John Z Black

John Z Black May 4, 2026 Policy, Law & Governance #cargo-hacking #FBI #supply-chain #DHS #surveillance #data-centers #pentagon #AI #infrastructure

There is a version of cybersecurity that lives entirely in the abstract: stolen credentials and ransom notes on a screen. That version is over. What has replaced it is much messier, because it doesn’t respect the line between the digital and the physical anymore.

Consider the FBI’s new alert. Criminal groups are hacking freight brokers, stealing API access, and then impersonating logistics companies to redirect physical shipments. No guns required. Just a few changed delivery instructions in a browser tab, and a truckload of merchandise vanishes. It is 21st-century highway robbery where the heist happens in a browser.

Then there is the ocean floor. A startup called SubCompute just raised a billion dollars to build wave-powered data centers underwater. It solves cooling and power problems, but it introduces a whole new set of security questions. How do you audit a data center you can’t easily reach? Physical security at an underwater facility is a model that hasn’t even been written yet.

Even the government is pushing boundaries. DHS used a 1930s Customs statute to demand Google data for a Canadian citizen who has never even visited the US. This is what happens when digital activity has no geography. Your data lives on American servers, so a US agency can assert jurisdiction over foreign speech. In 2026, the question isn’t whether you’re protected from cyber threats. It’s where your physical exposure begins. The honest answer is: it doesn’t.

See how the merger of physical and digital risk is changing everything