I am so grateful to everyone who has read my new novel Lessons in Magic and Disaster already. And especially to everyone who’s been reviewing it, shouting about it online, and telling their friends about it. Word of mouth is everything these days, and it means the world to me that y’all are talking about this book. Thank you so much.

In case you missed it, Lessons in Magic and Disaster is about a young witch who teaches her mother how to do magic. It’s also about queer families and how we get through challenging stuff. Plus brazen women of the eighteenth century! Kara Reviews writes, “Unexpectedly healing and wholesome, Lessons in Magic and Disaster is queer, witchy, and compassionate in just the right amounts.”

You can get it anywhere, but I’ll still sign/personalize/doodle copies from Green Apple.

---

What it means when they call you an NPC

Lately my mind has been circling around a weird thought.

You have a cadre of absolute bedknobs who go around calling the majority of humans "NPCs." (Which stands for “non-player-characters”.) Meaning that most of us, to them, are the same as the computer-generated people in video games, who behave in predictable, algorithmically-generated ways and have no minds or thoughts of our own. We're not just non-people, we're essentially part of the scenery. We're only there to give the "real" people (a tiny minority of humans) something to interact with.

And meanwhile, tech leaders keep insisting that we should outsource human creativity and critical thought to LLMs and chatbots. Essentially they want us to give our interiority — the thing that makes us more than NPCs — to an algorithm and let it do our thinking for us.

My highly subjective sense is that these two groups of people are basically the same. The venn diagram is a circle.

In other words, the people who claim that we're all NPCs are spending all of their time trying to turn us into NPCs for real.

I do not believe this project started with Chat-GPT or Grok or whatever. I think it's been going on for years, if not decades: tech trying to seduce us into letting it do our thinking for us. Algorithms trying to tell us what to believe. This concept has been embedded in social media, in apps, in all the little conveniences that have taken away some of the burden of independent thought, bit by bit. This is part of why democracy is in such huge trouble.

But so-called "A.I." represents a major escalation of this project. And a host of studies suggest that it's working: people who use Chat-GPT for hours every day show reduced levels of critical thinking skills and atrophying creativity. We're letting the machine do our thinking for us, and it's making the narcissistic "NPC" slander closer to the truth.

So I think it's important to drill down into what it means for most human beings to be NPCs, and why we need to resist this notion as hard as we can. But first, here's some music to read the rest of this essay by:

That's the late, great Walter "Wolfman" Washington telling it like it is.

Obviously, thinking of your fellow human beings as NPCs is revoltingly dehumanizing. It is a way of taking away not just agency, but also authority, from other people. It's utterly pathetic that a person would only feel as though they have agency if other people do not. That is the sign of a weak individual.

And it's essential to think of the push to use algorithmic thought-prostheses as dehumanization. They don't want us to use our own critical faculties — because if we are full human beings, then the failure of their chatbots to evolve into anything greater becomes more apparent. The only way to make a chatbot into something more is for us to be less.

And yet, in the process of reframing the rest of us as NPCs, they are also turning themselves into less than full humans.

An NPC in a game is there for the player to react to. The NPC is part of the scenery, but it's also a feature of gameplay that you have to interact with and respond to. In many games, the player’s choices are somewhat constrained by what the game allows. You can't decide to stop killing zombies and open a fruit stand, if the game is about killing zombies. The NPCs, in many cases, are part of what constrains a character's choices in a game. Thus, when you start thinking of other people as NPCs, you also start to think in ways that mean your own choices are limited.

In other words, turning some people into NPCs makes all of us less-than — even the people who are supposedly players in a game that the rest of us merely participate in.

My other thought is that the sort of person who believes that algorithms can replace human thought, and who sees other people as NPCs, is often obsessed with efficiency. Every minute of the day must be exploited for its maximum value. We must be extreemly haaaardcore. We must rise and grind. A true winner is constantly maximizing their time. 

This feels like an extremely impoverished way of thinking about life, even to an extreme workaholic such as myself. But it's also a worldview that thinks of things only in terms of will. Life is an exertion of willpower. The superior person has a strong will and uses it to push through and overcome challenges. Etc, etc. 

You know who is driven by a single objective and never stops to question or reflect? An NPC. 

