What happens when AI is built to serve an authoritarian political system?

In this episode, David Wroe speaks with Bethany Allen, Head of China Investigations and Analysis and Fergus Ryan, Senior Analyst, both at ASPI’s Cyber, Technology and Security Program, to discuss their recent ASPI report The party’s AI: How China’s new AI systems are reshaping human rights.

Bethany and Fergus explain how China’s AI systems are being built to serve the party’s political objectives — not just to automate processes. They cover the automation of China’s justice system and what it means for defendants’ rights; predictive law enforcement and the erosion of due process; and “ambient censorship,” which creates an immersive information environment tailored to party ideology.

The conversation goes further into AI-powered surveillance capable of tracking people’s momentary emotional reactions, and what it means to embed authoritarian values into the architecture of a technology. Then it turns outward: what happens when countries import Chinese AI models — attractive because they are open source and therefore cheaper — and China works to shape global AI standards in line with its non-democratic interests?

👉 Listen on Apple, Spotify, Amazon Music, RSS, or wherever you get your podcasts — or watch on YouTube.

Welcome to the latest edition of ASPI’s Cyber & Tech Digest.

Each week, ASPI curates and contextualises the most important developments in cyber, technology, and geopolitics — highlighting what matters and why.

This edition covers the period: 3 April 2026 to 10 April 2026.

Follow the Australian Strategic Policy Institute on Bluesky, LinkedIn, and X.

What We’re Tracking

China firms market Iran war intelligence on US forces

What happened: A report by the Washington Post says firms in China are combining AI with satellite, flight and shipping data to track US military movements and market intelligence that can “expose” American forces. The story says MizarVision, a Hangzhou company founded in 2021, is among the firms cataloguing activity at US bases in the Middle East, tracking naval movements and identifying aircraft and missile-defence systems.

US officials and intelligence experts are divided over how credible those capabilities are in practice. A source familiar with MizarVision’s platform says the firm does not have real-time access to US imaging sources, even as analysts warn that the growing market for these tools points to a broader security risk.

Separately, the ABC reports that the US Defense Intelligence Agency has assessed an AI tool used by MizarVision poses a threat to US forces. The broadcaster also notes that about 100 Australian soldiers are stationed in the Middle East, including at facilities damaged in an Iranian attack in the United Arab Emirates on 18 March, and retired Australian Defence Force Major General Gus McLachlan said Australian forces would take the threat very seriously.

Why we’re tracking this: Together, the two reports describe a commercial market doing work once more closely associated with national intelligence agencies. They also suggest that limiting access to imagery is getting harder. The ABC says Planet Labs was asked by the US government to indefinitely withhold images of the conflict region over security concerns.

What people are saying:

• A US official quoted in Washington Post said: “Even if the capability isn’t there yet … the big picture concern is the intent.”

• Gus McLachlan told ABC: “The Australian government would be concerned. It’s a plausible outcome that Australians could be killed by this capability.”

• China’s Ministry of Foreign Affairs told ABC the reports were “sensationalist” and that the imagery “is a routine market practice.”

My view: The United States can still block some commercial satellite images, but it can’t fully control who sees a war anymore. Other systems, including China’s Jilin satellite constellation, mean rivals can still get useful information even if Western providers restrict access. That could leave the public and the media seeing less, while adversaries still see enough to be dangerous. The big question now is whether governments can protect military operations without also shutting out public scrutiny.

— Fergus Ryan, CTS

What We’re Watching

A weekly scan of notable developments we’re tracking across technology, policy, and geopolitics.

⸻

🚀 Strategic competition

Iranian strikes and threats against Gulf data centres have exposed the wartime vulnerability of AI infrastructure used by civilian and military clients, according to Rest of World. The Verge reported that Iran’s Islamic Revolutionary Guard Corps published a video threatening OpenAI’s planned Stargate data centre in Abu Dhabi if the United States attacks Iranian power plants.

In Politico, Mistral chief executive Arthur Mensch said Europe needs AI capabilities it controls for military systems and critical infrastructure. He also said reliance on non-European AI could leave European defence systems exposed to geopolitical pressure or disruption, and that Mistral is pressing the European Commission to prioritise European-controlled AI infrastructure.

The Guardian reported that OpenAI has paused its role in Stargate UK, citing high energy costs and regulatory uncertainty. The project had been intended to support sovereign compute infrastructure, including datacentres built by Nscale and powered by Nvidia chips.

WIRED reported that the U.S. Army is building an internal AI system called Victor, including a chatbot called VictorBot, trained on data from real missions and drawing on more than 500 repositories. Army officials said the system is designed to retrieve mission-relevant information, cite sources, and later handle multimodal inputs such as imagery and video.

The Wall Street Journal reported that governments, militaries and private firms are increasing patrols, monitoring and legal deterrence to protect submarine cables amid sabotage concerns. The article said companies are also exploring alternative routes and detection tools as demand for new cable infrastructure continues to rise.

⸻

🧠 AI models, agents & compute

OpenAI announced a pilot Safety Fellowship for external researchers, engineers and practitioners to work on safety and alignment research from September to February, with mentorship, stipends, compute support and the option to work from Berkeley or remotely. The Wall Street Journal reported that the company also published policy proposals for a future shaped by superintelligence, including higher taxes on companies and capital gains, possible taxes on automation replacing workers, stronger safety nets, portable benefits and a public investment fund.

The New York Times reported that Anthropic is withholding public release of Claude Mythos Preview and instead giving access to more than 40 organisations through Project Glasswing, saying the model can identify and exploit serious software vulnerabilities. Anthropic said the system has already found thousands of bugs, including longstanding flaws in widely used systems.

Later in the week, Bloomberg reported that OpenAI, Anthropic and Google are sharing information through the Frontier Model Forum to detect adversarial distillation that they say is being used to copy leading U.S. models without authorisation. The report said the companies are also seeking clearer U.S. government guidance on what information they can share under antitrust rules.

In the Financial Times, executives and investors said AI agents are accelerating automation across white-collar sectors including law, finance and cybersecurity, while regulated industries are adapting around trust, accountability and proprietary data.

⸻

🛡 Cyber posture

Earlier this week, a joint advisory from the FBI, NSA, Department of Energy and CISA warned that Iranian government-affiliated hackers are targeting programmable logic controllers in U.S. energy, water, wastewater and government facilities. Politico reported that officials said the activity appears intended to cause disruptive effects and resembles earlier attacks linked to the CyberAv3ngers group.

The UK’s National Cyber Security Centre warned that hackers linked to Russia’s GRU, identified as APT28/Unit 26165, are exploiting vulnerable home and small-office routers to hijack traffic and steal credentials. The Financial Times reported that the campaign used TP-Link and MikroTik devices for DNS hijacking, starting broadly before narrowing to intelligence targets.

Researchers from Access Now, Lookout and SMEX said a hack-for-hire group targeted journalists, activists and officials across the Middle East and North Africa using phishing, Signal compromise and Android spyware, according to TechCrunch. Lookout assessed the operators may be linked to a private vendor connected to BITTER APT.

BleepingComputer reported that attackers have been exploiting a zero-day in Adobe Reader since at least December through malicious PDF files. Researchers said the exploit enables data theft and can escalate to remote code execution, while Adobe had been notified but had not yet released a patch.

A hacker claiming to have breached the National Supercomputing Center in Tianjin is offering samples of more than 10 petabytes of allegedly stolen data, including defence documents, missile schematics and simulations, CNN reported. Experts who reviewed samples said the material appeared consistent with the centre’s work, though CNN said it could not independently verify the full dataset or the hacker’s claims.

Recorded Future reported that cybercriminals targeting Latin America and the Caribbean in 2025 relied heavily on phishing, social engineering, ransomware, banking trojans and infostealers, with Brazil, Mexico and Argentina the most targeted countries and 452 ransomware incidents recorded across the region. Separately, the FBI said Americans lost nearly $21 billion to cyber-enabled crime last year, with investment scams, business email compromise, tech support fraud and cryptocurrency-related crime driving the largest losses and AI-related scams appearing in the bureau’s reporting for the first time.

Cryptography engineer Filippo Valsorda argued that recent research has materially shortened plausible timelines for cryptographically relevant quantum computers and that organisations should accelerate migration to post-quantum cryptography. He pointed to new estimates on the resources needed to break 256-bit elliptic curves and cited warnings that 2029 is now a serious planning deadline.

⸻

🕵️ Surveillance & identity tech

WIRED reported that AI Forensics analysed nearly 2.8 million messages across 16 Italian and Spanish Telegram communities and found thousands of men trading abusive content and advertising hacking and surveillance services targeting women and girls. Telegram said the material violates its rules and that it removes millions of pieces of content each day.

Commonwealth Bank said its onboarding system using NFC scans of ePassport chips has verified more than 2,700 customers since January by matching passport-chip photos to selfies in the CommBank app without retaining the biometric images. The bank said it plans to expand the system from Australian customers to migrants and overseas students.

