CySecurity News - Latest Information Security and Hacking Incidents: Privacy

Data protection law Digital Personal Data Protection Act DNPA Petition Investigative Journalism Journalism Rights Press Freedom Privacy Right To Information Supreme Court Of India

Publishers Move Supreme Court Against Key Provisions of Data Protection Law

Digital News Publishers Association (DNPA), representing 21 prominent news organizations, has filed suit with the Supreme Court challenging provisions of India's Digital Personal Data Protection Act, 2023, and the DPDP Rules, 2025. As a result of the current data protection framework, journalists could be restricted in their activities, investigative reporting may become complex, and public access to information may be limited.

Upon receiving notices from the Union Ministry of Law and Justice and Ministry of Electronics and Information Technology (MeitY) on October 27, 2026, the Supreme Court requested the Centre's response to the challenge. This case emphasizes the conflict between preserving the right to maintain an individual's digital privacy and preserving the right to investigate and report issues of public interest for the press.

Indian Parliament passed the DPDP Act in August 2023, the first comprehensive law specifically designed to protect digital personal data. It establishes rules for organizations and other entities that collect and process personal information. Under the Act, these entities are considered Data Fiduciaries and are required to obtain the consent of individuals before processing personal data, except for certain permissible purposes listed below Section 7.

A significant financial penalty is also introduced in the legislation, with data protection violations resulting in fines as high as Rs 250 crore. On November 13, 2025, MeitY notified the DPDP Rules for setting up the operational framework, with phased implementation over a period of 18 months. However, news publishers contend that the legislation does not specifically exempt journalistic activities from its provisions.

A clear provision for news reporting is not provided by Section 7, which identifies legitimate purposes for processing personal information, nor by Section 17, which lists exemptions from the Act. According to the DNPA, this omission may pose significant challenges for reporters investigating individuals, institutions, or organizations.

While investigating issues involving public accountability, journalists often obtain personal information from public records, interviews, documents, and other sources. A lack of a journalistic exemption may raise questions about whether consent is required before such information may be collected or used. Further, the association emphasized that earlier versions of data protection legislation, drafted in 2018, 2019, and 2021, included exemptions for journalistic purposes. They have been removed from the final framework and are a key part of the legal challenge.

Moreover, the dispute also involves amendments to the Right to Information Act (RTI Act), which raise concerns regarding the impact of the new provisions on transparency and access to government information. DPDP Rule 23 also presents a challenge, which provides the Central Government with the authority to request information from Data Fiduciaries and intermediaries through an authorized agent. Moreover, the rule prohibits these entities from disclosing the fact that a request has been made.

News publishers have expressed concern over the possibility that the provision could affect the confidentiality of journalistic sources and create confusion regarding the handling of information obtained during investigations. Moreover, the association has questioned the amendment to Section 8(1)(j) of the Right to Information Act, which was implemented by Section 44(3) of the DPDP Act.

A public authority previously had the option of withholding personal information that had no connection to public activities or that could cause an unwarranted invasion of privacy. If a larger public interest justified the disclosure, information could be released. Information related to personal information has been broadly exempted from the amended provision.

Publishers argue that this change could make it more difficult for them to obtain government records required for investigations of matters such as conflicts of interest, public appointments and the use of public funds. Those seeking information about welfare programs, recruitment processes, and government services can also benefit from such information. However, the amendment does not remove every route for disclosure.

Information may be released in accordance with Section 8(2) of the RTI Act when the public interest outweighs the potential harm to protected interests. Despite the government's assertion that stronger privacy safeguards are necessary for preventing misuse of personal information, the current provision pertaining to public interest continues to protect transparency as it does today. In addition, the legal dispute involves constitutional protections of privacy.

In its 2017 Justice K.S. Puttaswamy decision, the Supreme Court recognized privacy as a fundamental right under Article 21, albeit clarifying that the right is not absolute. This case raises the question as to how that protection should be applied simultaneously with freedom of speech and information access rights for the public. After issuing notice to the Centre, the Supreme Court declined to grant an interim stay on the challenged provisions before hearing the government's response.

According to the bench, a blanket restriction on disclosure of digital personal information is not necessary, but a more proportionate approach is required. Additional hearings will be held on November 17, 2026 in regards to this matter. An examination by the court may have broader implications for how the privacy laws in India apply to news organizations, investigative reporting, and the public's right of access to public records.

It is expected that the Supreme Court's decision in this case will have a significant impact on the balance between individuals' rights to privacy, freedom of the press, and access to information for the general public. Its findings may also affect the way news organizations handle personal data when conducting investigations in India.