We are dealing with people who are trapped in an incredibly limiting paradigm, of relentless, goal-driven work. They cannot imagine any other way to be, because they will not take the time to use their imaginations at all, and so they desperately need the rest of us to join them in hell.

I really do think this is a case where every accusation is a confession. They accuse us of being NPCs not simply because they want us to become NPCs, but also because that is what they have been systematically turning themselves into.

---

Music I Love Right Now

The 1960s-1970s funk-rock band Sly & the Family Stone are having a moment, thanks mostly to Questlove’s incredible documentary Sly Lives! and its accompanying soundtrack. A previously unheard concert from 1967 was released a while back, called The First Family: Live at Winchester Cathedral 1967.

I’ve been listening to it on and off, and I like it a lot. But it also does not sound particularly special to me? It’s a really great concert by a soul/R&B band in 1967, but you only get the slightest hints of what this band would become in a year or two. The only original song (i.e., not a cover) is “I Ain’t Got Nobody,” which could easily be an Otis Redding b-side. There are a few moments that sound a bit like the breakdown of “Dance to the Music”.

What’s missing? Rose, Sly’s sister, hadn’t joined the band yet. Larry Graham still isn’t playing the bass with the thump-and-pluck intensity he brought later. There’s not much in the way of psychedelic vibes, such as you’d hear on their debut album, A Whole New Thing. You could put this alongside Live at the Haunted House 1968 by Charles Wright and the 110th Street Watts Rhythm band — both albums sound pretty similar to me, though Haunted House has more extended jam sessions and feels a bit more adventurous.

So I’m enjoying The First Family a lot, but it feels like it’s for Sly & the Family Stone completists rather than casual listeners. If you wanna hear Sly at the height of his powers, try The Woodstock Experience or Live at the Fillmore East.

Tens of thousands of people, at any given time, are idly listening to the ambient, muted beats that accompany the Lofi Girl livestream: in solo studying sessions, taking tests in a classroom, and using the tunes as a stand-in for white noise to aid sleep. The livestream, which is one of the longest running live broadcasts on YouTube, is often hiding in browser tabs, leaving the perpetually busy Jade (the Lofi Girl) to lazily take her notes behind whatever Wikipedia page or spreadsheet you’ve got open. But she is always there, the googly eyes stuck to her headphones wobbling as she looks up from her notes, to peek in on, to study with, or to chill to—the details of the music become secondary to the vibe.

From a single livestream that’s been running in some form since 2017—the YouTube channel, which was started in 2015, was called ChilledCow before the iconic rebrand—Lofi Girl has grown into an empire. To put that growth into perspective, ChilledCow had 1.6 million YouTube subscribers in 2018, a number that grew to 5 million in 2020. Now, the channel has more than 15 million subscribers. The soundtrack of Lofi Girl’s brand of chill is pervasive, and the ubiquity of her aural and physical aesthetic made Jade a big business, her essence seeping into wider culture; Nissan harnessed the vibe to sell its electric car, Will Smith to sell hoodies, and even U.S. president Donald Trump in a maniacal attempt to sell his administration’s “Big Beautiful Bill.” Lofi Girl—the company—leverages its influence itself, expanding from simply a YouTube channel into an advertising arm, merchandising enterprise, and full blown record label.

To reach this success over the past 10 years, Lofi Girl has had to adjust. Its success in making music that’s appealing to everyone changed the kind of music that’s coming out of the channel. While Lofi Girl once firmly fit within the genre of lofi hip hop, known for pairing relaxed—but still thumping—beats with nostalgic sound samples, its music has largely dropped the hip hop. Lofi Girl's music is now simply its own genre: lofi, where the soft, tonal consistency means it can be hard for the average listener to even see its works as distinct songs. The drum beats of the "chill beats to relax/study to" sometimes even take a backseat to the rounded, flighty melodies Dr. Jenessa Williams, a music and fan culture researcher at Stanford University, called Lofi Girl a “deeply valued background noise community.”

“Music consumption is shifting,” a Lofi Records label manager, who goes by Berrkan Bag online, told 404 Media in an email. “Short-form and scroll-driven platforms have changed how people engage with lo-fi. Some of the long-form, narrative visuals that helped define the genre are being challenged by algorithmic trends.”

