Tag: mass surveillance

This Company Will Add Phone, AirPod, and Smartwatch Trackers to License Plate Readers

 A surveillance company plans to add sensors to automatic license plate readers (ALPRs) that would mean the devices, as well as capture the license plate of passing vehicles, would also sweep up unique identifiers of mobile phones, wearables, and other Bluetooth-enabled devices in those cars, potentially letting law enforcement identify specific drivers or passengers.

The technology, called SignalTrace, would turn ALPR cameras from devices focused on tracking cars to ones that can more readily track the location of particular people. ALPR cameras have become a commonly deployed technology all across the U.S.; SignalTrace would make some of those cameras capable of collecting much more data.

SignalTrace “bridges license plate recognition data with sensor-captured device identifiers—such as those from mobile phones, Bluetooth wearables, and vehicle systems—to create a unique, trackable ‘electronic fingerprint’ for investigative use,” according to a product sheet describing the tool, written by surveillance company Leonardo, which advertises SignalTrace.

The sort of data Leonardo says SignalTrace can sweep up includes the RFID tags in key cards and pet microchips; devices with Bluetooth such as wireless headphones, fitness trackers, and mobile phones; components of a car like tire pressure sensors and infotainment systems; and Wi-Fi sources such as vehicle hotspots and laptops, according to the product sheet.

The idea is to correlate these unique device identifiers to a license plate. If a Leonardo camera detects a license plate and sees where a vehicle was at a specific time, it can then allegedly link those unique device identifiers to it.

The sheet suggests SignalTrace collects this data for it to be searched by law enforcement much later. One line says SignalTrace “stores device and correlation data securely in the EOC [Enterprise Operations Center] for future queries and analysis.”

“When multiple devices consistently move together with a vehicle, SignalTrace’s algorithms link them to that vehicle’s license plate and time-stamped location data. This correlation provides investigators with another layer of actionable intelligence, even if a suspect changes or removes a plate,” the sheet reads.

Keep reading

Signal, DuckDuckGo, and NordVPN threaten to exit Canada if metadata surveillance law passes

Another day, another government attempt to force tech companies to build backdoors. This time, Canada is proposing legislation that would require companies to retain certain metadata and provide law enforcement with access to it. Predictably, many tech players have sharply criticized the proposal, with some saying they would rather leave the Canadian market than comply.

The latest version of Canada’s Bill C-22 would require digital services such as internet service providers, messaging platforms, email providers, and potentially hardware companies to retain up to one year of user metadata. In addition, tech companies would have to implement mechanisms that allow authorities to obtain “lawful access” to that information for criminal investigations. Critics argue the proposal amounts to another government-mandated backdoor.

During his testimony before the House of Commons Standing Committee on Public Safety and National Security, Signal executive Udbhav Tiwari said Bill C-22 would turn everyday digital tools into a surveillance network. He argued that requiring companies to retain metadata about users’ communications runs counter to Signal’s privacy practices.

A spokesperson for DuckDuckGo also confirmed that the company would remove its VPN service from Canada if Bill C-22 passes. NordVPN and other VPN providers have made similar statements.

Apple and Google have also joined industry warnings that the legislation could force them to weaken encryption. Last year, Apple successfully opposed a similar proposal in the United Kingdom that would have required it to build a backdoor into iCloud. The incident was the latest in a series of conflicts between the Cupertino-based company and government regulators over security and user privacy.

The primary concern is that malicious actors would inevitably discover and exploit any digital backdoor, regardless of whether it was designed exclusively for law enforcement or domestic government agencies. OpenMedia, which has described C-22 as an attempt to create a surveillance state, pointed to a late-2024 incident in which Chinese state-backed hackers compromised government-mandated police wiretap systems to steal sensitive data from AT&T, Verizon, Lumen Technologies, and other telecom providers.

Keep reading

Starmer Calls for Spyware on All Phones

British Prime Minister Keir Starmer strode onto a stage at London Tech Week and handed Apple, Google and friends a three-month ultimatum with all the menace of a substitute teacher confiscating phones at the door. Build us controls that stop children from taking, sharing, or viewing nude images, switch them on by default across every phone and tablet already humming away in the nation’s pockets, and look sharp about it.