The Robot Vacuum in Your Living Room May Know More About You Than You Think



 

wifi network

2FA AI Cloud Security Data Theft firmware Privacy Robots Technology vacuums wifi network

The Robot Vacuum in Your Living Room May Know More About You Than You Think

The device quietly navigating your living room floor might be doing more than picking up crumbs. Robot vacuums, now a fixture in millions of homes, collect data that goes far beyond what most buyers realize when they pull one off the shelf. Depending on the model, a connected vacuum can generate detailed floor maps, record cleaning histories, capture ambient audio through built-in microphones, and stream live video to an app on your phone. Some models let you monitor progress remotely, routing that footage and data through the manufacturer's servers. And while the machine charts a path between your couch and your coffee table, it may be quietly building a picture of how you live.

iRobot, maker of the popular Roomba line, spells out its data practices in its privacy policy. Connected models can send room names, floor types, detected objects, robot movements, and Wi-Fi network details back to the company. That is not a hidden clause buried in fine print, but it is something most consumers never read before buying. For businesses, this kind of information carries real commercial value: consumer behavior data, household layouts, and everyday habits are precisely the intelligence that advertisers and smart home companies have long sought.

The Flaw That Opened 7,000 Homes

In February 2026, a software engineer named Sammy Azdoufal set out to do something benign: control his DJI Romo vacuum with a PlayStation 5 controller. What he found was a flaw that handed him access to roughly 7,000 other people's vacuums across more than 20 countries.

Azdoufal, an AI strategy specialist, reverse-engineered how the Romo communicated with DJI's servers. The backend authentication system accepted his device token as valid for thousands of other users' devices. From that position, he could view live camera feeds, hear microphone audio, see floor plans and room layouts, and check battery levels and cleaning status. He reportedly watched a journalist's vacuum operating in that person's living room in real time.

"Devices promising convenience can invite unseen observers into private spaces." [Dallas Express, February 2026]

Azdoufal notified DJI immediately. The company closed the vulnerability by late February and attributed the problem to a permission issue in its MQTT communication system, deploying automatic updates that required no action from users. The Romo model was removed from DJI's online store two days later. DJI said no widespread misuse had been detected. Critically, Azdoufal did not bypass encryption or use any sophisticated hacking technique. The problem sat on DJI's server, where device data was stored in plain text and access controls were loose enough that a legitimate customer's token opened thousands of doors.

This was not an isolated episode. In 2024, hackers took over Ecovacs Deebot X2 robot vacuums in several American cities, steering the machines remotely and playing racial slurs through their speakers. Minnesota lawyer Daniel Swenson, one of the affected users, described the intruder: "I got the impression it was a kid, maybe a teenager."

What the Vacuum Actually Knows About You

The data a robot vacuum collects is more revealing than it first appears. Floor maps trace the layout of your home, including where you sleep, where you store valuables, and the shape of your living spaces. Object detection features identify furniture, shoes, and personal items. Layer microphone access on top of that and the device starts resembling something other than a cleaning appliance. A privacy policy describes what a company intends to do with your data. It does not guarantee the product is free of security vulnerabilities. An attacker who reaches a manufacturer's servers could access whatever has already been collected, regardless of what any policy says.

Buying a Vacuum That Collects Less

Not every connected vacuum poses the same degree of risk. Buyers wanting to limit their exposure should look for models that process navigation data locally rather than routing it through manufacturer servers. Matic, a smaller company, builds its vacuum around that principle: maps stay on the home Wi-Fi network and all processing happens on the robot itself. Remote app access is available, but only through encrypted cloud infrastructure with explicit user consent.

One distinction worth keeping straight: a camera-free model still generates maps and sends account data to the manufacturer. "No camera" and "no data collection" are not the same thing. Mandatory cloud features, with no option to use the device offline, are a signal worth weighing as a dealbreaker before purchase.

Steps for People Who Already Own One

For the millions of households already running a connected vacuum, a few changes lower the risk without requiring a new purchase. Set a strong, unique password and enable two-factor authentication on any linked account. Keep the vacuum's firmware updated. Disable remote viewing and other cloud-connected features unless you actually use them. The fewer connections left open, the smaller the surface available to anyone looking for a way in.

Researchers Identify Spyware Attacks Targeting Two Serbian Opposition Figures



 

Serbian Opposition

Citizen Lab cyber espionage digital surveillance Mobile Phone Security NSO Group Pegasus Spyware Privacy Serbia Spyware Attack Serbian Opposition

Researchers Identify Spyware Attacks Targeting Two Serbian Opposition Figures

There have been allegations of spyware targeting two prominent Serbian figures, raising new concerns about digital surveillance in advance of the country's parliamentary elections scheduled for October 25, 2026. As part of a partnership with Serbia's SHARE Foundation, Citizen Lab researchers confirmed that Vladan Đokić, rector of the University of Belgrade, had his iPhone compromised by Pegasus spyware earlier this year.

A former prosecutor, Rade Baji, was identified as a potential target by the investigation. According to Reuters, Apple notified Baji on August 13 that his phone had been infiltrated with spyware targeting mercenaries. The forensic investigators, however, have not yet determined whether his device was successfully compromised or identified the method used in the suspected attack.

