Surveillance Report: Weekly News For Digital Freedom

153 Million Driver's Licenses For Sale, Plus Chrome Kills uBlock Origin & Texas Kicks Out Flock

An ID-verification company, IDScan.net, appears to have leaked scans of 153 million driver's licenses, then sold on a dark-web market called Nexus. This week I break down

Apple Fixed A Leak Without Telling Anyone, Plus More VPN News and Flock's Creepy Police AI

Four positive VPN stories in one week: Mullvad's new multihop modes, Obscura shipping on Windows, Apple quietly patching the iCloud Private Relay leak, and Firefox's free

Apple's Private Relay Is Leaking Your IP, Plus Fake VPN Extensions & France's Big Win

Three cracks opened up in Apple's privacy story this week: iCloud Private Relay leaking real IP addresses through DNS prefetching, WebTransport, and passkeys; Hide My Ema

Signal's Biggest Update In Years, Plus Rival App Stores Arrive In The Play Store

Signal just shipped its largest set of updates in years: A second phone can finally be a linked device, automatic key verification is rolling out alongside safety numbers

OpenAI's Hacking Story Got Worse, Plus Iran In US Water Systems & A Felony For Wiping A Phone

OpenAI's rogue AI agent turned out to have hacked more than Hugging Face, and the more details come out, the less impressive it seems. Then Anthropic came forward with it

France Banned Social Media For Under-15s, Plus A Hidden Device In Millions Of US Cars

France has become the first country in Europe to ban social media for children under 15. Meanwhile there's real good news elsewhere: the UK's incoming PM dropped digital

EU Passes Chat Control Anyway, Plus Microsoft's Secure Boot Mess & the Flock Resistance

This week's a double-week catch-up: the EU just greenlit Chat Control even after Parliament voted against it, Microsoft had a brutal stretch between a decade-old Secure B

Apple Quietly Downgrades Hide My Email, Plus Chrome Kills uBlock Origin & Google's IP Tracking

Apple is moving Hide My Email aliases to a new private.icloud.com subdomain, which makes it trivial for any app or website to spot a private email and block the signup.

Meta Hid Face-Recognition Code on 50M Phones, The UK's Device-Scanning Ultimatum & A Burner Phone Ban

Meta quietly embedded unreleased facial-recognition code, internally called "nametag" onto more than 50 million phones through its Meta AI app, then deleted it the day af

Dashlane Confirms Hackers Stole Password Vaults, Pentagon Location Tracking, and Hackers Trick Meta's AI

Dashlane has confirmed hackers stole around 20 encrypted password vaults, and the company is being unusually quiet about how it happened. Plus the Pentagon admits US troo

A Rare Age Verification Win, AI Cameras On School Buses, And A License Plate Tracking Ban

A rare and genuine win against age verification with California following Colorado in exempting Linux and other open source operating systems from its Digital Age Assuran

A Brutal Week for Microsoft Security, Signal Threatens to Leave Canada, And Bitwarden Quietly Shifts

A brutal week for Microsoft with seven vulnerability stories, an actively exploited Exchange zero-day, the MiniPlasma exploit (rooted in a six-year-old Project Zero repor

Linux's Rough Run, ICE's 20M Palantir Database & Android Good/Bad News

Linux gets hit with a third major vulnerability in as many weeks, a Palantir-built database of 20 million people, and Android delivers both bad news (a new VPN leak Googl

CopyFail Explained, Utah's New VPN Law, and Microsoft Edge Keeping Passwords in Plaintext

This week's Surveillance Report covers the most severe Linux threat in years sending researchers and admins scrambling, Apple patching the bug police were using to extrac

VPNs Could Make You an NSA Target, North Korea's Supply Chain Hijack & the EU Kills Chat Control

The government told you to use a VPN, but are you actually making yourself a target for NSA surveillance in the process? This week's highlight story digs into a letter fr

Two iOS Exploits, Google's Android Lockdown & Instagram Drops Encryption

This week's Surveillance Report covers two sophisticated zero-click iOS exploit frameworks: Coruna and DarkSword hit hundreds of millions of iPhones in the span of a sing

Password Manager Vaults Aren't Private, Google Threatens Open Android, & Apple's Global Age Verification

Password managers CAN see your vault (new research reveals attack vectors), Google threatens the open Android ecosystem, Apple rolls out age verification globally, 147 mi

3 Mac Attacks Explained, Discord Age Verification Goes Global & Hidden Hotel Cameras

No operating system is safe, and this week, Mac users got hit from three directions at once. We cover the attacks, Discord's messy age verification expansion, hidden hote

FBI Can't Crack iPhone Lockdown Mode, Age Verification Hits 3 Countries, And Chat Control 1.0 Extended

The FBI couldn't crack a journalist's iPhone because of one security feature, and we'll break down exactly how Lockdown Mode stopped them. Meanwhile, Austria, Spain, and

Microsoft Gave FBI Your Encryption Keys

This week's Surveillance Report covers Microsoft handing BitLocker encryption keys to the FBI, meaning your "encrypted" Windows data isn't as secure as you thought. This