralized financial “pressure valve” in sanctioned or conflict-affected economies. When traditional banking rails are constrained or politically vulnerable, digital assets offer relative portability and censorship resistance.¹

Internet blackouts and temporary exchange disruptions complicate interpretation. Outages can cluster transactions when connectivity resumes, making withdrawal spikes appear sharper than underlying demand alone would suggest.³ Nonetheless, the pattern aligns with prior episodes in emerging markets where digital assets gained traction during currency stress.

The lesson is not that crypto replaces sovereign financial systems, but that it increasingly supplements them under strain.

Economic Implications for the Middle East (Next 12 Months):

Looking forward, several dynamics are likely to shape regional economics:

1. Expanded Informal Dollarization via Digital Assets. Sanctioned or financially constrained economies may see broader retail and institutional adoption of dollar-linked stablecoins as parallel monetary tools.

2. Heightened Regulatory and Surveillance Pressure. As crypto flows intersect with sanctions regimes, U.S. and allied regulators are likely to intensify scrutiny of exchanges, custodians, and cross-border blockchain activity.¹

3. Persistent Capital Flight Incentives. Geopolitical volatility increases incentives for households and firms to diversify outside domestic banking systems.

4. Infrastructure Fragility Risks. Internet shutdowns and exchange outages remain structural vulnerabilities in crisis environments.³

Collectively, these forces suggest that digital asset adoption in parts of the Middle East will continue—not as ideological endorsement of crypto, but as pragmatic economic hedging.

What This Means for U.S. Markets:

For U.S. investors and policymakers, the implications extend beyond regional headlines.

Oil and Energy Sensitivity. Any escalation involving Iran carries oil supply risk implications. Even absent sustained disruption, perceived risk premiums can lift energy prices.

Safe-Haven Flows and Dollar Strength. Periods of geopolitical tension historically reinforce demand for U.S. Treasuries and dollar-denominated assets. Concurrently, Bitcoin and gold often experience volatility tied to risk sentiment shifts.⁴

Regulatory Spillover. If crypto is increasingly viewed as a sanctions-adjacent vector, U.S. enforcement posture may tighten, affecting exchanges and institutional investors.

Systemic Interconnectedness. Crypto is no longer a siloed asset class. It is embedded within global liquidity networks. Geopolitical events can trigger rapid on-chain responses that ripple into equities, commodities, and foreign exchange markets.

Forecast—A Converging Risk Landscape:

Over the next year, expect three converging trends:

  1. Greater integration between geopolitical risk modeling and digital asset analytics.
  2. Increased compliance burdens on global crypto infrastructure providers.
  3. Continued volatility transmission across oil, crypto, emerging market currencies, and U.S. equities during regional escalations.

The Iranian withdrawal spike may have involved only millions of dollars—but its significance lies in what it signals: digital capital now moves at the speed of conflict.

For U.S. markets, that means geopolitical shocks increasingly transmit through hybrid financial rails—traditional and decentralized alike. Outside of economic considerations, peace is desirable for the benefit of all.

Bibliography:

  1. Yahoo Finance. “Millions of Dollars in Crypto Left Iranian Exchanges After Airstrikes.” February 2026.
  2. Economic Times. “Why Did Iran’s Largest Crypto Exchange See a 700% Withdrawal Spike Minutes After US–Israel Airstrikes Hit Tehran?” February 2026.
  3. Bitget News. “Iranian Crypto Exchange Records Surge in Withdrawals Following Tehran Strikes.” February 2026.
  4. Forbes. “Iran War, an Oil Crisis, a Crypto Stress Test.” March 2026.

Apple’s Carrier-Level Location Privacy: Strategy, Law, and the Future of Data Control

Fig. 1. Apple’s Carrier-Level Location Privacy Infographic. Jeremy Swenson and Open AI Chat GPT. 2026.

In January 2026, Apple quietly introduced a new privacy control in iOS 26.3 that allows users to limit the precision of location data shared with cellular carriers. While the feature’s initial rollout was narrow—restricted to select devices and carriers—it represents a significant shift in how location data is governed at the network level, with implications for legal investigations, platform competition, and data marketing strategies.1

Unlike app-level location permissions, which have been a focal point of mobile privacy debates for more than a decade, this control targets a less visible layer of the data stack: the information that cellular networks inherently collect as devices connect to towers. By allowing users to reduce carrier access to neighborhood-level rather than precise location data, Apple is challenging long-standing assumptions about the inevitability of carrier-side surveillance.

