Moxie Marlinspike: The Anarchist Sailor Who Built Signal and Encrypted Billions of Chats

Moxie Marlinspike, a dreadlocked squatter who sailed a $1,000 wreck to the Caribbean with bags of bricks for anchors, built Signal and the encryption guarding billions of WhatsApp and Messenger chats, then got Facebook, Google, and Microsoft to run his code.

Moxie Marlinspike at the mast of S/V Pestilence, somewhere on open water, in a still from his film Hold Fast.

I. The Bricks

The spare anchor is a bag of bricks.

Not a Danforth, not a plow, not one of those gleaming stainless-steel Rocna jewels that the yacht-club people in Fort Lauderdale hang off their bows like cufflinks. Bricks. Construction-grade, red-clay, scavenged bricks, stuffed into a sack and tied to a line. Somewhere in the islands, off the side of a beat-up thirty-foot sailboat that a gang of broke kids bought as a wreck in Fort Lauderdale for a thousand dollars ($1,000!) and named, with perfect punk logic, Pestilence, the sack goes over the side, ker-SPLOOSH, and sinks into the green water, and everybody on deck watches the line pay out and thinks the same thing, which is: Well. We'll see.

Bricks go into a bag on the deck of Pestilence to become an anchor. A still from Hold Fast.

This is the mid-2000s. On deck is a tall, lanky young man with a head of dreadlocks and a name that sounds like a pirate made it up after three rums: Moxie Marlinspike. Moxie is a childhood nickname that stuck. Marlinspike is a sailor's tool, a tapered steel spike for prying apart the strands of a rope so they can be spliced together. He was born in Georgia; his birth name, widely reported as Matthew Rosenfeld, is something he declines to discuss. He picked the name the way he picks almost everything: on purpose, against convention, and with a straight face.

The boat is a Pearson 30, or what's left of one: a fiberglass shell with no mast and no engine. The crew, Moxie and three friends calling themselves the Anarchist Yacht Club, with more nerve than sense among them, is sailing it, somehow, over two winters, from Florida through the Bahamas and south toward Haiti and the Dominican Republic. They rebuilt it with scavenged plywood and stepped the mast using the dinghy crane of an unattended superyacht. They film the whole thing. The result, released in 2008 as a video zine called Hold Fast under a Creative Commons license (share it, copy it, just don't sell it), becomes a cult object in sailing forums and anarchist infoshops: a movie about salt and improvisation and the stubborn, half-crazy idea that the world's systems are more fragile and exclusive than they look, and that anybody with enough guts and skill can sail straight past them.

A Pearson 30 under sail, the same model as the Hold Fast boat.

Hold that picture. The bricks. The splash. The line paying out into the deep.

Now jump ahead a decade or so. That same man, who scavenged a dead boat and anchored it with rubble, wrote the mathematics that protects the private conversations of more people than have ever lived under any empire in human history. The Signal Protocol, which he designed with the cryptographer Trevor Perrin, runs inside Signal, inside WhatsApp, inside Facebook Messenger, and inside Google Messages. Until Microsoft pulled the plug in 2025, it ran inside Skype, too. A teenager in São Paulo texting her girlfriend uses it. So do a reporter in Kyiv messaging a source and an oncologist in Ohio sending a patient's scans. All of them lean, without knowing it, on the brain of the guy with the bricks.

That is the paradox, and it's the whole story. An anarchist who doesn't trust technological power ended up building the most important piece of privacy technology on Earth. He looks at the digital establishment and sees a machine for coercion and mass surveillance, and then he writes the code that the machine's biggest players beg to license. When he stepped down as CEO of Signal in January 2022, worn down by more than a decade of carrying it, he left behind a landscape he had rearranged by force. The world's intelligence agencies had been gliding toward frictionless mass surveillance, and he had thrown a wrench into the gears.

II. The Squat, the City, and the End of History

San Francisco, the late 1990s. The dot-com boom is at full fever. You can feel the money on the street like humidity: the Aeron chairs, the launch parties with ice sculptures, the twenty-four-year-old vice presidents in fleece vests with startup logos on the chest, the endless cocktail-party question: So what's your company?

And into this, at eighteen, from Georgia, comes Matthew Rosenfeld. He sleeps his first few nights in Alamo Square Park, then lands a job at the dot-com WebLogic, a normal dot-com thing of that era. It doesn't take. At the height of the bubble he quits and goes the other way, down, into the crust: the punk houses, the squats, the hacker collectives, the scene where people live in abandoned buildings on principle and fix bicycles out of dumpster parts and argue about Bakunin over shared bowls of lentils. Over the years that follow he hitchhikes across America. He lives cheap. He builds a life around one idea that he holds almost like a monk: autonomy above everything, direct action instead of permission, and an ascetic, almost athletic refusal to be governed.

Mission Street, San Francisco, 2005. After the boom: the city of the punk houses and the squats.

This isn't a pose. It's a philosophy, and he writes it down. In 2005, with Windy Hart, he co-authors a tract called An Anarchist Critique of Democracy, distributed through Audio Anarchy Radio and later collected in The Anarchist Library. It's startling if you only know Moxie as the Signal guy, because it doesn't go after dictators. It goes after democracy. Even democratic systems, the argument runs, demand that the individual submit to an outside power. Majority rule is still rule. The core charge is alienation: voting hands your will to someone else. What Marlinspike and Hart want instead is "unmediated relations between free individuals," self-organization and direct action. Even direct democracy, one section heading declares, "isn't anarchy."

Keep that tract in mind. It comes back later, in the strangest possible form.

The sea is where the philosophy turns physical. Moxie goes into sailing the same way he'll go into cryptography: skip the gatekeepers, scavenge what other people threw away, and trust only your own competence. Sailboats were supposed to belong to millionaires. Moxie and his friends found out that the marinas were full of neglected, half-dead boats that nobody wanted, and that with enough sweat and stubbornness one of them could be made to float. That's how you get to the bricks, and to what he and his friends called "Blue Anarchy," the name of their anarchist sailing collective: the waves don't check your credentials.

In 2020, after about two years in Venice, California, he gave The New Yorker's Anna Wiener a line that sums up how he feels about the pre-built world. He said it dryly, the way he says most things:

"Living in Venice is like living at the end of the world, the end of history. … All the decisions have been made. This is the world we get."

Listen to the contempt in that. All the decisions have been made. For most people that sentence is just a description of life. For Moxie Marlinspike it's a provocation, and what follows is a twenty-year answer to it.

