Microsoft AI on Thursday released MAI-Transcribe-2, a speech-recognition model the company says is faster, more accurate, and cheaper than anything OpenAI, Google, or ElevenLabs currently sells. Then it priced the thing at 10 cents per hour of audio.

That figure deserves a pause. When Microsoft AI shipped the first model in this line just five months ago, it charged $0.36 an hour. Thursday’s early-bird price cuts that by roughly 72%. For an enterprise processing 100,000 hours of call-center audio a year — a modest volume for a large bank or telecom — the bill drops from $36,000 to $10,000. At that level, transcription stops being a line item anyone argues about.

The release arrives as Microsoft executes a strategy that would have seemed implausible two years ago: building its own frontier-class models one modality at a time, then steadily swapping them into products that once ran on OpenAI’s technology. Transcription is the modality where that plan has moved fastest, and MAI-Transcribe-2 is its clearest proof point yet. It also offers a preview of how the world’s most valuable software company intends to compete in AI without depending on the partner it spent $13 billion to cultivate.

What MAI-Transcribe-2 does and why the feature list matters to enterprise buyers

The model transcribes audio in 60 languages, up from 43 in June’s MAI-Transcribe-1.5 and 25 in April’s original release. It runs on Microsoft Foundry, the company’s model marketplace for developers, and in MAI Playground, its testing environment. Microsoft says it built the model for the messy audio that real businesses generate — background noise, low-quality recordings, overlapping speech — rather than clean studio conditions.

More important than the language count is what Microsoft has bundled into the base product. Speaker diarization sorts out who said what in a multi-person recording, which is the difference between a wall of text and a usable meeting transcript. Word-level timestamps attach a precise time marker to every word, enabling search, editing, and alignment with video. Keyword biasing lets developers feed the model a list of drug names, product codes, or employee names so it stops mangling domain jargon. Automatic language identification means users no longer have to declare the language in advance.

Two features stand out for their specificity. A configurable output style offers a “verbatim” mode that preserves every “um,” false start, and stutter for compliance and legal teams, alongside a “clean” mode that strips fillers for readable captions and notes. And code switching handles conversations that drift between languages mid-sentence; Microsoft explicitly names Hinglish and Spanglish, a nod to the Indian and U.S. Hispanic markets where a single customer-service call might toggle languages a dozen times. Specialty vendors have historically charged premiums for each of these capabilities. Microsoft is including all of them for a dime.

How to read Microsoft’s FLEURS and Artificial Analysis benchmark claims

Microsoft makes three performance claims, each resting on a different measuring stick, and technical buyers should understand what each one captures and what it misses.

The first is that MAI-Transcribe-2 ranks number one on FLEURS across 60 languages with an average word error rate of 5.2%. FLEURS is a benchmark Google researchers published in 2022, built from native speakers reading roughly 2,000 sentences in each of 102 languages — about 12 hours of speech per language. It is the standard yardstick for multilingual speech recognition because it lets you compare a model’s Swahili against its Swedish on identical content. Word error rate, its metric, simply counts substitutions, insertions, and deletions against a human reference; 5.2% means roughly one word in 20 is wrong. But FLEURS is read speech, not conversation, and Microsoft’s average has actually risen from the 3.7% it reported for MAI-Transcribe-1.5 in June. That almost certainly reflects broader coverage rather than regression — averaging across 60 languages instead of 43 means folding in low-resource languages where every model struggles — but buyers should request the per-language breakdown.

The second claim is that the model ranks second on the Artificial Analysis word-error-rate leaderboard and defines that firm’s accuracy-latency Pareto frontier. Artificial Analysis is an independent benchmarker that tests models through their public APIs, measuring what a customer actually gets. Its index blends simulated agent conversations, European Parliament speeches, and corporate earnings calls, weighting heavily toward English business speech. In June, the firm ranked MAI-Transcribe-1.5 third at 2.4% WER, behind Alibaba’s Fun-Realtime-ASR-preview and ElevenLabs’ Scribe v2, while calling it the fastest model in the top 10. Climbing to second suggests Microsoft has cleared ElevenLabs. “Pareto frontier” is the phrase practitioners should note: it means no rival beats the model on accuracy without being slower, and none beats it on speed without being less accurate.

The third claim is raw speed — 10 times faster than OpenAI’s GPT-Transcribe, seven times faster than ElevenLabs’ Scribe v2, five times faster than Google’s Gemini 3.5 Transcribe, per Artificial Analysis evaluations. In batch transcription, speed matters less because anyone is waiting and more because throughput is cost. A model running at 300 times real-time needs a fraction of the GPU-hours of one running at 30 times. That efficiency is what lets Microsoft charge a dime and, presumably, still make money.

Three speech models in five months: inside Microsoft AI’s rapid release cadence

The pace is the story within the story. On April 2, MAI-Transcribe-1 launched with 25 languages at $0.36 per hour. On June 2, MAI-Transcribe-1.5 arrived with 43 languages, keyword biasing, and a third-place ranking on Artificial Analysis. Today, MAI-Transcribe-2 shipped with 60 languages, diarization, timestamps, code switching, a second-place ranking, and a price of $0.10.

Three releases in five months, each expanding language coverage by roughly 40% while adding features competitors gate behind premium tiers. That cadence is characteristic of a team that has settled on a stable architecture and is now turning the crank on data and scale — the phase where speech models tend to improve quickly and predictably. It is also the cadence of a company that intends to make transcription a commodity before anyone else can.

The organizational bet behind that speed is one Mustafa Suleyman, Microsoft AI’s chief executive, described to The Verge in April. He credited the first model to “a small, focused 10-person team” that had been “liberated from any of the bureaucracy,” with a larger surrounding group handling vendor management and data acquisition.

