On October 4, 2024, the European Court of Justice handed down its Grand Chamber ruling in Bezirkshauptmannschaft Landeck (C-548/21).

The case seems straightforward: Austrian police seized a man’s phone during a cannabis investigation, tried to unlock it without authorization from a prosecutor or court, didn’t document the attempt, and didn’t tell the owner.

And the Court said you can’t do that.

Even attempting to access the data constitutes processing under Directive 2016/680. You need prior authorization from a court or independent authority. You need to document what you did. You need to tell the subject afterward.

These are not suggestions.

As an old investigator, and an early adopter of acquisition tools, I find the results of this ruling very interesting.

It has been called “groundbreaking for investigative work and data protection throughout the European Union.“ It is. You can tell because forensic extraction vendors noticed immediately, in a weird way. Rather than help investigators comply, I see them pouncing on a compliance gap as a market opportunity.

Sigh.

Within months, vendor pitches started arriving on my desk. They want me to think the Landeck ruling means full-device imaging is legally indefensible. Ok, but does that really mean old workflows are non-compliant? We always should have focused on selective extraction tools and targeted, proportionate acquisition. So, asking are your current workflows compliant is a bit like asking how far from spirit you were by torturing the written law.

Investigators were being technically accurate to the letter, while also knowingly dishonest.

The Landeck ruling doesn’t mandate a specific technical approach to data extraction. It mandates a legal process. Prior judicial authorization. Proportionality assessment. Documentation. Notification to the data subject. That’s the stuff of good work.

A department that obtains proper authorization, documents the scope and justification, and notifies the subject afterward can perform a full-device image and remain fully compliant. The legal requirement is the process around the access, not a magic volume of data touched.

Do no harm doesn’t mean tie people up with a garden hose and beat them with a phone book, even if it doesn’t leave physical evidence of torture.

The selective extraction pitch I’m seeing actually inverts the ruling’s logic. I’m not a lawyer but that seems like something lawyers should be looking at sooner rather than later.

The vendor argument goes like this: our tool can target when it pulls, which means the extraction has inherent proportionality, which means skipping heavy authorization processes for a full image. The proportionality is point and click first, ask questions later.

The compliance gap is sold as compliance.

Ugh.

The Court was explicit that even unsuccessful attempts to unlock a phone require prior authorization. I’ve seen that before. Even attempts at data access are sometimes still classified a data breach (e.g. healthcare). The threshold isn’t the volume of data extracted when it’s the act of accessing the device at all. A tool that makes it easier to do quick, targeted pulls at the local station level is a tool that makes it easier to skip the required authorization step. The investigator does a selective extraction, writes up their own proportionality justification after the fact, and calls it compliant because the tool only grabbed what was “relevant.”

That’s the investigator escalating themselves to judge and jury, performing their own prior review, which is exactly what the prior review requirement exists to prevent.

EDRi flagged this dynamic before the ruling even landed. Companies like Cellebrite, MSAB, and Grayshift sell extraction equipment widely deployed at corporations and police stations for prosecuting any and all crimes, including petty ones. I still remember where my classmates came from for EnCase certification.

The bottom line is that technology outpaced the legal frameworks years ago. In many EU countries, smartphones still end up treated as ordinary evidence-gathering, another object to be seized, without special data considerations.

Germany is the clearest example. The rules on search and seizure in the Code of Criminal Procedure (StPO) don’t differentiate between complex digital data carriers and other objects. It’s left entirely to the interpretation practice of prosecutors and investigating judges to apply proportionality case by case. In practice, suspects’ laptops and smartphones are often seized even when suspicions are tenuous and the hope of finding evidence is based solely on investigative experience.

Landeck is supposed to fix this.

The Court laid down clear requirements: national legislatures must define with sufficient precision the factors to be taken into account, including the nature and categories of offences. Access must be subject to prior review by a court or independent authority except in urgent cases. The data subject must be informed of the grounds for authorization as soon as disclosure won’t compromise the investigation.

Yet the vendor ecosystem is openly flogging workarounds in real time. Selective extraction tools to bypass Landeck, marketed as Landeck-compliant by design, allow investigators to access device data faster and with less friction than a full forensic image would require. The reduced scope becomes the justification for reduced oversight. The tool tries to avoid the authority of a judge.