How the Feature Works—and Why It Matters

The new “Limit Precise Location” setting is found within Cellular Data Options on supported devices running iOS 26.3. When enabled, it reduces the granularity of location data available to participating carriers without degrading network performance or interfering with emergency services.2 Apple has emphasized that precise location data remains available to emergency responders and to apps that users have explicitly authorized, underscoring that the control is designed to limit passive collection rather than eliminate functionality.

At launch, the feature applies only to devices equipped with Apple’s newer C-series modems and is supported by a limited number of carriers, including Boost Mobile in the United States and select providers in Europe and Asia.2 This constrained availability reflects Apple’s vertically integrated approach to privacy: by controlling hardware, operating system, and key software layers, Apple can implement privacy protections that are difficult to standardize across more fragmented ecosystems.

Legal Investigation and Carrier Data: A Shifting Boundary

Carrier-level location data has long been a cornerstone of law-enforcement investigations. Historical cell-tower records can be used to infer a person’s movements, corroborate timelines, or establish proximity to crime scenes. As a result, carriers are frequent recipients of subpoenas and lawful data requests.

By limiting the precision of location data available at the carrier level, Apple’s new feature introduces friction into this investigative model. While it does not prevent lawful access to available data, it may reduce the specificity of records in cases where users have enabled the setting. This development raises important legal questions: if a platform offers a user-controlled mechanism that technically limits data collection, what obligations do carriers retain to preserve or disclose information that no longer exists in high-resolution form?

Security researchers and privacy advocates have framed the feature as a defensive response to the growing misuse of carrier data, including cases where location information has been sold, leaked, or exploited by criminal actors.3 From this perspective, the control is less about obstructing legitimate investigations and more about narrowing the attack surface of sensitive personal data.

Platform Strategy: Apple Versus Android

The contrast with Android is instructive. Android has made substantial progress in recent years with fine-grained app permissions, background location alerts, and transparency dashboards. However, it does not currently offer a system-level control that restricts the precision of location data shared directly with carriers.

This difference reflects deeper architectural realities. Android’s ecosystem spans multiple hardware manufacturers, modem vendors, and carrier customizations, making uniform carrier-level privacy controls difficult to deploy. Apple’s ability to design proprietary modems and tightly integrate them with iOS enables a level of privacy enforcement that is harder to replicate in a more open, modular platform.

From a strategic standpoint, this gives Apple a competitive narrative advantage: privacy not merely as policy, but as product design. While Android remains dominant globally in market share, Apple’s approach positions privacy as a premium feature tied to hardware, reinforcing brand trust among users who are increasingly sensitive to data misuse.

Privacy, Data Marketing, and Consumer Trust

Location data is among the most valuable assets in the data economy. It fuels targeted advertising, behavioral analytics, and predictive modeling across industries. Limiting carrier-level access does not eliminate these practices, but it does alter where and how data is collected.

Apple has been careful to frame this feature as part of a broader philosophy of data minimization rather than an absolute shield. App-level data collection, Wi-Fi triangulation, Bluetooth beacons, and other signals can still reveal detailed location information when users grant permission. The new control instead constrains a historically opaque channel of data flow that users rarely considered or understood.1

For consumers, this reinforces a key reality of modern privacy: meaningful control requires layered defenses. Carrier-level protections, app permissions, and informed usage patterns must work together. For data marketers and brokers, the shift signals a gradual tightening of default access to passive location data, encouraging greater reliance on consent-driven and aggregated sources.

Conclusion: Implications and Best Practices

Apple’s decision to limit precise location data shared with carriers marks an incremental but meaningful evolution in mobile privacy architecture. It highlights the growing tension between user autonomy, lawful access, and commercial data practices, while underscoring the strategic power of vertically integrated platforms.

Looking ahead, several implications stand out:

  1. Legal frameworks may need to adapt to scenarios where high-resolution location data is no longer uniformly available at the carrier level.
  2. Platform competition will increasingly hinge on architectural control, not just policy promises.
  3. Data markets will continue shifting toward explicit consent and diversified data sources as passive collection channels narrow.