He also told The Verge the model ran at “half the GPU cost of the other state-of-the-art models,” calling it “a huge cost-saving” for Microsoft. Meta, Amazon, Google, and Anthropic have all experimented with similar flattened structures, The Verge noted. Microsoft’s transcription line is the most visible test yet of whether the approach produces commercial results rather than research papers.

Why Microsoft is building its own AI models despite its $13 billion OpenAI bet

Microsoft has invested more than $13 billion in OpenAI, and hosts OpenAI’s models across Azure, Office, and Copilot. For most of the past four years, the obvious question about any Microsoft-built model has been: why bother? The answer has sharpened over the past year, and it begins with independence.

When Microsoft hired Suleyman from Inflection AI in March 2024, along with most of Inflection’s staff, Salesforce CEO Marc Benioff read it as a declaration of intent. “Microsoft is building their own AI and I don’t think Microsoft will use OpenAI in the future. They’ll have their own frontier models,” Benioff told CNBC in January 2025. “That’s why they hired Mustafa Suleyman.” Benioff had his own motives — Salesforce competes with Microsoft and invests in Anthropic — but events have largely borne him out.

In October 2025, Microsoft and OpenAI restructured their partnership in a deal that, per Microsoft’s own announcement, allowed Microsoft to “independently pursue AGI alone or in partnership with third parties” for the first time. Suleyman told The Verge that renegotiation “unlocked [Microsoft’s] ability to pursue superintelligence,” and Microsoft announced its MAI Superintelligence team weeks later. In April 2026, the companies amended the deal again, ending Microsoft’s exclusive access to OpenAI’s models and eliminating Microsoft’s revenue-share payments, according to reports at the time. Each amendment loosened the tie. Each one was followed by more MAI models.

How Microsoft’s in-house models are cutting costs across Teams, Word, and Excel

The second half of the answer is margin. Every prompt Microsoft routes to an OpenAI model carries a cost. Every prompt it routes to its own model on its own GPUs carries a smaller one. In July, Bloomberg reported that Microsoft had begun using MAI models to answer a portion of user prompts in Word and Excel — products it had previously advertised as powered by OpenAI and Anthropic. TechCrunch framed the shift as part of a broader industry pullback on AI spending, with Amazon, Uber, Meta, and Accenture all reportedly trimming.

Transcription is the natural first target for this substitution because the problem is bounded and the metric is objective. Microsoft owns Teams, which generates an enormous volume of meeting audio. It owns Nuance, whose clinical documentation business runs on speech recognition. It owns the Azure speech services that thousands of enterprises already call. Every one of those workloads is a candidate to move onto MAI-Transcribe-2, and every hour that moves is an hour Microsoft no longer pays anyone else for.

Suleyman has been unusually candid that this is the point. Superintelligence, he told The Verge in April, “is really about, ‘Are these models capable of delivering product value for the millions of enterprises that depend on us to deliver world-class language models?’” Whatever one thinks of applying the word “superintelligence” to a transcription API, the commercial logic is plain: build the capability once, deploy it across a dozen products, and stop writing checks to a partner that is increasingly a competitor.

MAI-Transcribe-2 vs. OpenAI, Google, and ElevenLabs: the competitive picture

Microsoft’s release names four rivals: OpenAI’s GPT-Transcribe, Google’s Gemini 3.5 Transcribe, OpenAI’s older Whisper V3-Large, and ElevenLabs’ Scribe v2. It does not mention Deepgram, AssemblyAI, Speechmatics, or Rev — the specialists that have sold transcription to enterprises for a decade. Microsoft is positioning against the frontier labs, not the incumbents.

That framing is partly marketing and partly true. The frontier labs have treated speech as a checkbox feature of broader platforms, priced accordingly, and a dedicated model that beats them on speed by five to 10 times while matching their accuracy is a genuine differentiator. But the specialists will feel the price pressure most acutely. At $0.10 an hour, Microsoft is pricing at or below where many of them sell high-volume enterprise contracts, and it is bundling diarization, timestamps, and 60 languages into the base rate. The specialists’ remaining moat is domain depth — medical vocabularies, legal formatting, industry-specific integrations — and Microsoft’s keyword biasing feature is aimed squarely at it.

The one competitor Microsoft conspicuously does not claim to beat on accuracy is Alibaba, whose models have posted leading numbers on independent leaderboards for much of 2026. TechCrunch reported in July that some U.S. companies had begun evaluating Chinese models as cheaper alternatives despite security concerns. Microsoft’s pitch to those buyers is implicit but unmistakable: comparable accuracy, faster inference, lower price, and a vendor your compliance team already trusts.

The questions technical decision makers should ask before switching transcription vendors

For all its specificity on benchmarks, the release leaves several practical questions open. The first is duration: Microsoft calls $0.10 per hour a launch offer without naming an end date or a standard rate, and anyone building a cost model should get both in writing. The second is streaming. The release emphasizes batch throughput and long-form audio but says nothing about real-time transcription, which voice agents and live captioning require. Artificial Analysis maintains a separate streaming leaderboard, and Microsoft’s silence on it is notable.

The third is per-language accuracy. A 5.2% average across 60 languages could mean 3% on major languages and 12% on low-resource ones, so buyers with specific needs should test those languages directly. The fourth is diarization quality. Word error rate does not measure speaker attribution; a transcript can have near-perfect WER and still assign every other sentence to the wrong person. The release offers no diarization error rate or comparable metric.

The fifth is data handling. Enterprise transcription touches medical records, legal privilege, and financial disclosures, and the release says nothing about data residency, retention, or whether audio submitted to Foundry feeds future training. Microsoft’s April announcements described training data as a mix of human-curated recordings, contractor-recorded noisy audio, and “vast amounts of data from the open web,” per The Verge — a description that should prompt pointed questions from regulated industries. None of these gaps is unusual for a launch announcement, but they are exactly the questions that separate a leaderboard win from a production deployment.