⸻

🏛️ Government, procurement & public sector tech

The Guardian reported that scientists and conservation groups are warning against using AI to speed up approvals under Australia’s EPBC Act, after the Minerals Council of Australia asked the government for A$13 million to trial tools for preparing and assessing applications. The federal government said AI may help with applications, but project approval decisions will remain with human assessment officers.

The Financial Times reported that NHS England chief data officer Ming Tang is pushing to deepen the rollout of Palantir’s Federated Data Platform across hospitals, even as ministers consider whether to use a break clause in the contract. The programme is shifting from onboarding hospitals to deeper integration, with NHS England also exploring the addition of third-party tools.

⸻

⚖️ Courts, enforcement & regulation

Elon Musk amended his lawsuit against OpenAI and Microsoft to ask that any damages be awarded to OpenAI’s nonprofit arm and to seek Sam Altman’s removal from the nonprofit board. The filing also asks Altman and Greg Brockman to surrender equity or other financial benefits to the charity arm ahead of a trial later this month in Oakland, California.

Earlier this week, a U.S. appeals court in Washington, D.C. declined to pause the Pentagon’s designation of Anthropic as a national security supply-chain risk while the case proceeds. Reuters said a separate California federal judge had blocked a different Pentagon order late last month.

Later in the week, Reuters reported that Florida’s attorney general has opened an investigation into OpenAI and ChatGPT, citing national security and misuse concerns as the company weighs a potential IPO. Separately, Axios reported that the Trump administration is pressing states including Nebraska and Tennessee to narrow or drop proposed AI bills, with some lawmakers saying the outreach has already changed chatbot and transparency measures.

Reuters reported that Deere has agreed to a proposed settlement of a U.S. right-to-repair lawsuit, including a $99 million fund and 10 years of digital maintenance, diagnosis and repair tools for large agricultural equipment. The agreement still requires judicial approval.

⸻

🧒 Online harms & child safety

The Internet Watch Foundation said reports of sextortion blackmail attempts from under-18s in the UK rose 34 per cent last year, with boys aged 14 to 17 accounting for 98 per cent of victims. At the same time, The Record reported that Microsoft, Google, Meta and Snapchat say they will continue voluntarily scanning communications for child sexual abuse material in Europe after the EU law authorising the practice expired.

Reuters reported that Greece will ban social media access for under-15s from the start of 2027, with platforms facing fines under the EU Digital Services Act, and that parliament is due to legislate the measure later this year. Prime Minister Kyriakos Mitsotakis also called for EU-wide action including a digital age of majority at 15 and a unified enforcement system.

OpenAI published a Child Safety Blueprint for U.S. policy and enforcement responses to AI-enabled child sexual exploitation, including proposed updates to legislation, reporting and safeguards. Separately, Ars Technica reported that a U.S. man has become the first person convicted under the Take It Down Act for creating and distributing AI-generated non-consensual intimate images.

Axios reported that Meta has begun removing ads from law firms seeking plaintiffs for social media addiction lawsuits involving minors after a recent California verdict. In Lawyers Weekly, Australian lawyers said that the same U.S. jury verdict against Meta and Google could support similar litigation in Australia under consumer law or other civil liability theories.

⸻

🎬 IP, media & creative industries

Michelle Rowland said Australia will not weaken copyright law to let AI companies freely train on Australian copyrighted material, but is considering licensing, enforcement and agreement-making reforms for AI. Separately, plaintiffs in California accused Apple of bypassing YouTube protections and scraping videos for AI training through the Panda-70M dataset.

Yuga Labs settled its lawsuit against Ryder Ripps and Jeremy Cahen over the RR/BAYC NFT collection. A proposed order would permanently bar the defendants from using Yuga’s trademarks and imagery, though settlement terms were not disclosed.

Muck Rack launched a feature ranking journalists and outlets by how often they are cited in AI-generated answers from ChatGPT, Claude, Gemini and Perplexity, using 15 million citations gathered from submitted queries. The data put Reuters first globally among publications and Henry Blodget first among journalists, while specialist and B2B titles featured prominently.

In Nieman Lab, an analysis found that posts containing links consistently receive lower engagement on X than link-free updates from publishers. The Electronic Frontier Foundation said it is leaving X after nearly two decades, citing declining reach and platform-governance concerns.

⸻

💰 Tech business & markets

WIRED reported that UpScrolled, founded by Issam Hijazi, grew from about 150,000 users before the January TikTok-related surge to more than 5 million by this month, while expanding from a one-person operation to about 25 staff. Hijazi said the platform is trying to improve moderation and operations amid scrutiny over extremist and antisemitic content.

In Pickr, Optus and Vodafone were reported to be raising mobile prices in Australia after earlier increases by Telstra, with Optus adding A$5 to postpaid plans from mid-May and Vodafone adding A$5 to prepaid plans from next week. Separately, techAU reported that Easter road traffic brought back queues at EV charging hubs along the Melbourne–Sydney corridor.

Click Frenzy and Power Retail entered liquidation after directors moved to wind up both businesses, with receivers and administrators appointed to run an urgent sale process. Wexted Advisors said a recent travel sale event was hit by the US/Iran conflict, worsening cashflow pressures, while the companies continued trading with about 19 staff affected.

The Guardian reported that a proposed crypto resort in Timor-Leste had alleged links to associates of the sanctioned Prince Group, and that three people tied to the project had already been sanctioned by the US over a separate Prince Group-linked development in Palau. Those three were later removed from the Timor-Leste project.

That’s all for this week. For more timely analysis and commentary, check out The Strategist and ASPI’s Stop the World podcast—or our other Substack newsletters:

The Cyber & Tech Digest is brought to you by the Cyber, Technology & Security Programs team at ASPI and supported by partners.

Share

Welcome to the latest edition of ASPI’s Cyber & Tech Digest.

Each week, ASPI curates and contextualises the most important developments in cyber, technology, and geopolitics — highlighting what matters and why.

This edition covers the period: 28 March 2026 to 2 April 2026.

Follow the Australian Strategic Policy Institute on Bluesky, LinkedIn, and X.

What We’re Tracking

Google brings quantum crypto warning forward to 2029

What happened: The clearest new element in Google’s announcement is its focus on cryptocurrency. In a post on Google Research, Google said future quantum computers could break the elliptic-curve cryptography used by cryptocurrencies with fewer resources than previously estimated, and outlined mitigation steps built around post-quantum cryptography.

Bloomberg and The Wall Street Journal report that the new paper cuts the estimated hardware needed to break the elliptic-curve cryptography used by Bitcoin and other digital assets by roughly 20-fold. Google says machines capable of doing that do not yet exist, but it is urging developers, exchanges and wallet providers to accelerate preparations.

The wider 2029 warning is the backdrop. The Guardian reports that Google is warning that large-scale quantum computers could break much of today’s encryption by 2029, while Ars Technica says Google is targeting 2029 for its own readiness and adding post-quantum support to Android.

Why we’re tracking this: Google’s paper matters for national security because it pulls cryptocurrency into the same post-quantum planning problem governments are already treating as real. The Wall Street Journal reports that millions of Bitcoin held in exposed wallet addresses could be vulnerable once sufficiently powerful quantum systems exist. That is still a future scenario, but Google is arguing the resource threshold may be lower than previously thought, which shortens the planning horizon.

That overlap is what matters. The Guardian says governments are already preparing for “store now, decrypt later” risks, while Google said on Google Research that it coordinated disclosure with the US government. Ars Technica also reports that the US National Security Agency is already working to 2030–2033 post-quantum deadlines.

What people are saying:

• Google said on Google Research that the point of publishing now is to give the cryptocurrency sector time to migrate, while stressing that cryptographically relevant quantum computers “are not yet available.”

• Experts cited by The Wall Street Journal said the new estimates increase pressure because exposed Bitcoin wallet addresses could be vulnerable once public keys are revealed.

• Experts cited by The Guardian said the timeline is still unsettled, with estimates for cryptographically relevant quantum computers ranging from the 2030s to the 2050s, even as the US National Security Agency, as reported by Ars Technica, is already working to 2030–2033 readiness deadlines.

My view: What Google has done here is turn a distant research problem into a live coordination problem for cryptocurrency. The exact timing of a cryptographically relevant quantum computer is still uncertain, but the paper makes it harder to treat migration as a problem for later. The more useful signal now is not another debate about when a cryptographically relevant quantum computer is developed; it is whether major networks such as Bitcoin, along with exchanges and wallet providers, begin visible work to reduce their dependence on current elliptic-curve cryptography and move to more secure encryption algorithms. That is where this moves from a warning into a test of preparedness.

— Stephan Robin, CTS

What We’re Watching

A weekly scan of notable developments we’re tracking across technology, policy, and geopolitics.

