Twenty-six minutes into episode 108, Tom Moyer was describing the years Apple spent building its headquarters in the middle of a quiet Cupertino neighborhood. Some of the people who lived next to the site were suspicious, and some were angry. He told us what his security team decided about them.
“they were never treated like threats. They were always treated like neighbors.”
Tom Moyer, at 26:36
Tom spent 20 years at Apple. He started as the lawyer who ran its employment law practice and became its first chief compliance officer. Then he ran security for about 13 years, until he retired in January 2026. He now runs 7 Elm Strategies, a security advisory firm, and publishes a free weekly brief on opposition to the technology industry. Episode 108 of The Security Podcast of Silicon Valley aired on November 10, 2026 (Podbean, Apple Podcasts, Spotify, YouTube). Sasha and I hosted it together. The episode’s title calls him Thomas. He goes by Tom, and Tim Cook calls him Tom in the story he tells, so this page does too.
This page follows the conversation in order and checks it against the record: Apple’s own documents, the press that covered Apple Park’s neighbors, the surveys and counts on opposition to data centers, and the methodology Tom publishes for his brief. It has 17 figures, 13 clips from the tape, 2 more videos, the full transcript, and 6 tools: a quiz, a scorecard, a calculator for how long it takes to account for everyone in a crisis, a second calculator for the data lookups you can’t explain, a timeline and a to-do list.
One note on dates. We recorded on October 20, 2026, and the episode aired 3 weeks later. Where Tom gives a number for his tracker, it’s the number on that day. A lot happened in those 3 weeks, and the last section covers it.
A second note. Tom tells these stories from memory, and in a few places the record has a different date or name. I’ve marked each one. His argument doesn’t depend on any of them.
20 years at Apple
I asked Tom to introduce himself, and he did it in about a minute.
“I was at Apple for 20 years.”
Tom Moyer, at 1:46
He “started under Steve”, as a lawyer who “headed up their employment law practice”. Then he moved into “the role of their first chief compliance officer”, a job he called wonderfully fulfilling. Security came third, and he didn’t go looking for it. In his words he “begrudgingly, I should say, accepted the position of their chief security officer”.
His LinkedIn gives the dates. He joined Apple in January 2006 as director of global labor and employment law and became chief compliance officer in September 2009. Security was added to the title in February 2013, and he held the chief security officer title from November 2018 until January 2026 (LinkedIn). By those dates the security years come to just under 13. He said “13 plus years” on the tape, so I’ll call it about 13.
Before Apple he served as an intelligence specialist in the U.S. Navy and then went to law school, graduating from UC Hastings, now UC Law San Francisco, in 1999. He practiced at Fenwick & West and worked in legal affairs at Siebel Systems before Apple hired him (UC Law San Francisco).
His firm’s site adds the scale. It says the security organization he led at Apple grew from 35 employees to more than 650 and worked across more than 150 countries (7 Elm Strategies). He told us the job he hadn’t wanted ended up being “the most fulfilling thing that I’ve done outside of working for the military”.
Because I told you so
Sasha asked the question a founder asks the first time someone says the word compliance: why does a company build a compliance department at all?
Tom gave the legal reason in a sentence of shorthand and then gave the real one. Apple, he said, saw “value in teaching people how to do the right thing and why it matters”, and in “giving them the mechanisms to complain if they see something wrong”. The program he built “reported to the board on a quarterly basis”.
The legal reason is older than his shorthand made it sound. Since November 1, 1991, the federal sentencing guidelines for organizations have given a company credit if it had an effective compliance and ethics program in place when something went wrong. The section that defines effective asks for a way employees can report a problem “without fear of retaliation” (U.S. Sentencing Commission). The Sarbanes-Oxley Act of 2002, which Tom named, added requirements of its own for public companies.
Then he told us how he actually sold it.
“look, don’t do compliance because I told you so”
Tom Moyer, at 4:09
His pitch was that Apple works “under a microscope”, and that a company seen doing business the right way becomes “a case study” for everyone else. He had a line he says he always used.
“you didn’t come to Apple to sell phones, right? You came to Apple because you wanted to make a difference in the world.”
Tom Moyer, at 4:37
How many people was he pitching? The headcount he gave on the tape fits Apple near the end of his time there better than it fits his compliance years. Apple reported 72,800 employees at the end of its 2012 fiscal year, around when he moved into security (MacRumors). Tens of thousands of people is the safe way to say it.
A 40-person company writing its first SOC 2 policies has a smaller version of the same problem. Policies written for an auditor get skipped by the team, and the evidence shows it. What worked at Apple’s size works at yours: give people a reason they’d choose for themselves. For most startups that reason is the customer on the other side of the deal, who is trusting you with their data. We write policies with your engineers, around how the team already ships. If you’re starting from zero, What Even Is a SOC 2? is the plain-English version, and Sasha and I recorded a founder’s guide to compliance in episode 37.
