Starmer Calls for Spyware on All Phones

British Prime Minister Keir Starmer strode onto a stage at London Tech Week and handed Apple, Google and friends a three-month ultimatum with all the menace of a substitute teacher confiscating phones at the door. Build us controls that stop children from taking, sharing, or viewing nude images, switch them on by default across every phone and tablet already humming away in the nation’s pockets, and look sharp about it.

“This government will not stand by while children are put at risk online,” he announced, before adding the line every tech executive in the room heard as a polite threat.

“Today I am calling on the tech companies to introduce device-level controls to prevent children from taking, sharing or viewing nude images. And if they don’t act, we will.”

Stirring stuff. Nobody wants children harmed, and saying so out loud is the cheapest applause line in British politics.

The trouble is the two innocent-looking words tucked into the speech like a wasp in a picnic basket, the words “device-level.”

Here is what “device-level” means once you peel off the cuddly branding. To catch one naughty photo on your phone, something has to inspect every photo on your phone. All of them.

It is software that leans over your shoulder the instant you raise your camera, squints at whatever you are making, and decides whether you may keep it or it gets reported to authorities.

Engineers named this trick years ago, client-side scanning, and even Apple, a company that would happily sell you the air inside its packaging, built a version of it in 2021 and then sprinted away from the idea the moment people worked out what it did to private messaging.

The worst part is what it does to encryption. End-to-end encryption is meant to mean nobody in the middle can read your stuff, not the app, not your internet provider, not a bored government with a search warrant fetish.

Client-side scanning waltzes around all of that by reading your photo on your own device first, before the encryption clicks shut. The lock on the front door stays bolted. There is just a man with a clipboard standing in your hallway, jotting notes before you turn the key. The math survives. The privacy, meanwhile, is dead.

Step back and admire how casually people are treating this. A government politely asking every phone maker to install a tiny invigilator inside the camera lens, marking your snapshots as they form, would have been thrown out of a Black Mirror writers’ room a decade ago for being too on the nose.

Keep reading

UK Government Plots Digital ID Lockdown On Every Phone In Lockstep With Big Tech

The Labour government in Britain is accelerating its assault on digital privacy under the well-worn banner of child protection. Fresh plans leaked to the press reveal ministers intend to compel Apple, Google and other tech firms to restrict smartphones so thoroughly that a digital ID will be needed to use them with unfettered access.

The mechanism comes in the form of expanded age verification that effectively demands digital identification for device setup and use. What is sold as safeguarding the young is shaping up as a backdoor mandate for every adult in Britain to submit ID just to operate a phone or go online.

This development lands alongside Google’s confirmation that it will soon bring digital IDs to Android devices in the UK via Google Wallet. Users will record a short video selfie and scan a government-issued ID to add a digital version of their passport or other documents.

Keep reading

New Digital ID Bill Ties Your Identity to Your Phone—and Everything You Do Online

Republicans are once again teaming up with Democrats to ram Digital ID through at the federal level.

The bill they’ve just introduced is, if you can believe it, worse than all the others before it.

HR 8250, deceptively named the Parents Decide Act, doesn’t just force everyone to link their identity to use apps on their phones, it mandates that they must do it to use ANY operating system. That means Apple, iOS, Windows, Google, Android, even Samsung—basically everything.

And once that’s in place, there’s nowhere to step outside of it.

But one brave group is refusing to go along.

GrapheneOS has made a statement saying: GrapheneOS will remain usable by anyone around the world without requiring personal information, identification, or an account.

Glenn and Eric Meder from Privacy Academy have been working to educate people on how to escape the digital control grid, including how to put GrapheneOS on your phone—for free. And they have a solution to Digital ID right now.

Keep reading

FBI Recovers Deleted Signal Messages Through iPhone Notifications

The FBI successfully recovered private Signal messages from a defendant’s iPhone even after the app was deleted. Learn how this security loophole works and the simple setting you must change today to keep your chats private.

Most of us prefer using the Signal app because it is supposed to be very secure with a remarkable end-to-end encryption system that hides our chats from everyone else. It also has a message-disappearing feature to help us set a message deletion time.

But the Federal Bureau of Investigation (FBI) found a way to read private Signal messages on an iPhone, even after the app was deleted. This was revealed in a court case in Texas that these messages can stay hidden in the phone’s memory longer than we expected.

How the loophole works

The case involves a woman named Lynette Sharp and an attack on a Texas detention centre in July 2025. During the trial in April 2026, the FBI revealed they recovered her messages even when she had deleted the Signal app. The bureau, reportedly, retrieved the messages from the iPhone’s push notification database.

During the trial, FBI Special Agent Clark Wiethorn explained how investigators accessed the evidence. When a message arrives, the phone shows a little preview on the screen, which is handled by the phone’s operating system and not the Signal app.

Even if Signal deletes the message later, the phone’s system can save a copy of that preview in its own records. To read these saved messages from Signal, the FBI used Cellebrite, a forensic tool often used by law enforcement to scan seized devices.

A key finding is that the FBI could only see incoming messages, not the ones Sharp sent, which confirms the data came from the notification storage. It shows that while the app’s encryption is strong, the phone’s operating system keeps its own logs of everything.

Keep reading

Massachusetts Agrees to Delete Data From App It ‘Secretly Installed’ During Pandemic

Massachusetts officials have agreed to delete data from a contact tracing application that people said was installed on their phones without their permission during the COVID-19 pandemic.