He added that lofi itself is maturing as the genre redefines “itself between functional background music and meaningful creative expression.”

March marked 10 years since creator Dimitri Somoguy started the ChilledCow YouTube channel that would eventually become Lofi Girl. It started as a place to broadcast lofi hiphop beats, set to a looping video clip of Shizuku Tsukishima, the young girl protagonist from Studio Ghibli’s 1995 animated film Whisper of the Heart. The stream was taken down in 2017 over copyright concerns over the character’s usage, and that’s where Jade came from: ChilledCow hired Colombian artist Juan Pablo Machado to create an original character. Jade’s been the face of lofi beats on YouTube since, and so it makes sense the channel was renamed from ChilledCow to Lofi Girl in 2021. The current stream started in July 2022, making this particular broadcast one of the longest running livestreams on YouTube. The record would have been longer if it weren’t for a Digital Millennium Copyright Act takedown notice from 2022 that forced the Lofi Girl YouTube channel to go dark. (YouTube later called the DMCA notice “abusive.”)

Lofi Girl has never been the only place with beats to study or relax to—a genre that’s since become both a phenomena and a meme: Actor Will Smith has chill beats to quarantine to;  Chillhop Music, which precedes even ChilledCow, has chill beats to farm Elden Ring runes to; you can even study with Waluigi—for more than 11 hours!—to the sound of somewhat chaotic lofi hip-hop. The aesthetic popularized by Lofi Girl is a mixture of muted, anime clips with music that’s engaging enough without distracting from whatever task a person is doing in the background. The Lofi Girl channel, as a whole, is by far the most popular place for lofi music, and has been for a while.

Today, there are more than a dozen streams of different lofi themed music running concurrently, several of which have thousands of people listening at any given time. Dozens of YouTube videos, both branded content and an emerging narrative about Jade and a new character, Synthwave Boy, a neighbor whose intertwined story is slowly unravelling over short videos. The company, which has about 20 employees, not including its hundreds of collaborators, according to a Lofi Girl representative, expands from there. Lofi Records is the in-house record label that’s published thousands of songs on its YouTube channel and on vinyl. Lofi Studio, an art team that makes Lofi Girl’s branded content, pumps out regular collaborations and brand deals. And then there's Lofi Girl Shop, which sells, among other things, vinyl records, a recreation of Synthwave Boy’s bomber jacket and purple beanie, and a plush orange cat. Lofi Girl is expanding into gaming, too. Lofi Girl has three official Fortnite maps: one in which you can, dressed as Darth Vader or Peely Bone, walk about a recreation of Jade’s bedroom; another that’s a Lofi Girl simulator; and a third that’s a parkour game called Only Up.

It’s no coincidence that the Lofi Girl channel blew up exponentially during the pandemic. People were spending a lot of time online, of course, but the channel offered a predictable constant. The music even edges on sleepy. YouTube creator Peter Tagg told 404 Media he has it playing for hours in the background multiple days a week—it's a salve that's beneficial for studying and even as a sleep aid. It’s always there, and the music is curated in such a way that you’re never really surprised by what you’re hearing, which can be comforting and not distracting. Williams, the music researcher, told 404 Media that Lofi Girl's aesthetic taps into "the psychology of productivity mirroring," which is a technique in which people motivate themselves to do a task by having another person around.

Williams says the music itself can often become secondary to the familiar, comforting vibe for Lofi Girl listeners. “Lofi Girl appeals most to young music fans who love and consume lots of different kinds of music, but appreciate the Lofi Girl specifically because it gives them something predictable in an evermore chaotic world,” she said. “Musical discovery via the Lofi Girl is certainly possible, but you’re unlikely to encounter anything truly surprising or cortisol-spiking, and I think—whether one sees this as a positive or not—that's why it has become so popular.”

Lofi music was originally more hip hop than anything else, popularized by two artists in particular: J Dilla and Nujabes. It’s a genre defined by nostalgia, drum beats, and melancholy sound—but as Lofi Girl, the channel, got more popular, the hip hop influence started to slide away in favor of reverb-heavy, ethereal music with simple drum beats. Producer and Lofi Girl collaborator Phil Morris Lesky, who publishes under the name Lesky, told 404 Media that the music he creates for Lofi Girl, specifically, is “more its own thing now. The rhythm section takes a little bit of a backseat. It’s more about arrangement.” 