Tom loved that job enough that he didn’t want to leave it: “I was reluctant to move over into the security role”.
Is that the right thing to do?
I asked how security was handled differently with Steve Jobs leading the charge. Tom corrected the premise, kindly.
“My tenure in the compliance function was really under Tim.”
Tom Moyer, at 5:32
Then he told a story from his first weeks. He thinks he was “2 weeks into Apple”, and he’d been asked to brief Tim Cook on the legal risk in an old agreement with a former employee. He warned us that he was going to blur the facts, and I’ll leave them blurred. The outline is that the company had struck a deal with the man years before, and enough time had passed that his legal claims had expired.
So Tom gave the lawyer’s answer: “Look, Tim, you don’t have to do anything because all of your statutes of limitation have run.” Tim went quiet for a while.
“But Tom, is that the right thing to do? What’s the right thing to do?”
Tom Moyer, recalling Tim Cook, at 6:55
Tom thought about it and said they’d shaken hands on a deal, so the right thing was to honor it. Tim’s reply was one word: “Exactly.”
“you do the right thing even when it’s hard and even when you don’t have to”
Tom Moyer, at 7:20
The dates make the story better. Tom’s LinkedIn has him joining Apple in January 2006. Tim Cook had been named chief operating officer 3 months earlier, on October 14, 2005 (Apple). The person asking a lawyer in his second week what the right thing was ran Apple’s operations, and he was more than 5 years from running the company. Tom said the meeting set how he saw him for the next 20 years: “I have enormous respect for him not just as a leader but as a human being”.
Founders get this question more often than lawyers do, usually about a promise that never made it into a contract. The legal answer comes quickly, and people remember the other one for a long time. Tom has remembered it for 20 years. There’s a security version too. Every enterprise deal you sign carries promises about how you’ll protect the buyer’s data, and nobody checks most of them until something goes wrong. Sasha wrote about checking them yourself in The Security Exhibit Your Startup Signed Last Quarter.
Tom did answer my question about Steve. Steve cared about security in one area above all, “especially when it came to leaks”, and about new products being revealed before Apple could “cast it in their narrative”. That concern, Tom said, “continues in Apple today”. His firm’s site puts a number on the result, saying annual prototype losses went from 35,000 to 0 (7 Elm Strategies). Protecting what you haven’t shipped yet is a job startups have too, and it’s the work behind our counter business espionage service.
Are our employees safe
I said something about the human being behind all the technology, and Tom picked it up. He told us how Apple’s crisis management program began, and he named the 2 attacks Paris suffered in 2015: the shooting at the offices of Charlie Hebdo on January 7, and the attacks of November 13 that included the Bataclan (Wikipedia). After the second, Tim Cook asked a simple question.
“Tim wanted to know are all of our employees safe and we had no ability to contact them to verify that if they were safe.”
Tom Moyer, at 8:56
Apple, in Tom’s telling, had no crisis management program at that point: “No way to prepare for crisis events, no way to respond to them, no way to recover from crisis events.” None of Apple’s employees were directly involved in the attacks, he said. The question stayed, and his team built the group that could answer it.
“we had the ability to contact any employee at Apple”
Tom Moyer, at 9:32
They could do it by text message or phone call, “and verify if they were safe or feed them information”. He described what a report to Tim sounded like by the end. Of about 450 employees and their families leaving Ukraine, 449 were confirmed safe. The team had “a good lead on the final one” and expected an answer “within about an hour”.
He wrote about the same instinct on LinkedIn the day after we recorded.
Tom Moyer on what his job at Apple was when protests turned violent in Hong Kong and Paris: getting people home safely.
Tom Moyer · October 21, 2026
Here’s the founder’s version of Tim’s question. If something happened this afternoon in a city where 3 of your people live, how long would it take you to know they’re all right? For most startups the honest answer is a group chat and some phone calls. A SOC 2 auditor asks a narrower version, which is whether your incident response plan has been tested. Running it once is how you find the phone numbers that are wrong. The calculator below puts a time on it.
Sasha took the thought one level down.
“in order to build a successful company, it all starts at the root, which is how do you take care of each other?”
Sasha Sinkevich, at 10:55
Tom agreed, and reached for Maslow.
“unless employees really feel safe, they can never create anything”
Tom Moyer, at 11:19
He said Maslow lists safety among the higher needs. Maslow’s 1943 paper puts it near the bottom of the pyramid, just above food and water, among the needs that have to be met before the rest (Wikipedia). The correction helps his argument. He described the security team’s mission as giving people enough of a sense of safety that they could “go off and design something that’s going to just shock the world”. He doesn’t think the idea is unique to Apple: “We just doubled down on it.”
