> daily_signal(2026_05_31)

A Dixon, Illinois man faces felony charges after posting a state representative's home address on Facebook over a data center dispute. Microsoft connected M365 subscribers' medical records to an AI this week.

PickBits Daily Signal · Sunday, May 31, 2026

This week the FBI's "anti-tech violent extremism" surveillance label produced its first documented felony case in Illinois, and a security researcher's months-long feud with Microsoft over an unpaid BitLocker bounty went public in the worst way for Windows users. Two different systems, one direction: the friction is showing up now.

Microsoft also moved your doctor's notes inside your AI assistant this week, and Georgia's regulators handed residential customers a modest win that still left data centers off the hook for a significant share of the costs their growth drove. The thread running through all four stories is that decisions made at scale -- about what to build, what to secure, what to cost, and who absorbs the risk -- are landing in individual lives faster than the systems designed to govern them were built to handle.

Wednesday in Dixon, a Facebook post about a data center ended in felony charges for doxxing a state representative. The same week Microsoft connected 400 million M365 accounts to their medical histories, a security researcher's USB bypass for Windows encryption went public after Microsoft paid them nothing, and Georgia Power cut residential bills while leaving data centers off the hook for three cost categories.

1. A Dixon, Illinois man faces felony charges after posting a former state representative's home address on Facebook and calling people to show up at his house over a data center dispute.

Civil liberties and data-center community opposition, Lee County, Illinois.

On Wednesday, May 27, Dixon Police arrested Harley R. Delander, 28, on charges of intimidation (Class 3 felony under 720 ILCS 5/12-6), stalking (Class 4 felony under 720 ILCS 5/12-7.3), and cyberstalking (Class 4 felony). The investigation centered on communications Delander allegedly sent to Tom Demmer, a former Illinois state representative who now directs the Lee County Industrial Development Association and has been a public supporter of data center construction in the region. According to reporting by Shaw Local and WQAD, Delander had posted Demmer's home address on Facebook alongside a call for people to show up at his house over the weekend. Investigators described a course of conduct that went beyond the protest posts themselves. The case has been referred to the Lee County State's Attorney's Office.

Dixon Police Chief Ryan Bivins issued a statement that drew the line explicitly: "This is not about limiting anyone's right to speak, disagree, or peacefully protest. Threats and conduct that create fear for personal safety cross a serious line." The statement matters because the broader context is loud: WIRED published a thousand pages of FBI and DHS intelligence-fusion-center reports earlier this month showing federal agencies tracking data-center opposition organizing under the category "anti-tech violent extremism," a label that explicitly included non-violent civic activity such as attending town halls and photographing data center facilities. Whether the Dixon case was influenced by that federal surveillance infrastructure or arose independently from local policing is not established by any reporting available so far. What is established: opposing a data center in Illinois via a Facebook post escalated, in this specific case, to felony charges -- and the charge sheet rests on what police describe as the alleged doxxing and calls for confrontation, not the protest organizing itself.

wqad.com: Man arrested, accused of stalking former Illinois State Rep. Tom Demmer
shawlocal.com: Dixon man's alleged threat to former state representative centered on data center development, police chief says

2. A security researcher published a USB-stick bypass for Windows BitLocker after Microsoft threatened criminal prosecution instead of paying a bug bounty. Every Windows PC ships with BitLocker on.

The vulnerability, CVE-2026-45585 -- codenamed "YellowKey" by the security community -- allows an attacker with physical access to a Windows machine to bypass BitLocker encryption using a modified USB drive. The attack loads specially crafted files onto the USB, plugs it into the target machine, and reboots into the Windows Recovery Environment (WinRE), which launches an unrestricted shell that can read the encrypted drive. Physical access to the device is required, which limits who can execute the attack -- but also means anyone who steals, borrows, or briefly handles your laptop can use it if they have the USB and know the procedure. BitLocker ships enabled by default on most Windows 11 devices sold in the last three years.

The researcher, known as "Nightmare Eclipse," said Microsoft deleted the MSRC (Microsoft Security Response Center) account they used to report vulnerabilities and paid them zero bug bounties despite multiple disclosures. YellowKey is the fifth of six zero-day exploits Nightmare Eclipse published between April and late May in what multiple security outlets have described as a retaliatory campaign. Microsoft's response to the publication was to invoke its Digital Crimes Unit and warn in an MSRC blog post that it could pursue criminal charges against those releasing exploit code. Multiple prominent security researchers published public statements calling Microsoft's threat an abnormal and disproportionate use of criminal law against a legitimate researcher. Microsoft released a mitigation: disabling WinRE, which requires a group policy change and trades the ability to run Windows repair tools for the removal of the YellowKey attack surface. The CVE carries a CVSS score of 6.8 (medium severity), reflecting the physical-access requirement.

techcrunch.com: Microsoft under fire for threatening security researcher with criminal investigation

3. Microsoft opened an AI tool this week that connects your doctor's visit notes and medical records to your M365 subscription. It is opt-in, voluntary HIPAA compliance only, available now.