III. We Should All Have Something to Hide

June 12, 2013. A week earlier, The Guardian had published the first story based on the Snowden documents. Everywhere, on cable news and at dinner tables, people kept repeating the same tired line, smug and soothing: If you have nothing to hide, you have nothing to fear.

Moxie sat down and took it apart.

The essay, posted on his personal blog, is called We Should All Have Something To Hide, and it reads like a crowbar. It doesn't argue that surveillance is creepy, or that privacy is nice to have. It argues something sharper: in the modern world, everybody is a criminal.

Look at the numbers, he says, quoting the law professor James Duane: federal crimes are spread across roughly 27,000 pages of the United States Code, and the regulations that carry criminal penalties number nearly 10,000. He adds Supreme Court Justice Stephen Breyer to make the point that no ordinary person can know ahead of time whether some harmless thing they did on a Tuesday might someday be used against them.

Then he delivers the punchline, which is about a lobster. Owning a lobster below a certain size is a federal crime. It doesn't matter whether you bought it legally at the grocery store, whether somebody gave it to you, or whether you found it already dead of natural causes. You are, it turns out, a crustacean outlaw.

It's funny. Then it isn't. If everyone breaks some law at some point, and the state has a permanent, searchable record of everyone's communications, then enforcement is entirely a matter of choice. The law stops being blind. It looks wherever the powerful point it. Show me the man, as Stalin's secret-police chief is supposed to have said, and I'll show you the crime.

Moxie in 2013, the year of "We Should All Have Something To Hide" and of Open Whisper Systems.

He goes further, and this is the part that keeps the essay alive. Progress, he argues, depends on people being able to break the law in private. Marijuana legalization, same-sex marriage: these didn't come from polite debate in some abstract "marketplace of ideas." They happened because people lived differently first, in the shadows, until the culture caught up and the law followed. A surveillance state that sees everything and enforces everything perfectly wouldn't just be oppressive. It would freeze society solid, like an insect in amber.

He names the shift that made this possible. The old surveillance, Carnivore, Echelon, Total Information Awareness, was "proximate": the government tapping communications itself. The new kind is "oblique." The government doesn't have to bug anyone. It just harvests the data already piling up on its own in the databases of search engines, social networks, and phone companies.

His conclusion doesn't pull its punch. Don't just vote or petition, he writes. Build user-friendly technology that stymies surveillance, and use it, because "it's going to take all of us."

He didn't mean it as a slogan. By then he had already started building it.

IV. The Man Who Broke the Locks

Before he built the vault, he spent years proving that every other vault was made of cardboard.

In the early 2000s the whole security model of the web, every padlock icon, every "secure" checkout page, every bank login, rested on the Certificate Authority system and two protocols, SSL and its successor TLS, that were supposed to make sure that when you typed your password you were talking to your bank and not to a guy in a van. People trusted it the way they trust the floor.

Moxie Marlinspike pulled up the floorboards.

The Black Hat Briefings stage, where researchers turn the industry's assumptions into live demos.

Think about the null-prefix attack for a second, because it's almost beautiful. A certificate authority reads paypal.com\0.thoughtcrime.org, notes that the requester really does own thoughtcrime.org (his domain, its name borrowed, of course, from Orwell), and signs it. But the browser, written in C, hits that null byte, \0, the invisible character that in C means the string ends here, and stops reading. All it sees is paypal.com. A forged identity, blessed by the system itself, undone by one character nobody can see.

And sslstrip! Black Hat DC, February 2009. Rooms full of security professionals in lanyards, the hum of projectors, the polite applause of an industry that thought it understood its own threats. Moxie shows them he doesn't need to break encryption at all. He just has to stop it from starting. Most people never type "https://". They type "bank.com", and the bank redirects them to the secure version. Moxie's tool catches that first moment and quietly keeps the victim on plain HTTP forever. The padlock just... isn't there, and nobody notices.

That's when his reputation hardens into legend: the elite, dangerous researcher, the guy who doesn't just find the hole but hands you the crowbar. He doesn't write polite advisories and wait three years for a vendor. He turns the flaws into tools anyone can download. You can ignore a whitepaper. You can't ignore a working exploit in every script kiddie's toolkit.

He also saw that the trouble wasn't a few bugs. The Certificate Authority system itself was structurally rotten, a pyramid where any one of hundreds of authorities, some run by governments you wouldn't trust with your cat, could vouch for anything. So in 2011 he proposed an alternative, Convergence, a distributed system of "notaries," and in 2012 co-authored the TACK Internet Draft with Trevor Perrin. Convergence never replaced the old system. But it made the argument out loud, and once it's out there, an argument has a way of eventually winning.

V. Five Hours at JFK

November 2010. John F. Kennedy International Airport, Queens. If you've come home on an international flight you know the room: fluorescent hum, low ceilings, ropes zigzagging into eternity, the bored officers in their booths with their stamps and screens. Moxie Marlinspike is coming back from the Dominican Republic. He hands over his passport.

And then he doesn't leave for almost five hours.

Customs and Border Protection agents take him aside. They want his passwords. They want into his laptop and his phones, the open contents of his digital life. He refuses. Calmly, completely, without negotiating. So they take the devices away to inspect them.

Secondary inspection: a U.S. Customs and Border Protection officer at work (Dulles, not JFK).

Why him? Moxie's own theory was that his name was in the contacts of a seized phone belonging to his friend Jacob Appelbaum, a WikiLeaks volunteer, which is darkly funny, since Moxie questioned whether the WikiLeaks project even worked. That didn't matter. In the logic of the surveillance state, being connected is enough. You're a node in a graph, and the graph is suspicious.

There's a detail that could have come out of Kafka. A TSA supervisor gave him a phone number to call about his case and how to appeal it. He called it, and it went to a full voicemail box. Of course it did. The machine has a face, and the face has a phone number, and the phone number goes nowhere.

The agents handed the devices back before they let him go. Moxie didn't want them. He said he could never trust them again, and he meant it literally: he assumed the government might have altered the hardware or installed new keyboard firmware to record every keystroke. Once a device has been out of your control, it isn't yours anymore. That's not paranoia. It's what a man who has spent his life studying how trust gets broken concludes about his own afternoon.

VI. Dear Hacker, Please Help Us Spy

Governments didn't only want to search Moxie Marlinspike. Some of them wanted to hire him.

In 2013 an email arrived about a project run by Yasser D. Alruhaily, Executive Manager of the Network & Information Security Department at Mobily, one of Saudi Arabia's largest telecom companies. The subject line was almost touching in its bluntness:

"Solution for monitoring encrypted data on telecom."