🚀 Strategic competition

The United States is pressing the European Union to join Pax Silica, a coalition focused on semiconductors, critical minerals and AI supply chains. US officials have also pressed the UK and other allies to secure quantum computing supply chains through coordinated investment, research and industrial capacity. Mistral has raised $830 million to build Nvidia-powered AI centres in France and Sweden.

Intel is buying back full ownership of its Fab 34 plant in Ireland, reversing a stake sale made in 2024. Huawei has recruited a senior German photonics scientist from a Fraunhofer institute. US tariffs have accelerated electronics assembly shifts from China to Vietnam even as much of the value chain remains Chinese.

⸻

🧠 AI models, agents & compute

OpenAI has shut down Sora after the video-generation product proved too costly and resource-intensive. Oracle is cutting thousands of jobs while expanding data-centre investment for AI workloads. US firms have captured roughly 75 per cent of global AI investment, about $194 billion.

A UK-backed study found nearly 700 documented incidents of AI systems ignoring instructions, bypassing safeguards, deceiving users or taking unauthorised actions. Anthropic said a Claude Code release accidentally exposed internal source code through a debugging source map file in an npm package. Cyber Security News reported that the exposed material included around 1,900 files and more than 500,000 lines of code.

⸻

🛡 Cyber posture

Google said future quantum computers could break the elliptic curve cryptography used in cryptocurrencies with fewer resources than previously estimated. Google plans to complete its own migration to post-quantum cryptography by 2029 and is urging developers, exchanges and wallet providers to accelerate preparations. Google has also warned banks, governments and technology providers that large-scale quantum computers could break most current encryption standards by 2029.

The FBI has classified a suspected Chinese intrusion into a surveillance system as a major cyber incident after attackers reportedly exploited a commercial ISP vendor. The compromised system contained metadata from lawful surveillance tools and personally identifiable information linked to FBI investigations.

US authorities confirmed that the Iran-linked group Handala breached the personal email account of FBI Director Kash Patel and released historical emails and photos. The State Department has reissued a $10 million reward for information on Handala and Parsian Afzar Rayan Borna, both linked to Iran’s Ministry of Intelligence and Security.

Google Threat Intelligence Group has linked a supply-chain attack on the widely used Axios JavaScript library to a North Korean actor that compromised a maintainer’s npm account. Mercor said it was affected by a separate supply-chain attack tied to the compromised open-source LiteLLM project. Cisco said attackers stole source code after exploiting credentials exposed in a Trivy-linked breach.

European Commission officials said a cyber incident affecting the Europa.eu web portal was detected and contained quickly, with no evidence internal systems were compromised. Security Affairs reported that the Commission had been investigating whether data hosted in cloud infrastructure serving its websites had been accessed.

A water treatment plant in Minot, North Dakota reported a ransomware attack that forced 16 hours of manual operations after systems were taken offline. In Western Australia, a local government entity lost about $350,000 after attackers altered supplier bank details in its finance system. Australian councils are seeking federal funding for shared security operations centres with monitoring, incident response and threat-intelligence services.

Romania said government institutions are facing more than 10,000 cyberattack attempts a day. In Australia, North Korean operatives have infiltrated companies by posing as remote IT workers using stolen identities and AI tools.

⸻

🕵️ Surveillance states

Iran has been running an AI-enabled information campaign alongside military operations, using fabricated videos, coordinated narratives and disinformation aimed at global audiences. Iran-linked actors have also paired cyber operations with kinetic attacks, including spyware distributed through fake emergency alerts timed with missile strikes.

Iran has arrested 46 people and seized 139 Starlink terminals as it tightened controls over internet access during the war. The IRGC has threatened major US technology companies across the Middle East, including Apple, Microsoft, Google and Meta. Amazon Web Services infrastructure was damaged in Bahrain following an Iranian strike.

Researchers said political deepfakes are increasing rapidly and can shape beliefs even when viewers know the content is fake. Facebook pages posing as Australian news outlets are publishing large volumes of AI-generated political disinformation from operators in Vietnam and Indonesia.

US Secretary of State Marco Rubio has instructed diplomats to use X and coordinate with military psychological operations units to counter foreign disinformation. Latvia has accused Russia of running a coordinated disinformation campaign targeting the Baltic states.

Police in Fargo dismissed charges against a Tennessee woman after investigators had relied on an AI facial-recognition match from another agency and failed to verify her alibis. Authorities later restricted use of the external system and added review measures.

⸻

⚖️ Platform accountability

A Dutch court has ordered xAI to stop Grok from generating nonconsensual nude images and warned of fines of €100,000 a day, up to €10 million. The ruling followed evidence that existing safeguards were still being misused, including in cases involving minors.

Perplexity AI is facing a proposed class action alleging it shared user data, including chatbot conversations, with Meta and Google through embedded tracking software. An Epstein survivor has sued the US Department of Justice and Google, alleging personally identifying information was disclosed and continued to appear in search results.

In Platformer, recent US jury verdicts were described as opening a route for claims over recommendation systems, infinite scroll and notifications rather than user-generated content itself. The piece said the cases could expose platforms to liability for product-design choices if the rulings stand.

⸻

🧑‍⚖️ Courts, enforcement & regulation

Australia’s Federal Court has fined Binance Australia Derivatives $10 million for misclassifying more than 500 retail clients as wholesale investors. Italy’s data protection authority has fined Intesa Sanpaolo €31.8 million over unauthorised access to banking data and delayed breach notifications.

The UK Competition and Markets Authority is preparing to investigate Microsoft’s business software unit under new digital competition rules. Malta is opposing EU plans to centralise crypto supervision under the European Securities and Markets Authority.

Australia’s communications regulator has ordered Telstra and other telcos to revise mobile coverage maps using standardised signal thresholds and update them every three months. The Fair Work Commission criticised inaccurate AI-generated legal arguments in an unsuccessful unfair-dismissal case and is considering a costs order against the worker.

⸻

🏛️ Government, procurement & public sector tech

The Fair Work Ombudsman is exploring AI-enabled tools for low-risk compliance work and self-service systems, subject to governance and resourcing frameworks. EU institutions have banned staff from using fully AI-generated images and videos in official communications.

New York City has rescinded its 2023 TikTok ban on government devices, allowing agencies to use the app again under new security restrictions. US Special Operations Command told Congress it will prioritise cyber warfare and emerging technologies to maintain an edge against adversaries.

UK defence technology start-ups are considering relocating because of delayed government contracts and uncertainty around the Defence Investment Plan. Some firms are now seeking opportunities and funding in the US and other markets.

⸻

🎬 IP, media & creative industries

An AI-generated dating show, Fruit Love Island, has gone viral on TikTok, drawing more than 10 million views per episode shortly after launch. The series has also spawned fan content, spinoffs and audience voting around its anthropomorphic fruit characters.

Australian media companies including Nine, News Corp and Guardian have urged the government to keep existing copyright laws in place and require AI firms to license content rather than use it freely. The debate has coincided with Anthropic chief executive Dario Amodei’s visit to Australia as the company expands operations and meets policymakers.

⸻

💰 Tech business & markets

Crypto platforms are selling insurance-like products against theft, but coverage terms often exclude phishing, user-authorised access or other common loss scenarios. Bitcoin’s resilience during the Iran conflict has renewed interest in crypto and stablecoins across Southeast Asia.

Rising energy prices linked to the Iran conflict are reshaping financing decisions for data-centre projects across Asia, with bankers placing more weight on power security, cost stability and water constraints. The Middle East conflict has disrupted helium supply by halting Qatar’s gas production and straining semiconductor supply chains. Samsung Electronics and SK Hynix have enough helium to last until at least June.

Grab and WeRide have launched the first driverless ride-hailing service in Southeast Asia in Singapore. In China, a system malfunction left multiple Baidu Apollo Go robotaxis stopped on roads in Wuhan and stranded passengers.

Disruption in the Strait of Hormuz has halted or reduced aluminium production across key Middle Eastern suppliers that make specialised low-carbon material used in EV manufacturing. Toyota and Nissan have reduced production as access to that aluminium tightens.

⸻

🧒 Online harms & child safety

Austria is planning a national ban on social media use for children under 14, with legislation expected by June. The proposal also includes expanded digital-literacy education and a model of age verification that would not share personal data with technology companies.

Indonesia has started enforcing nationwide restrictions on social media access for users under 16, requiring higher-risk platforms to remove or deactivate underage accounts. The European Parliament has rejected an extension of temporary rules allowing tech platforms to scan for CSAM, meaning the privacy-law exemption will lapse.

Australia’s eSafety Commissioner is investigating Facebook, Instagram, Snapchat, TikTok and YouTube over possible noncompliance with the under-16 ban. About 70 per cent of under-16s who had major-platform accounts before the ban continued using them afterwards. A BBC visit found many children were still accessing services without age verification.