Though it clearly resonates with a mainstream audience, some in the lofi hip hop community criticize Lofi Girl for its role in anonymizing the music and stripping out its hip hop influence. Another Lofi Girl collaborator, who asked to remain unnamed as to not jeopardize an ongoing relationship with the brand, likened it to Muzak—a brand of background music designed to be unobtrusive for use in retail stores. “That’s kind of what happened with lofi music,” they said. “It’s no longer artists making sounds they want, rather, it’s a record label trying to curate an experience for, like, coffee shops.” (One prominent lofi hip hop musician, bsd.u, cheekily criticized lofi streams like Lofi Girl with a song called “all my homies hate 24/7 lofi streams.”)

This collaborator said Lofi Girl has a Discord server for musicians, and that’s where the company solicits music for its livestream. Often, Lofi Girl asks musicians to write to a specific theme—be it medieval, Halloween, synthwave, or for the vague “asian” radio channel, just make it lofi. The company often provides a playlist of music to emulate, they say. Then, a musician can submit music to Lofi Girl in hopes it gets chosen. Lesky and lofi producer Julien Pannetier, who goes by VIQ, aren’t bothered by the themed submission system. Lesky said it's easy to know exactly what the label is looking for. No guesswork involved. There’s less creative freedom, Pannetier told 404 Media, “but that can also be a driving force.”

The aforementioned anonymous Lofi Girl collaborator doesn't see it that way: “It’s really a policing of aesthetics and sounds that keeps artists from actually taking creative risks.”

It’s designed to be palatable to everyone. “The whole livestream on YouTube, the playlist growth on Spotify, without any judgement or critique, is creating a homogeneous sound that’s basically easily categorized,” Lesky said. “People understand it quickly. It’s really search engine-optimized. They have a huge influence.”

What this adds up to is big business for Lofi Girl. A YouTube channel of Lofi Girl’s size alone can bring in millions of dollars a year from YouTube’s ad revenue program. (Though Lofi Girl’s live streams aren’t interrupted by ads like lots of YouTube videos, they’re preceded by them. That, plus ads on dozens of other videos on the Lofi Girl channel that aren’t livestreams make a ton of money.) The popularity of the channel, and its ability to harness a vibe that resonates with everyone, is what’s driving Lofi Girl’s successful push into advertising. Over the past few years, Lofi Studio has been hired to create branded content that pulls a piece of the respective company into the Lofi Girl world. Lofi Girl’s marketing studio created a one-hour YouTube video created for Alien: Isolation, but instead of Jade and her bedroom, it’s an alien on an anime-rendered spaceship, complete with Jones the cat perched at Nostromo’s window. For Lofi Studio’s Starfield collab, the company remixed the Microsoft game’s soundtrack, and set the video in a cozy little starship. No cat, but the robot does have its own cozy cup of coffee.

It works so well that other brands are trying to mimic the aesthetic. 

Nissan debuted a four-hour YouTube video in 2023 to advertise its electric car Ariya. Its inspiration is obvious, swapping Jade for a dark-haired woman in a leather jacket who’s vibing to lofi beats from a car instead of a bedroom. None of this was created by Lofi Studios. Advertising company The Mayda Creative Co. and animation studio Titmouse created the YouTube video and its art, but ran the ads on Lofi Girl content. It’s got more than 18 million views. Will Smith’s quarantine beats slapped on, or, if you’re less generous, ripped off the aesthetic of Lofi Girl in this way. Dr. Steven Gamble, lecturer of digital humanities at the University of Southampton who writes about hip hop and the internet, told 404 Media that Smith’s fashion brand Bel-Air Athletics posted the video as Lofi Girl was taking off during the pandemic. “When things are popular and there’s an audience that has commercial potential, that’s what people do,” he says. Smith and Bel-Air Athletics positioned the video as "chill beats to quarantine to"—but it’s really “chill beats to buy his hoodies to,” Gamble told 404 Media. Nissan and Smith did not respond to a request for comment.