What Microsoft’s speech model strategy reveals about its broader AI ambitions

Step back from the speech-recognition details and a pattern emerges that extends well beyond transcription. Microsoft’s AI unit now ships models for images, voice, transcription, code, reasoning, and cybersecurity. At Build in June, it announced seven new MAI models in a singlekeynote. Each follows the same playbook: target a well-defined modality, optimize aggressively for inference cost, price below the frontier labs, distribute through Foundry, and quietly swap the model into Microsoft’s own products.

This is not an attempt to build one model that beats GPT or Gemini at everything. It is an attempt to build a portfolio of specialized models that, in aggregate, let Microsoft serve most of its enterprise workloads without paying anyone else — and to sell the surplus capacity to everyone else at prices the specialists cannot match. Transcription happened to be the first modality where the approach fully matured, but the release notes for MAI-Transcribe-2 read less like a product announcement than a template.

Suleyman has spent two years talking about “humanist superintelligence” and AI assistants that are “accountable to them, on their side.” The vocabulary is lofty. The execution is a spreadsheet. Five months ago, Microsoft charged 36 cents to turn an hour of speech into text. On Thursday it charged a dime, threw in six features its rivals sell separately, and claimed the top spot on the industry’s standard multilingual benchmark. The company that spent $13 billion learning what frontier AI costs has decided it would rather own the factory than rent the output — and now it is selling the output for less than the rent.

MAI-Transcribe-2 is available now through Microsoft Foundry and MAI Playground.

How large does a digital movie collection need to become before storage starts getting a little ridiculous?

Kaleidescape apparently thinks 246TB is a reasonable place to find out.

At CEDIA Expo 2026, the company introduced the Compact Terra Prime 246TB SSD Movie Server, its highest-capacity server to date. What makes it more interesting than another exercise in storage excess is the packaging: Kaleidescape has squeezed two 123TB solid-state drives into the same compact chassis used by the Strato K 8K movie player.

For perspective, the full-size Terra Prime 120TB introduced earlier this year suddenly looks rather modest.

The new model is aimed at very large Kaleidescape collections, whole-home installations and marine systems where multiple Strato players need immediate access to a centralized movie library.

And presumably people who regard deleting a downloaded movie as a personal failure. It appears someone at Kaleidescape finally read my email.

Related Reviews:

How Much Fits on 246TB?

Kaleidescape estimates the Compact Terra Prime can store approximately 4,000 conventional 4K movies, 2,300 4K Cinematic or 8K movies, 6,600 HD movies, or 37,000 SD titles.

There is an important distinction with that 2,300 figure. It represents storage capacity based on typical file sizes; it does not mean Kaleidescape currently offers 2,300 native 8K movies.

The company offers more than 14,000 titles across its supported formats, while its newer 4K Cinematic and 8K playback capabilities are tied to the Strato K platform.

Storage requirements are also moving upward. Kaleidescape says 4K Cinematic downloads average approximately 1.5 times the size of its conventional 4K versions, with average bitrates around 110 Mbps. The format can retain chroma information up to 4:4:4 and was introduced alongside Strato K in June 2026.

Strato K itself includes a 960GB SSD, which is useful for a small standalone library but can hold only about seven 4K Cinematic titles. Connecting it to Terra storage removes that constraint and lets the player concentrate on playback while the server maintains the collection.

That makes a huge server considerably easier to understand, even if most home theater owners will never come remotely close to needing this much capacity.

SSD Changes More Than Storage Capacity

The existing Terra Prime 120TB uses four removable hard drives in a traditional full-width component. Moving to SSDs allows the 246TB version to deliver considerably more capacity in a chassis less than half as wide.

There are also performance advantages.

With a 2.5 Gigabit Ethernet connection, Kaleidescape says a high-bitrate 4K movie can download in as little as four minutes.

The more relevant specification for large custom installations may be simultaneous playback. One server can provide high-bitrate 4K content to as many as 25 network-connected Strato players.

Nobody needs 25 movie zones in a two-bedroom condo.

In a large residence, yacht or other professionally integrated system, that capability starts making considerably more sense.

Almost One Petabyte of Kaleidescape

If 246TB somehow proves inadequate, Kaleidescape allows up to four Compact Terra Prime SSD servers to operate together.

That creates a maximum combined capacity of 984TB, just shy of one petabyte.

Kaleidescape says three of the new servers provide sufficient capacity for its entire current Movie Store based on typical storage requirements.

This is where the intended customer becomes fairly obvious. Someone building a modest single-room Kaleidescape system can choose the Strato E, Strato M, Strato K and considerably smaller Terra options already in the lineup.

The 246TB server exists for installations where users want an enormous collection stored locally and available instantly throughout the property without continually deciding what stays downloaded.

Kaleidescape has never been about cloud streaming. Purchased movies are downloaded to local storage and then played directly from the system, which allows the company to use movie files and bitrates that would be impractical for conventional streaming services.

Increasing local storage therefore becomes increasingly useful as Kaleidescape pushes toward higher-quality downloads.

What About Price?

Kaleidescape has not announced a fixed MSRP for the Compact Terra Prime 246TB SSD.

The server is available now on a special-order basis through authorized Kaleidescape dealers.

That is probably just as well.

For context, the Terra Prime 120TB sells for $34,995, before adding a Strato movie player. Two 123TB enterprise-class SSDs are not exactly something you pick up from the impulse aisle at Costco, so attempting to reverse-engineer a retail price from consumer SSD pricing would be pointless.

Anyone genuinely shopping for one will be speaking with an authorized integrator anyway.