The telecom, reportedly under pressure from the Saudi regulator, wanted his help building tools to intercept the encrypted mobile traffic of its own customers: Twitter, Viber, WhatsApp and Line, the apps a population uses when it doesn't want the state listening. A polite, professional request, the kind that comes with a nice consulting fee.

Most people would quietly say no. A few would quietly say yes.

Moxie published it.

On his blog, for the world to read, he named the project's manager, quoted the emails, and described Mobily's design document. Mobily scrambled out a denial, telling Reuters that neither the company nor its employees had ever communicated with the author of the blog, a line that would have been funny if the excerpts hadn't been sitting right there for anyone to read.

The intelligence world got the message, written in neon: this man is not for sale. You can't hire him. You can't scare him. You can't even safely email him.

That reputation bought him the trust of people who couldn't afford to trust the wrong person. When Edward Snowden walked out of NSA Hawaii in 2013 with the largest trove of classified documents in the agency's history, he and the journalists he chose lived in a world of Tor relays, PGP keys, burner laptops paid for in cash, and the constant low dread of being watched. In the years that followed, Moxie's tools became a standard part of that world. In November 2015 Snowden tweeted, in four plain words: "I use Signal every day."

Edward Snowden in Hong Kong, June 2013, in a still from Laura Poitras's Citizenfour.

The man who knew better than anyone alive what the NSA could do, who had seen the slides, chose this.

VII. Building the Blind Spot

Here's the turn, where the punk who breaks locks becomes the punk who makes them.

Tearing down broken systems, he'd figured out, isn't enough. You can smash every padlock on the internet and people are still exposed; they just know it now. Real protection meant building something that works without friction, for everyone.

That last part is the revolution. Before Moxie, strong encryption was a hobby for the obsessed: PGP, command-line incantations, key-signing parties in conference hotel basements, forty-character fingerprints read aloud to strangers. The cypherpunks had built a cathedral with no front door. Moxie's insight, a moral insight disguised as a design one, was that privacy only experts can use isn't privacy for anyone. He didn't want to invent new math. He wanted encryption that people who aren't doing anything high-risk could actually benefit from. Your mother. The woman at the bus stop.

2010. He and the roboticist Stuart Anderson co-found Whisper Systems and release two Android apps: TextSecure, for encrypted texts, and RedPhone, for encrypted calls.

Late 2011. Twitter buys Whisper Systems, mainly to bring Moxie in to run its cybersecurity. Picture that: the anarchist squatter with a corporate badge, padding through a boom-era office of free snacks and standing desks. But he gets something out of it. He persuades Twitter to open-source TextSecure and RedPhone, keeping the code in public hands.

Twitter's headquarters at 795 Folsom Street, San Francisco, in 2011, the year it bought Whisper Systems and the anarchist briefly wore a corporate badge.

Early 2013. He leaves Twitter and starts Open Whisper Systems, a grant-funded open-source project, to keep building free of any company's agenda.

And then, with Trevor Perrin, he builds the thing.

The core idea was first called the Axolotl Ratchet, after the Mexican salamander famous for regrowing its own lost limbs. It's the kind of name a man named after a rope-splicing spike would pick, because the protocol's defining feature is that it heals itself. Steal a key, break in, and the system regenerates, grows new keys, and shuts you out again.

The problem it solved had beaten the field for years. Older schemes like OTR (Off-the-Record) needed both people online at the same moment to set up a secure session, which is useless for the way people actually text: constantly, sporadically, while one of them is asleep or on a plane. Moxie and Perrin figured out how two devices could agree on a shared secret, and keep rotating their keys forever, even if one of them was offline when the conversation started.

Inside the Machine

The Signal Protocol isn't one algorithm. It's an assembly of audited cryptographic parts that together deliver end-to-end encryption (nobody in the middle, not even Signal, can read your messages), forward secrecy (steal today's keys and you still can't read yesterday's messages), and post-compromise security (steal today's keys and you lose access again once the ratchet turns).

The Double Ratchet: root, sending, and receiving chains, from the specification by Trevor Perrin and Moxie Marlinspike.

A ratchet is the right image, physical and mechanical. Click, a message goes out and the key changes. Click, another goes out and it changes again. It only turns one way. Every message permanently retires the key before it, so a thief who breaks in gets one tooth of the gear and nothing else.

The academics came to check, and they didn't come to cheer. A formal analysis led by Katriel Cohn-Gordon and Cas Cremers went through the protocol with mathematical pliers and proved the security of its key-exchange core. In cryptography, where most clever ideas die in peer review, that's close to a miracle.

A Billion People, Overnight

In November 2014, WhatsApp, by then owned by Facebook, announced it was building Moxie's protocol into its app, and by April 2016 the rollout was complete: end-to-end encryption by default for more than a billion people. It may be the biggest jump in private communication in human history, and almost none of those billion people noticed. That was Moxie's whole theology. The best security is the kind you never have to think about.

Others followed: Google Allo, Facebook Messenger's secret conversations, Skype's private conversations, and eventually Google Messages. The companies that ran the largest data-harvesting operations in the history of capitalism were now, for the content of their users' messages at least, running Moxie's code.

By then Open Whisper Systems had already folded TextSecure and RedPhone into one app, with one name and one clean blue icon: Signal. It became the gold standard, the thing security experts install first, the thing you tell a friend about in a low voice when something bad is happening.

One app, one name, one blue icon: Signal.

In 2017, Moxie Marlinspike and Trevor Perrin received the Levchin Prize for Real-World Cryptography, the field saying out loud what everyone already knew: these two had taken its most important ideas and put them in ordinary people's hands.

VIII. The Anarchist King

And now the paradox closes in, tight and suffocating, like a wetsuit two sizes too small.

As Signal grew from a hacker's tool into a global platform, a deep split opened between Moxie and the decentralize-everything faithful. The purists made one demand, again and again, with the fervor of people defending the faith: Federate. Make Signal work like email, like Matrix, like XMPP, where anyone can run a server, anyone can write a client, and they all talk to each other. Isn't that what anarchists want? No center. No masters. No king.

Moxie said no.

Signal stayed a walled garden. Moxie made clear that third-party clients weren't welcome on its servers. The infrastructure was centralized, running largely on Amazon Web Services under the exclusive control of the Signal organization.

You can almost hear the howl: The man who wrote An Anarchist Critique of Democracy is running a centralized platform?!