“This government will not stand by while children are put at risk online,” he announced, before adding the line every tech executive in the room heard as a polite threat.

“Today I am calling on the tech companies to introduce device-level controls to prevent children from taking, sharing or viewing nude images. And if they don’t act, we will.”

Stirring stuff. Nobody wants children harmed, and saying so out loud is the cheapest applause line in British politics.

The trouble is the two innocent-looking words tucked into the speech like a wasp in a picnic basket, the words “device-level.”

Here is what “device-level” means once you peel off the cuddly branding. To catch one naughty photo on your phone, something has to inspect every photo on your phone. All of them.

It is software that leans over your shoulder the instant you raise your camera, squints at whatever you are making, and decides whether you may keep it or it gets reported to authorities.

Engineers named this trick years ago, client-side scanning, and even Apple, a company that would happily sell you the air inside its packaging, built a version of it in 2021 and then sprinted away from the idea the moment people worked out what it did to private messaging.

The worst part is what it does to encryption. End-to-end encryption is meant to mean nobody in the middle can read your stuff, not the app, not your internet provider, not a bored government with a search warrant fetish.

Client-side scanning waltzes around all of that by reading your photo on your own device first, before the encryption clicks shut. The lock on the front door stays bolted. There is just a man with a clipboard standing in your hallway, jotting notes before you turn the key. The math survives. The privacy, meanwhile, is dead.

Step back and admire how casually people are treating this. A government politely asking every phone maker to install a tiny invigilator inside the camera lens, marking your snapshots as they form, would have been thrown out of a Black Mirror writers’ room a decade ago for being too on the nose.

Keep reading

UK Encryption Backdoor Could Hit US Data, Jordan Warns

Britain has refused to let a US technology company brief Congress about a secret order to weaken encryption and the chairman of the House Judiciary Committee is treating that refusal as a problem in its own right.

Jim Jordan, the Ohio Republican who leads the committee, wrote to Home Secretary Shabana Mahmood on Friday warning that Britain may be using encryption powers to reach the private data of US citizens.

The underlying dispute is not new. For more than a year, the UK’s use of secret “technical capability notices” under the Investigatory Powers Act 2016 has strained relations with Washington, ever since reports that Britain ordered Apple to open up encrypted iCloud data. What is new is the wall Jordan says he keeps hitting when he tries to learn more.

He met Sir Christian Turner, the British ambassador to the United States, in March, after a US company asked to brief members of Congress about one of these notices, something that would require Mahmood’s sign-off.

The ambassador suggested it could happen. Mahmood then refused.

“This denial is inconsistent with our understanding from Ambassador Turner and raises serious concerns about shared cooperation on these sensitive matters, particularly as Congress exercises its important oversight responsibilities,” Jordan wrote, the Telegraph reported, adding that it cast doubt on the “trust and effective partnership between our two countries.”

He asked Mahmood to “review this matter and grant the US company’s request to speak with Congress about an alleged technical capability notice,” which he said would “honour the representation made by the ambassador during our meeting and uphold the spirit of transparency and cooperation that is the foundation of our shared security relationship.”

The secrecy Jordan ran into is built into how these orders work and it is worth keeping in view.

The UK may be building “backdoors into their encrypted services,” he wrote.

A backdoor is a deliberately built flaw, a master key, or a hidden bypass that lets an intelligence agency read encrypted data without the user ever knowing. It defeats end-to-end encryption, the design that normally keeps a message readable only to the person who sent it and the person who received it.

A company served with a notice cannot tell its customers, the press, or apparently even a foreign legislature, without the express permission of the Home Secretary.

Keep reading

7 Republicans vote no on FISA extension

Seven Republican senators sided with Democrats early Friday to vote against advancing an extension of warrantless spy powers set to expire next week, complicating efforts to keep those powers alive.