Best practices for consumers remain straightforward but essential:

  • Regularly review system-level and app-level privacy settings.
  • Understand the scope and limits of each control.
  • Grant precise location access only when it is necessary for functionality.
  • Stay informed about how platforms and carriers handle personal data.

Ultimately, Apple’s new feature does not end location tracking, nor does it resolve every privacy concern. What it does accomplish is more subtle—and more consequential: it redraws the boundary of what is considered acceptable default data collection in the mobile ecosystem, setting a precedent that others will be pressured to follow.

Endnotes

  1. Apple Inc., “Limit precise location from cellular networks,” Apple Support, accessed January 2026, https://support.apple.com/en-euro/126101.
  2. Chance Miller, “iOS 26.3 Adds New Feature to Limit Location Data Shared With Your Carrier,” 9to5Mac, January 26, 2026, https://9to5mac.com/2026/01/26/ios-26-3-adds-new-feature-to-limit-location-data-shared-with-your-carrier/.
  3. Suzanne Smalley, “New Apple Feature Will Block Cell Networks From Capturing Precise Location Data,” The Record from Recorded Future News, January 29, 2026, https://therecord.media/new-apple-feature-block-location-data-cell-networks.

Why Being Respected Matters More Than Being Nice in Leadership

In leadership, the tension between being respected and being merely nice has been debated for centuries. Niceness is often equated with politeness, affability, and the desire to avoid conflict. Respect, on the other hand, is grounded in trust, competence, and integrity. While niceness may win temporary approval, respect creates lasting influence. Leaders who prioritize being respected over being liked not only drive stronger performance but also safeguard their organizations against complacency and poor decision-making. A change agent leader cannot be overly nice, or he or she will be trampled on.

Fig. 1. Jeremy Swenson, Pink Suit With Yellow Background, 2025, Jeremy Swenson.

Fig. 1. Jeremy Swenson, Ink Suit Yellow Background, 2025.

The Pitfalls of “Niceness”:

Niceness can be an appealing trait, especially in team settings where harmony is valued. However, as a leadership strategy, niceness carries inherent risks. When leaders prioritize being liked, they may avoid difficult conversations, tolerate poor performance, or bend organizational rules to keep others happy. Over time, this erodes accountability. Research in organizational psychology demonstrates that leaders who are overly agreeable may sacrifice effectiveness, as employees perceive them as weak or inconsistent (Judge, Bono, Ilies, & Gerhardt, 2002).

Margaret Thatcher, the former Prime Minister of the United Kingdom, captured this dilemma bluntly: “If you set out to be liked, you will accomplish nothing” (Thatcher, 1993, p. 147). Niceness often becomes a form of self-preservation—leaders seek short-term harmony at the cost of long-term impact. While being liked may feel rewarding in the moment, it does not inspire confidence or loyalty when difficult decisions must be made. An overly nice person would likely give undue favor to people close to them and thus would not encourage growth or innovation.

Why Respect Endures:

Respect is a far more enduring quality. It is not rooted in popularity but in consistency, fairness, and competence. Respected leaders earn trust by setting clear expectations, making principled decisions, and holding themselves and others accountable. Respect does not preclude kindness; rather, it frames kindness in a way that maintains boundaries and integrity.

The late Maya Angelou (1993) famously observed: “People will forget what you said, people will forget what you did, but people will never forget how you made them feel” (p. 21). In a leadership context, being respected makes people feel valued, secure, and motivated because they know their leader will not waiver under pressure or abandon fairness for personal popularity. Respect builds psychological safety, which modern research identifies as one of the strongest predictors of high-performing teams (Edmondson, 2019).

Moreover, people are more likely to trust those who build respect than politeness. Respect crosses all demographics while what is nice in one culture may not be nice in another culture. In other words, respect is less subjective and thus more powerful. Respect means you mean what you say and enforce it over time, across cultures, and no matter what. Niceness signals your pliable and not confident in your approach as to who or what is right.

Lessons from Business Leadership:

Business history is filled with examples that highlight the difference between respected leaders and merely nice ones.