Specifications

• Product: Kaleidescape Compact Terra Prime SSD Movie Server
• Storage: 246TB
• Drives: 2 x 123TB SSD
• Approximate Storage: 2,300 8K or 4K Cinematic movies; 4,000 4K movies; 6,600 HD movies; 37,000 SD movies
• Download Speed: High-bitrate 4K movie in as little as 4 minutes
• Simultaneous Playback: Up to 25 network-connected Strato players
• Networking: 2.5 Gigabit Ethernet recommended; 1 Gigabit minimum
• USB: USB 3.0, reserved
• Dimensions: 7.87 x 1.52 x 10 inches
• Weight: 4 pounds
• Typical Power Consumption: 22 watts
• Maximum Power Consumption: 42 watts
• Typical Fan Noise: 20 dB(A)
• Construction: Black anodized aluminum
• Rack Mounting: Optional 1U shelf supports one or two compact units
• Supported Storage: 8K, 4K Cinematic, 4K Dolby Vision, 4K HDR10, 4K SDR, HD and SD Kaleidescape downloads
• Availability: Available now by special order through authorized Kaleidescape dealers

The Bottom Line

The Compact Terra Prime 246TB SSD is clearly not intended to make Kaleidescape more affordable. Strato E and Strato M have already taken on that job by lowering the cost of entering the ecosystem.

This product pushes in the other direction.

Kaleidescape is building an increasingly scalable platform in which a relatively simple single-room system can coexist with installations serving dozens of playback zones and enormous locally stored collections. Strato K and 4K Cinematic have also increased the amount of data required to deliver the company’s best video quality, making higher-capacity storage more than just a game of spec-sheet one-upmanship.

Does anyone really need almost a quarter-petabyte of movie storage in one box?

Probably not many people.

But the customers who do were unlikely to be satisfied with 120TB anyway.

For more information: kaleidescape.com

Related Reading:

Windscribe has reduced its annual plan from $69 to $39 upfront ($3.25/month), just in time for the new academic year.

The plan includes unlimited simultaneous connections — a feature missing from competitors like NordVPN or Proton — along with a built-in ad, tracker, and malware blocker.

Its user-friendly apps are available across desktop, mobile, and many smart TVs, so it can cover everything you need: whether you’re securing public Wi-Fi in the library or streaming back in the dorm.

Crucially, this isn’t a first-year teaser rate. You’ll be billed $39 every 12 months for as long as you keep the subscription active, avoiding the steep renewal price hikes standard across the VPN industry.

Few premium VPNs match this pricing, particularly when accounting for renewal costs. For example, NordVPN‘s one-year plans start at $65.88, over $20 more, and renew at $139 per year. It’s a similar story when you look at the likes of Surfshark and ExpressVPN, too.

It’s also among the fastest VPNs we reviewed during our most recent tests, achieving over 2,000 Mbps over WireGuard. Plus, it reliably unblocks major streaming platforms and bypasses regional internet blocks.

If you’re not keen on Windscribe but want to keep top speeds, PrivadoVPN is another top choice that achieved over 2000 Mbps in testing. Equally, for streaming performance, no VPN performed better than NordVPN with global services this time around.

If you want to test it first, Windscribe offers a solid free tier. While bandwidth and server locations are capped, it gives you a risk-free way to test the interface before upgrading.

from the good-deals-on-cool-stuff dept

The Adobe Graphic Design Bundle has 3 courses designed to help you learn the essentials of graphic design and how to apply those skills to your projects. Courses cover Photoshop, Illustrator, and InDesign. You’ll learn all aspects of the design process. It’s on sale for $50.

Note: The Techdirt Deals Store is powered and curated by StackSocial. A portion of all sales from Techdirt Deals helps support Techdirt. The products featured do not reflect endorsements by our editorial team.

Filed Under: daily deal

from the when-you-it-it-that-way,-it-seems-bad dept

Even as Donald Trump regularly uses mail-in ballots himself, he has decided that mail-in ballots are a system by which voting fraud occurs. To be quite clear, this is bullshit. There is astoundingly little evidence of significant voter fraud, and that’s equally true between in-person and voting-by-mail. And there’s zero evidence that mail-in voter fraud has ever even come close to swinging a federal election. Indeed, what little voter fraud there is often involves mixups of people who thought they were eligible to vote accidentally trying to vote when they were ineligible.

Either way, a few years back, Trump started blaming mail-in ballots for the completely mythological “rigged elections” he keeps insisting are happening, and of course the MAGA establishment quickly fell into line. We just recently wrote about how the Fifth Circuit appeals court has been working overtime to pretend that it’s well-established that mail-in ballots are insecure. But the bigger issue is that earlier this year, Trump issued an executive order to try to limit the use of mail-in ballots.

Specifically, the executive order tells the US Postal Service to engage in a “rulemaking” that is designed to make it much more difficult for states to offer mail-in ballots. And, on top of that, it demands that states that offer mail-in ballots must hand over their voter rolls to the federal government. The White House has been demanding voter rolls from a bunch of states, and so far every state that has engaged in litigation over this issue has won (it’s now over 20 cases, all of which have gone against the administration).

On its face, the executive order should be seen as pure nonsense, given that the states get to run elections, not the federal government. And even if it were the federal government, that’s not what executive orders are for. But given that the same Supreme Court that insisted no Democratic president could do literally anything without explicit congressional approval now treats Donald Trump as the very special birthday boy who gets whatever he asks for, we have to take even his most ridiculous demands seriously.

A district court judge, Indira Talwani, who is overseeing two of the cases challenging that executive order has issued injunctions in both cases, blocking the US government from putting it into effect. As Talwani notes, the states get to determine how their elections are run, per the Constitution.