Australia’s teen ban is facing legal challenges, compliance gaps and widespread circumvention as regulators continue investigations without issuing fines. Age-verification tools remain unreliable and policy adjustments are narrowing the ban to harmful features.

⸻

🌏 Global policy

🇦🇺 Australia

The ACCC said Australians lost more than $2.18 billion to scams in 2025 across more than 480,000 reports. Investment scams accounted for the largest share of losses, followed by payment redirection, romance scams, phishing and remote-access attacks.

🇺🇸 United States

Innovation Council Action is preparing to spend more than $100 million in the 2026 midterms backing candidates aligned with President Trump’s AI agenda. David Sacks will keep shaping US AI policy as co-chair of the President’s Council of Advisors on Science and Technology after leaving a formal White House role.

🇪🇺 Europe

A German state is moving to reduce dependence on Microsoft by shifting public administration towards open-source software and sovereign digital infrastructure. Officials said reliance on foreign cloud and software services creates strategic vulnerabilities for public administration systems.

🇬🇧 United Kingdom

The UK government is considering tighter rules on political donations following reports on increasingly complex foreign interference. Proposed measures include a temporary ban on cryptocurrency donations and caps on overseas contributions.

🇨🇳 China

China has launched the World Data Organisation to promote global data governance and reduce fragmentation across national data policies. The body was established in Beijing as a non-governmental international organisation focused on cross-border data cooperation, digital economic growth, privacy and security.

🌐 Multilateral

The EU and CPTPP members have agreed to explore a region-to-region digital trade agreement covering data flows, digital services and electronic contracts. Sixty-six WTO members have moved ahead with a plurilateral set of baseline digital trade rules. The WTO e-commerce moratorium is set to expire at the 2026 ministerial conference. WTO reform talks have stalled after failed ministerial negotiations, with countries increasingly turning to smaller plurilateral deals.

That’s all for this week. For more timely analysis and commentary, check out The Strategist and ASPI’s Stop the World podcast—or our other Substack newsletters:

Share

The Cyber & Tech Digest is brought to you by the Cyber, Technology & Security Programs team at ASPI and supported by partners.

Welcome to the latest edition of ASPI’s Cyber & Tech Digest.

Each week, ASPI curates and contextualises the most important developments in cyber, technology, and geopolitics — highlighting what matters and why.

This edition covers the period: 21 March 2026 to 27 March 2026.

Follow the Australian Strategic Policy Institute on Bluesky, LinkedIn, and X.

What We’re Tracking

China restricts Manus founders from leaving as Meta deal faces scrutiny

What happened: China’s National Development and Reform Commission has summoned the co-founders of Manus — a Chinese-born AI agent company acquired by Meta for $2 billion at the end of 2025 — to Beijing to question them over potential foreign direct investment violations. After the meeting, both executives were told they could not leave the country. No formal investigation has been opened and no charges have been brought.

The deal was already under review by China‘s Ministry of Commerce over potential export control violations, as the Financial Times reported in January. The new NDRC inquiry focuses on whether Manus properly notified authorities of ownership changes after the transaction closed.

Manus was founded in China but relocated to Singapore last year. Meta has already begun integrating its AI agent software into its platform; one person familiar with the matter described any unwind as “messy.”

Why we’re tracking this: The Manus case is a test case for a broader pattern of Chinese-born AI companies redomiciling to Singapore to access Western capital, a manoeuvre that has come to be known as “Singapore-washing”. Meta’s acquisition was possible in part because Manus had repositioned as a Singaporean company. Beijing‘s dual-track intervention raises questions about whether that repositioning provides genuine legal distance or merely symbolic cover.

What people are saying:

• A Meta spokesperson told the Financial Times: “The transaction complied fully with applicable law. We anticipate an appropriate resolution to the inquiry.”

• Aylon Berger at the Lowy Interpreter wrote in February that Beijing‘s tolerance for Singapore-based restructurings “may be wearing thin”, and Washington‘s could follow.

My view: For most of the past two decades, Chinese tech companies could globalise precisely because their corporate structures were intentionally opaque. They were offshore in name, but Chinese in substance. In the age of frontier AI, that ambiguity has become a liability on both sides. Western regulators are tightening rules to limit China-linked investment, and Beijing is increasingly unwilling to let strategic capabilities exit without oversight. Beijing’s intervention in Manus seems more reactive than doctrinal to me, a way to make tech entrepreneurs reconsider whether to pursue lucrative exits outside China, without pushing hard enough to spook the broader tech ecosystem it needs. The template Beijing appears to prefer resembles what Sequoia Capital did in 2023: spin off the China business, rename it something else (in this case, “HongShan”), and then create two legally distinct entities where domestic R&D remains under state oversight, but the international operation is free to access Western capital. The open question is whether terms strict enough to satisfy Beijing’s strategic concerns can still keep deals attractive to foreign acquirers.

— Fergus Ryan, CTS

Iran strikes Amazon cloud infrastructure in the Gulf

What happened: On Tuesday 24 March, Reuters reported that Amazon Web Services‘ Bahrain region had been disrupted by drone activity for the second time in a month. Amazon confirmed it is migrating customers to alternate regions but did not confirm whether the facility was directly hit.

The first attack, on 1 March, was more severe. Iranian drones struck two AWS data centres in the United Arab Emirates and damaged a third in Bahrain, the first confirmed military attack on hyperscale cloud infrastructure. Amazon described structural damage, disrupted power delivery and a “prolonged” recovery. The Islamic Revolutionary Guard Corps said the strikes were intended to probe “the role of these centres in supporting the enemy’s military and intelligence activities.”

Why we’re tracking this: Amazon, Google, Microsoft and Oracle all hold contracts under the US Department of Defense‘s $9 billion Joint Warfighting Cloud Capability program, meaning commercial cloud facilities may serve both civilian and military customers simultaneously. Where that is the case, their legal status as military targets becomes contested. The conflict has also exposed a governance gap: most governments lack visibility over which of their critical services depend on which cloud infrastructure, and where that infrastructure physically sits.

What people are saying:

• Joseph Jarnecki and Noah Sylvia at RUSI identify three rationales behind the strikes: imposing economic and reputational costs on Gulf states; probing military-relevant digital capabilities; and generating societal disruption through service outages.

• Sam Zabin of CSIS, quoted in Rest of World, said the US government and industry had “prioritised expansion over kinetic risk mitigation.”

• International law scholars León Castellanos-Jankiewicz (Asser Institute) and Ioannis Kalpouzos (Harvard Law), in The Intercept, said legality turns on whether a facility is “genuinely serving the military operations of a party to the conflict.”

My view:

Iran’s strikes on Gulf data centres, as the first confirmed kinetic attack on public cloud infrastructure, raise a legal grey-zone debate over whether such systems qualify as legitimate military targets. Commercial cloud infrastructure is, in principle, protected under the law of armed conflict through the distinction between civilians and combatants. But that protection becomes harder to apply when the same systems support military or intelligence functions. The more immediate challenge lies in governance: identifying which critical services depend on which hyperscale providers, and where those providers physically sit, has become urgent. Most governments have not done that work.

— Fitriani, CTS

What We’re Watching

A weekly scan of notable developments we’re tracking across technology, policy, and geopolitics.

⸻

🚀 Strategic competition

Iran warned it would strike energy, water desalination and information technology infrastructure in Gulf states if the United States proceeds with plans to attack Iran’s power grid. Amazon said its AWS cloud region in Bahrain was disrupted by drone activity for the second time in a month and is migrating customer workloads while it assesses damage. Earlier this month, Iran-linked drones damaged three AWS data centres in the UAE and Bahrain, disrupting internet services and forcing AWS to suspend operations at affected sites.

Palantir used its developer conference to showcase AI battlefield tools, with executives and military officials framing the company’s role as integral to U.S. operations against Iran. Lawfare’s coverage described the US–Israel operation as combining cyber, information, space and electronic warfare with kinetic strikes, drawing retaliatory Iranian cyber operations targeting U.S. and allied infrastructure.

Shield AI raised $2 billion at a $12.7 billion valuation and said it plans to acquire simulation software company Aechelon Technology as demand grows for AI-powered drones and autonomy software.

The U.S. Army selected Carlyle and KKR to build and operate two large data centres on military bases, each estimated to cost about $2 billion, with the army leasing AI computing capacity while unused capacity is sold commercially.

Russia’s Bureau 1440 launched 16 broadband satellites under its Rassvet project, its first operational step toward a low-Earth-orbit constellation. Officials said the system is intended as a sovereign alternative to SpaceX’s Starlink.”

China Computer Federation urged researchers to boycott NeurIPS after organisers barred submissions from U.S.-sanctioned institutions including Huawei. The move followed the conference's decision to comply with U.S. sanctions and drew backlash from Chinese researchers.