This is a pattern we’ve seen before. Every time a court or regulator establishes a constraint on data access, the compliance industry immediately begins selling products that satisfy the letter of the requirement while undermining its purpose. Cookie consent banners. Privacy impact assessments. And now, “proportionate” mobile forensic tools for unauthorized access to feel authorized because the extraction was selective.

The Landeck ruling said: get a judge involved before you touch the device. It didn’t say buy a tool that makes touching the phone feel proportionate enough that you can ignore Landeck.

Rubber hose cryptography still counts as a threat to confidentiality.

Investigators who want to comply with the actual Landeck ruling should focus on the procedural requirements: get authorization before access, document scope and justification, notify the subject when appropriate. The tool matters less than whether a judge reviewed the request for acquisition.

The ones buying selective extraction tools to skip authorization aren’t achieving compliance. They are being sold a black bag of plausible deniability.

In 2008, Jeffrey Epstein was convicted of soliciting prostitution from a minor. That conviction is the fixed point in this story. Everything that follows happened after it.

Why? The system that should have removed Epstein from power instead credentialed him as someone the system couldn’t touch. The conviction didn’t function as punishment. It functioned as a rating agency.

In November 2014, Peter Thiel as the co-founder of Palantir Technologies, known for his long-standing Nazi beliefs, personally emailed this convicted sex offender to solicit $10 to $20 million for Valar Ventures. The venture capital fund Thiel had founded. Not a subordinate. Not an intermediary.

Thiel himself. With Epstein. Sex years after conviction. Oops, I mean six years.

A meeting followed in December 2014 at Epstein’s Manhattan townhouse, which was the same property that would become notorious as the location where numerous women said they were sexually abused.

Thiel brought with him two principals, Andrew McCormack and James Fitzgerald. Whatever happened in that infamous child sex abuse townhouse meant that by June 2015, Epstein had committed $15 million through his Southern Trust Company as a limited partner in a Valar Ventures fund.

That was not the end of the relationship.

It was the beginning.

As Nafeez Ahmed reports in Byline Times, more than 100 documents from the Epstein Files released by the US Department of Justice show that Thiel’s firm treated Epstein as an active premium partner for the next five years.

In June 2017, Valar Ventures sent Epstein exclusive investment opportunities marked “super confidential.” In November 2018, Thiel’s firm solicited additional capital from Epstein. As late as March 2019, four months before Epstein’s final arrest on federal sex trafficking charges, Epstein’s accountant was requesting detailed portfolio information for “presentation to Mr Epstein.”

The expanding investigation about abuse of underaged girls seemed only to deepen the Palantir relationships.

The original $15 million commitment grew to approximately $40 million. Epstein’s Valar Ventures stake is now worth approximately $170 million, making it the largest single asset in his estate.

Former Israeli Prime Minister Ehud Barak described Thiel and Epstein as “owners” of the fund in an email released as part of the Epstein Files. Thiel’s spokesman of course denied the characterization yet also confirmed Epstein was a limited partner. Whether you call it ownership or partnership, Peter Thiel personally solicited a convicted sex offender’s money, hosted him as a premium investor, and maintained the relationship until Epstein’s suspicious suicide.

Now add the intelligence dimension.

Christopher Steele, former MI6 Russia desk head, assessed that Epstein’s fortune likely originated from the former Soviet Union and Russian organised crime.

The documentary record supports this. In 2015, Epstein recommended that Thiel meet Sergey Belyakov, an alumnus of the Russian FSB spy academy who had served as Putin’s Deputy Minister of Economic Development. Thiel’s assistant arranged an in-person meeting. In October 2016, Epstein arranged at least one meeting between Thiel and Vitaly Churkin, Russia’s Ambassador to the United Nations and a veteran Kremlin operative.

When Churkin died suddenly and suspiciously in February 2017, Epstein emailed Thiel:

My Russian ambassador friend died. Life is short, start with dessert.

Thiel later told the Wall Street Journal that the meeting contained “nothing memorable” and tried to DARVO the situation by falsely claiming himself the “rather naïve” victim.

