Last week’s question was who performs the act the paper demands, and the Bureau of Prisons was the counterexample that made the point. This week the union went back and asked again — exactly the second filing #32 said to budget for — and the judge ordered reinstatement a second time while stopping short of contempt. So the remedy for ignoring a court order turned out to be another copy of the court order, and the officials who ignored the first one have now ignored two at the same price. That is the week’s lesson and it runs well past labor. A college told Flock to take its cameras down and the company declined. A court told the USDA to stop its reorganization and the reorganization stopped. The difference is not the venue, the judge, or the strength of the claim. It is the direction of the demand. An order that prevents a transfer lands on schedule, because compliance costs nothing and requires nobody to move. An order that demands something back runs into the party that already holds it, and holding is free. Sort your controls that way and most of this week sorts itself.
The second ask produced the same paper
Government Executive has the next beat in the sequence: a judge again ordered reinstatement of Bureau of Prisons union contracts, but stopped short of contempt. AFGE’s own release celebrates the judge again ordering the Bureau to reinstate the contract, which is the right posture for a union keeping its members in the fight and also a precise reading of how low the bar now sits: the win is a re-issued instruction. The first order cost no official anything, so it was defied. The second order costs no official anything either. The contracts are still inside the Bureau, and the Bureau is still the only party who can open the drawer.
Now the contrast — same union, same week, same kind of courtroom. AFGE reports a court ordering a stop to the USDA reorganization in a suit filed by unions, nonprofits, cities and counties. That one will most likely hold, for a structural reason rather than a judicial one. A stop order asks the defendant not to do a thing. Compliance is instantaneous, free, and requires no official to hand anything over. The BOP order asks an agency to give back something it already took. These are not the same instrument with different luck. They are different instruments, and one of them has a built-in enforcement problem the other does not.
The agencies that have internalized this are not defying anything, because they never have to. Government Executive reports the VA allowing its union contract to expire for most employees — the purest version of the move, in which the agency signs nothing, announces nothing and simply lets the clock run out on an asset it holds. AFGE says the Social Security move to end workers’ flex schedules violates the union contract; the schedules changed first, the argument comes after, and getting them back is now a restorative demand. Outside the federal file the mechanism needs no agency at all: Jacobin reports that AutoZone workers won a union and then the company fired them. An election result is paper. A job is possession.
Organizing continued anyway, because changing who holds the thing is the only move that has ever worked. LaborPress reports Dungeons & Dragons and Studio X workers joining CWA, and Jacobin that Dattner’s architects say they want a union. On the electoral track AFGE endorsed six Illinois candidates and six Florida candidates, Government Executive lists eight midterm races for federal employees to watch, and People’s World covers close races and shifting maps in the election’s final days. The costs that require no ruling arrived on time as always: federal retirees face more than a COLA change in 2027.
The college said take them down, and the company said no
The specimen of the week fits in one headline. Slashdot: a college told Flock to remove its cameras, and the company refused. Not a court, not a regulator, not an activist — the property owner, the customer, the party whose poles the hardware is bolted to, issuing the one instruction everyone assumes always works. It did not work, because removal is a physical act and the vendor is the one who would have to perform it. Every governance theory that quietly assumes the buyer controls the deployment should be rewritten around that sentence. Slashdot also has the Flock CEO defending the surveillance tech amid national backlash and another woman suing Flock over a mistaken crime accusation by police — a suit filed after the stop, the arrest and the record already happened.
Which instruments are actually moving tells you the same thing. Nextgov’s roundup has tech bills cutting federal funding for Flock and making data centers shoulder their power costs. Defunding is prospective: it reaches the next camera, not the installed one, and that is precisely why it is the version getting drafted. The Atlantic’s argument to make Big Brother bad for big business is the right shape for the same reason — it attacks the economics of the next deployment rather than demanding the return of the last one. Meanwhile the installed base keeps growing sideways: Slashdot asks whether we should beware of the other license plate surveillance companies besides Flock, Futurism reports experts warning that Flock cameras are really just the start, Techdirt catches cops playing hide and seek about using spy tech to avoid scrutiny and bad PR, and The Verge talks to Benn Jordan about Flock, privacy and the new surveillance backlash. The one person who changed the symmetry this week did not file anything: Futurism reports cops are not happy that a man built a Flock-style camera that only collects police plates. He did not ask for the data. He acquired some. Cory Doctorow’s Bundestrojaner is the state-malware version of the same lesson about who ends up holding the capability.