He laid out his reasoning in an essay called The Ecosystem Is Moving, first published in 2016 and later turned into a talk at the 36th Chaos Communication Congress (36C3) in Leipzig in December 2019. Picture the crowd: thousands of hackers in a vast hall of blinking LED art, Club-Mate bottles, and sticker-covered laptops, the most hardcore believers in decentralization anywhere on Earth. And he tells them, in effect, that they're wrong about how the world actually works.

The glass hall at 36C3, Leipzig, December 2019. In a lecture hall nearby, Moxie told the decentralization faithful the ecosystem was moving.

His argument was brutal and practical. Federated protocols are stuck. When a feature or a critical security fix needs agreement from dozens of independent server operators and client developers, progress stops. Email, the poster child for federation, still mostly isn't end-to-end encrypted, decades after the technology existed. "My email is not encrypted," he told the crowd, "and never will be." Federation looks free but works like a museum.

He put speed and metadata protection ahead of ideological purity. Because Signal controls its servers, it could ship features like Sealed Sender in 2018, a technique that hides who sent a message even from Signal itself. And federation leaks metadata by its nature: IP addresses, timestamps, who talks to whom, passed from server to server like gossip. The stakes had been spelled out in 2014 by Michael Hayden, former director of both the NSA and the CIA:

"We kill people based on metadata."

So he accepted the paradox, magnificent and maddening: to build the most anti-authoritarian tool on the planet, he had to run it with near-total authority. The anarchist who wanted no one standing over anyone became a benevolent dictator. He knew trust in him was the soft spot, so he designed it away. He made the cryptography mathematically verifiable, and he made the server keep almost nothing at all.

The proof is in the subpoenas. When the U.S. government came to Signal with legal demands, the company could hand over only two pieces of data: the timestamp when an account was created, and the date it last connected. No contacts, no messages, no groups. A king, maybe. But a king whose vaults are empty by design.

IX. It Fell Off a Truck

If you want to see the real Moxie, the trickster, the punk who never quite went corporate, look at April 2021.

The target was Cellebrite, an Israeli digital forensics company whose flagship product, the UFED, sits on desks in police stations around the world. Investigators plug a seized phone into it and it pulls out the contents: photos, messages, contacts, deleted files. Law enforcement uses it, and so, according to human rights groups, do authoritarian governments, against journalists and dissidents.

In December 2020 Cellebrite had boasted that it could get at Signal data. All that really meant, Moxie would show, was reading Signal's files from an unlocked phone already in police hands. The boast turned out to be a mistake.

Moxie answered with a blog post that's still remembered as performance art. He explained, deadpan, how he had come to possess a Cellebrite kit, normally sold only to law enforcement:

"By a truly unbelievable coincidence, I was recently out for a walk when I saw a small package fall off a truck ahead of me."

Fell off a truck. The oldest wink in the book, delivered with a perfectly straight face.

A Cellebrite UFED handheld extraction device, the kind of kit that "fell off a truck."

Then he did the forensics on the forensics company, and what he found was embarrassing. The software that produces evidence used to send people to prison lacked industry-standard exploit mitigations. It bundled FFmpeg libraries built in 2012 that had missed more than a hundred security updates. It even appeared to bundle Apple's own software libraries, which, Moxie noted with a raised eyebrow you could practically hear, Apple seemed unlikely to have licensed.

Then came the knife. A specially crafted file placed on a phone, looking harmless among everything else, could, when police scanned the phone, run arbitrary code on the investigator's own computer. The phone would hack the machine that was hacking the phone.

He posted a video as proof. The UFED software runs its extraction, and then pop, a Windows MessageBox appears on screen, the hacker's way of saying I'm in your house now. The implication was devastating: such a file could silently alter or delete past and future extraction reports. Every piece of evidence Cellebrite had ever produced was now open to doubt in court, and defense lawyers noticed right away.

And then the most Moxie touch of all. The post closed with a sly note that, completely unrelatedly, future versions of Signal would periodically fetch files to keep in app storage, files never used for anything inside Signal, and that he described, with a straight face, as merely "aesthetically pleasing." He didn't say what was in them. He didn't have to.

You want to look inside our users' phones? Go ahead. See what looks back.

X. The Price of Freedom

Now for the part nobody puts on a T-shirt: money.

Signal refuses to make money the way the rest of the internet does. It sells no data, shows no ads, charges no subscription. It serves tens of millions of monthly users, around 70 million by some estimates, on goodwill, donations, and nerve.

Moxie at TechCrunch Disrupt, San Francisco, September 2017, in his years as Signal's CEO.

In February 2018, a lifeline arrived from Brian Acton, the WhatsApp co-founder who had walked away from Facebook after bitter fights with Facebook's leadership over how to monetize WhatsApp and what that meant for users' privacy, and who later tweeted the two words heard around Silicon Valley: #deletefacebook. Acton put $50 million into creating the nonprofit Signal Technology Foundation, structured, according to the foundation's tax filings, as an unsecured, interest-free loan (which grew to about $105 million by the end of 2018) not due until 2068. That's not a business deal. It's a moonshot of conscience.

But the bills are enormous. By 2024, the foundation was reporting about $29.4 million in revenue against roughly $38.0 million in expenses, a deficit of about $8.6 million, and Signal itself has projected that it needs about $50 million a year to operate.

Which brings us to the coin.

In 2021, looking for a way to bring private peer-to-peer payments into Signal, Moxie led the integration of MobileCoin, a privacy-focused cryptocurrency he had advised early on. Observers compared it to China's WeChat Pay, minus the state reading every transaction; Moxie's own pitch was being able to pay your therapist over Signal as privately as you talk to them. In theory it fit his values: money as private as speech.

In practice it blew up. The respected cryptographer Bruce Schneier reacted with a blog post, "Signal Adds Cryptocurrency Support" (its web address began, bluntly, with "wtf"), calling the move a mistake that invited regulators. Critics accused Moxie of polluting a vital public good with a volatile "funny-money" scheme that would put a huge regulatory and intelligence target on Signal's back.

It hurt. The people who had defended Signal hardest were suddenly the ones questioning it.

And in January 2022, Moxie Marlinspike announced he was stepping down as CEO of Signal.

He said the team was now strong enough that he felt "very comfortable replacing myself," recalling years when he had been the only engineer on call. For more than a decade he'd carried the world's private conversations on his shoulders, debugging, fundraising, fighting governments, fighting purists, and now he could hand it on. Not leave the mission. Just stop carrying all of it himself.

The critics weren't finished. The next day, one headline didn't bother being polite: "Shame on You, Moxie Marlinspike."