Now add the UK infrastructure.

Palantir Technologies holds more than £670 million in UK Government contracts spanning nuclear weapons systems at the Atomic Weapons Establishment, NHS patient records, Ministry of Defence operations, and police intelligence databases. In September 2025, Palantir bizarrely grabbed a £240.6 million MoD contract without competitive tender, awarded under a “defence and security exemption.”

This system led by the man giving white supremacist extremist sermons of Nazi Lebensraum, funded through a fortune that MI6’s former Russia desk head assessed originated from Russian organised crime… now processes data across “all security classifications” for “critical strategic, tactical and live operational decision making” throughout Britain’s defence apparatus.

And how did Palantir take control over British defense? In 2018, while Epstein remained an active Valar partner receiving confidential investment opportunities, Palantir hired Peter Mandelson’s lobbying firm, Global Counsel. The explicit purpose was to position a toxic Palantir as a respectable partner to the British government. Global Counsel brought former Health Minister Nicola Blackwood on board for “political risk analysis.” Matthew Swindells, Deputy Chief Executive of NHS England until July 2019, joined Global Counsel two months after leaving and immediately began advising Palantir on NHS contracts. He went on to chair Palantir’s health advisory board while simultaneously chairing four NHS hospital trusts.

Mandelson, of course, had his own Epstein problem. Between 2009 and 2010, while serving as Business Secretary, he leaked market-sensitive government information to Jeffrey Epstein. When this came to light, the British government moved swiftly:

Mandelson was sacked as US Ambassador, resigned his Labour Party membership, and was forced to quit the House of Lords. He now faces potential criminal charges for misconduct in public office.

The principle established by Mandelson’s removal is unambiguous: those who compromise the UK’s secrets to a foreign intelligence-linked sexual predator forfeit their access to power.

That principle has not been applied to Palantir.

The company whose radical right-wing founder personally solicited a convicted sex offender as a business partner, who received meetings with Russian intelligence operatives through that sex offender, who hired the lobbying firm of a man now facing criminal charges for leaking state secrets to that same sex offender? That company? It now processes Britain’s nuclear weapons data, military operations across all classification levels, NHS patient records, and police intelligence.

Thiel, infamous lately for giving extremist sermons promoting “ACTS 17” Nazi Lebensraum, says he is the naive victim. We would be naive to believe him. Thiel targeting Epstein in 2014 to be his partner makes perfect sense. Epstein had just publicly survived a child sex trafficking process that should have destroyed him. That’s not a liability for Thiel. That’s a due diligence result. It told him the asset is protected.

The two also met with several CEOs for dinner in Palo Alto in Aug. 2015, which Epstein described as “wild”…. “Does my bad press give you pause?” Epstein asked Thiel in one email. Thiel’s response was unfazed: “If I was intimidated by bad press, I would not have gotten anywhere in life.”

The MoD says there are “robust processes in place.” Palantir hired four Ministry of Defence officials in 2025 alone.

These processes seem to be working exactly as designed.

They’re NOT designed to protect Britain.

Almost every finding in a BBC article called “How where you grow up affects your personality” is about how culture shapes you.

Almost.

Buried deep is another finding. Your political identity shapes your perception of someone else’s authenticity. Rather than “culture influences personality” it’s proof how “ideology determines who gets to count as real.”

…researchers asked people with different political views to evaluate the morality of a Christian man who was attracted to other men. People who identified as liberals thought the man was acting according to his true self, while people who identified as conservatives believed instead he was going against his true, Christian self.

The article frames it as a curiosity about the philosophy of selfhood. What it actually demonstrates is the mechanism by which political identity becomes a tool for defining other people’s inner lives.

The ideologue doesn’t just disagree with their opponent about policy, they disagree about what’s actually happening inside another human being. And vice versa.

Each side arrogates the authority to adjudicate someone else’s ontological status.

Sartre is rolling in his grave.

That’s not a personality trait shaped by geography. That’s a power claim disguised as an observation about human nature. And this article tries to bury it between paragraphs about twin studies and underwater scene descriptions as if an antithesis isn’t what it is.