Under a settlement agreement approved by a federal judge on March 31, the Massachusetts Department of Public Health “shall (a) destroy any Primary Data in the Department’s possession, custody, and control, which the Department, exercising all due diligence, has located and … that was made available to the Department from the COVID Exposure Notification Setting on Android Devices; and (b) certify in writing to Class Counsel that such data has been destroyed and will not be provided to any third party.”

The state’s health commissioner also promised not to have data collecting applications installed on people’s phones without their permission for five years.

The settlement came in a case brought by plaintiffs who said the app in question, known as MassNotify v.3 or Exposure Notification Settings Feature-MA, was “secretly installed” on their phones without their permission.

American Institute of Economic Research senior fellow Robert Wright, who lives in Massachusetts, said the app was downloaded onto his Android phone around July 1, 2021, without his knowledge. Johnny Kula, a New Hampshire resident who travels to Massachusetts on a daily basis for work, also said he discovered the app on his phone around the same time, and that it was back on the phone later in 2021 after he uninstalled it.

The plaintiffs’ claims echoed reviews from app store users complaining they had not downloaded the app, but it appeared on their phones. The app, which allowed people to say they had tested positive for COVID-19, and alerted others who had recently been close in location to those people, was downloaded more than one million times, according to court filings. Similar applications were developed by at least 24 other states.

Keep reading

FBI Issues Public Alert on Americans Using Foreign Apps

The FBI identified data security risks from foreign-developed mobile apps used in the United States, the agency warned in a March 31 public service announcement.

“As of early 2026, many of the most downloaded and top-grossing apps in the United States are developed and maintained by foreign companies, particularly those based in China,” the FBI said, without naming any apps.

“The apps that maintain digital infrastructure in China are subject to China’s extensive national security laws, enabling the Chinese government to potentially access mobile app users’ data.”

In the Google Play store, the most popular apps include short-form video platform TikTok, video editor CapCut, artificial intelligence video generator PixVerse, and communication app Telegram X. China-based ByteDance maintains ownership of TikTok and CapCut. PixVerse is owned by a Singaporean company, and the developer of Telegram X is based in the United Arab Emirates.

On Apple’s App Store, the top free apps include CapCut, TikTok, and Chinese shopping apps Temu and Shein.

In its alert, the FBI warned users to be aware of the types of data the foreign apps request access to when they are downloaded.

Keep reading

White House App Found Tracking Users’ Exact Location Every 4.5 Minutes via Third-Party Server

The Trump administration’s newly launched White House App is under scrutiny after a software developer claimed to have found embedded code that tracks users’ precise GPS coordinates every 4.5 minutes and automatically syncs them to a third-party server. The claim, posted on 28 March 2026 by the X account @Thereallo1026, has drawn nearly 260,000 views and prompted questions about data collection practices in government-operated applications.

The post included what appeared to be decompiled source code from the app, revealing what the user described as OneSignal’s ‘full GPS pipeline compiled in.’ According to the post, the code showed the app ‘polling your location every 4.5 minutes, syncing your exact coordinates to a third-party server.’ The White House has not publicly responded to the specific technical claims.

What the Code Allegedly Shows

OneSignal is a widely used push notification platform that, according to its own documentation, updates a user’s GPS coordinates ‘approximately every 5 minutes (based on permission and system rules)’ when location sharing is enabled within a mobile app. The platform is designed to allow developers to segment and target users based on their physical location for messaging campaigns.

The decompiled code shared by @Thereallo1026 references Android location permission strings, background location access, and a foreground update time set to 270,000 milliseconds — the equivalent of 4.5 minutes — alongside a background update time of 600,000 milliseconds, or 10 minutes. If accurate, these constants suggest the app is configured to collect and transmit precise location data at regular intervals, even while running in the background.

Keep reading

White House renamed ‘Epstein Island’ on Google phones – WaPo

The White House was briefly renamed ‘Epstein Island’ for some Google Pixel phone users, the Washington Post has reported.

The term is used to refer to the Caribbean island of Little St. James, which had been owned by the late convicted pedophile Jeffry Epstein. According to the prosecutors, it served as the venue for sex trafficking and other abuses involving some high-profile figures in business and politics.

WaPo said in an article on Saturday that when its journalist tried calling the White House switchboard earlier this week, the name on screen indicated that they were contacting “Epstein Island.”

Only users of Google’s Pixel phones experienced the issue. For those calling the presidential residence from other Android phones and iPhones, no name was displayed, the report read.

Keep reading

Mexico Mandates Biometric SIM Registration for All Phone Numbers

Anonymous prepaid SIM cards are dying in Mexico. By July 1, 2026, every active cell phone number in the country must be biometrically linked to a named, government-credentialed individual or face suspension. That’s around 127 million numbers, each one tethered to an identity the Mexican government can look up by name.

The mobile registration law took effect January 9, 2026, covering prepaid and postpaid plans, physical SIMs, and eSIMs alike. Existing subscribers have until June 30 to complete registration. New lines activated after January 9 get 30 days. Miss the window, and the line goes dark.

The enforcement mechanism runs through the CURP Biométrica, Mexico’s biometric upgrade to its existing population registry code. The new credential embeds a photograph, electronic signature, and QR code that ties directly to biometrically verified records held in the national registry.

Residents registering a mobile line must provide their CURP number alongside a valid government ID, which makes biometric enrollment not optional but structurally required. You cannot register a phone number without first handing your biometric data to the state.

What Mexico is building here is a national phone network where every number has a face attached to it.

Keep reading