The procedural vote failed by a vote of 47-52 after Sens. Josh Hawley (Mo.), Sen. John Kennedy (La.), Mike Lee (Utah), Rand Paul (Ky.), Eric Schmitt (Mo.), Rick Scott (Fla.) and Tommy Tuberville (Ala.) broke with their GOP colleagues.

Some of the pushback was attributed to President Trump’s tapping of Federal Housing Finance Agency chief Bill Pulte to serve as acting director of national intelligence, which received backlash from both sides of the aisle.

Lee brushed off speculation that anger over Pulte’s appointment was the motivator behind the defectors who voted with Democrats, instead pointing to privacy concerns.

“FISA 702 reauthorization failed because it did not contain a warrant requirement for spying on Americans,” the Utah Republican wrote on the social platform X. “The people who spied on the Trump campaign, Members of Congress, and countless other Americans hate the idea.”

He added, “Come back with warrant requirement, and we’ll pass the bill.”

The motion to proceed would have paved the way for enhanced federal surveillance authorities under Section 702 of the Foreign Intelligence Surveillance Act (FISA) before it lapses June 12.

Trump’s decision to name Pulte to replace outgoing Director of National Intelligence Tulsi Gabbard triggered fights on Capitol Hill.

Sen. Mark Warner (D-Va.), vice chair of the Senate Intelligence Committee, said Democrats could not support extending surveillance authorities with Pulte in a position to access sensitive intelligence information that could be used against Trump’s political foes.

“I thought I had gotten to the stage where I could no longer be shocked by Donald Trump’s choices, but this may be the most outrageous of all,” he told MS NOW, speaking of the recent appointment.

Every Senate Democrat except Sen. John Fetterman (Pa.) voted against the motion, as they argued Pulte could not be trusted to oversee the nation’s intelligence apparatus, among other reasons.

Keep reading

Flock Cameras Being Used By Police To Target Citizens For Variety Of Non-Criminal Investigations

A new analysis by the Electronic Frontier Foundation (EFF) has revealed that law enforcement agencies across the United States are increasingly deploying automated license plate reader (ALPR) systems — particularly those operated by Atlanta-based Flock Safety — for non-criminal administrative purposes, including school residency verifications and employment background checks, often without warrants.

Flock Safety promotes its nationwide camera network as a vital public safety tool that assists police in solving crimes and locating missing persons. However, the EFF report contends that the technology is being repurposed for routine administrative tasks far removed from urgent law enforcement needs, raising significant privacy concerns.

School Districts Turning to ALPR for Residency Enforcement

According to the report, several school districts have enlisted local police to conduct ALPR searches on vehicles belonging to parents and guardians suspected of falsifying residency information to enroll children outside their designated zones.

In Georgia’s Buford City Schools, which serves roughly 6,000 students, officials authorized more than 375 ALPR queries between January 2025 and March 2026 specifically for residency verification. A district spokesperson defended the practice, stating: “Because Buford City Schools is a highly sought-after district, we experience ongoing challenges with residency fraud. Flock Safety is one of the tools we use to verify residency and protect the integrity of the Buford City School System for families who live within the district.”

In Ohio, the Delhi Township Police Department (DTPD) ran 35 ALPR searches tied to residency verification across five schools during a three-month period in spring 2025. Following an inquiry from the EFF, DTPD said the searches were not used for initial enrollment screening but to investigate suspected false information on forms. The department did not disclose the threshold of suspicion required to justify a search or how many cases were ultimately substantiated.

Keep reading

A Nation of Suspects

Some of the recent legal challenges to the use of surveillance by the Department of Homeland Security upon Americans have resulted in the revelation of truly terrifying behavior by the government, in direct defiance of the Fourth Amendment to the Constitution. We now know that the federal government spies on innocent Americans without suspicion and without warrants.

The spying seems to fall into several categories. The National Security Agency, which is in the Department of Defense, employs about 60,000 domestic spies. These are the folks who want us to believe that they go through the trouble of making applications to the Foreign Intelligence Surveillance Court for warrants to spy on foreigners.

Actually, from time to time they do go to this court, but their travels there — where judges are frisked upon entering and leaving the courthouse by the NSA agents who appear before them — serve as fig leaves for their massive warrantless spying on Americans. The FISA Court is unconstitutional because it issues warrants based on probable cause of communicating with a foreign person, rather than on probable cause of crime as the Fourth Amendment requires.