  • Steve Jobs (Apple): Jobs was not widely regarded as “nice.” His demanding nature often clashed with employees. However, he was deeply respected for his vision, creativity, and relentless pursuit of excellence. Walter Isaacson (2011) documented how Jobs inspired loyalty and innovation because employees trusted his uncompromising standards, even if they did not always appreciate his methods.
  • Indra Nooyi (PepsiCo): Nooyi combined respect with empathy. She was known for her warmth and for writing personal letters to employees’ families, yet she also set bold strategic goals and held teams accountable for results. Her leadership illustrates that respect does not exclude kindness but rather enhances it when boundaries and accountability remain intact (Nooyi & Mirza, 2021).
  • Colin Powell (U.S. Army General): Powell (1995) explained that respect is inseparable from accountability: “The day soldiers stop bringing you their problems is the day you have stopped leading them” (p. 54). For Powell, respect came not from being “nice” but from being competent, decisive, and trustworthy in the face of pressure.

These examples highlight that respected leaders may not always win popularity contests, but they leave legacies of trust and performance.

Respect, Boundaries, and Authority:

A crucial distinction between respect and niceness lies in boundaries. Nice leaders often allow others to cross their boundaries in order to avoid discomfort. Respected leaders, by contrast, maintain clear boundaries, which prevents exploitation and reinforces authority. As Maxwell (1998) argued, leadership is fundamentally about influence, and influence requires credibility. A leader without respect may have a title, but not authority.

In practice, this means making unpopular but necessary decisions—layoffs during a downturn, holding a top performer accountable for misconduct, or refusing to compromise ethics for profit. These choices rarely make a leader “liked” in the moment, but they generate long-term respect and loyalty. Employees may not always agree, but they admire the leader’s consistency and courage. This is especially true in contexts that require tough change management, such as mergers, new products, entering new countries, and adopting new technologies. This is where a strong respected visionary leader beats nice person every time.

Conclusion:

In the final analysis, it is far better for leaders to be respected than to be merely nice. Niceness without boundaries leads to exploitation and mediocrity. Respect, however, fosters trust, accountability, and sustainable success. Leaders who cultivate respect create organizations that withstand challenges, adapt to change, and achieve long-term goals.

As Thatcher, Angelou, Jobs, Nooyi, and Powell all remind us in different ways, leadership is not about avoiding conflict or pleasing others—it is about earning trust through integrity, competence, and courage. Respect lasts; niceness fades. In business and leadership, respect is not just preferable—it is essential.

A respected leader will not be taken advantage of. His or her management structure will be less likely to be challenged, making operations run more smoothly. Those around such a leader will be more inspired to follow the tough decisions they make and will feel relief knowing they did not have to shoulder those burdens themselves, yet can remain confident in the respected leader who did. That leader is not doubted. With the right experience and training, you can be that leader.

References:

Angelou, M. (1993). Wouldn’t take nothing for my journey now. Bantam Books.

Edmondson, A. C. (2019). The fearless organization: Creating psychological safety in the workplace for learning, innovation, and growth. Wiley.

Isaacson, W. (2011). Steve Jobs. Simon & Schuster.

Judge, T. A., Bono, J. E., Ilies, R., & Gerhardt, M. W. (2002). Personality and leadership: A qualitative and quantitative review. Journal of Applied Psychology, 87(4), 765–780. https://doi.org/10.1037/0021-9010.87.4.765

Maxwell, J. C. (1998). The 21 irrefutable laws of leadership. Thomas Nelson.

Nooyi, I., & Mirza, R. (2021). My life in full: Work, family, and our future. Portfolio.

Powell, C. (1995). My American journey. Random House.

Thatcher, M. (1993). The Downing Street years. HarperCollins.

About the Author:

Jeremy Swenson is a disruptive-thinking security entrepreneur, futurist/researcher, and senior management tech risk consultant. Over 17 years, he has held progressive roles at many banks, insurance companies, retailers, healthcare organizations, and even government entities. Organizations appreciate his talent for bridging gaps, uncovering hidden risk management solutions, and simultaneously enhancing processes. He is a frequent speaker, podcaster, and a published writer – CISA Magazine and the ISSA Journal, among others. He holds a certificate in Media Technology from Oxford University’s Media Policy Summer Institute, an MBA from Saint Mary’s University of MN, an MSST (Master of Science in Security Technologies) degree from the University of Minnesota, and a BA in political science from the University of Wisconsin Eau Claire. He is an alum of the Cyber Security Summit Think Tank, the Federal Reserve Secure Payment Task Force, the Crystal, Robbinsdale and New Hope Citizens Police Academy, and the Minneapolis FBI Citizens Academy. He also has certifications from Intel and the Department of Homeland Security.

