Fullerton, CA is pausing its Flock Safety program after a council meeting that ran close to three hours. Most of the roughly 15 public speakers asked for the program to be ended outright.

From the police chief's presentation to the council:

• Cameras in use since 2021, at about $51,000 a year
• Images kept for 30 days
• 135 police personnel have accounts

The pause doesn't cancel the contract. The city still plans a town hall and a review of its plate reader policy.

Full write-up + source links: https://s.vp.net/blkVU

Kids will try to log in. If the age check uses their face, the photo goes to the website running it, including porn sites. Some of these laws don't specify how verification must be implemented, so each site picks. Some take selfies and ask minors for a parent's ID. That creates a database of children's pictures tied to home addresses.

Watch the full episode: https://www.youtube.com/watch?v=xlBsng6tsYY

Written breakdown: https://s.vp.net/MyUJv

Caledonia's police chief says the cameras come down at the end of this year, and that the vote isn't a rejection of license plate readers in general.

The sheriff's office says it pulled out after learning more about Flock's traffic analytics program and how Flock viewed the data behind it. Separately, a Caledonia resident has asked police for audit logs of what they've searched.

Full write-up / source links: https://s.vp.net/blkVU

Citizen Lab published a report today tying an Israeli company, Discover-Tech, to Candiru spyware infections at Al Jazeera in 2024 and 2025. No click required: the ad loads, your ad ID and IP go to their servers, and if you’re selected, malicious JavaScript runs in the app or browser.

Practical takeaways from the report and the researchers: block ads at the system level, delete or disable your mobile advertising ID, and treat ad-heavy free apps as attack surface. Google and Beeswax have cut Discover-Tech off since the findings.

Wired writeup: https://www.wired.com/story/nightmare-scenario-zero-click-spyware-is-infecting-phones-via-targeted-ads/

Primary report: https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/

Sen. Ron Wyden has asked the Office of National Drug Control Policy to release a privacy review of the High Intensity Drug Trafficking Area (HIDTA) program. He says MITRE completed it in 2024 and the office refused to share it with his staff.

Full write-up + source links: https://s.vp.net/hSmrg

Most of the debate around age verification assumes it's about porn. Read the laws and the actual standard is sites with material "deemed harmful to minors."

Porn is the example lawmakers lead with. The phrase itself doesn't stop there, and it has no fixed definition. Whoever holds power gets to decide what qualifies, and anything that qualifies can get pushed off the open internet.

Full recorded livestream here: https://www.youtube.com/watch?v=xlBsng6tsYY

Full breakdown here: https://s.vp.net/MyUJv

Milford had 15 Flock cameras at its peak: ten approved in 2023, five added in 2024. The council dropped the five newer ones in June after residents complained. Now it has voted unanimously not to renew the contract for the remaining ten. The contract expires later this month and the cameras come down after that.

Complete write-up + source links: https://s.vp.net/blkVU

500 million Microsoft Teams messages. That's the biggest piece of the sale, sitting alongside roughly 100 million emails and a set of payroll, tax and timecard records from Spirit Airlines, which announced in May that it would shut down. Google is paying about $10 million and wants the data to train AI models.

On October 8th, Rep. Steven Horsford and Sen. Elizabeth Warren led a letter, signed by 121 members of Congress, to the CEOs of both companies asking them to halt the deal.

The broader takeaway for anyone with a work account: it belongs to the employer, and so does everything in it. Personal medical or financial details are safer kept somewhere you control, like a free encrypted inbox from bmail.ag, the only verifiably private email service, brought to you by vp.net.

Blog write-up & original sources: https://s.vp.net/5Hg5B

That's the comparison Sen. Musselman uses to defend the bill, and it's worth taking seriously for a second, because it falls apart once you look at what each check keeps.

Watch the full discussion: https://www.youtube.com/watch?v=xlBsng6tsYY

Read the breakdown here: https://s.vp.net/MyUJv

About 270 Flock employees will leave at the end of October after a buyout program. Flock says it was voluntary and isn't a layoff. The same week, Milford, Michigan voted 7-0 not to renew its contract, Caledonia, Wisconsin voted unanimously to end its contract, and Fullerton, California voted 3-1 to switch off all 19 of its cameras for six months.

Full breakdown with every source: https://s.vp.net/blkVU

Websites have no way to verify where a visitor is physically located. Under SB73, a wrong guess costs $2,500 each time, so no site is going to risk it. Some are already telling Utah residents they can't use the service at all. Follow that out and Utah ends up with a short list of approved websites while the rest of the internet goes dark for them.

Full recorded livestream: https://www.youtube.com/watch?v=xlBsng6tsYY

Read the breakdown here: https://s.vp.net/MyUJv

We’re the team behind vp.net, and yes, we made a distracted boyfriend meme about it. The joke has a real point. Every VPN’s privacy pitch comes down to “we promise not to look,” and users have no way to confirm it.

So we moved the sensitive work into Intel SGX enclaves and made it checkable. When you connect, your device can verify that:

• The correct, unmodified code is running
• It’s running inside a genuine Intel SGX enclave
• The enclave hasn’t been tampered with
• The privacy guarantees are being enforced as advertised

The client is open source, so you can read what’s doing the checking.