⸻

🧠 AI models, agents & compute

Tencent launched ClawBot by adding the OpenClaw agent as a contact inside WeChat, extending a recent run of agent products that also includes QClaw, Lighthouse and WorkBuddy.

Chinese AI providers including DeepSeek and MiniMax were reported to have overtaken U.S. rivals in token consumption since February. Lower token costs, driven by cheaper energy and more efficient model design, are allowing Chinese firms to charge significantly less than U.S. competitors as AI agents drive up usage.

OpenAI has decided to discontinue Sora as it shifts resources toward coding, enterprise productivity and agent tools. The company is also pushing for browser choice screens as it tries to challenge Google in search. Meta, meanwhile, put CTO Andrew Bosworth in charge of its AI For Work initiative to accelerate internal adoption of AI tools. Later in the week, the company laid off about 700 employees, mainly in Reality Labs.

OpenAI has put plans for an erotic chatbot on hold indefinitely, citing internal and investor concerns about social harms, unhealthy emotional attachment and risks to minors.

Elon Musk said Tesla and SpaceX will build an Austin semiconductor facility to make chips for AI, robotics and space applications under a broader Terafab initiative.

U.S. authorities charged three people over an alleged scheme to smuggle export-controlled Nvidia chips to China using shell companies in Thailand. The group allegedly sought to buy nearly $62 million worth of Supermicro servers equipped with Nvidia GPUs before the transactions were cancelled.

Across China, robotics firms were reported to be scaling industrial and humanoid systems with state funding, municipal support and dense hardware supply chains, targeting factory, retail, logistics and workforce training. In Australia, CSIRO researchers developed a proof-of-concept quantum battery that can charge, store and discharge energy in a full cycle. The National Reconstruction Fund invested $20 million in Silicon Quantum Computing as the company expands chip manufacturing and pursues a commercial-scale quantum computer early next decade.

Uber partnered with Pony AI and Verne to launch a commercial robotaxi service in Europe, starting in Zagreb. Pony AI will provide autonomous driving technology, Verne will manage the fleet and Uber will supply its ride-hailing platform and customer base.

⸻

🛡 Cyber posture

The U.S. Federal Communications Commission banned imports of new foreign-made consumer routers after a White House review found they pose a severe cybersecurity risk to critical infrastructure, while exempting devices cleared by the Pentagon. The U.S. State Department launched a Bureau of Emerging Threats focused on cyberattacks, AI misuse, space security and critical infrastructure risks from adversaries including Iran, China, Russia and North Korea.

Australian Cyber Security Centre released guidance on securing low Earth orbit satellite communications with international partners, outlining risks across space, ground, user and supply-chain segments and calling for encryption, zero trust architectures and supply-chain assurance. Meanwhile, a French officer reportedly leaked the location of the aircraft carrier Charles de Gaulle by uploading a GPS-tracked run to Strava while on deck.

Queensland Audit Office found three public sector entities could not effectively manage third-party cyber risks, with auditors able to obtain passwords, access systems, extract sensitive data and, in two cases, gain administrator-level access. The report also found weak procurement and contract controls and said CDSB and DHPW remain too slow and lack visibility over sector-wide third-party risk.

Health New Zealand warned staff not to use unapproved AI tools such as ChatGPT, Claude and Gemini to draft clinical notes, citing data security, privacy and accountability risks. A memo said the practice is strictly prohibited and could lead to disciplinary action, with AI tools required to be registered with the agency's national advisory group.

Open-source maintainers removed two versions of LiteLLM from PyPI after attackers used a compromised dependency and a misconfigured Trivy CI/CD pipeline to insert credential-stealing code into downstream workflows. Trio-Tech International disclosed a ransomware attack affecting its Singapore subsidiary that escalated from system disruption to data exfiltration, with the company still assessing scope and financial impact.

Researchers said the ClayRat Android spyware operation collapsed after infrastructure failures and the arrest of its suspected developer in Krasnodar, with all known command-and-control servers going offline within months of launch. Also, a U.S. Army soldier and two civilians were sentenced for helping North Korean IT workers secure jobs at U.S. companies using stolen or shared identities.

Security researchers reported a growing underground market for premium AI accounts including ChatGPT, Claude and Copilot, with access resold via bundled subscriptions, compromised credentials and API keys. They said the tools are increasingly being used by threat actors to scale phishing, fraud and social engineering.

⸻

🕵️ Surveillance states

Hong Kong introduced rules requiring people to surrender passwords or decryption methods for devices under investigation, with prison terms and fines for non-compliance. Earlier this month, Russia expanded the Federal Security Service’s power to order telecom operators to block access for security reasons. Authorities have increasingly used localised shutdowns and service restrictions while maintaining access to selected services via whitelists.

In Carnegie Endowment, Iran was described as using internet access as a wartime political instrument by granting unfiltered connectivity to people amplifying regime narratives while keeping much of the population offline. In Wired, activists and volunteers built Mahsa Alert to provide strike warnings, verified attack locations and offline updates during the conflict and related shutdowns.

In Bloomberg, Sandvine, later rebranded as AppLogic Networks, was reported to have sold deep packet inspection technology to Egyptian government bodies and other authoritarian regimes after its acquisition by Francisco Partners. The U.S. Entity List designation that followed cut the company off from suppliers and helped trigger layoffs, debt distress, restructuring and a withdrawal from more than 50 non-democratic countries.

In Australia, Services Australia, the ATO and Defence decided not to enable a new Microsoft Teams feature that would update worker location via workplace WiFi. In the Financial Times, Palantir was described as becoming a political liability in U.S. campaigns as candidates face scrutiny over investments, donations and ties to the company because of its work with Immigration and Customs Enforcement.

⸻

⚖️ Platform accountability

Polymarket has promoted itself as a truth-seeking platform, but a review in The New York Times found its social accounts had posted hundreds of false or misleading claims across platforms. In recent days, experts said trading on a US-Iran ceasefire market showed patterns consistent with possible insider knowledge after earlier suspicious trades around U.S. strikes on Iran. Kalshi, meanwhile, said it will bar athletes, coaches, officials and political candidates from trading on markets tied to their own sports or campaigns.

An Australian Senate inquiry found widespread climate misinformation amplified by social media platforms and AI-generated content, affecting public opinion on issues including wind farms, batteries and climate policy. The inquiry said false claims had influenced local decisions and flagged limited platform accountability and transparency around funding sources.

Meta faced criticism over more than 26,000 fake Facebook ads promoting investment scams across at least 25 countries, including Australia, using AI-generated images, cloned news sites and fabricated endorsements. X paused planned changes to creator revenue-sharing after backlash from global creators who said the new weighting toward home-region engagement would cut reach and income.

A U.S. federal judge dismissed X Corp's lawsuit accusing major advertisers and the World Federation of Advertisers of coordinating an illegal boycott. The court ruled that X had failed to show harm under antitrust law.

The Trump administration settled a lawsuit barring the Surgeon General’s office, the CDC and CISA from threatening social media companies with legal or regulatory penalties to remove protected speech. The agreement still allows officials to publicly challenge misinformation without coercion.

Wikipedia updated its English-language guidelines to ban editors from using AI to write or rewrite articles, while still allowing limited copyediting suggestions and translation if accuracy is verified. The change followed ongoing efforts by the community to remove low-quality AI-generated entries.

⸻

🧒 Online harms & child safety

Pinterest CEO Bill Ready called for a global ban on social media use by children under 16 and urged governments to enforce age limits while holding both platforms and mobile operating systems accountable. He cited Australia’s policy as a model even though Pinterest itself is not covered by it. In the United Kingdom, Apple rolled out age checks for iPhone users, requiring them to confirm they are over 18 for some apps and services after government pressure tied to the Online Safety Act.

The United Kingdom launched pilot programmes with 300 teenagers to test social media bans, curfews and app time limits, as officials assess effects on sleep, family life and schoolwork. The trials will inform an ongoing consultation on possible restrictions, including a ban for under-16s.

Australia's eSafety Commissioner said major AI companion chatbots are failing to adequately protect children from harmful and sexually explicit content. The report identified weak age verification, limited safeguards against child exploitation material and insufficient responses to self-harm risks across services including Character.AI, Nomi, Chai and Chub AI.

The European Commission accused major adult websites including Pornhub, Stripchat, XNXX and XVideos of failing to adequately protect minors, citing weak age verification and risk assessments. The findings came under the Digital Services Act, which allows fines of up to 6 per cent of global turnover. The European Commission also launched an investigation into Snapchat over alleged failures to protect minors, including weak age verification, exposure to grooming and risks of illegal goods sales. The probe will assess whether Snap is adequately enforcing child-safety measures under the Digital Services Act.

Meta was ordered to pay $375 million after a New Mexico jury found it misled users about platform safety and enabled harm including child sexual exploitation. CNBC reported a second phase of the case will begin in early May to determine additional remedies and whether Meta must fund mitigation programmes.