🛡️ Cyberattack on St. Paul Disrupts Systems, Triggers National Guard Response: A Wake-Up Call for City Infrastructure and Public-Private Security

Fig. 1. St. Paul Cyber Attack, St. Paul, 2025.

A major cyberattack brought critical systems across the City of St. Paul to a halt this week, prompting Governor Tim Walz to take the rare step of activating the Minnesota National Guard’s 177th Cyber Protection Team through Executive Order 24-25. The breach, which has yet to be fully disclosed in technical detail, forced the shutdown of municipal networks, libraries, payment systems, and internal applications—raising alarms about the fragility of local government infrastructure in the digital age.

This crisis has not only impacted operations but also exposed deeper vulnerabilities—from disruption of city services to potential legal and evidentiary breakdowns, especially concerning the chain of custody for digital evidence and sensitive case management platforms used by law enforcement and legal teams.

“The cyberattack… has resulted in a disruption of city services and operations, and the city has requested assistance from the State of Minnesota in the form of technical expertise and personnel,” Gov. Walz stated in the executive order. “The incident poses a threat to the delivery of critical government services.” (Walz, 2025)

Legal and Infrastructure Ramifications:

One often overlooked consequence of cyberattacks on public systems is the risk to legal integrity. City governments often store digital evidence for court cases, police body cam footage, and case records within networked systems. When such systems are compromised or taken offline, the chain of custody—a legal requirement for maintaining the integrity of evidence—may be broken. This could lead to dismissed charges, delayed court proceedings, or contested verdicts.

Beyond the courts, St. Paul’s systems underpin essential infrastructure. From 911 backend operations to building permits, utility management, and emergency communications, these disruptions ripple into residents’ lives and civic trust. Any delay in fire dispatch systems, real-time weather alerts, or even payroll processing for emergency responders can escalate into broader crisis.

Why Public-Private Partnerships Are Essential:

The attack illustrates the need for stronger collaboration between public entities and private cybersecurity firms. Municipalities often operate with limited budgets, aging infrastructure, and insufficient security staff. In contrast, private-sector vendors—ranging from cloud security providers to endpoint monitoring specialists—offer scalable defenses and expertise that cities can’t always sustain in-house.

Governor Walz’s executive order underscores this reality, stating:

“Cooperation between the Minnesota Department of Information Technology Services (MNIT), the National Guard, and other partners is necessary to protect public assets and respond to cybersecurity threats.” (Walz, 2025)

This partnership must also extend beyond technical vendors. Insurance carriers, legal risk consultants, and incident response firms should be part of proactive city planning, not just post-breach triage.

The Human Factor: Employee Training Matters:

While technical systems are critical, human error remains the top vector for cyberattacks, especially through phishing and social engineering. A well-crafted phishing email clicked by a single city employee can introduce malware into core systems.

St. Paul’s situation shows how cybersecurity education is no longer optional. Ongoing staff training—including:

  • Simulated phishing attacks
  • Clear escalation protocols
  • “Stop and verify” culture for email attachments and access requests

…is essential. Cities should treat their staff as the first line of defense, not just passive users.

The Road Ahead: What Cities Must Do Now:

The cyberattack on St. Paul should serve as a regional and national inflection point. Other cities must take this as a cue to reassess their cyber posture through the following:

Strategic Priorities:

  1. Zero Trust Implementation Limit internal access and require constant authentication, even for trusted users.
  2. Third-Party Risk Audits Review vendors, contractors, and outsourced services for security gaps.
  3. Resilient Backup and Recovery Ensure data is stored offsite and tested regularly for recovery readiness.
  4. Legal and Digital Forensics Planning Build frameworks for protecting the chain of custody in case of breach.
  5. Integrated Public-Private Playbooks Define shared roles between city staff, Guard units, and private partners in cyber response drills.
  6. Community Transparency Proactively inform the public about risks, responses, and what’s being done to rebuild digital trust.

Final Thoughts:

The breach in St. Paul is not just a local IT issue—it is a civic security event that affects courts, emergency services, legal integrity, and public confidence. Governor Walz’s activation of the National Guard is a bold signal that digital defense is now a matter of public safety.

“Immediate action is necessary to provide technical support and ensure continuity of operations,” reads Executive Order 24-25 (Walz, 2025).