Brian Acton stepped in as interim CEO. That September, Meredith Whittaker, an AI researcher who had helped organize the 2018 Google walkout, became president and Signal's public face: sharp-tongued, fearless, the same fire in a different voice.

Meredith Whittaker, Signal's president, at re:publica 2023 in Berlin.

The punk had left the throne. The kingdom kept running. That, maybe, was the thing he was proudest of building.

XI. The Poop Emoji Heard Round the World

On January 7, 2022, three days before he announced his departure from Signal, Moxie threw one more grenade, at the loudest, most money-soaked party in tech.

My first impressions of web3.

Remember that winter. NFTs of cartoon apes were selling for millions. Celebrities were shilling tokens on late-night TV. Venture capitalists were declaring the coming of a decentralized internet owned by its users. The words were chanted like a mantra: trustless, permissionless, decentralized.

Moxie, who unlike most of the commentators actually built things, went and built some: decentralized apps called Autonomous Art and First Derivative. What he found was a con of architecture. Phones and browsers can't realistically run full blockchain nodes, so the whole "decentralized" ecosystem had quietly re-centralized around a handful of companies, mainly the node providers Infura and Alchemy and marketplaces like OpenSea. And the client software didn't verify what those services sent back. The whole thing ran on trust, the exact opposite of the manifesto.

So he proved it in the most Moxie way imaginable.

He made an NFT that was a shape-shifter: the image it showed depended on who was asking. On OpenSea it looked like one thing, on Rarible another. And when you bought it and looked at it in your own crypto wallet, the thing you supposedly owned forever on the immutable blockchain, it showed up as a poop emoji. 💩

Then the real punchline happened by itself. OpenSea delisted his NFT, and it also vanished from his wallets, including MetaMask, on his own phone, because those wallets relied completely on OpenSea's API to display it. The blockchain record was untouched. One company flipped one switch, and the illusion was gone.

Moxie in 2022, after Signal: still building, still sailing past the gatekeepers.

His verdict: Web3 had rebuilt the centralization of Web2 on infrastructure that was slow, expensive, and impossible to update, driven not by any real desire for cryptographic trust but by a financial gold rush.

The irony is rich. The man the purists had condemned for refusing to decentralize Signal had just shown, better than any of them, that most of what passed for decentralization was theater. He had never been against decentralization. He was against pretending.

XII. The Quantum Horizon

Signal kept going without him at the helm, and the architecture he left behind turned out to be ready for the next existential threat to cryptography: the quantum computer.

Intelligence agencies are believed to be running a strategy called "Harvest Now, Decrypt Later": vacuum up and store encrypted traffic today, and wait for a quantum machine that can tear through the elliptic-curve cryptography protecting it. In September 2023, Signal upgraded its handshake to PQXDH, pairing the classical X25519 curve with the post-quantum CRYSTALS-Kyber (since standardized as ML-KEM), so an attacker would have to break both. In 2025 it added the Sparse Post-Quantum Ratchet (SPQR) alongside the Double Ratchet, forming a Triple Ratchet that keeps the protection renewing message after message.

Inside an IBM Q quantum computer. The machine the harvest-now-decrypt-later strategy is waiting for.

Moxie didn't write these upgrades; his successors did. But the bones were his. The ratchet he designed with Perrin was built to take new teeth. The salamander, it turns out, could grow a limb its creators never imagined.

XIII. Confer: Encrypting the Machine That Listens

Moxie Marlinspike doesn't stay idle for long.

In late 2025 and early 2026 he came back at the most charged crossroads in technology, where cryptography meets artificial intelligence, with Confer, a private AI assistant built to bring end-to-end encryption to large language models.

You can see why it called to him. People don't just ask chatbots to write emails. They confess. They ask about their divorces, their diagnoses, their debts. They talk to these systems the way people once talked only to priests and therapists. In Moxie's view, mainstream AI chat apps (he singles out OpenAI) have become vast data lakes, taking in the most intimate data people produce and keeping it on servers that can be subpoenaed or breached. It's the "oblique" surveillance he warned about in 2013, scaled up to people's inner lives.

Confer uses passkeys to encrypt conversation history on the user's devices, and runs the AI model inside hardware-isolated trusted execution environments, with prompts and responses encrypted in and out, so the company hosting the service can't read or harvest the conversation, provided the hardware holds. The philosophy is the one that's run through his whole life: privacy isn't a premium feature to upsell. It's a public necessity, like a lock on your front door. Confer is meant to do for AI what Signal did for messaging: pull the technology out of the panopticon and give people back control.

Then, in March 2026, came a twist worthy of his career. Moxie announced he would work to build Confer's privacy technology into Meta AI, with Confer staying independent, much as he had once helped bring the Signal Protocol to WhatsApp. The anarchist was walking back into the house of Zuckerberg, carrying the lock.

The kid who anchored a junked boat with bricks is still sailing past the gatekeepers. The waters have just gotten stranger.

XIV. Hold Fast

So what do you make of him?

You make a list of contradictions and then you stare at it, because the contradictions are the man.

He's an anarchist who decided that full decentralization leads to paralysis, and who ran the world's most important privacy infrastructure like an uncompromising autocrat so that it would stay secure. He's an elite cryptographer who distrusts technology, who sees the digital world not as a utopia of connection but as an engine of coercion that has to be neutralized, mathematically, one ratchet click at a time. He's a punk who never put on a suit and still told Facebook, Google, Microsoft and, in effect, the National Security Agency how private communication would work. He's a saboteur who turned into a builder, a lock-breaker who made the strongest lock in the world.

And he did something very few people in history can claim. As security experts have long argued, tools like his change the economics of state surveillance. Before Moxie, mass surveillance was cheap, quiet, and frictionless. After Moxie, for the billions of people whose messages run on his protocol, it isn't. Intelligence agencies are pushed toward expensive, risky, targeted attacks: hacking individual phones, spending real money and taking real chances to get at a single person. He didn't end surveillance. He made it cost something. In the arithmetic of power, that's close to winning.

Go back one more time to the green water of the islands, the sack of bricks and the line paying out into the deep. Hold fast is an old sailor's command: grip the line, don't let go, whatever the sea throws at you. It was the name of his movie. It turned out to describe his life.

Because in the end Moxie Marlinspike proved the thesis he'd held since the squats. The only way to protect human autonomy in an age of total visibility is to make sure that everyone, everywhere, keeps the fundamental, inalienable, dangerous right to hide.

He held fast. The anchor held.