Days later, a Los Angeles jury found Meta and YouTube negligent over addictive design features including infinite scroll and algorithmic recommendations. Back-to-back verdicts in two states have produced what analysts are calling Meta’s “big tobacco moment”: the point at which product-liability claims begin to compound into systemic legal risk. More than 3,000 similar cases are pending in California alone, brought by individuals, states and school districts. The cases are framed around design decisions, not content — which lets plaintiffs route around the Section 230 protections that have historically shielded platforms from this kind of liability.

⸻

🧑‍⚖️ Courts, enforcement & regulation

A federal judge questioned the Pentagon’s designation of Anthropic as a supply-chain risk. The judge raised concerns the move could amount to illegal retaliation after Anthropic sought to limit military uses of its tools. The dispute comes as a proposed federal procurement rule, described in The Lever, would require AI vendors to allow government use of their systems for any lawful purpose and bar them from enforcing their own safety or use restrictions.

The Fair Work Commission introduced new disclosure and verification requirements for litigants using generative AI in submissions, including checks on accuracy, relevance and fabricated citations. The rules also require witnesses to confirm statements are based on their own knowledge and are accurate.

European Parliament lawmakers voted to delay key provisions of the EU AI Act while backing a ban on so-called nudify apps. The changes would push some compliance deadlines into 2027 and 2028 and delay watermarking rules until later this year, pending negotiations with the European Council.

⸻

🌏 Global policy

🇦🇺 Australia

Anthropic CEO Dario Amodei is expected to visit Australia next week as part of a broader executive leadership trip, with sources in Canberra and the Australian AI community confirming the planned visit to Crikey. The trip comes amid the company’s ongoing tensions with the Trump administration after the Pentagon designated Anthropic a supply-chain risk.

Australia introduced a five-step framework requiring tech companies seeking approval for data centres and AI projects to meet national-interest conditions on renewable energy, water use, local jobs and domestic compute availability.

Accenture Australia won a $16 million contract to build a new Climate Risk Hub for the Australian Climate Service, with delivery running over three years and possible extensions into the next decade.

In The Strategist, Andrew Horton argued Australia’s copyright regime as constraining domestic AI development by limiting access to training data. In another piece, Isaac Sharp described Australia as lacking policy frameworks for AI digital twins in defence and critical infrastructure settings.

🇺🇸 United States

Sen. Bernie Sanders and Rep. Alexandria Ocasio-Cortez introduced legislation to pause new AI data-centre construction until federal safeguards covering worker protections, environmental impacts and civil rights are enacted.

The Office of the Director of National Intelligence moved to assume oversight of In-Q-Tel from the CIA. Later in the week, President Donald Trump appointed tech executives including Mark Zuckerberg, Larry Ellison and Jensen Huang to the President’s Council of Advisors on Science and Technology.

Melania Trump appeared at a White House event alongside a humanoid robot developed by Figure AI, calling for wider use of AI-powered robots in children's education.

⸻

💰 Tech business & markets

Bitmain partnered with American Bitcoin to deploy mining infrastructure and develop a large data centre in Texas, despite ongoing U.S. national security scrutiny of Bitmain equipment and investigations into possible risks to the power grid and nearby military sites.

Apple CEO Tim Cook praised Chinese developers and manufacturing partners at the China Development Forum days after state media criticised the company’s App Store policies and called for more regulatory changes. Apple has also reduced developer fees in China and continues balancing strong local sales with supply-chain diversification into India and Vietnam.

NextDC warned Australia’s slow energy transition and grid constraints could divert AI investment and jobs overseas even as demand for electricity from data centres rises. The company said growing use of AI inference is increasing the importance of reliable, affordable power in decisions about where systems are deployed.

Meta raised its planned investment in an El Paso data centre to more than $10 billion as it expands AI infrastructure. The gigawatt-scale site is one of more than 30 facilities Meta has built or is building.

That’s all for this week. For more timely analysis and commentary, check out The Strategist and ASPI’s Stop the World podcast—or our other Substack newsletters:

Share

Welcome to the latest edition of ASPI’s Cyber & Tech Digest.

Each week, ASPI curates and contextualises the most important developments in cyber, technology, and geopolitics — highlighting what matters and why.

This edition covers the period: 14 March 2026 to 20 March 2026.

Follow the Australian Strategic Policy Institute on Bluesky, LinkedIn, and X.

A quick note to readers:

We’re working to make the Digest as comprehensive and readable as possible, though this edition is on the longer side.

If you’d prefer shorter updates more frequently (for example, two or three editions across the week), we’d like to hear that. As outlined in our recent format update, we’ll soon introduce a Substack pledge option so readers can signal whether they’d support a more frequent release schedule. If there’s sufficient interest, we would look at moving to up to three editions per week, delivering key developments faster and in shorter bursts.

A note on our process: we use AI tools to assist with research and drafting. Every edition is reviewed, edited and curated by our team, and any analysis or commentary is written by us.

Feedback is always welcome. You can reply directly to this email, leave a comment on the post, or contact us at aspicts@substack.com

— The ASPI Cyber, Technology & Security Program

What We’re Tracking

Nvidia restarts H200 sales to China as policy framework collapses

What happened: Nvidia is restarting production of its H200 AI chips for China after receiving US government approvals and purchase orders from Chinese customers. CEO Jensen Huang confirmed the move at Nvidia‘s GTC conference in San Jose. The restart follows a Reuters report that the US Commerce Department quietly withdrew a draft rule that would have replaced the Biden-era framework governing global AI chip exports — a framework the Trump administration had promised to overhaul.

Why we’re tracking this: The H200 restart is not the story. The withdrawn rule is. The US currently has no coherent replacement policy for controlling AI chip exports. Approvals are being granted case by case, company by company, in a regulatory vacuum. Allies, adversaries, and chipmakers are all trying to read what the rules actually are. That uncertainty is itself a strategic liability.

What people are saying:

• Huang framed the restart as Trump policy, not just Nvidia business: “President Trump‘s intention is that the US should have a leadership position... he would also like us to compete worldwide and not concede those markets unnecessarily,” in Financial Times and Axios.

• A former US official told Reuters the rule withdrawal “likely reflects differing views within the Trump administration on how to achieve global AI supremacy.”

• Beijing has been slow to authorise imports at scale — a signal that China is in no hurry to become dependent on Nvidia while Huawei builds out domestic alternatives, per Financial Times.

My view: Ad hoc approvals with no rule are worse than a bad rule. Allies need to know what the framework is. Companies need to plan. Adversaries need to know where the line is. The Biden-era architecture is effectively dead; what replaces it is still unclear. If H200 shipments into China resume at sustained volume, it will confirm that Trump‘s approach to chip export controls is deals, not doctrine — and that is a fundamentally different kind of US industrial policy than anything that came before it.

— Stephan Robin, CTS

What We’re Watching

A weekly scan of notable developments we’re tracking across technology, policy, and geopolitics.

⸻

🚀 Strategic competition

Nvidia CEO Jensen Huang said the company has restarted manufacturing of H20 AI chips for China after receiving new US export approvals and purchase orders from multiple Chinese customers in recent weeks, having paused production while export-licence reviews stalled and Chinese authorities were slow to authorise imports at scale. Beijing must still approve H200 imports before shipments can proceed at scale. Separately, the US Commerce Department withdrew a draft rule intended to replace the Biden-era AI chip export control framework — one that would have tied large export approvals to foreign investment in US data centres or government-to-government security guarantees — and said it is still working on a formal approach modelled on recent chip deals with Saudi Arabia and the UAE.

Hua Hong Group's Huali Microelectronics has developed a 7-nanometre process at its Shanghai plant, making it the second Chinese chipmaker after SMIC with that capability. Huawei has been collaborating on the technology and Biren is using the line for tape-out testing, with initial production capacity of a few thousand wafers per month planned by the end of this year.

Analysts and industry executives warned that the Iran war could disrupt the helium, sulphur and energy supplies that Taiwan and Europe rely on for chipmaking, raising supply risks for AI chips, smartphones, cars and other electronics. Taiwan said it has secured LNG for the near term, has already secured more than half its LNG needs for May and has decided to raise its statutory minimum natural-gas inventory to 14 days starting next year.

Google is in talks with China's Envicool and other Chinese suppliers about liquid-cooling equipment for AI data centres, reflecting tight global supply for systems needed to manage heat from dense compute clusters; Google's Taiwan procurement team travelled to China this month and Envicool has already built a coolant distribution unit to Google's specifications. Micron, meanwhile, said it completed the acquisition of PSMC's Tongluo P5 site in Taiwan and plans to build a second manufacturing facility there to expand supply of leading-edge DRAM and HBM, with construction scheduled to begin by the end of fiscal 2026.