Article I of the Constitution also empowers the States to prescribe the “Times, Places, and Manner of holding” congressional elections. U.S. CONST. art. I, § 4, cl. 1. “[T]hese comprehensive words embrace authority to provide a complete code for congressional elections, not only as to times and places, but in relation to notices, registration, supervision of voting, protection of voters, prevention of fraud and corrupt practices, counting of votes” among other issues. Smiley v. Holm, 285 U.S. 355, 366 (1932).

The President is elected by vote of the Electoral College. See U.S. CONST. amend. XII. The Electors Clause empowers each State to appoint electors to the Electoral College “in such Manner as the Legislature thereof may direct.” U.S. CONST. art. II, § 1, cl. 2. The States require their electors be appointed by popular vote of qualified voters. See Chiafalo v. Washington, 591 U.S. 578, 584 (2020). Accordingly, the States alone determine voter-eligibility requirements, subject only to the outer limits of the Constitution. See, e.g., U.S. CONST. amend. XIX (“The right of citizens of the United States to vote shall not be denied or abridged . . . on account of sex.”); U.S. CONST. amend. XXVI (“The right of citizens of the United States, who are eighteen years of age or older, to vote, shall not be denied or abridged . . . on account of age.”). For presidential elections, the Electors Clause gives States the primary authority to decide how electors are chosen.

As a result, the court ordered (among other things) the USPS to not take any steps to implement the executive order.

Furthermore, in the latter injunction, Talwani pointed out that the federal government failed to present literally any evidence of mail-in voting fraud:

The record is devoid of any declarations or other proffered evidence to suggest that mailin voting has resulted in voting by non-citizens.

In other words — the DOJ, despite the president insisting that non-citizen voting was happening all the time with mail-in ballots — didn’t even try to present evidence of that to the judge.

But this week, a USPS whistleblower revealed that the Postal Service has been building the machinery to implement the order anyway — issuing a final rule on August 26 and, per the disclosure, restarting development around July 29 even though the very clear injunction against doing anything was still in force. The whistleblower went to Senator Richard Blumenthal who released the whistleblower’s report, along with a letter to the Postmaster General demanding an explanation.

My office is in receipt of an alarming whistleblower disclosure (the “Disclosure”) outlining the United States Postal Service’s (“USPS”) perilously rushed and potentially unlawful implementation of President Trump’s Executive Order seeking to restrict mail-in voting. The whistleblower’s allegations make clear that USPS lacks the technical or operational capability needed to effectively implement the EO’s provisions in a way that safeguards every citizen’s right to vote in the upcoming midterm elections. Despite this, the Trump Administration appears intent on USPS moving forward with its flawed plans, no matter the chaos they may create. The whistleblower’s allegations also provide disturbing information suggesting that USPS may have violated a court order by continuing to implement the EO despite being ordered to cease all such work. We urge you to abandon this ill-conceived, unconscionable plan and ensure that all Americans can exercise their constitutional right to vote, including by mail, without interference by USPS.

The USPS’s defiance of the court order here is pretty direct. The judge issued an injunction on Section 3 of the executive order on June 25th. USPS did, in fact, stop work on the portal, while the DOJ appealed. On July 25th, the appeals court upheld the injunction, noting that the executive order “directs unprecedented levels of involvement by federal officials in how states administer elections.”

But just four days later, on July 29th, the whistleblower says that USPS leadership told the IT team to start building a tool to enforce the executive order, in direct and obvious defiance of the injunction against it. Then on August 11th, the district court expanded the injunction, which should have made it even clearer to USPS to stop. But USPS appears to have completely ignored that. While the Supreme Court put a stay on the injunction on August 24th, two days later the district court issued a temporary restraining order. But it appears that basically none of that mattered, as USPS leadership had the IT team continue to work on the thing they were explicitly barred by multiple courts to do.

As Blumenthal’s letter summarizes, the USPS rushed to build a portal whose main job appeared to be to block the mailing of mail-in ballots to voters (i.e., this is not them swiping already completed ballots, just refusing to send them to voters in the first place). And because USPS is now run by people whose main qualification is loyalty to Donald Trump, the execution is exactly as incompetent and slapdash as you’d expect:

The whistleblower’s Disclosure describes an unprecedented process that allows USPS to decide whether ballots issued by state election officials should be mailed. To do so, USPS is building an entirely new online system, the USPS Federal Ballot Mail Portal and related IT systems (the “Portal”), which will be used to screen ballots submitted by state election officials prior to USPS agreeing to mail them to voters. The Disclosure identifies problems at every stage of USPS’s development of the Portal, demonstrating deeply flawed plans for implementation. According to the whistleblower, USPS’s effort to develop and deploy the Portal has been “rushed,” “risky and haphazard” because leadership has demanded an impossible timeframe. In an effort to meet impossible deadlines, USPS has eliminated standard and needed testing, thereby creating substantial risk of a “catastrophic failure” of the system that could “derail the midterm elections.”

What could possibly go wrong:

USPS began work building the Portal on or around June 15, 2026 just three months before the date USPS planned to launch the system and just five months before the November 2026 midterm elections. On or about June 25, 2026, USPS ordered work on the Portal to cease due to a court order enjoining implementation of the EO. That work stoppage persisted for approximately a month, further reducing the time that USPS had to build the new system. According to the whistleblower, building the information technology infrastructure necessary to complete the Portal could take a year or more. Yet, USPS leadership demanded that the Portal be completed for a launch date of September 1, 2026, less than six months after the EO was issued. As a result of this rushed process, USPS has been unable to conduct tests of the Portal to ensure its proper functioning, troubleshoot problems, or distribute instructions on use to state election officials. According to the whistleblower, the Portal “violates standard principles of testing and debugging new software before launch.” Normal procedures at USPS for such systems include internal testing, customer acceptance testing, and a final development stage before release to public facing users. The Portal has gone through none of these basic checks.