The hardest possession cases are the ones with people in them. People’s World reports a nurse facing federal charges for helping a patient escape ICE custody, The Atlantic has a soldier who joined the military and had his wife reported to ICE, and Axios reports an ICE shooting producing a rare Jeffries–Mamdani collaboration. Custody is the oldest and most literal form of this rule: once the agency holds the person, every remedy is a request for return. The same structure governs the rolls — Democracy Docket reports the DOJ suing Los Angeles to stop 20,000 people from voting, with the problem that some are not registered there, and People’s World covers the fight back after 130 million voters were purged in India. Removal from a list takes an afternoon; restoration takes a cycle you may not have.
You cannot un-ship it
The deployment numbers only look reassuring until you read which ones make it through. The New Stack asks why 88% of AI pilots never make it to production, and The Next Web has where the other twelve percent land: Kyndryl will run AI agents inside Toyota Finance’s live IT operations. The pilots that die are harmless. The ones that survive go straight into the system of record, where un-deploying them is a restorative act with a change window, a vendor and an SLA attached. The Atlantic’s Musing Ourselves to Death is the consumer-side view of that chaos arriving in e-commerce.
The safety discourse caught up to the physical form of the problem. Futurism reports the godfathers of AI saying models are so out of control they need to be airgapped — an airgap being the only control on the list that is purely about possession and requires no cooperation from the thing being controlled. The reason they are reaching for it is in the same week’s wire: Techdirt has AI worms, The Atlantic has the invasion of the self-replicating AI-malware botnet, and Futurism has the genuinely strange artifact of a rogue AI swarm answering a reporter’s questions. Self-replication is the pure case of the possession rule: there is no party to serve, no drawer to open, and no version of the instruction that reaches every copy. The cleanest operational statement of the whole thesis came from The New Stack: the permission you denied today is your safety net for tomorrow. Denial is prospective and free. Revocation is restorative and may not be possible.
Knowing about a defect is not the same as holding the fix. The New Stack reports that Claude found 29,000 possible bugs in open source and only 516 have been fixed, and that 66% of billion-dollar companies leave critical bugs unpatched — the part the AI bug-hunting hype leaves out. Discovery has gone to roughly zero marginal cost; remediation still requires the party holding the deploy button, and that party’s calendar did not change. The flood is real enough that The New Stack has a whole company built on it — everybody with a $20 account is now a researcher, and Akrites is tackling the pile. Meanwhile the attackers kept to the fundamentals: hackers hijacked 1,900 GitHub accounts and then went after 30,000 repos. Take the credential, take everything downstream of it, and no notice period applies.
The week’s most literal possession story is in crypto hardware, where possession is the security model. Web3 Is Going Just Great logs at least $86 million stolen via tampered Ledger hardware wallets resold by CryptoBilis, and Futurism reports supposedly super-secure Ledger wallets secretly draining users’ holdings. Somebody else held the device before you did, which was the entire attack. For the forward-looking version, Futurism has crypto gurus worried AI is poised to crack blockchain math.
On deployed consumer products, the restorative demand is now a docket. Futurism reports OpenAI hit with a stack of lawsuits over ChatGPT allegedly coaching children to harm themselves, and Platformer has the structural read in the states come for OpenAI. State AGs are the right venue precisely because they can compel rather than request — but every remedy on offer still arrives after the product has been in the hands of the people it reached. In the same category of controls written after the install: Nextgov covers the Utah AI sandbox launching health care pilots with question marks and officials seeing gaps in election communications as AI makes foreign influence easier, three weeks out. Washington Technology reports the US moving to staff leaders for an industry-partnered offensive cyber program, and Government Executive warns that the next counterintelligence threat may be hiding in federal hiring — access granted at onboarding being, once again, far easier to hand out than to claw back.