Moving forward, public-private partnerships, cybersecurity training, and legal readiness must become foundational to how cities govern in the digital era. The stakes are no longer theoretical—they are real, operational, and deeply human.

References:

  1. FOX 9. (2025, July 29). Gov. Walz activates National Guard after cyberattack on city of St. Paul. https://www.fox9.com/news/gov-walz-activates-national-guard-after-cyberattack-st-paul
  2. KSTP. (2025, July 29). City of St. Paul experiencing unplanned technology disruptions. https://kstp.com/kstp-news/top-news/city-of-st-paul-experiencing-unplanned-technology-disruptions/
  3. League of Minnesota Cities. (2024, October). Cybersecurity Incident Reporting Requirements for Cities. https://www.lmc.org/news-publications/news/all/fonl-cybersecurity-incident-reporting-requirements/
  4. Reddit. (2025, July 29). Minnesota National Guard activated after city cyberattack [Discussion threads]. https://www.reddit.com/r/minnesota
  5. Walz, T. (2025, July 29). Executive Order 24-25: Activating the Minnesota National Guard Cyber Protection Team. Office of the Governor, State of Minnesota. https://mn.gov/governor/assets/EO-24-25_tcm1055-621842.pdf

About the Author:

Jeremy Swenson is a disruptive-thinking security entrepreneur, futurist/researcher, and senior management tech risk consultant. Over 17 years, he has held progressive roles at many banks, insurance companies, retailers, healthcare organizations, and even government entities. Organizations appreciate his talent for bridging gaps, uncovering hidden risk management solutions, and simultaneously enhancing processes. He is a frequent speaker, podcaster, and a published writer – CISA Magazine and the ISSA Journal, among others. He holds a certificate in Media Technology from Oxford University’s Media Policy Summer Institute, an MBA from Saint Mary’s University of MN, an MSST (Master of Science in Security Technologies) degree from the University of Minnesota, and a BA in political science from the University of Wisconsin Eau Claire. He is an alum of the Cyber Security Summit Think Tank , the Federal Reserve Secure Payment Task Force, the Crystal, Robbinsdale and New Hope Citizens Police Academy, and the Minneapolis FBI Citizens Academy. He also has certifications from Intel and the Department of Homeland Security.

What If You Bought 10,000 Bitcoins on November 30, 2010?

Minneapolis—07/14/25

Fig. 1. Bitcoin Stock Image, 2025.

Investor enthusiasm for Bitcoin continues to grow as corporate treasuries ramp up their acquisitions and the U.S. Congress edges closer to passing pivotal cryptocurrency legislation. Starting on 07/14/25, the U.S. House of Representatives will begin reviewing a suite of crypto-related bills during what has been labeled “Crypto Week.” These proposed measures aim to establish a more transparent regulatory framework for digital assets—an initiative long championed by the crypto industry. The policy push has received backing from former President Donald Trump, who has positioned himself as a crypto-friendly leader and is involved in multiple blockchain-related ventures. Among the most closely watched proposals is the Genius Act, which could introduce federal oversight for stablecoins pegged to the U.S. dollar and potentially open the door for private companies to issue digital dollars.

However, on 11/10/10, Bitcoin was trading at roughly $0.23 per coin.(1) If you had invested $2,300 then, you could’ve acquired 10,000 BTC. At the time, that decision would’ve seemed obscure, laughable even, especially compared to buying gold, stocks, or real estate. The real estate market was down then due to the mortgage bubble-induced Great Recession.

But today, with Bitcoin priced at $121,000 per coin (2), that same purchase would now be worth an astonishing $1.21 billion. Your original $2,300 would have grown by over 52 million percent, delivering a profit of $1,209,997,700—yes, that is billions! That’s not just life-changing wealth—it’s generational. Billionaire status, from a sum that’s less than many people’s rent check.

The High-Risk Investment Nobody Believed In:

Despite the reward, a 2010 Bitcoin investment was far from low-risk. Investors at the time faced:

  • Technology Risk: You had to navigate early exchanges like Mt. Gox and use command-line wallets.
  • Security Risk: Wallet hacks and exchange thefts were rampant. There was no FDIC or insurance for crypto losses.(3)
  • Regulatory Uncertainty: Bitcoin was considered the currency of the dark web. Its legal future was murky at best.(4)
  • Volatility: There were frequent 70–90% drawdowns. Many early holders sold at $1, $10, or $100, fearing it would crash back to zero.