The week's constructive-use story. An AI that can read your medical history when you ask a health question is genuinely useful. The privacy architecture around it is worth understanding before you connect.

On May 29, Microsoft opened Copilot Health to preview for all Microsoft 365 Personal, Family, and Premium subscribers in the United States. The service connects to HealthEx, which aggregates records from more than 50,000 US healthcare provider organizations, and allows Copilot to incorporate your doctor's visit summaries, medication lists, and test results into its responses when you ask health questions. It is opt-in: subscribers link their HealthEx account in Microsoft 365 settings. Microsoft confirmed it has voluntarily adopted HIPAA Security Rule principles -- access controls, audit logs, integrity controls, and transmission security -- for the service.

The key distinction is that HIPAA does not legally require Microsoft to treat this product as a covered-entity or business-associate relationship. HIPAA's statutory obligations attach to hospitals, insurers, and their specific contractual business associates. Microsoft is building Copilot Health as a direct consumer service, which means the enforceable privacy obligation is the M365 subscriber agreement and Microsoft's privacy policy -- not the federal statute. Microsoft's vice president of health stated in a post that HIPAA does not apply to direct consumer experiences of this type. That framing is legally accurate; it is also worth knowing before you connect a decade of medical records to a consumer product. The service launches as HealthEx simultaneously announced the partnership in March 2026; the preview covers US users 18 and older, English only.

microsoft.com: Copilot Health now in preview

4. Georgia Power residential customers get a $4-per-month rate cut starting June 1. Consumer advocates say data centers still do not pay for gas pipelines, solar contracts, or fuel-hedging programs.

Continuing the data center cost-allocation arc. Oregon mandated full grid-cost coverage last week, Pennsylvania published GRID standards the week before. Georgia's settlement lands different: the rate goes down, but the structural gap stays.

The Georgia Public Service Commission voted on May 28 to approve a settlement that cuts Georgia Power residential bills by $50 per year, or roughly $4.04 per month for a typical 1,000-kWh residential customer, effective June 1. The settlement adjusts fuel cost recovery and storm charges and includes a new large-customer billing framework that Georgia Power says puts data centers on the hook for direct distribution infrastructure costs.

Bob Sherrier of the Southern Environmental Law Center told the PSC that the deal left three cost categories unresolved: new gas pipelines built to support data center load growth, solar power purchase agreements signed to meet data center renewable energy commitments, and Georgia Power's natural gas price-hedging program, which locks in forward gas prices to smooth rate volatility. These three categories are classified as generation-level costs in Georgia's rate structure, which means they are allocated to all ratepayers rather than directly billed to the customers whose demand drove them. Georgia Power and the PSC's own fact sheet frame the new data center tariff as requiring large customers to fund specific distribution upgrades -- but the generation-level gap is what advocates say keeps the cross-subsidy intact. The GPB News headline for the PSC vote: "Georgia PSC backs disputed Georgia Power fuel deal amid data center cost concerns."

gpb.org: Georgia PSC backs disputed Georgia Power fuel deal amid data center cost concerns

» What to watch this week

• The Lee County State's Attorney's charging decision on Harley Delander. The arrest was made by Dixon Police; the State's Attorney decides whether to prosecute and on which counts. If the intimidation count proceeds, the trial record will establish what communications crossed from protected political speech into a criminal threat under Illinois law -- a fact pattern that every data-center community group in the country will want to read.
• Whether Microsoft publishes a mandatory WinRE mitigation for BitLocker YellowKey (CVE-2026-45585) or keeps it opt-in. The current mitigation guide documents a group policy change that IT teams must apply manually. If Microsoft pushes it as a mandatory Windows Update, the attack surface closes for consumer devices automatically. If it stays optional, consumer laptops with BitLocker stay exposed to anyone who walks away with the device.
• How many M365 subscribers connect HealthEx to Copilot Health in the first week of the preview. Microsoft has not disclosed adoption metrics or a timeline for general availability. If the opt-in rate is high, you can expect a federal inquiry from the House Energy and Commerce Committee or the FTC's health data enforcement team, both of which have been watching voluntary HIPAA health AI products since the FTC health breach rule expansion in 2024.
• Whether any other state utility commission opens a data center cost-allocation docket modeled on Oregon's large-load tariff. Georgia's settlement shows one outcome; Oregon's mandate shows another. Washington, Virginia, Texas, and Illinois have hyperscale concentrations and active PUC dockets. The one to watch is Virginia, where Amazon and Microsoft have the highest density of data centers in the world and where the SCC has been under pressure from consumer groups since 2024 on the Dominion Energy large-load question.

Tomorrow's signal lands here.

PickBits Daily Signal is a working brief by Mark Pickering. Twenty years shipping apps and workflow automation, with the last stretch on agentic workflows on ServiceNow. The newsletter is free. If a friend forwarded this to you and you want it in your inbox, subscribe at pickbitsai.substack.com.