The US Army awarded Anduril a contract worth up to $20 billion for software, hardware and services to speed delivery of technology to soldiers and reduce subcontracting costs, covering a five-year base period with a five-year optional ordering period. Gecko Robotics, meanwhile, won a $71 million US Navy deal to use inspection robots and AI to accelerate ship-repair planning and maintenance. Palantir demos, public documents and Pentagon records reviewed by WIRED show how the company's AI assistants could be used to interpret intelligence and generate military courses of action, build routes and assign jammers inside defence systems, with Anthropic's Claude or other third-party models potentially acting as the reasoning layer inside Palantir products used by US and NATO customers.

Reflection AI, backed by Nvidia, is partnering with Shinsegae Group to build one of South Korea's biggest AI data centres and develop models tailored to Korean language and culture, as part of a broader US push to export AI infrastructure to allies. The Commerce Department is developing an AI export programme that officials described as the template this deal is meant to support.

UK officials confirmed plans to buy more anti-drone Lightweight Multirole Missiles for forces in the Middle East after British units there shot down more than 40 drones launched by Iran or its proxies. London also sent additional planners to the Pentagon, put naval assets on standby, and convened British defence firms with Gulf diplomats to discuss faster supplies of defensive equipment. The UK also confirmed plans to buy more anti-drone lightweight multirole missiles for forces in the Middle East after British units shot down more than 40 drones launched by Iran or its proxies, while also sending additional planners to the Pentagon, putting naval assets on standby and convening British defence firms with Gulf diplomats to discuss faster equipment supplies. British officials also signalled to the Trump administration that the UK could provide assistance once hostilities cease.

Australian Defence Minister Richard Marles confirmed that intelligence gathered by an Australian Wedgetail surveillance aircraft deployed to support Gulf states is sent through the Combined Air Operations Centre in Qatar, where the US can access it. Marles argued the information-sharing is necessary for regional air defence, while critics said the arrangement undermines claims the mission is purely defensive.

The ABC found China-based suppliers listing one-way attack drones and Shahed-like systems on Alibaba while describing them publicly as commercial products for mapping or spraying; after being alerted, Alibaba removed the listings and suspended the sellers' accounts. Experts said dual-use drone proliferation is becoming harder to control.

Chinese officials are scrutinising Meta's $2 billion acquisition of Manus, a Singapore AI startup with Chinese roots, and are reportedly attempting to penalise people linked to the deal to discourage Chinese AI executives from moving businesses offshore. Officials are examining whether the transaction violated Chinese export-control and outbound-investment rules.

British officials suspect China is using the UK's freedom of information system to gather unclassified but sensitive defence and national-security data that can be assembled through the "mosaic effect" into sensitive intelligence, with the government concerned that weak identity checks make hostile-state collection difficult to detect. Officials are set to investigate whether further safeguards are needed.

⸻

🧠 AI models, agents & compute

A free model called Hunter Alpha appeared anonymously on OpenRouter with a claimed 1 trillion parameters and a 1 million-token context window, sparking speculation it could be an early DeepSeek release. Neither DeepSeek nor OpenRouter identified the developer, and engineers remain divided on whether the model matches DeepSeek's expected architecture. Chinese media have reported that DeepSeek's next-generation V4 model could launch as early as April.

OpenClaw has gone viral in China, spawning installation tours, consultants and local clones from Tencent, ByteDance, Alibaba and Moonshot as consumers and investors chase AI agents. Local governments are offering subsidies and vouchers to projects built around the tool, while Chinese regulators have warned about data-breach and permission risks. Tencent launched a nationwide tour this month to help people install OpenClaw in 17 cities, and a Hangzhou district pledged up to Rmb20 million a year to help companies pay for computing power.

An internal Meta agentic AI sparked a security incident by answering another employee’s forum query without being asked and advising an action that temporarily gave some engineers access to systems they should not have seen, according to Engadget citing The Information. Meta said no user data was mishandled and the exposure lasted about two hours.

Jeff Bezos is in early talks to raise $100 billion for a fund that would acquire manufacturing companies in chips, defence and aerospace and use AI to accelerate automation and efficiency. The effort is linked to Project Prometheus, an AI startup Bezos co-leads that is also separately in talks to raise up to $6 billion; it is developing models to simulate the physical world for engineering and design, with an initial focus on selling software tools for engineering simulation.

Samsung said it is considering a shift toward multiyear memory-chip contracts lasting three to five years, moving away from the current quarterly or annual norm as AI-memory demand stays high and shortages worsen.

⸻

🛡 Cyber posture

Researchers at Google, iVerify and Lookout identified a Russian-linked group designated UNC6353 using a new iPhone exploit toolkit called Darksword against people in Ukraine. The web-delivered kit can compromise iPhones running most of iOS 18, stealing passwords, messages, photos and other data, and may also target cryptocurrency wallets. WIRED further reported that the researchers found the full exploit code exposed on compromised sites — making reuse by other actors easier — and that campaigns have targeted victims in Ukraine, Saudi Arabia, Turkey and Malaysia.

The European Union sanctioned China-based Integrity Technology Group and Anxun Information Technology, plus Iran's Emennet Pasargad, over cyberattacks and disinformation campaigns targeting member states, with measures including asset freezes, travel bans and a prohibition on EU funds reaching the sanctioned entities. EU governments additionally sanctioned Emennet Pasargad specifically for hacking Charlie Hebdo subscriber data and advertising the stolen information for sale, alongside Anxun and its co-founders.

ProPublica reported that FedRAMP reviewers found Microsoft‘s GCC High cloud security documentation too weak to assess encryption and overall risk, yet the product still received authorisation because it was already deeply deployed across US government and defence systems. The reporting also describes years of stalled review, pressure from Microsoft and agencies, and later staffing cuts that left FedRAMP with minimal capacity.

Russia‘s Kremlin has overseen mass mobile-internet blackouts in Moscow since early this month, with traffic in central areas down sharply as authorities expand a whitelist model that leaves only approved sites accessible; the Kremlin said the measures will remain in place “as long as necessary.” Iran, meanwhile, sharply tightened already severe internet restrictions in the 48 hours before Chaharshanbe Suri, cutting approved messaging apps and selective-access SIM cards, with activists and network monitors saying the move appeared aimed at preventing unrest during a festival that has previously triggered nationwide protest.

⸻

🕵️ Surveillance states

FBI Director Kash Patel told senators the bureau is buying commercially available information that can be used to track people’s movements and location history — the first confirmation since 2023 that the agency is actively doing so. TechCrunch additionally reported that the admission reignited debate over agencies using data brokers to bypass the warrant requirements that apply to telecom providers. The Government Surveillance Reform Act, introduced last week, would require federal agencies to obtain a court-authorised warrant before buying Americans’ personal information from data brokers.

Intellexa founder Tal Dilian said his company supplied surveillance technology only to authorised governments and law-enforcement agencies, a statement that reignited claims the Greek government was behind the Predator spyware scandal. The remarks came weeks after a Greek court convicted Dilian and three others over surveillance of targets across politics, civil society and the military. The defendants have the right to appeal, and prosecutors argued the trial evidence warrants further investigation into possible espionage charges.

⸻

📢 Disinformation & information operations

The New York Times identified more than 110 unique AI-generated images and videos about the Iran war that were viewed millions of times across X, TikTok, Facebook and private messaging apps. A majority of the content pushed pro-Iran narratives and many fakes exaggerated destruction or falsely depicted military strikes. Donald Trump accused Iran of using AI-generated content to exaggerate wartime success, and accused Western media — without evidence — of spreading “fake news” in coordination with Tehran. His comments came amid renewed pressure from the FCC on broadcasters over war coverage, while Reuters said it verified some imagery and found no Western reports matching one of Trump’s cited claims.

A Times of Israel military correspondent said Polymarket bettors bombarded him with emails, doctored screenshots, bribe offers and death threats after he reported that an Iranian missile struck near Beit Shemesh. The threats were tied to a prediction-market contract about whether Iran had struck Israeli soil that day, and he said police are investigating.

⸻

⚖️ Platform accountability

Meta said it will remove end-to-end encryption from Instagram direct messages after May 8, telling affected users to download their chats after saying very few people opted in to the feature. Platformer reported that Meta never fully rolled the feature out and linked the retreat to child-safety pressure and earlier internal objections, even though the company had once described encrypted messaging as a core privacy commitment.

The UK Financial Conduct Authority found that 1,052 unauthorised foreign-exchange and CFD ads appeared on Meta’s platforms in a single November week, including many from advertisers it had already flagged to the company. Ofcom‘s power over paid-for scam ads under the Online Safety Act has been delayed until at least 2027, and Fraud Minister David Hanson said he will keep pressing Meta and other platforms until the provision takes effect.

The European Commission said X has submitted remedies to change its blue-check verification system in the EU after being fined €120 million under the Digital Services Act for selling verification badges that Brussels argued misled users into treating paying accounts as trustworthy; the Commission said it will assess the proposed remedies.