The courts have ruled consistently since the 1960s that spying — surveillance, as the feds call it — is a search, and the capture of data from a surveillance is a seizure.

The Fourth Amendment protects all persons in America — not just Americans — from warrantless searches and seizures of their “persons, houses, papers, and effects.” There are some well-recognized exceptions to this constitutional baseline, such as evidence that will quickly vanish or be seriously degraded, but those exceptions do not apply here as the NSA captures in real time all keystrokes on all digital devices and all fiber optic data transmitted into, out of and within the United States.

The judges of the FISA Court surely know that the Department of Justice lawyers and NSA agents who appear before them are going through a charade, and the court has been made a part of it. The charade is the pretense that all spying is done pursuant to the warrants that FISA Court judges issue. Former NSA agents have revealed publicly that this is hardly the case.

Nevertheless, the lowered standard from probable cause of crime to probable cause of communicating to a foreign person was crafted by Congress — in another of its many moments heedless of the Constitution. After a few years of this, the FISA Court began to issue warrants for spying on the Americans who communicate with foreigners, out to the sixth degree. A sixth grader can do the math, as this leads to hundreds of millions of Americans whose communications are captured.

A second category of spying is employed by the DHS. The DHS — now a 250,000-person strong federal police department nowhere countenanced by the Constitution — has sophisticated software that can read fingerprints at 15 feet and irises at 15 inches. So, if you wave goodbye or good riddance to an ICE agent, and he holds up his mobile phone, and you are in the federal system for any benign reason, he has captured your bank, health, legal and commercial records on the spot. If he talks to you in your car and is within 15 inches of your face, he can capture the same data.

As if all this were not enough, the feds and local police use a device called a Stingray, which mimics the signal sent to all mobile devices as if the device were being used to communicate. But the communication is just one way, as the Stingray will tell the government where the person possessing the mobile device is at any given moment. This, too, is a seizure of private personal information — the contents of the computer chip in your mobile device — which the Fourth Amendment characterizes as an “effect.”

And then there is the FBI, which now uses zero-click software. This permits agents without warrants or even approval of their superiors to engage in computer hacking without having to trick the hacked victim into clicking on a link. Computer hacking is a felony.

All of this surveillance is unconstitutional, dangerous and commonplace. It consists in the use of surveillance and law enforcement tools without articulable suspicion.

For 600 years, articulable suspicion — the lowest evidentiary standard we have — has been the baseline for all government behavior that targets an individual. Articulable suspicion is the fact-based ability to state why a person — not a group — should be targeted and for what crime. This is the same standard that must be met when police stop someone in public.

Anything less than articulable suspicion is a fishing expedition; stated differently, a general warrant. General warrants — which were used by British agents on American colonists — permitted the agents to stop anyone, to search anywhere and to seize anything without articulable suspicion. The Fourth Amendment outlawed them.

Keep reading

More License Plate Reader Mission Creep: School Residency Verification, Background Checks, and Noise Complaints

An EFF analysis of millions of searches of Flock Safety automated license plate reader (ALPR) data by police has uncovered a troubling pattern: in the absence of a warrant requirement to search ALPR databases, law enforcement agencies have moved beyond specific investigations to use these surveillance networks for virtually any whim.

Our findings suggest that the absence of a warrant requirement has fostered a culture of unrestricted access to sensitive location data, allowing agencies to leverage that data beyond the scope of specific criminal investigations.

As a refresher: Law enforcement agencies lease or purchase camera systems from Flock Safety and then mount them by the side of the road and at intersections to document every vehicle that passes, including the plate, make, model, color and distinguishing characteristics, along with the date, time and location of where it was seen.

Law enforcement’s talking points—often scripted by the company itself—trumpet their role in solving high-stakes crimes. But the data reveals a different story. What they’re not saying is that ALPRs are also frequently used for extremely low-level investigations, such as verifying whether a student lives within a particular school zone. In some cases, police have even used this tech to conduct employment background checks and investigations into loud music complaints. Recently, a motorcyclist was even targeted for simply holding a cell phone while riding.