To hold 10,000 BTC from 2010 to 2025 required not just foresight—but ironclad conviction and secure digital hygiene.

Three People Who Made (and Kept) Their Bitcoin Fortunes:

1. Erik Finman

In 2011, a teenage Finman bought about 100 BTC with $1,000. By the time he was 18, he had become a millionaire. He parlayed his gains into building educational tech ventures and became a public face for Gen Z crypto success.(5)

2. Roger Ver

Known as “Bitcoin Jesus,” Ver was among the first to promote Bitcoin full-time. He invested heavily when it was under $1, and his early holdings are believed to number in the hundreds of thousands. Though later he championed Bitcoin Cash, his Bitcoin fortune is still substantial.(6)

3. Charlie Shrem

A co-founder of BitInstant, Shrem acquired thousands of Bitcoins in 2011, using them to build infrastructure for Bitcoin access. Though he served prison time due to regulatory issues, his stake made him a multimillionaire.(7)

Is There Another Bitcoin Out There?

It’s easy to dream that another asset might offer Bitcoin-like returns. But we should note:

  • Bitcoin was a first-mover. It’s the only digital asset to go from $0.01 to over $100,000 while maintaining broad global recognition.
  • Markets are now institutionalized. Regulators, hedge funds, and custodians watch the crypto space closely, making “wild west” gains harder to find.
  • Asymmetric bets still exist. AI startups, early-stage biotech, and deep-tech platforms might offer the next moonshot—but with similar volatility and failure risk.

Lessons from the Bitcoin Billionaires:

  1. Be Early—but Stay Invested Timing is only half the story. Holding through crashes (like in 2014, 2018, and 2022) was just as critical.
  2. Protect Your Holdings Many early holders lost everything due to poor key management. Cold wallets and secure backups are vital.
  3. Have Conviction Amid Doubt The biggest returns often come from believing before the crowd does—when the risk feels scariest.

Final Word: From $2,300 to $1.21 Billion:

Had you purchased 10,000 BTC for $2,300 on November 30, 2010, and held it securely for 15 years, you’d now be worth $1.21 billion. Few people made that choice, and even fewer had the resolve to hold. But this extreme example offers a timeless insight: Fortune doesn’t just favor the bold—it favors the bold who are patient, prepared, and just a little bit lucky. One thing is for sure: paper and coin currency are dead, too burdensome, and are declining in use over credit cards.

Footnotes:

  1. CoinMarketCap. (2023). Bitcoin Historical Data – November 2010. Retrieved from https://coinmarketcap.com
  2. Yahoo Finance. (2025, July 14). Bitcoin (BTC-USD) price. Retrieved from https://finance.yahoo.com
  3. Popper, N. (2015). Digital Gold: Bitcoin and the Inside Story of the Misfits and Millionaires Trying to Reinvent Money. Harper.
  4. Greenberg, A. (2014). This Machine Kills Secrets. Dutton.
  5. CNBC. (2017, Dec 14). Teen Bitcoin Millionaire Erik Finman. https://www.cnbc.com
  6. The Guardian. (2017, July 2). Bitcoin’s Evangelist: Roger Ver. https://www.theguardian.com
  7. Wired. (2014, Jan 27). Bitcoin’s First Felon: The Rise and Fall of Charlie Shrem. https://www.wired.com

About the Author:

Jeremy Swenson is a disruptive-thinking security entrepreneur, futurist/researcher, and senior management tech risk consultant. Over 17 years, he has held progressive roles at many banks, insurance companies, retailers, healthcare organizations, and even government entities. Organizations appreciate his talent for bridging gaps, uncovering hidden risk management solutions, and simultaneously enhancing processes. He is a frequent speaker, podcaster, and a published writer – CISA Magazine and the ISSA Journal, among others. He holds a certificate in Media Technology from Oxford University’s Media Policy Summer Institute, an MBA from Saint Mary’s University of MN, an MSST (Master of Science in Security Technologies) degree from the University of Minnesota, and a BA in political science from the University of Wisconsin Eau Claire. He is an alum of the Cyber Security Summit Think Tank , the Federal Reserve Secure Payment Task Force, the Crystal, Robbinsdale and New Hope Citizens Police Academy, and the Minneapolis FBI Citizens Academy. He also has certifications from Intel and the Department of Homeland Security.