Safety at work reaches past the office now. Leigh Honeywell talked with me about protecting employees from harassment online in episode 5, and it belongs in the same conversation.
West, before the tanks
The clearest example Tom gave was Ukraine. He told it carefully, and I’ll keep to what he said.
“we had been tracking the Russian advancement into the Ukraine for months in advance”
Tom Moyer, at 12:26
The team moved employees west in stages, with their families and their pets. On the pets he was firm: “employees go nowhere without their pets”. They went “first to Kyiv” and then, when Kyiv looked like it would be in danger, to the Polish border. “And we did this before the Russian tanks started to roll in.”
One employee was giving birth. She couldn’t cross into Poland without paperwork that her doctor had to sign, so the team sent cars in to get it and then took her family to the border. The detail Tom liked best came after that.
“I don’t even think she knew who we were. We just did it all in the background.”
Tom Moyer, at 13:31
He mentioned Puerto Rico in the same breath, where families were told after a major hurricane that a jet was ready for them. Then he took on the cynical reading before either of us could offer it.
“some people might say that it was because you had lots of money you could do that. No, that wasn’t why.”
Tom Moyer, at 13:55
I looked for Apple’s account of this in the public record and didn’t find one, which fits how Tom describes the work. Russia’s full-scale invasion began on February 24, 2022 (Wikipedia). What he’s describing is a team that had been moving people before that date.
The money matters less than it looks. The hard part was months of watching and a decision to move early. What a startup can copy is the inexpensive part: knowing where its people are, and deciding in advance who makes the call to move them.
Privacy comes first
Sasha asked how privacy and security connect, and what artificial intelligence does to both. Tom called it a big question and answered the first half without hedging.
“I do think that they’re intimately connected”
Tom Moyer, at 14:30
His example was Flock, which makes license plate cameras that police departments and neighborhoods install. He gave both sides in one sentence. The cameras “can do some real good in the world but people view it as an invasion of their privacy”. When a company treats those as 2 separate questions, he said, it ends up where Flock is now, with people going after the cameras themselves.
At Apple, he said, “they always put privacy first”. He added the caveat a careful person adds: “no company has ever been perfect in this space”.
“people can’t feel secure, Sasha, to your point, unless they also feel as if their privacy is protected in some way”
Tom Moyer, at 15:22
On the second half of the question he said he wasn’t sure he had the best answer. What he had was the research he’s been doing since he left Apple.
4 groups, 1 target
Tom has been studying opposition to technology, and he sees 4 currents in it. The first is economic. It’s people who think “I’m going to lose my job”, or who see wealth and power gathering in what they’d call a tech elite. The second is environmental, about technology and “its impact on the environment”. The third is about autonomy, which covers privacy and “what it means to be a human”. The fourth is about association, and it’s people objecting to who technology companies work with.
People have opposed technology before, he said, as far back as the Luddites. What he thinks is new is the alignment.
“you have four separate ideologies which otherwise would have nothing to do with one another and they are pointing to in their view one common villain and that is the technology industry”
Tom Moyer, at 17:38
He made it concrete with a picture I keep coming back to. At one protest over a data center, a sign that says “no more surveillance” stands next to a sign that says “protect our water”.
His brief’s methodology sorts grievances into nearly the same 4 categories: economic, environmental, autonomy and political. It calls an incident where more than one shows up a convergence (7 Elm Strategies).
The record had been pointing the same way for months before we sat down. In September 2026, Bloomberg reported research from Data Center Watch that put the value of data center projects blocked or delayed between April and June at $68 billion. The same research counted 843 opposition groups, in every state except Hawaii, and 142 protests on one weekend in July (Tom’s Hardware).
Most founders reading this don’t build data centers. The reason to keep reading is what Tom says next about speed, and later about which part of a technology people can see.
Zero to 150 miles per hour
Tom’s case for why this moment is different comes down to time. With earlier technologies, he said, there was a period in which people could get used to the new world: “you have the ability to complain about it. You have the ability to consult with politicians about it”, and maybe some say in how it develops.
“We have just gone from zero to 150 miles per hour in the blink of an eye and people just haven’t caught up with it yet.”
Tom Moyer, at 19:59
His history is right in outline and off by a couple of years. The Luddites were skilled textile workers, “the software engineers of their time” in his phrase, and their movement ran from 1811 to 1816, starting in Nottinghamshire (Wikipedia). On the tape he said 1813 to 1815.
The polling supports the mood he describes. In June 2025, Pew Research Center found that 50% of American adults were more concerned than excited about the growing use of artificial intelligence in daily life, up from 37% in 2021. Only 10% were more excited than concerned (Pew Research Center).