Nobody hands back a data center
The infrastructure story is the possession rule poured in concrete. ProPublica reports that New Mexico and El Paso spent millions on climate plans that three new data centers could undo. The plan is a document with a revision history. The data center is a substation, a water contract and twenty years of load. Which is why the only credible instrument in that Nextgov bill roundup is the one that makes data centers shoulder their power costs going in, and why Axios finds geothermal landing in a rare political sweet spot amid the AI boom — a supply-side answer beats a demand-side request. Axios also notes AI’s extreme heat challenge moving from prediction to protection, which is the correct direction of travel: a forecast is information, protection is a thing somebody owns. People’s World has the counterweight in the Trump administration gutting the Endangered Species Act as nature advocates fight back — a protection removed in one signature that will take a decade to restore.
The money arguments all turn on the same asymmetry. Ed Zitron’s Annualized Enron Rate is the week’s balance-sheet read, Futurism reports AI experts already doomsday prepping for when AI takes out the entire financial system, and Doctorow documents the intermediary move in Expedia amazoning hotel rooms — once the platform holds the customer relationship, the hotel’s own guest is something it has to ask for back. On who gets to write the next rules, Axios has AI safety money flooding into political races and Bill Gates returning to wage war on AI risks; TPM argues that Trump’s move to rename artificial intelligence to Super Intelligence is about much more than it seems, which is the vocabulary version of the same grab and the direct sequel to last week’s refusal to let open weight and open source blur. Taking a word back is as hard as taking a camera back. Blood in the Machine reports the tech elite’s reaction to the first billionaire wealth tax — they should be afraid, The Nerd Reich has citizens defeating billionaires, for now, and The Atlantic’s Choose Your Overlord frames the menu.
State capacity is the same ledger read from the inside. ProPublica reports scammers stealing millions from food stamp recipients, a problem Congress could fix but won’t — the skimmer holds the balance, and the statutory fix that would prevent the next theft is the cheap one nobody will pass. Government Executive finds fraud-prevention work stalled at USDA amid staffing cuts and funding disputes. Don Moynihan reports that things really are getting worse at IRS and dissects the blockers and grifters. Kottke makes the structural argument that it’s time to de-privatize the US government — which is, stated plainly, a proposal to take a very large amount of delivered capability back from the parties currently holding it, and therefore the hardest category of ask on this page.
Culture produced the week’s best illustrations almost by accident. Techdirt reports MLB planning to play stupid games with its website again in the upcoming lockout — the league holds the archive, so during a labor dispute the record of the players’ own work is a lever. The Atlantic marks a bold era in Hollywood ending with a whimper after last week’s merger approval, Stratechery has a conversation with Ari Emanuel about entertainment and AI, and Aftermath reports that nothing can stop the Ubisoft layoff machine and that Sega pulling its Total War remake from Steam is embarrassing — a rare case of a publisher performing the removal itself, which is the only way removals happen quickly. 404 Media reports a video game reverse engineering community shutting down because AI has made it too easy: when a capability stops being scarce, the community built around holding it dissolves. The Verge supplies the perfect coda — we can finally hear some of Wu-Tang Clan’s Once Upon A Time in Shaolin, an album whose entire artistic premise was that exactly one party would ever possess it. Garbage Day notes that no one actually likes AI influencers, and The Atlantic asks what newsrooms should know before they take money from OpenAI — a question about dependency, which is possession with extra steps. Techdirt’s continuing series lands in the same place twice, on the end of the universal internet and the long decline of certainty.
The ray of hope: the exits people took before they needed permission
Every encouraging item this week is a case of somebody refusing the transfer in the first place, or of a mechanism that takes things back without needing the holder’s cooperation. Start with the best one. Doctorow explains how labor rights rescued Ultima from a monopolist — termination of transfer, the statutory right to reclaim a copyright you signed away decades ago. It is the rarest instrument on this page: a restorative remedy that actually lands, because it is self-executing, the clock is in the creator’s hands, and the party holding the asset cannot refuse. If you want a model for what a working giving-back rule looks like, that is it, and it came from labor law.