Going beyond just Blumenthal’s summary, the actual whistleblower report has some astounding details about how the bosses at USPS working on this seem to have no clue how to build reliable software (one wonders if they’re ex-DOGE folks):

Throughout the development of the project, those giving guidance to tech developers lacked understanding of project parameters. Different team members continued to have different understandings of how the system is supposed to function which caused ongoing and greater confusion among the group.

While there continued to be no clear written requirements for the software and IT system, those developing the new election ballot mail IT system were placed in the position of trying to glean requirements from opaque comments at meetings. It continued to be clear that those giving directions did not understand exactly what was to be built. There was a growing concern that many were grasping at straws, trying to do their best to decipher cryptic instructions, and likely missing important details. Elements as basic to the project as whether a validation issue was a “warning” or an “error” continued to be unclear as leadership provided inaccurate information about these issues. To clarify, a warning allows a ballot to continue through the process while an error stops it. These occurrences reinforced the need for written requirements and the ongoing failures in communication.

Advertisement

Even so, the team was told that the system had to be ready to launch… by yesterday. They were given less than a month to figure it out. If you know anything about software development, project management, or… just about how anything works, these paragraphs are concerning:

Around this time at least one senior USPS official seemed to up the stakes by becoming a more active voice pushing for project completion on the new deadline. For example, when IT workers expressed concerns about the quality of the product under USPS leadership’s compressed timeline, the senior official stated that they (the official) “were not trying to stop anyone from getting their ballots and what is the problem?” Employees went on to reiterate concerns that many teams were still missing details of how systems were supposed to work and that written requirements could ensure that everyone was on the same page. The senior official was dismissive of these concerns. The conversation continued with others repeating the need for clear requirements; while leadership insisted that it was easy to understand what was needed and also that there was no time to write down the requirements. The contradiction was obvious that it should not take a great deal of time to write down something that is easily understood.

Concern continued to grow and the Whistleblower became aware that IT teams referred to the largely oral requirements as a “moving target.”

By the third week in August “user stories” – short, plain-language descriptions of a software feature written from the perspective of an end-user (focused on what a user wants to achieve and why) – were described as unusable “garbage”. User stories that had been generated had incorrect information and needed to be updated.

Throughout this project, the Whistleblower understood that IT teams were siloed and not communicating with one another. Teams had so little understanding what other teams were working on such that when elements were brought together, the teams were unaware of various developments, creating more work to utilize even the completed portions of the work.

Advertisement

By August 20, there was a massive rush as teams tried to get “everything committed” – in order to meet the goal of getting the ballot mail systems ready for customer testing on August 24. The resulting chaos caused work to be overwritten. By this point IT workers were resigned that even if they could get the portal put together and working in the internal development environment, there would not be enough time to test and fix any issue that would inevitably arise in customer testing.

The system was designated a grand total of four (FOUR!) days of user testing (and it’s not even clear if the testing actually happened):

By August 24 the expectation was that if somehow everything was accomplished on Monday the 24th, the code would end up in internal testing on Tuesday, August 25, then move to customer testing on Wednesday, August 26 allowing only four work days to test. For a system that manages something as important as handling voting and ballots, 4 days of user testing is entirely unreasonable. Only leadership seemed to express hope that the September 1 deadline was viable. If a problem was found during testing, which was almost certain, the IT workers would need to fix it and that fix would need to move back to internal testing and then into customer testing again. If a problem wasn’t found in the first 2 days, the fix could not make it back to the customer testing environment in time to meet the deadline.

In just the week prior to September 1, 2026, the Whistleblower learned that IT workers have described the election ballot mail development process as “a shit show.”

Very confidence building!

The whistleblower notes that a similar internal tech project that the USPS IT team built in the past “set aside 47 working days for testing.” And this one gets four.

Perhaps an even bigger problem than the slapdash hand-wavey “build a complex system in weeks with no written requirements, and no time for testing,” was the demand for a “zero percent failure rate.” That means that if a single barcode won’t scan — whether because of bad connectivity or a voter got married and changed their name — USPS bounces the entire batch back to the state. And these batches can run to tens of thousands of ballots. Back to Blumenthal’s summary:

Not only is this system astonishingly untested, USPS has simultaneously implemented an impracticable zero percent failure rate. When ballots are submitted to USPS in large-volume batches, if any one ballot in the batch cannot be verified against the Portal, all ballots in that batch will be rejected. For example, if a state election official brings a batch of 10,000 ballots to USPS and USPS is unable to match just one of those ballots against the Portal – because, for example, someone has recently changed their name after marriage or they’ve moved – then USPS would refuse to mail the remaining 9,999 ballots as well. As the whistleblower notes, “USPS expects the state to take back the entire batch to cure the issue with the single ballot…” Should the slapdash Portal mistakenly mark a ballot as unverified, there is no clear process by which state election officials or voters themselves can challenge the rejection. The Rule simply vaguely states that they “will be informed of the escalation procedures should they decide to challenge a rejection.” Voters intending to cast ballots by mail may not even be aware that their ballots have been rejected, or were part of a rejected batch, until it is too late to secure an alternative ballot or vote in person. Expecting a well-built, thoughtful Portal to return an accurate result 100 percent of the time is already a stretch—expecting a “rushed,” “risky and haphazard” Portal to do the same is a recipe for disaster.

A zero percent failure rate means that a single bad scan (which could happen for any reason) could block thousands of ballots (literally all of which could be legit and fine) from being sent out. Given that eight states already run elections entirely by mail, this could mean significant percentages of voters just not receiving their ballots at all.

And, we’re relying on a hastily built system with barely any testing not to have any bad scans that lead to thousands of ballots being blocked.

Of course, what Blumenthal and the whistleblower call “risky and haphazard” most others might call “deliberately designed to suppress votes and create chaos that will allow MAGA to call into question the validity of an election.”