The big difference, though, is that Smith’s chill beats are seemingly as low effort as possible, just licensing some existing music. Lofi Girl’s amalgamation of companies makes it so the company’s team of 20 employees (and hundreds of contracted musicians and artists) can do most everything in house, then hire artists to create the music central to its channels. That often benefits the musicians who drive the Lofi Girl channel, three artists that spoke to 404 Media said. The artists declined to share specifics, but said that Lofi Girl’s rates are standard for the industry. The money Lofi Girl musicians get isn’t from the ad revenue tied to the YouTube channel, but from the playlists it hosts on places like Spotify and Apple Music. 

Lesky said the “playlist power and ecosystem behind the brand” drives a lot of exposure to his music. “I just really appreciate the opportunity the label and channel has given me from the beginning,” he said. “They were one of the first outlets that shared my music and it kicked off from there. It kicked off a career that sustained me for years now.”

The New York Times, in 2018, declared that 24/7 channels like ChilledCow and Chillhop Music were “unlikely to have a broad impact on the music industry,” representing “an underground alternative to the streaming hegemony of Spotify and Apple Music.” They were wrong. Lofi Girl’s core audience might not be able to name a single artist broadcast during a livestream (even if it is driving listeners to Spotify and paying dividends for artists). They may not have even known Lofi Girl has a name. But Lofi Girl is hardly underground. The company signed an administrative publishing deal with Warner Music Group in 2024, putting Warner in charge of licensing, royalties, copyright and other admin work. (Still, Pannetier said his experience with Lofi Girl was the opposite of the wider music industry, which he described as “very closed off and elitist.”)

For better or for worse—it all depends on who you’re asking—Lofi Girl is no longer the “pirate radio station” that took over YouTube in 2018. Lofi Girl is no longer just your study buddy. She’s an enterprise.

Correction: This article previously linked to a study published in Scientific Research Publishing. We've removed that link because the journal doesn't meet our editorial standards.

 

In these scary times, it can be tempting to find a way to arm oneself, but it’s important to keep proper perspective of the real risks involved.

  

Opinion, by Veronica Esposito

Cravenly exploiting a tragedy to further dehumanize and endanger trans people, the Trump Administration’s Department of Justice now argues that because the perpetrator of the Annunciation shooting was trans, all trans people are mentally incompetent to own guns. In a rare display of unity, groups from GLAAD to the NRA, and even reliably anti-trans periodicals like The Independent and the New York Post, have thoroughly rejected the DOJ’s trial balloon.

Understandably rattled by these frightening developments, many trans people are now asserting their right to own guns—but as a mental health therapist specializing in serving the trans community, this gives me pause. While I am in favor of trans people taking steps they need in order to feel safe, I am also aware that a gun owner is far more likely to use that weapon to end their own life than for their self-protection: in fact, gun owners are 44 times more likely to use that gun to kill themselves than to protect against a home invader.

Let me be clear about where I stand. As a therapist who primarily supports marginalized groups, and as a trans person myself, I understand the immense importance of a person’s right to autonomy. As long as an individual is not actively choosing to harm themselves or others, I will always, wholeheartedly support their right to make their own decisions. This includes the decision to own a gun.

But as a therapist who frequently works with suicidal clients, I also know that a gun greatly elevates one’s suicide risk. In 2020, Stanford released the results of a 12-year study of 26 million Californians, finding that men who own guns were 8 times more likely to die by self-inflicted gunshot, and women were a staggering 35 times more likely.

The reason gun ownership increases risk so much has to do with the psychology and epidemiology of suicide. As a therapist, I’ve been trained to understand these factors to help support clients struggling with thoughts of suicide. When I work with those clients, it falls on me to operate with delicacy in order to enable my clients’ autonomy while also maintaining my responsibility to protect their safety.

In order to do this, I assess their risk to themselves, evaluating them based on the following three questions: Do you have a plan to end your life? Do you have the means of carrying out that plan? Do you intend to use those means to complete your plan? If a client answers yes to each of those questions, then they present a danger to themselves, and I am ethically and legally obligated to intervene.

This is high stakes stuff. Sometimes, intervening can mean persuading them share their suicide risk with someone else, or getting them to remove their means of suicide so that they can’t do it. But other times, intervening can be more extreme—it might mean breaking confidentiality to tell a parent, sibling, or close friend that they’re suicidal. In rare situations, it could even mean calling for an involuntary hospitalization.