He named one more cause, and it’s one the industry owns. We describe our own products in frightening terms: “you’ve got people in the industry talking about how scary these things are”. He ended the answer with a sentence I’ve thought about since.
“I know I’m concerned for our industry and what is around the next corner for us.”
Tom Moyer, at 21:25
If you sell an artificial intelligence product, this is the mood of your buyer’s employees before they’ve seen it. Half of them are more worried than excited. How you describe what your product does, and where its limits are, is part of the product. We wrote about bringing a team along in The Art and Zen of Adopting AI.
The bubble
Sasha asked the follow-up.
“it’s the fear that drives human to a bad places. The question is, how do we remove that fear from the equation?”
Sasha Sinkevich, at 21:46
Tom started with himself: “I’ve spent my whole life in tech. And so I am as guilty of this as the next person”. What he’s guilty of, he said, is optimism: “we are so incredibly hyper optimistic about our technology and about how it will change the world”. He called Silicon Valley a “tremendous bubble”, started to call its mission a myth, and stopped himself.
“It’s not a myth. It’s like there’s a lot of reality to it.”
Tom Moyer, at 22:39
I liked that he corrected himself mid-sentence. The belief is real, and he was naming what it costs.
“we don’t give as much credence for people who don’t view technology in the same way”
Tom Moyer, at 22:46
His prescription is listening, and he means it as security work. People who are heard have an outlet, and he worries about what the industry confirms for the ones who aren’t.
“we run a risk of radicalizing people by not listening”
Tom Moyer, at 24:39
He was specific about what counts as listening: “engage them in a meaningful way. Don’t just do it for you know on paper.” And he wondered aloud about a road the industry didn’t take: “if we had done that with, you know, data centers, I wonder if the results would have been different”.
On paper is a phrase security people know well. A control that exists in the policy and nowhere else fails the same way a listening session does when nobody acts on what was said. We wrote about the questionnaire version of that in Enabled Isn’t Enforced.
A neighbor or a threat
Then came the story the episode is named for. Tom now advises companies that build critical infrastructure, and he tells them about Apple Park. He described a site that took years to build, “two times the size of Disneyland”, going up “right in the middle of a quiet Cupertino neighborhood”.
The record agrees on the shape. Apple Park’s campus covers about 175 acres, and employees began moving in during April 2017 (Wikipedia). Disneyland’s park covers a little over 100 acres (Wikipedia), so two times is generous, though only a little.
The neighbors had real complaints. In August 2017 the Mercury News reported that residents of Birdland, the Sunnyvale neighborhood next to the site, were living with construction noise past midnight and with dust on their homes and cars. Apple’s vice president of real estate, Dan Whisenhunt, said, “I would say we were extremely aware of the local complaints” (SFist).
Tom’s memory matches the reporting. He described “people that would stand on their driveways with their arms crossed as dust was falling”. Here is what his team did about them.
“we developed a mechanism for how do you evaluate people who are truly threats and to be able to tell the difference between a neighbor and a threat”
Tom Moyer, at 26:16
The line this page opens with comes next on the tape. However angry a neighbor was, the answer from security was the same: “They were always treated like neighbors.”
He didn’t describe the mechanism, and I didn’t press him. What he described was its effect: “there is a way to engage with people and treat them with respect that keeps them closer to the neighbor camp than to the real threat camp”.
Then he said what he sees at some infrastructure sites today. Someone who lives across the road complains about the noise. Tom visits the site and looks at where the cameras are.
“they’re not placed at the entrances of the facility, but they’re pointing directly at this person’s home”
Tom Moyer, at 27:11
I answered with something I believe about people in general, that “people want to do the right thing, all people”. When someone is angry at what you’re building, the useful question is “what is it about the world that has to be true in order for that to be the right thing to do”. Tom took it somewhere I didn’t expect.
“you want them to complain because when they’re complaining they’re not, you know, driving a pickup truck into your facility trying to hurt people”
Tom Moyer, at 29:13
Software has neighbors too. The researcher who emails you about a bug is one, and so is the customer who posts an angry thread. Answer them and you stay in a conversation, where a lawyer’s letter to a researcher teaches the next one to publish without calling first. A published way to report a security problem takes an afternoon to set up: a security.txt file on your site and an inbox that someone reads. The scorecard below starts with that question.
Signal from noise
Telling a neighbor from a threat, Tom said, “takes sophistication”. He reached for an analogy from my side of the house. On a network, “maybe when you first start, you’re concerned about absolutely everything”. Later it changes.
“you can really start to tell the difference between all of that noise and true signal”
Tom Moyer, at 30:00
He thinks many infrastructure companies are early on that curve for physical security. They’ve spent years on the perimeter: “traditionally they’ve been putting fences around data centers and that was their protection”. The work he’s describing is telling “true threats” from “people that are just engaging in a democratic process”.