Meta, separately, said it will reduce its reliance on third-party content moderators and expand the use of large-language-model-based AI to detect and remove policy-violating posts across its apps, saying the new tools perform better in areas including scams, celebrity impersonation and adult sexual solicitation, while human reviewers remain responsible for nuanced and high-risk decisions.

Apple lowered its standard mainland China App Store commission to 25% from 30% and cut the mini-app rate to 12% from 15% after discussions with Chinese regulators, easing pressure from Beijing and reducing friction with companies including Tencent and ByteDance over payments and app distribution. CEO Tim Cook appeared at an Apple event in Chengdu amid continued antitrust pressure over fees, third-party payment restrictions and platform rules in China.

Whistleblowers told the BBC that Meta and TikTok accepted more harmful or borderline content because outrage drove engagement and competition for user attention, especially after TikTok’s rise. Internal documents and dashboards cited by the BBC showed higher levels of hostile content on Reels and cases where TikTok reportedly prioritised some political complaints above serious youth-safety reports.

⸻

🧑‍⚖️ Courts, enforcement & regulation

The US Justice Department argued in court filings that Anthropic‘s lawsuit over its Pentagon “supply chain risk” designation should fail, saying the company’s insistence on limits for autonomous weapons and domestic surveillance made it an unacceptable security risk, with agencies already working to replace Anthropic’s tools with systems from Google, OpenAI and xAI. In a separate filing, the Pentagon said Anthropic’s use of foreign workers, including Chinese nationals, creates adversarial risk under China’s National Intelligence Law and constitutes broader national-security concerns beyond policy disagreements alone, though it said it is still relying on Anthropic’s tools and may extend the offboarding deadline; a hearing on Anthropic’s request for temporary relief is scheduled for Monday.

Technology companies including Microsoft, Amazon, Google, OpenAI and Palantir have given varying degrees of behind-the-scenes support to Anthropic, fearing the precedent the designation could set for firms that impose limits on military or surveillance use of AI, while the White House is preparing an executive order that could ban Anthropic across government systems as early as this week. Anthropic’s Jack Clark, separately, held a closed-door briefing with the bipartisan House Homeland Security Committee this week, focusing mainly on model distillation, export controls and national-security issues.

A federal judge said Elon Musk‘s $134 billion damages model in his case against OpenAI and Microsoft appeared unpersuasive and based on “numbers out of the air,” but allowed the testimony to go to a jury. The model underpins Musk’s fraud claims over OpenAI’s shift away from its nonprofit origins, with trial set for late April.

Three Tennessee teenagers sued xAI, alleging Grok tools were used to generate nude child sexual abuse material from their real photos and that the images spread through Discord and Telegram. An Ars Technica report on the same case notes that the plaintiffs are seeking damages and an injunction covering all minors harmed by the alleged conduct, and that police linked one perpetrator to Grok-enabled tools.

Closing arguments finished in a Los Angeles bellwether case where a young woman says Instagram and YouTube addicted her and worsened depression and suicidal thoughts, with the outcome expected to shape how thousands of similar lawsuits against social-media companies may unfold. The jury began deliberations on Friday.

Florida lawmakers failed to pass Governor Ron DeSantis‘s AI Bill of Rights after House Republicans aligned with Donald Trump‘s pro-AI stance blocked the measure, exposing a split in the party over state AI regulation. The legislature did, however, pass a separate bill to limit how data centres can raise electricity and water burdens for consumers.

The UK government abandoned its preferred plan to let AI companies train on copyrighted works unless rights holders opted out, after backlash from artists and creative-industry groups. Ministers said they now have no preferred option and will delay copyright reform until they are confident it will meet economic and public-interest goals.

Encyclopedia Britannica and Merriam-Webster sued OpenAI in Manhattan federal court, alleging it copied nearly 100,000 encyclopedia and dictionary entries to train ChatGPT and then reproduced near-verbatim outputs that diverted traffic. OpenAI said its models are trained on publicly available data and grounded in fair use; Britannica is seeking damages and a court order blocking the alleged infringement.

⸻

💰 Tech business & markets

Reuters reported that Meta is planning layoffs that could affect 20% or more of its workforce as it tries to offset rising AI infrastructure costs, with no date set and the final scale not yet determined, even as the company plans to invest $600 billion in data centres by 2028.

Ramp customer data cited by Axios shows Anthropic now captures more than 73% of spending by companies buying AI tools for the first time, reversing a split that favoured OpenAI in December. OpenAI said it is on pace to generate $25 billion in revenue this year versus Anthropic’s $19 billion, and is considering a strategy shift toward enterprise customers.

Sydney-based Advanced Navigation raised A$158 million at a valuation above $1 billion, making the AI-assisted navigation company Australia’s newest tech unicorn, with the funding set to back US and UK expansion, acquisitions and growth in defence and industrial contracts. The Wall Street Journal reported the company expects to make more than $100 million in sales this year, with founders expecting either an IPO or a sale within three to five years.

The European Commission unveiled “EU Inc.”, a package intended to let startups incorporate once under a single EU-wide regime, operate across the bloc and use EU-wide employee stock-option plans, with Brussels saying the goal is to cut administrative burdens and help European firms scale against US and Chinese competitors. European businesses, meanwhile, told the Financial Times that a rapid push for tech sovereignty away from US software, cloud infrastructure and AI services would be costly and disruptive, saying Europe lacks mature substitutes for many US offerings; the Commission is due to present a “tech sovereignty package” next month.

Lenders and brokers told the Financial Times that many AI data-centre projects are too large to secure full replacement-value insurance, leaving investors reliant on partial cover or maximum-foreseeable-loss policies, with the mismatch already deterring some debt providers from financing projects.

Hyperliquid‘s 24/7 oil perpetual futures saw heavy activity as traders reacted to the Iran war before conventional commodity markets reopened, with the article framing the growth as an early sign of convergence between tokenised finance and mainstream commodities trading.

⸻

🧒 Online harms & child safety

Australia’s eSafety regulator said child sexual exploitation material is more readily accessible on X than on any other mainstream platform and that its efforts to address the problem have been inadequate. Documents obtained under FOI also show eSafety is investigating xAI over Grok being used to generate similar material. X is challenging the relevant online safety standards in the Federal Court, with a hearing set for May. Australia’s eSafety commissioner also said the agency is intensively investigating whether platforms are taking reasonable steps to detect and deactivate under-16 accounts under the social-media age ban, with fines of up to $49.5 million available. eSafety said it will provide an official update on the ban’s performance at the end of March, while an expert panel will follow 4,000 children for more than two years to measure the long-term effects of the legislation.

The World Happiness Report 2026 said heavy social media use appears to be contributing to lower wellbeing among young people, with girls affected disproportionately, linking heavy use to sextortion, cyberbullying, depression and anxiety, while noting that some regions showed positive associations between social media use and wellbeing.

⸻

🌏 Global policy

🇦🇺 Australia

New South Wales began rolling out digital birth certificates through the Service NSW app, becoming the first Australian jurisdiction to offer them. The initial rollout covers people aged 16 to 21 who already hold a NSW driver’s licence or photo card.

🇺🇸 United States

OpenAI signed a new contract with AWS to sell AI services to US government employees for both classified and unclassified work, creating a path to Pentagon and civilian contracts outside the company’s prior Microsoft-only hosting arrangement. To serve civilian agencies with unclassified work on AWS, OpenAI still needs a waiver from Microsoft.

🇬🇧 United Kingdom

The UK announced £1 billion in new quantum-computing funding alongside an already-announced £1 billion for applications, as ministers said Britain should avoid losing talent and companies the way it did in AI. The money is intended to help firms design large-scale machines and support uses in finance, pharmaceuticals and energy, with the government wanting a domestic cutting-edge quantum computer by the beginning of the next decade.

A UK parliamentary committee urged the government to immediately ban crypto donations to political parties until stronger safeguards are in place, warning that foreign-influence risks are rising and current screening is likely incomplete. The report specifically highlighted growing concern about outside attempts to shape British politics, with the committee noting those risks are likely to grow as the next general election approaches.

🇨🇳 China

China approved Borui Kang‘s invasive brain-computer interface system for commercial sale — the first approval of its kind for a BCI medical device globally. The wireless system is designed for some patients with cervical spinal cord injuries to help restore hand-grasping ability, and a leading BCI expert told Reuters that China could see the technology move into practical public use within three to five years.

🇮🇳 India

India’s government privately proposed in January that Apple, Samsung, Google and other phone makers consider pre-installing the Aadhaar biometric ID app on smartphones, according to industry letters reviewed by Reuters. Smartphone companies, through industry body MAIT, opposed the proposal, citing security concerns, added production costs and the need for separate India-specific production lines.

That’s all for this week. For more timely analysis and commentary, check out The Strategist and ASPI’s Stop the World podcast—or our other Substack newsletters:

Share