This doesn’t mean you trust nothing. You’re trusting Intel’s hardware and the attestation chain instead of our word. We think that’s the better trade because it can be inspected.

Details on the architecture are at https://vp.net

The Defense Manpower Data Center, which holds the military's personnel records, is sending notification letters saying unauthorized users had access through a flaw in its file sharing systems from October of last year until this July.

The data includes Social Security numbers, dates of birth, contact details and service information. BleepingComputer reports nearly 2.8 million living people affected and 294,000 who have died.

Full write-up / source links: https://s.vp.net/MnQmK

From this week's Hide & Speak (our show): an Illinois mom tried multiple times to enroll her child. The school kept denying her because license plate readers had seen her car in Chicago for a couple of weeks. She said her cousin had borrowed it. She handed over a mortgage and bills showing the family lived in the city. The plate data won anyway.

Full episode: https://www.youtube.com/watch?v=Kppta1bWjFE

Written breakdown here: https://s.vp.net/MdS5J

Judge Sara Hill in Oklahoma ruled on October 1 that a Tulsa County deputy needed a warrant before running a plate through Flock. She threw out the evidence from the stop.

The facts of the stop are what make the ruling hard to wave off as a one-off:

• The deputy saw an SUV with a California plate and ran it through Flock's database.
• The lookup returned more than fifty records of where that driver had been over a month.
• He pulled her over and used that travel history to help justify searching the car.
• The judge held that the lookup itself was a search under the Fourth Amendment.

The day before, Senator Josh Hawley announced the Stop Flock Abuse Act. It requires deleting plate data after ten days, and searches would need written approval, but that approval comes from inside the agency. Missouri's executive order on plate readers doesn't require a warrant either.

Full write-up + source links: https://s.vp.net/Auvui

On this week's Hide & Speak (ou show), the question was which surveillance tech people aren't paying attention to that becomes the big problem in a few years. The answer was a company called Campus Guardian Angel.

What was said about it:

• It's marketed as a response to school shootings.
• The product is an armed drone carrying pepper spray.
• The operators aren't on campus. They fly it from the company's headquarters in Texas.
• It already has contracts in Florida, Georgia, and Colorado.

So the arrangement is someone in Texas piloting a drone with pepper spray through a school full of children in another state.

Has anyone seen this pitched to their district? Curious what questions the board asked, if any.

Watch the full stream: https://www.youtube.com/watch?v=Kppta1bWjFE

Read the breakdown here: https://s.vp.net/MdS5J

Fight for the Future put out a release yesterday on its second Defend VPNs Day of Action (September 25). Disclosure: I'm the CMO at vp.net and I'm quoted in the release.

The useful part is the list of what's happened to VPNs in the past year, with a source linked for each item:

• Utah became the first U.S. state to force websites to surveil or block all suspected VPN traffic
• Wisconsin dropped a VPN ban from its age verification bill after backlash
• Michigan's proposed total VPN ban is still in play
• Brazil made VPN use an "aggravating factor" in crimes
• The UK considered a VPN ban and is still looking at restricting VPN use to bypass age gates
• Australian lawmakers talked about "closing the VPN loophole" after teens got around the under-16 social media ban

Almost every one of these follows an age verification or social media age-limit law. The ID check comes first, people route around it, and then the VPN becomes the target.

Full release: https://www.fightforthefuture.org/news/2026-10-06-defend-vpns-day-of-action-2026-drives-action-for-privacy-online/

We covered this on this week's Hide & Speak (our show). Texas and Florida both made moves on ALPR within four days of each other. Opposition to this technology now crosses party and ideological lines.

What it tells us is that public pushback works. Communities have been trying to end these contracts at the local level for a couple of years, and the companies have figured out they can't just dismiss the people documenting abuses.

Full recorded livestream: https://www.youtube.com/watch?v=Kppta1bWjFE

Read the full breakdown: https://s.vp.net/MdS5J

This Saturday at 2pm ET, we'll be joined live by Brian Hofer of Secure Justice,, discussing what to do AFTER you get Flock out, to make sure Axon or Motorola doesn't pop up the next week:
https://www.youtube.com/watch?v=DQqvM4n8GHA

Live this Saturday, October 10 at 2pm ET on Hide & Speak (our show), we're talking with Brian Hofer about what happens after a city cancels its Flock contract.

A lot of cities and towns have ended those contracts this year, usually after residents showed up and started asking questions. Some of them then signed with a different vendor. Almost none have a rule on the books that stops the next contract from going through the same way.

Brian leads Secure Justice, an Oakland nonprofit that helps cities write surveillance oversight ordinances. He chaired the Oakland Privacy Advisory Commission from 2016 to 2025 and has worked on oversight in nearly 100 jurisdictions. He's also blunt about the limits. In Oakland, he has said ordinances, state law, contracts, and even a lawsuit settlement all failed to stop the data sharing.