Every security team walks this curve. A new monitoring tool pages someone for everything in its first month, and the job is teaching it what matters. Wesley Belleman described security operations as a series of classification problems back in episode 4, and it’s the daily work of our monitoring and response team.
What he built after Apple
I asked about the thing he’d hinted at building. He described the firm first. After Apple he started a consulting business that advises large technology and critical infrastructure companies on building what he calls “a security operating system”. I named it for the listeners: “And that’s with 7 Elm Strategies.” The firm also helps startups work out “how to actually sell into a company like Apple”.
While doing that work he kept noticing reports of opposition to the industry, and he went looking for a catalog of them. He found that “there was just nothing that was out there”. He compared notes with Mauro Lubrano, the author of Stop the Machines: The Rise of Anti-Technology Extremism, and they agreed nobody was keeping track.
One correction. Tom placed Lubrano at Leiden University. He’s a lecturer in international relations at the University of Bath (Lowy Institute), and Polity published the book in 2025 (publisher’s page). If you’d like the argument from its author, this is his own talk about the book.
So Tom built the tracker himself: “so I coded, vibe coded is probably a better word for it, a system which tracks all of this”. I made a joke about writing code by hand being old fashioned, and he had the comeback ready.
“What do you expect from a lawyer?”
Tom Moyer, at 33:02
He’s proud of it, and he said so: “I’m pretty proud that a lawyer could accomplish this”. By his count it has about 30,000 lines of code and runs about 500 automated tests a day. A lawyer shipping that is a fair picture of where software is going, and it’s the reason we wrote Vibe Coding Security.
99 incidents in 3 weeks
When we recorded on October 20, the system had been running for about 3 weeks. Tom gave the counts from memory, corrected himself once, and landed on about 30,000 articles screened and “99 separate incidents of opposition towards the technology industry”. Most of them were peaceful. He counted 7 disruptive protests and “19 acts of sabotage”.
He was careful about what the tracker is for.
“part of what I hope to do is to tell people that most of this is all peaceful and we need to respect that”
Tom Moyer, at 35:39
He was just as careful about who checks it: “every single incident that’s put into the database gets reviewed by me”.
The brief is public now. It’s free, and it comes out every Wednesday at 7elmstrategies.com/intelligence. Its methodology page was at version 1.14 when I read it. It says daily automated collection began on September 28, 2026, which matches his 3 weeks, and that a classifier drafts each record before 7 Elm approves every item. Conduct is sorted into 5 categories, from peaceful opposition to violence, and the page puts the principle in 9 words: incidents are “classified by what people did, never by their views” (7 Elm Strategies). The brief never names a private individual.
The fourth issue covered the week we recorded. It logged 32 incidents, 23 of them peaceful opposition. Tom wrote about that issue himself.
Tom Moyer on what that week's Technology Opposition Brief found.
Tom Moyer · October 29, 2026
Whatever you make of the numbers, a founder can borrow the method. He separated what people did from what they believe, and he put a person’s review between the machine and the record. If you run a model over anything that touches people, both rules are worth copying.
Write the rules yourself
I asked Tom what he’d say if he had a direct line to Flock’s founder. His first answer was about people: “You have to recognize that these are real people and just you telling them that they are wrong is not going to make them change behavior”. His second is the advice I think applies to almost every company listening.
“do not wait for the states or for Congress to come up with a set of meaningful rules”
Tom Moyer, at 39:07
If you wait, he said, cities and states will move away from your technology, and you become “the poster child for what not to do”. His alternative: “create those rules yourself. Institute them yourselves.”
He got specific. In his view, not everyone in a police department should be able to search the cameras. He’d give access to one person.
“one person with access that the records of that access should be immutable and so that they cannot be changed and that you can see why that individual is looking into it”
Tom Moyer, at 40:02
He’d also talk with the people most affected about what the rules should say, and he’d move quickly, knowing “You’re not going to get all of the rules right”. He thinks the alternative is worse.
“It was done to you rather than with you.”
Tom Moyer, at 41:15
Then he did something I respect. He put a limit on his own claim.
“I’m sure of half of what I’m saying they would reject. But I do suspect there’s some kernels of truth inside of my message.”
Tom Moyer, at 41:22
The rules are coming either way. The day after the November election, a lawyer at Venable wrote that state legislatures will likely propose many changes on data centers in 2027 (Venable). And when Pew asked whether the country will regulate artificial intelligence well, 47% of American adults said they had little or no trust that it will (Pew Research Center).