These are things that I never want to do to a client, particularly since trans people tend to have negative experiences with emergency psychiatric hospitalization. I fiercely support my clients’ confidentiality, independence, and their ability to make their own decisions—particularly for trans people, who have historically experienced so many devastating limitations on their fundamental right to autonomy.

When assessing a client’s risk, I am in part considering the lethality of their means of suicide. If a client tells me that they intend to end their life by stabbing themselves with a spoon, I can rest a little easier, because I know that’s virtually impossible to do. Guns on the other hand are extremely lethal: Although they account for only 5% of suicide attempts, over 50% of deaths to suicide are gun deaths. All in all, more than 90% of those who attempt suicide with a gun complete their attempt.

The extreme lethality of guns plays into the fact that suicide tends to be an impulsive decision. It most often occurs when individuals are intoxicated with drugs or alcohol, when they have experienced an acute precipitating event, or when they are going through a mental health crisis. Suicidal individuals will be much more likely to ride out such storms if their means of suicide is less lethal, more difficult to carry out, takes longer to achieve its aim, or is more prone to error. Guns, unfortunately, are none of those things.

This is why I have such mixed feelings over trans people owning guns, as we know that the trans community is more likely to abuse substances, experience mood or anxiety disorders, and to experience adverse shocks, such as job losses, rejection by friends and family, and political persecution. These elevated risk factors, caused by discrimination and the stress of living it, mean that trans people are more likely to attempt suicide—having the lethal means to do so sadly makes us more likely to succeed.

With all that said, I still support the decision of any given trans person to own a gun. My belief is that I can best support the mental health of my clients by empowering them to make their own choices. Yes, this does involve presenting them with alternatives and discussing the risks and benefits of any given course of action, but at the end of the day I don’t think I will ever do anyone any good by telling them what they should do. As long as they know the risks, they get to make their own choices. (Again, provided that they are not telling me that they mean to harm themselves or someone else.)

To conclude, a word about the current political situation. Understandably, many trans people right now feel extremely threatened by the Trump Administrations, and so they desire to own guns as a means of resistance and self-protection. I appreciate where they are coming from, but this is inconsistent with how authoritarian regimes actually end. Research by Erica Chenoweth (who themselves identifies as nonbinary) has found that authoritarian regimes have been far more likely to fall by nonviolent civil resistance than by violent insurrection. The most powerful thing we can do to bring about the end of the Trump Administration probably isn’t to purchase a weapon but rather to get out and protest this debasement of our democracy—and share the stories of how policies like his attempt to strip trans people of guns are harming us, and all Americans.

---

Veronica Esposito (she/her) is a writer and therapist based in the Bay Area. She writes regularly for The Guardian, Xtra Magazine, and KQED, the NPR member station for Northern California, on the arts, mental health, and LGBTQ+ issues.

 

A hacker has broken into Nexar, a popular dashcam company that pitches its users’ dashcams as “virtual CCTV cameras” around the world that other people can buy images from, and accessed a database of terabytes of video recordings taken from cameras in drivers’ cars. The videos obtained by the hacker and shared with 404 Media capture people clearly unaware that a third party may be watching or listening in. A parent in a car soothing a baby. A man whistling along to the radio. Another person on a Facetime call. One appears to show a driver heading towards the entrance of the CIA’s headquarters. Other images, which are publicly available in a map that Nexar publishes online, show drivers around sensitive Department of Defense locations. 

The hacker also found a list of companies and agencies that may have interacted with Nexar’s data business, which sells access to blurred images captured by the cameras and other related data. This can include monitoring the same location captured by Nexar’s cameras over time, and lets clients “explore the physical world and gain insights like never before,” and use its virtual CCTV cameras “to monitor specific points of interest,” according to Nexar’s website.

The breach shows in stark terms the security and privacy risks of adding an always-on camera to vehicles, be that the risk to individuals, or even governments that don’t want data related to their facilities or employees accessed by hackers or potentially other governments. It also shows that companies around the world have at least explored leveraging dashcam-related data for their own purposes, including Microsoft, Apple, and Google, a host of AI companies, and even Pokémon Go creator Niantic, according to the document that lists organizations that Nexar says have had access to its data.