Works Cited

1. The New Yorker profiles Moxie Marlinspike, the founder of Signal, https://www.reddit.com/r/signal/comments/jecenp/taking_back_our_privacy_the_new_yorker_profiles/
2. What's the deal with the lack of care in sailboats houses at marinas?, https://www.reddit.com/r/sailing/comments/141vedd/whats_the_deal_with_the_lack_of_care_in_sailboats/
3. Anarchist Libraries Network, https://www.anarchistlibraries.network/entry/28073
4. On the CEO and founder of Signal - Nicola Iarocci - Medium, https://nicolaiarocci.medium.com/on-the-ceo-and-founder-of-signal-fe7bd8970d0b
5. Signal | Overview, History, & Facts - Britannica, https://www.britannica.com/topic/Signal-app
6. Moxie Marlinspike - Wikipedia, https://en.wikipedia.org/wiki/Moxie_Marlinspike
7. Secure messaging | Cas Cremers - CISPA Helmholtz Center, https://people.cispa.io/cas.cremers/research/secure-messaging/
8. The story of Signal - Increment: Security, https://increment.com/security/story-of-signal/
9. Who are Signal's co-founders, Moxie Marlinspike and Brian Acton? - SCMP, https://www.scmp.com/magazines/style/entertainment/article/3304133/who-are-signals-founders-moxie-marlinspike-and-brian-acton-marlinspike-took-x-respond-trumps-us
10. CIA secrets exposed by Wikileaks - Middle East Monitor, https://www.middleeastmonitor.com/20170308-cia-secrets-exposed-by-wikileaks/
11. موكسي مارلين‌سپايك - المعرفة (Marefa), https://www.marefa.org/%D9%85%D9%88%D9%83%D8%B3%D9%8A_%D9%85%D8%A7%D8%B1%D9%84%D9%8A%D9%86%E2%80%8C%D8%B3%D9%BE%D8%A7%D9%8A%D9%83
12. Anarchist Critique of Radical Democracy: The Impossible Argument - CrimethInc., https://cdn.crimethinc.com/assets/articles/2018/08/16/anarchist-critique-of-radical-democracy-the-impossible-argument.pdf
13. An Anarchist Critique of Democracy (Moxie Marlinspike and Windy Hart) - Reddit, https://www.reddit.com/r/Anarchism/comments/1rqsok/an_anarchist_critique_of_democracy_moxie/
14. Moxie Marlinspike - Facebook (59North), https://www.facebook.com/59North/videos/moxie-marlinspike/1255606107803286/
15. HOLD FAST: Best Sailing Movie Ever? - Wave Train, https://wavetrain.net/2013/11/22/hold-fast-best-sailing-movie-ever/
16. Ask HN: What did you do after quitting the IT industry and how have, https://news.ycombinator.com/item?id=13337305
17. Hold Fast 2007 Full Documentary - YouTube, https://www.youtube.com/watch?v=2lwbHYOFD-4
18. Hi everyone! Wanted to drop you guys a line, in case you were... - Reddit r/maritime, https://www.reddit.com/r/maritime/comments/s5slgz/hi_everyone_wanted_to_drop_you_guys_a_line_incase/
19. We Should All Have Something To Hide - Moxie Marlinspike, https://moxie.org/2013/06/12/we-should-all-have-something-to-hide.html
20. The Art of Invisibility - Kevin Mitnick, https://digtvbg.com/files/books-for-hacking/Kevin%20Mitnic/The%20Art%20of%20Invisibility%20-%20The%20World%27s%20Most%20Famous%20Hacker%20Teaches%20You%20How%20to%20Be%20Safe%20in%20the%20Age%20of%20Big%20Brother%20and%20Big%20Data%20by%20Kevin%20Mitnick.pdf
21. Moxie Marlinspike - Computer Hope, https://www.computerhope.com/people/moxie_marlinspike.htm
22. There would be no way to check everything - Facebook, https://www.facebook.com/groups/243477431776934/posts/611576058300401/
23. Moxie Marlinspike (Computer Security Researcher) - Alchetron, https://alchetron.com/Moxie-Marlinspike
24. Black Hat 2009: Breaking SSL With Null Characters - Hackaday, https://hackaday.com/2009/07/29/black-hat-2009-breaking-ssl-with-null-characters/
25. Moxie Marlinspike - Wikipédia, https://fr.wikipedia.org/wiki/Moxie_Marlinspike
26. Feds Suddenly Interested in Security Researcher - Softpedia News, https://news.softpedia.com/news/Security-Researcher-Suddenly-of-Interest-for-the-Feds-167658.shtml
27. Security researcher: I keep getting detained by feds - CNET, https://www.cnet.com/news/privacy/security-researcher-i-keep-getting-detained-by-feds/
28. Dear Hacker, Please Help Us Eavesdrop on Our Customers - LinuxSecurity, https://linuxsecurity.com/news/privacy/dear-hacker-please-help-us-eavesdrop-on-our-customers
29. A Saudi Arabia Telecom's Surveillance Pitch - Moxie Marlinspike, https://moxie.org/2013/05/13/saudi-surveillance.html
30. No Place to Hide / Dark Mirror: Edward Snowden and the American Surveillance State, https://dokumen.pub/no-dark-mirror-edward-snowden-and-the-american-surveillance-state-2019049573-2019049574-9781594206016-9780698153394.html
31. Open Whisper Systems - Computer Hope, https://www.computerhope.com/comp/open-whisper-systems.htm
32. Moxie Marlinspike Makes Encryption for Everyone - Popular Science, https://www.popsci.com/moxie-marlinspike-makes-encryption-for-everyone/
33. How End-to-End Encryption Works: X3DH & Double Ratchet, https://nerdy.pro/blog/how-end-to-end-encryption-works
34. The PQXDH Key Agreement Protocol - Signal Specifications, https://signal.org/docs/specifications/pqxdh/
35. A Formal Security Analysis of the Signal Messaging Protocol - MIT 6.5660 reading, https://css.csail.mit.edu/6.5660/2026/readings/signal-formal.pdf
36. A Formal Security Analysis of the Signal Messaging Protocol - Oxford Research Archive, https://ora.ox.ac.uk/objects/uuid:b32f4e17-ceae-4c53-a54c-edeca815d827/files/m73494b47d78113b931b123188aa14177
37. Is Signal safe? What to know about this encrypted messaging app - Proton, https://proton.me/blog/is-signal-safe
38. Signal Documentation, https://signal.org/docs/
39. Security Analysis of the Signal Protocol - CTU DSpace Repository, https://dspace.cvut.cz/bitstreams/2083f360-aaa1-4b7b-904d-921686fd2c93/download
40. Goodbye Jan Koum, and good riddance - Medium, https://medium.com/enrique-dans/goodbye-jan-koum-and-good-riddance-ff1bd7d0fa5
41. Who owns Signal? Ownership structure explained (2026) - Revenue Memo, https://www.revenuememo.com/p/who-owns-signal
42. Levchin Prize - Wikipedia, https://en.wikipedia.org/wiki/Levchin_Prize
43. FAQ - Matrix.org, https://matrix.org/faq/
44. Why you should Self-host XMPP - Reddit r/selfhosted, https://www.reddit.com/r/selfhosted/comments/16galh6/why_you_should_selfhost_xmpp/
45. Signal Messenger interoperability - Reddit r/signal, https://www.reddit.com/r/signal/comments/1b1egon/signal_messenger_interoperability/
46. Signal - Freie Messenger, https://www.freie-messenger.de/en/warumnicht/signal/
47. My first impressions of web3 - Moxie Marlinspike, https://moxie.org/2022/01/07/web3-first-impressions.html
48. Securing End-to-End Encrypted Systems - University of Cambridge, https://www.repository.cam.ac.uk/bitstreams/44e37d33-9f0b-466a-a4f6-46c89710f8e7/download
49. Notes on privacy and data collection of Matrix.org (2019) - Hacker News, https://news.ycombinator.com/item?id=29105098