For a startup selling an artificial intelligence product, the first rule-writer to arrive is usually a customer. Your first enterprise buyer sends a security questionnaire that asks what data reaches the model and who can see the prompts. A team that has already written its own answers walks into that review with a policy. We listed the questions in The 10 AI Security Questions Your First Enterprise Buyer Will Ask in 2027, and the evidence buyers accept in From AI Policy to Proof.
Least privilege
Sasha put a name on Tom’s advice. It’s one of the oldest principles in access control.
“not everyone in the police department, as you mentioned, Thomas, needs to have access to all of the data in the Flock system. But if you’re a detective and you’re doing investigative work, then probably it makes a lot of sense.”
Sasha Sinkevich, at 42:00
He added that rules a company writes for itself can stay simple, where legislation “tends to be very complex”. He also remembered Apple’s billboards. The campaign he was reaching for began in 2019 and read “Privacy. That’s iPhone.” (AppleInsider).
At a Series A company, least privilege shows up as the access review in your SOC 2. Someone pulls the list of who can reach production and customer data, and every name without a reason comes off. The first pull takes the longest, because nobody has looked at that list since the seed round. Tom’s 2 additions are worth copying: a record of each lookup that can’t be edited, and the reason for it. Dirk Meister described a version of that at Augment Code in episode 77, and Yair Grindlinger made the case for shrinking what any one account can reach in episode 105. The second calculator counts the lookups you couldn’t explain today.
Tom wanted to be fair to the company we’d been using as the example.
“I don’t want to be too critical of Flock. This is not just a Flock issue.”
Tom Moyer, at 42:38
He thinks the cameras became the target because people can see them. Artificial intelligence is abstract, and a camera on a pole is there every morning.
“I can’t touch or feel that, but I can see a Flock camera, right? I can see a data center because it’s being built right here.”
Tom Moyer, at 43:23
If those cameras came down tomorrow, he said, other companies would fill the same space, and he declined to name them. He tied it back to a habit of ours, “move fast, break things”, and said of the result, “in its worst case, this is what can happen”. His summary was 5 words: “This is an industry problem.”
A founder can use this whatever the product is. The anger about a technology lands on the piece of it people can see. If your product is the visible piece, the rules you write for it are the ones the rest of the industry gets judged by.
The data vacuum in your pocket
Near the end I admitted something about my own phone.
“Every time I open an app, it’s recording accelerometer, gyroscope, location.”
Jon McLachlan, at 44:52
I called it “a data vacuum”, and I meant it. I also said Apple has put some basic controls in. Tom answered with how Apple handled the other side of that, requests from the government, in his time there.
“in order for Apple at least when I was there to provide access to that information to the government you’re going to need a warrant”
Tom Moyer, at 45:18
A warrant means convincing “some neutral third party judge”. Even then, he said, some of what’s on the device stays out of reach.
Apple’s published guidelines for law enforcement say the same today. The current version, dated October 2025, says “Apple will only provide content in response to a search warrant.” For an iPhone locked with a passcode it says “Apple is unable to perform an iOS device data extraction” (Apple).
He told us what he tells clients now, which is to treat people as neighbors and to build privacy into the product from the start: “It makes them have to try a little bit harder. But these aren’t impossible things to do.”
“They will be the companies that end up winning, at least in the court of public opinion.”
Tom Moyer, at 47:13
A founder can read that as a sales argument. Buyers ask where their data goes before they ask what your product does, and a product that can’t see the data has less to explain. Jonathan Mortensen built a company on that idea, and he told Sasha and me about it in episode 75.
Why the brief is free
Tom doesn’t charge for the brief. “I’m not making a business off of this”, he said.
“It’s really about sharing the information with people so that they can make better, more well-informed decisions”
Tom Moyer, at 47:50
I told him he was “taking that Tim Cook spirit of let’s do the right thing all the way”. He went back to that first meeting one more time. People sometimes doubt the story, he said: “sometimes people question it. I’m like 100% true.”
“it’s stuck with me. Certainly stuck with me.”
Tom Moyer, at 48:35
After the tape
We recorded on October 20. 2 weeks later, voters answered the question Tom has been tracking.
On November 3, 2026, 41 local ballot measure contests dealt with data centers. Ballotpedia counted the results, and voters favored limiting data center development in 40 of them. In 27 they approved a limit. In 13 they defeated a measure that would have helped a project. The exception was Harwood, North Dakota (Ballotpedia News).
J.D. Capelouto kept a running thread on election night. By the end he’d counted 28 measures in 25 places going against data centers.
THREAD on how data center-related ballot measures are faring tonight
J.D. Capelouto (@jdcapelouto) · November 4, 2026
A reader on Hacker News wrote the neighbor’s position in one line, and went on to name water and electricity.