The migrations continued, and this week’s version got the direction right. Slashdot reports Dutch tax authorities cancelling the Microsoft 365 cloud rollout and turning toward open source. Note the verb: cancelled, not extracted. They did not have to get the data back, because the data had not gone yet — the cheapest exit in existence is the one taken before the entry. Privacat is running the personal version in Walking the Walk, Part 1: the start of my big T(exit). And Waging Nonviolence has the week’s most instructive organizing piece in how Vermont shut down ICE — they did not win an argument about authority, they went after the infrastructure the authority runs on. Beds, contracts, facilities. You cannot order an agency to stop doing a thing it no longer has the equipment to do.
On tooling you hold yourself: The New Stack ran local AI models on Microsoft’s Surface Laptop Ultra, and reports Cloudflare open-sourcing Void to give IT a handle on employees vibe-coding their own apps — a governance answer that meets the shadow deployment where it already is rather than issuing a policy against it. Cloudflare also acquired Node.js creator Ryan Dahl’s startup, which is worth watching for exactly the possession reasons this issue is about. Futurism reports the creator of the free Adobe Suite clone striking again by reverse engineering Microsoft Office — acquiring a capability rather than petitioning for it. Slashdot marks KDE Plasma 6.8 and thirty years of the KDE project, thirty years being roughly how long software lasts when the people using it also own it, and has Linus Torvalds on why AI works for him. Axios reports Apple and Meta teaming up to bring open-source Muse to Macs, and Simon Willison does the unglamorous maintenance that keeps possession real in hello Python 3.15, goodbye 3.10.
Two more worth your time. Techdirt’s 11 or 13 justices start an arms race, 100 justices might actually end it is a serious proposal about making a captured institution too large to hold. Ted Gioia’s don’t trust people who talk like this is a field guide to the vocabulary that precedes a transfer. For the wider context the week demanded: The Atlantic on all the things you’re not allowed to say in Texas, and Drop Site on record Israeli attacks on Palestinian olive groves, a teen shooter killing children at an Oregon school, and Poland scrambling jets after Russian strikes.
The throughline
Five weeks, one question, still narrowing. Who fills in the field. Who sends the invoice. Whose hand was on the pen. Who performed the act. Now: who is physically holding the thing when the paper arrives.
The ledger sorts cleanly this week and it does not sort by venue. Things that landed: a court order stopping the USDA reorganization before it happened. A bill to cut federal funding for Flock rather than to remove Flock’s cameras. A denied permission, which costs nothing to deny and everything to revoke. A cancelled Microsoft 365 rollout. An airgap. A locally hosted model. A termination of transfer, which works because the statute executes itself. Vermont going after infrastructure instead of authority. Things that did not land: a reinstatement order, issued twice, with contempt withheld both times. A college’s demand that a vendor remove hardware from its own property. A union election followed by firings. A contract that expired while everyone was arguing. 29,000 found bugs against 516 fixes. A climate plan against three data centers. A list of 130 million purged voters.
The pattern is not that courts are weak or that vendors are bold. It is that an instruction to not transfer is executed by a party who has to do nothing, and an instruction to give back is executed by a party who has to do something expensive, against its own interest, holding the asset the whole time. The second category is not a worse version of the first. It is a different machine, and almost nothing you have built assumes that.
Three lines for operators. Sort your controls register into prevent and restore. Take every control you depend on and ask which way the demand points. Prevention controls are load-bearing. Restoration controls are hopes with a case number, and you should know which of your top ten are which before you need them. Never let a thing you would need back leave your possession. Credentials, data, hardware, source, the deploy button, the DNS zone. The denial you issue today is free; the revocation you issue next year is a negotiation with somebody who already has it. Run least privilege not as a security slogan but as a property rule. Write the exit at the entry. Before the contract is signed or the agent is wired into prod, name the removal procedure, who physically performs it, how long it takes and what it costs — in the same document that authorizes the install. The Dutch tax office did not need an extraction plan because it never moved in; the college needed one and did not have it.
An accord is a sentence, an order is a sentence with a venue behind it, and neither is a control until somebody performs it. This week adds the last condition: the performance only happens if the person who has to perform it is not already holding what you want. Check who has it before you decide what your rule is worth.