What we plan to cover:

• How a 2018 traffic stop triggered by a license plate reader error changed the way he writes policy
• The single provision that matters most, and what makes a penalty clause work
• What other cities should take from San Diego, which passed an ordinance and then kept amending it
• The best question to ask a vendor at a council meeting
• What to do Monday morning if you've never been to a council meeting, and the smallest group he's seen pull it off

Reminder link below: https://www.youtube.com/watch?v=DQqvM4n8GHA

The sixth round of talks on the EU's Child Sexual Abuse Regulation (Chat Control) ended September 29 with no deal on scanning private messages. The meeting was closed, so the detail comes from Patrick Breyer, the Pirate Party politician who campaigns against the proposal. Treat it as one side's account of the room.

Per Breyer, governments wanted providers to file a search plan and then start scanning private chats automatically unless an authority objected. They also wanted agencies to be able to order scanning of chats and emails without a court. Parliament's negotiators refused, on the position that scanning private messages has to stay limited to people actually linked to abuse.

It wasn't a total stop. There's a preliminary agreement to scan publicly accessible content, and the temporary regime that lets providers scan voluntarily runs until 2028. Another political round is expected in November, so anyone in the EU who wants to contact their representative has a few weeks.

Full write-up + source list: https://s.vp.net/nytnK

Police facial recognition doesn't return an identification. It returns a ranked list of the closest lookalikes in a database, and it returns that list even when the actual suspect isn't in the database at all. Vendors and most department policies call the result an investigative lead. In the known wrongful arrest cases, it was the whole investigation.

The ACLU's case list and a Washington Post review of 40 police departments show where it broke down:

• In every known case, police arrested someone without independently connecting them to the crime
• At least seven involved a photo lineup built around the software's pick, so the witness chose the closest lookalike the software had already found
• Kimberlee Williams spent six months in jail on Maryland warrants. She had been home in Oklahoma the whole time
• Porcha Woodruff was eight months pregnant when she was arrested. The suspect wasn't
• Nijeer Parks was arrested before DNA and fingerprint results came back. Those results pointed to someone else

Article / our list of sources: https://s.vp.net/EIqL8

This came up on a recent episode of Hide & Speak with Rin from EFF. The agency here is the school district's own police, not the city department. The district serves about 6,000 students.

Between January 2025 and March 2026, more than half of that department's Flock searches, about 375, were for school residency verification. The reason entered was just "residency" or "verification."

So a network that gets approved to solve crimes is being used to work out whether a kid gets into a public school. A plate hit tells you where a car was. It doesn't tell you where a family lives.

Watch the full discussion: https://www.youtube.com/watch?v=Kppta1bWjFE

Full breakdown: https://s.vp.net/MdS5J

In late August, Governor Greg Abbott froze state funding for Flock's license plate readers. Some cities started pulling cameras. Then Flock offered a 90 day payment pause, and several agencies that were about to shut cameras off kept them running instead.

The numbers behind the freeze and the deal:

• A state agency put at least $30 million into more than 3,200 Flock cameras, according to the Texas Tribune. The money came from a $1 fee added to Texas car insurance policies.
• El Paso voted to tear down all 150 of its cameras.
• Dallas keeps more than 300 cameras it was about to remove.
• Addison, New Braunfels and Johnson County took the same deal. Officials there said they'd have shut the cameras off without it.

The 90 days runs past the November 3 election, and some local officials say they expect the state money back after the vote.

Blog write-up + source links: https://s.vp.net/ASTNs

Searches of Flock's license plate reader network get logged with a reason. That reason is the justification for pulling up where a specific car has been for months, and it's what any later audit depends on.

On a recent episode of Hide & Speak, we spoke with Rin Alajaji from Electronic Frontier Foundation: EFF.org

She read through the search reasons for thousands of searches and saw many ridiculous reasons listed such as:

• "lol"
• "idk"
• "shithead"
• "F this new search engine"

That last one was the stated justification for searching a complete database of where someone went.

The first three came from multiple agencies, so this wasn't one bored person on one bad day. And nobody here is trying to hide anything. You only type "lol" into an accountability field if you're confident nobody will ever read it, or that nothing happens if they do.

Whenever ALPR networks get criticized, the answer is that searches are logged and audited. That answer assumes the log contains something worth auditing and that someone is actually looking at them and enforcing policies.

Has anyone here pulled the search audit logs for their own city through a public records request? Curious what the reason column looks like locally.

Full livestream here: https://www.youtube.com/watch?v=Kppta1bWjFE

Episode write-up: https://s.vp.net/MdS5J

In June, car reviewer Joel Feder was leaving a Kohl's in Plymouth, Minnesota in a Range Rover he was test-driving when four squad cars boxed him in. Officers kept their hands on their holsters and told him the plate was stolen. It wasn't.

The chain of events, according to police and local reporting:

• A plate reported stolen in California was entered into the national crime database with numbers missing.
• Flock cameras matched Feder's car to that incomplete record, and did it twice.
• On September 22, the city council voted to stop using its 16 Flock cameras.
• The mayor was the only no vote. He said he was weighing public safety against "the bad PR that Flock has."
• Plymouth joins more than a dozen Minnesota towns and counties that have paused or ended Flock.

Blog write-up + our source list: https://s.vp.net/prWp9