"I'm all for data centers so long as they pay market rates"
ajmarsh, on Hacker News, November 2026
I hear a neighbor in that comment. He has a condition, and it’s a fair one.
Tom’s brief has kept counting. On November 10, its site showed 831 approved incidents for 2026, 157 of them sabotage (7 Elm Strategies). The methodology explains that records from before September 28 came from a search of a news archive.
Our own post about the episode went up the day it aired.
YSecurity's post for episode 108: what Tom would tell a camera company's founder about access, and why to write the rules yourself.
YSecurity · November 10, 2026
Tom said he’s concerned about what’s around the next corner for the industry. 2 weeks after he said it, 40 of 41 contests went one way. The way I read those results, people were asking to be asked. Listening is slower than building, and it’s the least expensive security work on this page.
Did you catch it? A 7-question quiz
Quiz · 7 questions
Did you catch it?
Pick an answer to see whether you caught it.
-
What did Tim Cook ask after Tom said the company didn't have to do anything?
- What it would cost
- What the right thing to do was
- Who else knew about it
b. "But Tom, is that the right thing to do?" Transcript, 6:55.
-
What couldn't Apple do after the attacks in Paris, by Tom's account?
- Contact its employees to check they were safe
- Close its stores in France
- Reach its suppliers
a. "we had no ability to contact them" The crisis management program came out of that. Transcript, 9:00.
-
How did Tom pitch compliance to Apple's employees?
- As a legal requirement
- As a condition of the job
- As a way to make a difference in the world
c. "You came to Apple because you wanted to make a difference in the world." Transcript, 4:39.
-
How many groups does Tom see pointing at the technology industry?
- 2
- 4
- 7
b. "you have four separate ideologies which otherwise would have nothing to do with one another" Transcript, 17:38.
-
How did Apple treat the people who complained while Apple Park went up?
- As neighbors
- As threats to watch
- As a legal risk
a. "They were always treated like neighbors." Transcript, 26:38.
-
What would Tom tell a camera company's founder about rules?
- Wait for Congress
- Leave them to each police department
- Write them yourself
c. "create those rules yourself. Institute them yourselves." He also said he expects half of his advice would be rejected. Transcript, 39:40.
-
What does Tom charge for his weekly brief?
- $500 a month
- Nothing
- A consulting retainer
b. "you can get the brief for free" Transcript, 47:32.
Would your company pass the neighbor test?
Scorecard · 8 questions
Would your company pass the neighbor test?
Answer for your company as it runs today. If 2 answers fit, pick the lower one.
-
Can someone outside the company tell you about a problem and reach a person?
- There's no public way in
- An inbox that's checked sometimes
- A published channel with a named owner
A security.txt file and an inbox someone reads are the software version of a neighbor's phone number. See A neighbor or a threat.
-
When a complaint arrives, does someone decide whether it's from a neighbor or a threat?
- Anything angry goes to legal or security
- Case by case, with no written test
- A written test, and every complaint gets an answer
Tom's team built a way to evaluate who was truly a threat, so everyone else could be treated as a neighbor.
-
Can you list everyone who can look at customer data, with a reason next to each name?
- No list
- A list, without reasons
- A list with reasons, reviewed on a schedule
This is the access review a first SOC 2 asks for. See Least privilege.
-
Is every lookup of sensitive data recorded somewhere the person looking can't edit?
- Not recorded
- Recorded, and editable
- Recorded and immutable
"the records of that access should be immutable", in Tom's words. See Write the rules yourself.
-
Does the record show why the person looked?
- No
- Sometimes, in a ticket
- Always, tied to the lookup
Tom wants a record where "you can see why that individual is looking into it". The calculator counts the lookups you couldn't explain.
-
Have you written your own rules for how your product may be used, before a law or a buyer asked?
- We're waiting to be told
- Internal notes
- Written down and published
Tom's advice was "create those rules yourself". For an artificial intelligence product, the buyer's questionnaire gets there before any law does.
-
Could you confirm that every employee is safe within an hour?
- We'd start a group chat
- A contact list that's never been tested
- A tested plan with current numbers
Put your numbers in the calculator. See Are our employees safe.
-
Do the people your product affects have a say before a change that touches them ships?
- They find out when it ships
- We tell them in advance
- We ask them, and it changes what we build
"Don't just do it for you know on paper." See The bubble.
Your protection is a perimeter, and the people on the other side have no way to reach you. Start with a published channel and an owner for it, then pull the list of who can see customer data.
People can reach you, and you know who has access. Next, make the access records immutable and attach a reason to every lookup. Then write down the rules for your product before someone asks.
You can tell a complaint from a threat, and you can explain every lookup. Keep testing the plan for reaching your people, and publish the rules you wrote.
How long to account for everyone?
Calculator
How long to account for everyone?