50. XMPP: The secure communication protocol that respects privacy - Hacker News, https://news.ycombinator.com/item?id=29871358
51. Signal - Web3 Privacy Ethereum Cypherpunks Research, https://cypherpunk-research.benwest.io/projects/signal/
52. Meredith Whittaker on why Signal is so firm - Facebook (Nicholas Thompson), https://www.facebook.com/nxthompson/posts/this-is-a-remarkable-answer-from-meredith-whittaker-on-why-signal-is-so-firm-on-/1567383088084142/
53. In the News - Black Hat, https://blackhat.com/html/press.html
54. Signal CEO gives mobile-hacking firm a taste of being hacked - BleepingComputer, https://www.bleepingcomputer.com/news/security/signal-ceo-gives-mobile-hacking-firm-a-taste-of-being-hacked/
55. Signal IPO Timeline and Financing Details - Forge Global, https://forgeglobal.com/signal_ipo/
56. Exploiting vulnerabilities in Cellebrite UFED and Physical Analyzer - Hacker News, https://news.ycombinator.com/item?id=26891811
57. Moxie Marlinspike Demonstrates Cellebrite Tools Vulnerabilities - Gridinsoft, https://blog.gridinsoft.com/moxie-marlinspike-demonstrates-cellebrite-tools-vulnerabilities/
58. Signal's Financial Future - Reddit r/signal, https://www.reddit.com/r/signal/comments/1pqsxor/signals_financial_future/
59. MobileCoin: The project that doomed FTX a year before Terra Luna - Protos, https://protos.com/mobilecoin-the-project-that-doomed-ftx-a-year-before-terra-luna/
60. Signal Adds Cryptocurrency Support - Schneier on Security, https://www.schneier.com/blog/archives/2021/04/wtf-signal-adds-cryptocurrency-support.html
61. 'Shame on You, Moxie Marlinspike'—Fake Cash Scheme Pollutes Signal Nonprofit - Security Boulevard, https://securityboulevard.com/2022/01/shame-on-you-moxie-marlinspike-fake-cash-scheme-pollutes-signal-nonprofit/
62. Topics in ~tech - Tildes, https://tildes.net/~tech?tag=ceo&before=u11
63. Fighting for privacy, with Meredith Whittaker - Masters of Scale, https://mastersofscale.com/fighting-for-privacy/
64. Formal verification of the PQXDH Post-Quantum key agreement - USENIX Security 2024, https://www.usenix.org/system/files/usenixsecurity24-bhargavan.pdf
65. Quantum-Secure Messaging: Signal Protocol PQC Future, https://quantumsecuritydefence.com/quantum-news/quantum-secure-messaging-signal-protocol-future/
66. An Analysis of Signal's PQXDH - Cryspen, https://cryspen.com/post/pqxdh/
67. Post-Quantum Extended Diffie–Hellman - Wikipedia, https://en.wikipedia.org/wiki/Post-Quantum_Extended_Diffie%E2%80%93Hellman
68. Study of Post Quantum status of Widely Used Protocols - arXiv, https://arxiv.org/html/2603.28728v1
69. ML-KEM - Wikipedia, https://en.wikipedia.org/wiki/ML-KEM
70. Quantum resistance and the Signal Protocol: From PQXDH to Triple Ratchet - CSO Online, https://www.csoonline.com/article/4078062/quantum-resistance-and-the-signal-protocol-from-pqxdh-to-triple-ratchet.html
71. Signal Protocol - Wikipedia, https://en.wikipedia.org/wiki/Signal_Protocol
72. ChatGPT altered how we think about AI - Fast Company, https://www.fastcompany.com/91475312/chatgpt-anthropic-claude-coworker-signal-google
73. ChatGPT put a weird idea into our heads about how AI should look and act - Fast Company ME, https://fastcompanyme.com/technology/chatgpt-put-a-weird-idea-into-our-heads-about-how-ai-should-look-and-act/
74. Signal creator Moxie Marlinspike wants to do for AI what he did for messaging - Reddit r/signal, https://www.reddit.com/r/signal/comments/1qc38rd/signal_creator_moxie_marlinspike_wants_to_do_for/
75. "Confer" LLM claims E2EE privacy - GrapheneOS Discussion Forum, https://discuss.grapheneos.org/d/30680-confer-llm-claims-e2ee-privacy
76. Sailor-Punk and the State of Cruising - SAIL Magazine, https://sailmagazine.com/cruising/waterlines-diy-punk-sailors/
77. "Hold Fast" a documentary by Moxie Marlinspike - Internet Archive, https://archive.org/details/holdFastADocumentaryByMoxieMarlinspike
78. Hold Fast Film Screening - Latitude 38, https://www.latitude38.com/lectronic/hold-fast-film-screening/
79. Taking Back Our Privacy - Anna Wiener, The New Yorker (2020), https://www.newyorker.com/magazine/2020/10/26/taking-back-our-privacy
80. An Anarchist Critique of Democracy - The Anarchist Library, https://theanarchistlibrary.org/library/moxie-marlinspike-and-windy-hart-audio-anarchy-radio-an-anarchist-critique-of-democracy
81. Blue Anarchy, https://blueanarchy.org/
82. Hacker Moxie Marlinspike detained at border - Wired (2010), https://www.wired.com/2010/11/hacker-border-search/
83. Saudis' Mobily denies asking for help to spy on customers - Reuters, https://www.reuters.com/article/saudi-telecoms-spying/saudis-mobily-denies-asking-for-help-to-spy-on-customers-idUSL6N0DW33M20130515
84. Edward Snowden on X, "I use Signal every day" (2 Nov 2015), https://x.com/snowden/status/661313394906161152
85. The Ecosystem Is Moving - Signal Blog (2016), https://signal.org/blog/the-ecosystem-is-moving/
86. The Ecosystem Is Moving - 36C3 talk recording, https://media.ccc.de/v/36c3-11086-the_ecosystem_is_moving
87. Exploiting vulnerabilities in Cellebrite UFED and Physical Analyzer from an app's perspective - Signal Blog, https://signal.org/blog/cellebrite-vulnerabilities/
88. Grand jury subpoena for Signal user data, Eastern District of Virginia - Signal, https://signal.org/bigbrother/eastern-virginia-grand-jury/
89. New year, new CEO - Signal Blog (2022), https://signal.org/blog/new-year-new-ceo/
90. Signal Technology Foundation Form 990 filings - ProPublica Nonprofit Explorer, https://projects.propublica.org/nonprofits/organizations/824506840
91. Privacy is priceless, but Signal is expensive - Signal Blog (2023), https://signal.org/blog/signal-is-expensive/
92. Confessions to a data lake - Confer Blog (2025), https://confer.to/blog/2025/12/confessions-to-a-data-lake/
93. Private inference - Confer Blog (2026), https://confer.to/blog/2026/01/private-inference/
94. Encrypted Meta - Confer Blog (2026), https://confer.to/blog/2026/03/encrypted-meta/
95. Meta is killing end-to-end encryption in Instagram DMs - Engadget, https://engadget.com/social-media/meta-is-killing-end-to-end-encryption-in-instagram-dms-195207421.html
96. Twitter headquarters, San Francisco (795 Folsom St) - Wikimedia Commons, https://commons.wikimedia.org/wiki/File:Twitter_headquarters,_San_Francisco.jpg
97. Mozilla Foundation Security Advisory 2009-42 (null-prefix certificates), https://www.mozilla.org/en-US/security/advisories/mfsa2009-42
98. Breaking Microsoft's PPTP Protocol - Schneier on Security (2012), https://www.schneier.com/?p=4459
99. Weaknesses in MS-CHAPv2 Authentication - Microsoft Security Response Center (2012), https://msrc.microsoft.com/blog/2012/08/weaknesses-in-ms-chapv2-authentication

