Signal’s Meredith Whittaker on AI and the tension between privacy and public safety

An 18-year-old shooter killed eight people on Feb. 10 in Tumbler Ridge, B.C.; OpenAI later confirmed the shooter discussed the attack with ChatGPT and did not notify authorities, sparking calls for mandatory flagging. The piece highlights privacy and surveillance trade-offs: mandatory scanning risks mission creep into political dissent, while AI agents' need for broad device/data access can undermine end-to-end encryption and create new attack surfaces. Policymakers face public pressure (cited ~90% Canadian support for social media bans) but technical limits on age verification and the business model incentives of data collection suggest regulatory responses could increase pervasive surveillance rather than solve root causes.

Analysis

Regulatory and public backlash from incidents like Tumbler Ridge will force a bifurcation in consumer AI: firms that can afford continuous, auditable compliance pipelines will consolidate share, while smaller consumer-focused startups face either buyouts or regulatory death. Expect compliance and legal costs to scale into the tens-to-hundreds of millions annually for any company operating consumer-facing LLMs at scale, shifting marginal economics toward deep-pocketed incumbents over 6–24 months.

The technical trend is equally important: a move toward agentic capabilities will push meaningful inference and credential use to the edge, creating a new winner set among on-device silicon and secure enclave providers. Adoption of dedicated edge LLM accelerators and secure compute stacks should materially lift ASPs for chipmakers and drive incremental enterprise security spend; measurable demand inflection should appear within 12–36 months as developers prioritize usability without central data exfiltration.

There is a political and market reflex risk: proposals to mandate flagging or broaden identity verification create a commercial market for surveillance/compliance tooling (identity, auditing, lawful-intercept appliances), but also a countervailing activist/regulatory backlash that could freeze consumer feature rollout. Net: short-term volatility and headline risk (days–months) will be high, but structurally the sector reallocates capex to cloud/security and edge compute over years — a classic consolidation-and-repricing trade with clear sector winners and losers.

Key Decisions for Investors

• Long QCOM (12–36 months): buy shares or LEAP calls to play accelerated demand for on-device LLM accelerators and modem+AI integration. Rationale: edge-first agents lift ASPs and wafer-level content; expected upside 30–50% if adoption follows, downside ~15–25% if edge adoption stalls or macro weakens.
• Long CRWD or PANW (6–18 months): increase exposure to endpoint/cloud security vendors via shares or 12-month calls as enterprises harden against agentic AI threats. Rationale: recurring revenue growth and higher deal sizes; reward: 20–40% potential re-rating as security budgets shift, risk: 20%+ downside if macro cuts security spend.
• Pair trade — Long MSFT (6–24 months) / Short SNAP (6–12 months): MSFT as the compliance-and-cloud beneficiary vs SNAP as a consumer-engagement casualty if privacy/age-verification reduces youth usage. Rationale: MSFT gains from Azure safety tooling and enterprise demand; expect asymmetric upside on MSFT (20–35%) vs sharper downside on SNAP (25–40%) if regulations or user attrition accelerates.
• Long OKTA (12 months) or ID-related SaaS (12–24 months): buy shares to play the emergence of consented identity/verification infrastructure driven by age-verification regulatory work. Rationale: identity layer demand will be sticky and enterprise-paid; upside 25–45% in a successful compliance wave, risk is regulatory design that favors incumbents and compresses growth to single digits.