4 numbers: how many people you'd need to account for, the share who'd answer an automated message within 15 minutes, how long each phone call to the rest takes, and how many people are making the calls.
After the message goes out, 18 people are left to call, and the last name is confirmed in about 69 minutes. Calling everyone by phone would take 180 minutes.
Every default here is a placeholder: put in your own numbers. The model waits 15 minutes for replies and then starts the calls. By Tom's account, his team could tell Tim Cook that 449 of about 450 people were confirmed safe, with an answer on the last within about an hour. Testing your list once is how you find the numbers in it that are wrong.
How many lookups can’t you explain?
Calculator
How many lookups can't you explain?
3 numbers: how many people can look at customer data, how many lookups each one makes in a week, and the share of lookups that have a recorded reason.
25 people making 10 lookups a week comes to 13,000 a year. 10,400 of them have no recorded reason, which is about 42 every working day.
Every default here is a placeholder: put in your own numbers. Tom's advice for a police department was one person with access and an immutable record that shows why they looked. A startup can start smaller: count the lookups, then make the reason a required field.
From Navy intelligence to a weekly brief
Timeline
From Navy intelligence to a weekly brief
- The Luddites
Skilled textile workers begin breaking machines in Nottinghamshire, in a movement that runs to 1816 (Wikipedia, on this page).
- U.S. Navy
Tom serves as an intelligence specialist, through 1992 (LinkedIn).
- Credit for compliance programs
The federal sentencing guidelines for organizations take effect (U.S. Sentencing Commission, on this page).
- A law degree
Tom graduates from UC Hastings and joins Fenwick & West (UC Law San Francisco).
- Tim Cook runs operations
Apple names Tim Cook chief operating officer (Apple).
- Tom joins Apple
Director of global labor and employment law. About 2 weeks in, he meets Tim Cook (on this page).
- Chief compliance officer
Apple's first, by his account (on this page).
- Security
Tom becomes chief security and compliance officer (LinkedIn).
- The attacks in Paris
Tim Cook asks whether every employee is safe, and Apple builds a crisis management program (on this page).
- Apple Park
Employees begin moving in (Wikipedia).
- The neighbors
Residents next to the site describe the noise and the dust (SFist, on this page).
- Chief security officer
The title he held until he retired (LinkedIn).
- Privacy on billboards
Apple's privacy campaign for the iPhone begins (AppleInsider).
- 37% more concerned than excited
Pew first asks Americans how they feel about artificial intelligence in daily life (Pew Research Center).
- Russia invades Ukraine
By Tom's account, Apple had already moved its employees west (on this page).
- Stop the Machines
Mauro Lubrano's book on anti-technology extremism is published (Lowy Institute).
- 50% more concerned than excited
Pew asks again (Pew Research Center, on this page).
- Tom retires from Apple
After 20 years. He founds 7 Elm Strategies the same year (LinkedIn).
- $68 billion blocked or delayed
Data Center Watch's count of data center projects for the quarter (Tom's Hardware).
- Episode 103
Roei Ganzarski of Alitheon on security in the physical world (episode page).
- The tracker starts
Daily automated collection begins for the Technology Opposition Brief (7 Elm Strategies).
- Episode 105
Yair Grindlinger of Surf AI on shrinking what a breach can reach (episode page).
- We record
Tom, Sasha and Jon. The tracker has logged 99 incidents in about 3 weeks (on this page).
- Issue 4 of the brief
32 incidents in the week of October 20, 23 of them peaceful opposition (7 Elm Strategies).
- 40 of 41
Voters favor limiting data centers in 40 of 41 local contests (Ballotpedia News, on this page).
- Episode 108
Tom on this show, with Jon and Sasha.
- The statehouses
Legislatures are expected to take up data center rules (Venable, on this page).
What to do this week
5 things, in the order of the episode.
- Give your team a reason. Open the policy people skip most and rewrite its first paragraph to say who it protects, as in Because I told you so.
- Time a roll call. Send one message to the whole company and see how long the replies take. Put the numbers in the calculator, as in Are our employees safe.
- Publish a way in. Put a security.txt file on your site, give the inbox an owner, and write down what makes a complaint a threat. Then take the scorecard, as in A neighbor or a threat.
- Pull the access list. Write a reason next to every name that can see customer data, and count the lookups nobody could explain in the second calculator, as in Least privilege.
- Write one rule before you’re asked. Pick the question your next enterprise buyer will ask about your product and write the answer down, as in Write the rules yourself. Our SOC 2 Type 2 work covers the access review, and one of our security leaders can sit next to your team for the rest. We’ll be at MicroConf US in April 2027 talking about turning security commitments into revenue. If you’d like to talk sooner, book 15 minutes with us.