Look, this is just terrifying: the president and his administration are building a system designed to guarantee that fewer people receive their ballots, in a manner designed to create obvious chaos around an election they don’t expect to win. Whatever you want to call the intent, that’s an executive branch actively degrading the machinery of free and fair elections.

That should be the biggest story in the country.

Donald Trump has made it abundantly clear that he thinks the federal government works for him, and him alone. It does not. It works for the American people, and a court has already told USPS exactly that, twice. One postal employee understood the assignment well enough to risk their job and blow the whistle over it. It’s about time that more started to do so as well.

Filed Under: david steiner, donald trump, election interference, elections, mail-in ballots, richard blumenthal, usps, voting, whistleblower

Infostealer logs have evolved from an underground commodity into an operational security problem. For defenders, finding an exposed credential is only the beginning. In today’s reality many security analysts start their morning with an alert: an employee’s corporate email address has appeared in a newly collected infostealer log. 

The log contains a username and password for a corporate SaaS application. There are browser cookies, meaning live sessions that can be exploited, and several other saved, in files, credentials. 

A personal employee computer got infected by Vidar located hundreds of miles from the company’s offices. Now what?

Resetting the exposed password seems obvious. But that may not solve the problem. If the stealer captured an authenticated session cookie, an attacker may already have a way into the application without needing the password or another MFA prompt. If the employee reused corporate credentials on a personal computer, the endpoint that created the exposure may not even be managed by the organization.

And somewhere in an underground Telegram channel, the same information may already be available to an initial access broker, ransomware affiliate, or opportunistic attacker.

This is the operational challenge security teams increasingly face with infostealer logs.

According to Flare Research’s Practitioner’s Guide to Monitoring Stealer Logs, approximately 46% of stealer logs containing corporate credentials originate from likely unmanaged or personal devices. Flare also estimates that exposure involving credentials and sessions for major productivity SaaS and cloud services is growing approximately 29% annually.

For defenders, the question is no longer simply whether they should monitor infostealer logs.

The harder question is: How do you separate a meaningless old password from an identity compromise that could be happening right now?

The needle among millions of needles

Infostealers such as RedLine, Lumma, Vidar and other malware families are designed to harvest information stored on infected systems.

Depending on the malware and configuration, that can include saved browser passwords, cookies, autofill information, cryptocurrency wallets, system information, VPN configurations and other authentication artifacts.

These are packaged to be sold under as an infostealer log, when a single infection can produce hundreds or thousands of individual records. Multiply that across a global malware ecosystem and defenders quickly encounter a scale problem.

While defenders need to process and validate everything, the attackers only need one valid valuable set of credentials. As Flare describes the problem, this isn’t finding a needle in a haystack. It is finding a specific needle among millions of needles in millions of haystacks.

While stealer logs historically circulated through underground forums and marketplaces, Flare’s research estimates that roughly 90% of logs now appear on Telegram, where public channels can advertise samples and private subscription channels can provide access to fresher datasets.

A password isn’t always the most dangerous thing in the log

With the vast amount of data in multiple channels, it’s hard to prioritize the risk level. If you work for a large corporate you are working with thousands of employees, if you start your day with two alerts, how can you establish what is riskier?

The first alert may involve employees’ old password for a consumer website appears in a six-month-old stealer log, whereas the second alert may have been collected yesterday and contains the employee’s corporate identity credentials and an authenticated browser session for the organization’s identity provider.

While both may be labeled as employee credential exposures, they are completely different.

This is why practitioners should prioritize monitoring around assets that tell them something about the potential impact, for instance corporate domains and subdomains, enterprise identity providers, session cookies, VPN and RDP endpoints, and cloud consoles.

Identity providers deserve particular attention, since a compromised SSO identity (Microsoft Entra ID, Okta, Google Cloud Identity, etc.) can open a path to multiple connected applications. Where possible, automated verification and mitigation further strengthen this protection.

The peril in session cookies

When a user successfully authenticates, an application can issue a session cookie, so they don’t have to authenticate with every request.

If malware steals that authenticated session, an attacker may potentially replay it.

So, if the attackers get ahold of a session cookie, and an infostealer collects them, they don’t necessarily need to log in. Stolen credentials alone still require authentication, creating an opportunity for defenders to detect or block the login, however, a valid session cookie may remove that step entirely. This effectively bypasses MFA.

The first 60 seconds

Flare recommends an initial assessment immediately after discovering potentially relevant stealer data, followed by risk scoring and validation.

The objective isn’t to conduct the entire incident investigation in the first few minutes. It is to determine how quickly the organization needs to react.

A useful first question is: What exactly was stolen? An analyst should determine when the infection occurred, what system produced the log, how many corporate credentials are present, and whether authenticated sessions were captured.

Then add business context.

A credential for testserver.company.com shouldn’t necessarily receive the same priority as one for finance.company.com.

Similarly, an exposed identity belonging to a marketing intern shouldn’t automatically be handled identically to an administrator with access to the identity provider, cloud console and production infrastructure.

The illustrative framework in Flare’s guide therefore places enterprise identity credentials combined with session cookies at critical severity, with a suggested response target of under one hour. VPN/RDP access combined with multiple corporate credentials is classified as high severity because of its lateral movement potential.

From exposure to investigation

Suppose our hypothetical employee’s log contains an Entra ID credential, corporate SaaS passwords and browser cookies, the next question is whether someone has already used them.

Defenders can correlate the exposed identity with authentication telemetry: successful and failed logins, unexpected geographies, unusual devices, unfamiliar IP addresses and access to resources outside the employee’s normal behavior.

They should also determine whether the stolen information is still usable. Has the password changed since the infection? Has the session expired? Is the account still active?