“Nexar is an absolute privacy nightmare, their security is embarrassing, I would be very surprised if no one (foreign government or just bad actor) wasn’t already tapping their customer data,” the hacker behind the breach told 404 Media. “I was able to in 2 hours or so.”

The hacker provided a few dozen or so Nexar dashcam recordings for verification purposes. 

In one clip, the Nexar camera is faced inwards to the car, capturing what appears to be a rideshare driver picking up passengers. Like in many other videos, the peoples’ faces are clearly visible. 

Many, of course, show vehicles driving down a road or highway.

As well as letting users record their own trips, Nexar monetizes users’ data and recordings by repackaging them into various products. One of those is the company’s CityStream map, which displays recent and blurred images taken by Nexar dashcams on a publicly available map and annotates things such as yield or speed limit signs, damaged roads, and other hazards. The idea is for companies or public bodies to then pay for access to more of this data. Three Nexar users 404 Media spoke to all said they did not know that Nexar was posting user dashcam images publicly like this. The images on this site have license plates, faces, and car dashes blurred. Bruno Fernandez-Ruiz, Nexar co-founder and CTO, told 404 Media in an email that per Nexar’s privacy policy, users contributing to CityStream are either opt-out or opt-in depending on the jurisdiction.

The hacker highlighted that some of these images were taken inside vehicles that appeared to be entering sensitive U.S. government facilities, such as the Whiteman Air Force Base, Missouri, which houses B-2 stealth bombers, and Offutt Air Force Base, Nebraska, which is the headquarters of U.S. Strategic Command. One showed a Nexar user driving on the road towards 1000 Colonial Farm Road, the CIA’s headquarters.

From there, the hacker was able to find an unblurred video from this specific CIA-related user in the terabytes of hacked data. It showed the driver taking an exit off a road that heads towards the headquarters. The end of the clip shows them removing the camera from the dashboard itself. 

The CIA did not respond to a request for comment on its policies concerning staff or visitors’ use of personal dashcams, such as are they required to remove them from the dashboard before approaching headquarters or other facilities. Multiple representatives of the Air Force did not respond to requests for comment.

The hacker said they were able to access one of Nexar’s AWS buckets, a type of database run by Amazon Web Services, in which they found more than 130 terabytes of data. That included raw recordings from peoples’ dashcams and GPS data, the hacker said. The issue, the hacker said, was that embedded in every Nexar dashcam was a key to this database which had too high privileges, allowing anyone with the key not just to upload their own camera’s data, but also access that of everyone else. Nexar fixed this issue after being contacted by 404 Media this week. Fernandez-Ruiz said these recordings were users’ private backups.

The hacker also broke into Nexar’s Atlassian instance, a company that makes collaboration tools such as Jira and Trello, and obtained a file laying out companies and organizations that Nexar says have had access to the company's data. Beyond its CityStream product, Nexar also offers Virtual Cam, which gives access to anonymized images captured by the dashcams over time. In a demonstration video, Nexar shows a user selecting a location in New York City, being shown the most recently captured dashcam image, then using a timeline to scroll backwards and see earlier images from the same location.

One organization with access to Virtual Cam data is listed as “IDF,” according to the document. It says this organization has access to data inside Israel. Fernandez-Ruiz said “We do not work with the Israeli Defense Forces.” The Israel Defense Forces did not respond to a request for comment. Nexar is headquartered in Tel Aviv and New York.

Entities that have had access to Nexar data include big tech companies like Apple, Microsoft, Amazon, and Google; Pokémon Go creator Niantic; transportation companies Lyft and Waymo; the cities of Los Angeles and Austin; and many AI and logistics focused companies, according to the document.

Microsoft said that it explored using Nexar imagery for mapmaking purposes before March 2023, but that the work did not proceed beyond that evaluation stage. Google said it couldn’t comment on relationships with specific companies, but that it uses third party imagery to update its maps. Amazon said it evaluated Nexar data to improve driver safety a few years ago and decided not to work with the company. Apple said it did not enter a partnership with Nexar. Lyft and Waymo did not respond. Niantic declined to comment.