Image Credits

1. Moxie Marlinspike aboard S/V Pestilence, still from Hold Fast — Moxie Marlinspike / Anarchist Yacht Club, CC BY-NC-SA 3.0, via Internet Archive — https://archive.org/details/holdFastADocumentaryByMoxieMarlinspike
2. Bag of bricks used as an anchor aboard S/V Pestilence, still from Hold Fast — Moxie Marlinspike / Anarchist Yacht Club, CC BY-NC-SA 3.0, via Internet Archive — https://archive.org/details/holdFastADocumentaryByMoxieMarlinspike
3. Pearson 30 sailboat "Elle" — Ahunt, CC0, via Wikimedia Commons — https://commons.wikimedia.org/wiki/File:Pearson_30_sailboat_Elle_7367.jpg
4. Mission District, San Francisco, 2005 — Saopaulo1 at English Wikipedia, CC BY-SA 3.0, via Wikimedia Commons — https://commons.wikimedia.org/wiki/File:Mission_district,_San_Francisco_100_0062.jpg
5. Moxie Marlinspike, 2013 — Knight Foundation, CC BY-SA 2.0, via Wikimedia Commons — https://commons.wikimedia.org/wiki/File:Moxie_Marlinspike.jpg
6. Black Hat Briefings, Las Vegas, 2005 — Alexander Marks, Public domain, via Wikimedia Commons — https://commons.wikimedia.org/wiki/File:Michael_Lynn_Black_Hat_Briefing_Las_Vegas_2005.jpg
7. CBP officers at Dulles International Airport — U.S. Customs and Border Protection, Public domain, via Wikimedia Commons — https://commons.wikimedia.org/wiki/File:CBP_officers_process_inbound_travelers_at_Dulles_International_Airport_(53705250531).jpg
8. Edward Snowden, Citizenfour still — Laura Poitras / Praxis Films, CC BY 3.0, via Wikimedia Commons — https://commons.wikimedia.org/wiki/File:Edward_Snowden-2.jpg
9. Twitter headquarters, San Francisco — Wgreaves, CC BY-SA 3.0, via Wikimedia Commons — https://commons.wikimedia.org/wiki/File:Twitter_headquarters,_San_Francisco.jpg
10. Double Ratchet diagram — Trevor Perrin and Moxie Marlinspike, Signal Double Ratchet specification, Public domain — https://signal.org/docs/specifications/doubleratchet/
11. Signal logo — Signal Technology Foundation, Public domain (trademark), via Wikimedia Commons — https://commons.wikimedia.org/wiki/File:Signal-Logo-Ultramarine_(2024).svg
12. 36C3, Leipzig — SimonWaldherr, CC BY-SA 4.0, via Wikimedia Commons — https://commons.wikimedia.org/wiki/File:36c3_-_FairyDust_07.jpg
13. Cellebrite UFED device — jon crel, CC BY 2.0, via Wikimedia Commons — https://commons.wikimedia.org/wiki/File:Ufed_mobile_phone_imaging_device_(8661348282).jpg
14. Moxie Marlinspike at TechCrunch Disrupt SF 2017 — Max Morse for TechCrunch, CC BY 2.0, via Wikimedia Commons — https://commons.wikimedia.org/wiki/File:Moxie_Marlinspike_TC.jpg
15. Meredith Whittaker at re:publica 2023 — Martin Kraft, CC BY-SA 4.0, via Wikimedia Commons — https://commons.wikimedia.org/wiki/File:MKr30771_Meredith_Whittaker_(Republica_23).jpg
16. Moxie Marlinspike, 2022 (color) — Christopher Michel, CC BY-SA 4.0, via Wikimedia Commons — https://commons.wikimedia.org/wiki/File:Moxie_Marlinspike_in_2022_05.jpg
17. IBM Q quantum computer — IBM España, Public domain, via Wikimedia Commons — https://commons.wikimedia.org/wiki/File:IBM_Q_system_(27274387309).jpg