Flare’s recommended investigation workflow expands the analysis to include browser fingerprint information, the complete saved-credential inventory, information about the infected system, and additional artifacts such as VPN configurations or SSH keys.

Who is the employee? What can their identity access? Was the infected machine corporate or personal? Was this one infection or evidence of a broader campaign?

Authentication logs should then be examined across the systems accessible to that identity, prioritizing the most sensitive resources first.

Defenders should specifically look for behaviors indicating that exposure has progressed into account takeover: authentication from unexpected locations, access inconsistent with the user’s role, unusual downloads, password-reset activity, and enrollment of new MFA devices. This is how a stealer log becomes an early-warning sensor for identity compromise.

Treat stealer logs as an identity problem

Once a high-risk exposure is confirmed, speed matters. Defenders should invalidate compromised sessions, reset affected credentials, and increase monitoring around the identity.

Beyond individual incidents, organizations should track recurring exposures, affected applications, and whether stolen credentials lead to attempted access. 

Ultimately, infostealer monitoring has become an essential layer of identity security, enabling organizations to identify exposed credentials and sessions, understand the access they provide, determine whether they remain exploitable, and disrupt potential account takeover before it develops into a broader compromise.

Learn more by signing up for our free trial.

Sponsored and written by Flare.

from the ‘pathetic,-that’s-what-it-is’ dept

When we look back at this time and history words like “courage,” “integrity,” and “ethics” aren’t words you’re going to be associating with U.S. tech industry leadership. Everywhere you look you have tech sector executives either openly embracing fascism and the frontal assault on representative democracy, or too feckless and timid to take any sort of coherent stand on literally anything (and then wondering why the plebs are increasingly hostile to their software products).

Apple and Google’s quick decision to rename the Gulf Of Mexico at the behest of a mad and racist king was a lovely example; and now we’re back again with both companies quickly moving to rename Lake Ontario “Lake America” just because the increasingly unpopular U.S. President had a brain fart during his pointless and harmful trade war with Canada.

Google was the first to quickly make the change to appease Trump; in fact they acted so quickly on this the change to Google Maps happened before the government had even finished implementing it. Apple was very quick to follow suit, despite the fact that nobody at the company actually supports the ridiculous and pointless change:

These are, so we are clear, active choices — their mapping systems aren’t just innately and automatically following the lead of the authoritarian U.S. government’s GNIS data. Google (and the company’s defenders) had initially tried to insist they were following automated GNIS protocols, but that wasn’t actually the case:

“Google began rolling out this change for US users on Saturday. The company posted a brief update on its Google Maps blog, noting that it follows the US Geographic Names Information System (GNIS) for its maps, so the company implies it had no choice but to rename Lake Ontario in Google Maps, which is the most popular mapping platform in the US by a wide margin.

However, Google was even quicker to switch over to Lake America than the US government. While the GNIS database acknowledges the name change in a summary report, the base map layer still reflects the internationally recognized name of Lake Ontario. A message across the top of the USGS-operated website notes that the change to official maps is still pending.”

Even then, there’s nothing saying Google couldn’t have ignored the GNIS changes for the sake of product quality. As it is, both Apple and Google are still ensuring that U.S. users of both mapping products see King Trump’s pointless change, while everybody else in the world sees material reality.

This lightning-fast choice to quickly buckle to the incoherent whims of a tyrant over something this stupid certainly raises questions about what kinds of subservience we don’t know about yet by these titans of U.S. innovation. There was some hope that Apple, with new CEO leadership and no shortage of “fuck you money,” would demonstrate some sort of ethical leadership here, but alas.

Amusingly Mapquest (and I guess TomTom) used Apple and Google’s abject fecklessness to market “having the slightest hint of a backbone” as a market branding differentiator:

“The company said its mobile app received hundreds of thousands of downloads after it announced Thursday that the name Lake Ontario would remain on its apps, despite Trump directing the Interior Department to update the lake’s name in the Geographic Names Information System (GNIS).”

This is still somehow occurring despite the fact that Trump’s support is cratering due to pointless wars, high oil prices, sagging polling, and clearly waning health. Even on these peripheral issues where taking a stand could be easily defended by an ocean of highly paid lawyers, executives can’t even muster the vaguest outline of some sort of meaningful backbone.

I’m sure they’d argue that it’s their fiduciary responsibility to shareholders to not “antagonize” the U.S. government. But where’s the fiduciary responsibility to the continued existence to functional markets, industry autonomy, and democracy in a country under assault by some of the dimmest, most incompetent and corrupt autocrats the American experiment has ever seen?

Filed Under: apple maps, authoritarians, big tech, cowardice, donald trump, fascism, google maps, lake america, lake ontario

Companies: apple, google, mapquest

The spirit forms of The Warrior of Light, Terra, Zidane, and Cloud bob up and down behind each character in my party as I get into battle in an early dungeon in Final Fantasy Resonance.

When the trio of monsters is briefly staggered in front of me, I’m given a choice of which iconic character’s power to unleash to end the battle, and I promptly pick the spiky-haired and Buster Sword-wielding hero of Final Fantasy 7. My reward is a flashy CG cutscene of Cloud obliterating everything on screen in a visual display that seems strangely at odds with the rest of the game’s HD-2D style.

But this clash is perhaps to be expected when you learn that Final Fantasy Resonance adapts parts of an old 2015 mobile game, Final Fantasy Brave Exvius, to create a brand-new entry in the traditional turn-based style of Final Fantasy’s NES/SNES golden era.

For players like me whose formative gaming years were spent playing those classics and who long for more old-school turn-based RPGs, it’s the kind of pairing that should shoot Resonance right to the top of the must-play list. And even in just the brief hour I spent with the game, I could feel myself getting sucked into its combat and presentation style almost immediately.