Last week 404 Media reported that surveillance company Flock, which has directly and indirectly provided data to Customs and Border Protection (CBP) and Immigration and Customs Enforcement (ICE), is looking to integrate with Nexar. Flock is included in the list of companies and organizations given access to Nexar data. In the product column it says Flock has “All,” and under location it says “Worldwide.” A Flock spokesperson told 404 Media “Flock and Nexar do not currently have an integration, and we have no products available for customers.” Fernandez-Ruiz said “Flock Safety’s access to CityStream as part of our collective partnership evaluation is definitively restricted to blurred, unidentifiable data.”

Researchers who have used Nexar’s blurred data have previously raised privacy concerns with it. In a paper published in June, they wrote “Despite good-faith efforts by DSI [dense street imagery] providers to protect individual privacy through blurring faces and license plates, these measures fail to address broader privacy concerns. In this work, we find that increased data density and advancements in artificial intelligence enable harmful group membership inferences from supposedly anonymized data.” They point to examples such as a high viz vest still revealing that a blurred person works for the NYPD. 

The NYPD is also listed in the hacked internal material as having had access to Nexar’s Virtual Cam product. An agency spokesperson said “The NYPD does not have a formal relationship or contract with Nexar and we have not purchased any data from them.” The spokesperson did not reply when asked if the NYPD had any sort of informal relationship with Nexar, or whether it evaluated the company’s data. 

“Nexar’s global customer base and their access to CityStream for road intelligence are all subject to strict privacy guidelines and protocols that prevent access to personally identifiable information,” Fernandez-Ruiz added.

Update: this piece has been updated to include a response from Apple.

Margaux Blanchard is one of our widest-ranging long-form travel journalists. Just this year, she’s written about obsessive fans at Disneyland, UK health system failures, and couples getting married in Minecraft! That last one got reblogs in Mashable and Fast Company too! [SFGate, archive; Naked Politics, archive; WIred, archive; Mashable, archive; Fast Company, archive]

You won’t find any of those stories online right now — because “Margaux Blanchard” appears to be a pen name for someone who thought they’d fake a career in freelance journalism. With AI!

Journalism has long suffered fakes and plagiarists who built themselves a career on a throne of lies — until they were busted. AI lets the frauds go faster.

Jacob Furedi from Dispatch got a pitch from Blanchard just a month ago, at the start of August, where she offered to write about:

Gravemont, a decommissioned mining town in rural Colorado that has been repurposed into one of the world’s most secretive training grounds for death investigation.

Blanchard offered to write a long-form in-depth piece about the staff who run the tests on the dead bodies.

Furedi thought it sounded like the perfect article for Dispatch. But he did wonder a bit about how, right away, the pitch sounded like it was written by ChatGPT. So he went looking further.

The town of Gravemont, Colorado doesn’t exist. It seemed never to have existed. Furedi realised this was nonsense. He asked Blanchard for copies of the public records requests she said she had, and she didn’t answer. He told Press Gazette about Blanchard.

Wired ran the article on Minecraft marriages in early May. But a red flag for Wired was how the only payment method Blanchard could use was PayPal or a paper cheque. The editors fact-checked the article a bit more closely — and they realised it was just fabricated. They took the story down. [Wired]

Press Gazette wrote up the tale of Blanchard in late August, at which point everyone else who’d published her realised they’d been conned and took their stories down too. [Press Gazette]

One editor had received a pitch from Blanchard, so he wrote back asking for her plan of action and who her sources would be. Blanchard replied “parroting words and phrases the editor had just written.” [Press Gazette]

Another editor noticed that Blanchard wrote like a chatbot — but she included scans of two scholarly articles she said she’d written:

I Googled the titles of both papers and found that they had been authored by other people and Margaux had simply pasted her name over their names on the first page.

AI bros keep being literally unable to tell good writing from bad writing, so they tell you that obvious slop is just fine when it really isn’t. But editors can tell. Do  not write like a slop machine.

Whoever was operating “Margaux Blanchard” eventually realised they had to make the writing sound a bit less like slop. Though what busted Blanchard wasn’t the writing — it was the publications finally doing the basic fact-checking.

I’m pretty sure nobody in publishing is looking forward to the Blanchard-bot trying again. Because you know whoever did this will try again.

• Video version