The reach of this ALPR surveillance is amplified by the nature of the indiscriminate sharing these technologies encourage. Most agencies choose to share broadly, often as part of a nationwide pool, making it common for a single city’s system to be searched hundreds of thousands of times each month. By analyzing these “network audit logs,” privacy advocates and journalists have uncovered evidence of the technology being used to surveil protesters, abortion-seekers, immigrants, and even ethnic Roma populations.

While these high-profile abuses are shocking, the more mundane uses are also problematic, signaling a massive, unchecked mission creep that has turned an alleged “crime-fighting” tool into a universal tracker of everyone’s movements.

Keep reading

Canada Moves to Destroy Encryption – Demands Backdoor Access to ALL Available Data

Canada is walking into extremely dangerous territory and most people do not understand the implications because governments always package surveillance laws as “public safety.” That is how this begins every single time historically. They sell fear first, then quietly expand state power behind the scenes while claiming only criminals should worry.

Now even Apple, Google, Meta, Signal, privacy experts, cybersecurity professionals, and members of the U.S. Congress are warning that Canada’s Bill C-22 could force technology companies to weaken encryption and build government access mechanisms directly into their systems.

People need to understand what encryption actually is. Encryption is not some toy used only by criminals. Encryption protects bank accounts, corporate systems, private medical data, government communications, journalists, dissidents, businesses, lawyers, and ordinary citizens. Every time you use secure banking, send a private message, or protect sensitive data online, encryption is standing between you and cybercriminals.

The government always frames these laws as targeting terrorists, child exploitation, organized crime, or national security threats. But the mechanism itself never stays limited. Once governments establish the legal right to force “lawful access” into encrypted systems, the infrastructure for surveillance already exists. The temptation to expand those powers becomes overwhelming.

Apple warned directly that Bill C-22 could allow Canada to “force companies to break encryption by inserting backdoors into their products.” Meta warned the bill could require companies to “break, weaken, or circumvent encryption” and potentially install government spyware capabilities directly into systems. Signal reportedly stated it would rather leave Canada entirely than compromise its encryption promises.

Keep reading

California’s New Age-Verification Bill Frees Linux But Expands Age Tracking to the Open Web

California Assembly Bill 1856 is getting friendly press coverage because it now exempts Linux from the state’s age-tracking mandate. The part nobody’s talking about is that it simultaneously expands the surveillance to your web browser.

AB 1856, authored by the same lawmaker who wrote the original Digital Age Assurance Act, amends the law to exclude open-source operating systems from its definition of “operating system provider.”

Any software distributed under a license that lets users “copy, redistribute, and modify the software” would no longer be covered. Debian, Ubuntu, Fedora, Arch Linux, and Mint all walk free. That sounds like a win and tech outlets are reporting it as one. It’s also a distraction from what the bill adds.

The original law, AB 1043, required operating systems to harvest users’ ages during device setup and feed that data to app stores and app developers through a real-time API.

AB 1856 keeps all of that and extends the data pipeline to browser providers and website operators. Browsers would now be required to collect age signal data from the OS and pass it along to any website subject to online age verification laws.

We obtained a copy of the amended bill for you here.

Those websites, in turn, would have to request the age signal when you visit them. Your age bracket, declared once during OS setup, would follow you from app to app and now from site to site, broadcast to every developer and website operator who asks.

This is how a law originally limited to apps and app stores becomes an age-tracking system for the entire internet.

The Expanding Universe of “Covered” Websites

The category of websites subject to age verification laws started narrow as the earliest mandates targeted pornography sites. It has since expanded to social media platforms and a growing list of sites legislators consider likely to “harm” children in loosely defined ways. That list keeps getting longer and AB 1856 doesn’t define its own boundary. It piggybacks on whatever other laws exist, meaning every future expansion of age verification requirements automatically expands the reach of AB 1856’s browser-based data pipeline, too.

California has actually built an age-tracking infrastructure that scales itself.

Keep reading