Pegasus is a highly sophisticated spyware program developed by the Israeli surveillance technology company NSO Group that can be used to obtain extensive access to a targeted computer system. Depending on the circumstances of an infection, such access can expose private communications and other sensitive information stored on the phone Đokić has drawn attention for its support of Serbian student-led protest movement, which has organized anti-corruption demonstrations against the government since November 2024.

The positions he holds have also brought him into conflict with the authorities According to Citizen Lab, Serbian authorities raided his offices in March and seized computers and servers as a result of tensions surrounding the student protests. The former prosecutor was involved in proceedings against senior government officials alleged to have engaged in irregularities in connection with a proposed redevelopment project at the protected historic military site in Belgrade.

The development was planned by a company affiliated with Jared Infected devices are known as zero-click exploits. They are a method of compromise that does not require a user to click a link, open an attachment, or take any other action. As of yet, researchers have not publicly identified those responsible for the attack, and the investigation continues.

There is less conclusive evidence regarding Baji's case despite Apple's August threat notification indicating mercenary spyware might have been used to target him, but investigators have not determined whether he successfully received the malware. Despite Apple's confirmation that threat alerts were sent to users on August 13, the company has not commented specifically on the two incidents reported. These incidents have renewed concern about the use of commercial surveillance tools by public institutions against their employees.

According to the SHARE Foundation, targeting university officials and judges could result in weakened institutional independence, restrictions on freedom of expression and discouraged investigations into public interest matters. In addition, the organization highlighted the broader pattern of surveillance allegations in Serbia.

There have been reports of at least 14 students, activists, and opposition figures having been targeted with spyware in September. A student activist, Jelena Kontić, filed a criminal complaint on October 6 with Serbia's Prosecutor's Office for High-Tech Crime regarding the alleged installation of Pegasus on her cellphone. Attempts to identify the individuals or organizations behind the latest suspected attacks have not been successful.

Both the Serbian Interior Ministry and NSO Group have not responded to requests for comment. According to the company's previous statements, its technology is marketed to government agencies and commercial relationships involving serious misuse may be terminated. According to the US government, NSO Group was placed on its trade blacklist in 2021 after allegations of human rights abuse involving its surveillance technology were raised.

In preparation for the upcoming parliamentary election on October 25, the latest findings have intensified the scrutiny of spyware used against individuals associated with Serbia's protest movement. Furthermore, these cases raise questions regarding the safeguards surrounding powerful surveillance tools and whether independent researchers are able to identify responsible individuals when such technology appears to be employed against civil society representatives.

A number of recent attacks have raised concern about commercial spyware targeting civil society and public institutions. As Serbia prepares for parliamentary elections, these findings raise further questions regarding surveillance practices, accountability, and safeguards to prevent cyberespionage tools from being misused.

Microsoft's Xandr Handed Norway's Largest Privacy Fine for Funneling Grindr User Data to Thousands of Advertisers



 

Xandr

Advertising Data Regulation European Union GDPR Grindr Microsoft Norway Privacy sensitive data Xandr

Microsoft's Xandr Handed Norway's Largest Privacy Fine for Funneling Grindr User Data to Thousands of Advertisers

Norway's data protection authority has issued its largest fine to date, hitting Microsoft-owned advertising company Xandr with a NOK 92 million ($9.6 million) penalty for passing sensitive personal data belonging to Norwegian Grindr users through automated advertising auctions without a legal basis. The decision, signed October 2 by Datatilsynet Director General Line Coll and Head of International Tobias Judin, targets one of the most contested privacy questions in digital advertising: whether ad intermediaries can claim ignorance of how consent was collected by the apps they serve.

Grindr is a location-based dating app primarily used by gay, bisexual, trans, and queer people. For nearly two years, from July 2018 to April 2020, Xandr sat at the center of the app's advertising infrastructure, operating on both the buying and selling sides of real-time bidding. The process works fast and invisibly. The moment a user opened Grindr, the app passed their data through Xandr to a pool of companies competing in a split-second auction for the right to show that person an ad. Datatilsynet found that this relay included at minimum each user's advertising ID, IP address, and the fact of their Grindr use. Under GDPR, that last detail matters enormously. The authority concluded that being identifiable as a Grindr user is itself information that indicates sexual orientation, a category that European data law places under strict protection and requires explicit consent to process.

Xandr's defense rested on the argument that it believed Grindr had already collected consent from its users. Datatilsynet rejected that reasoning on a straightforward legal basis: Xandr was not a passive conduit but a joint controller alongside Grindr. Under GDPR's joint controller framework, both parties carry independent obligations to confirm a lawful basis exists before processing sensitive data. Xandr never verified that any such basis was in place, and the authority ruled that the company had no right to treat consent as someone else's responsibility. "Xandr omitted to verify that the consents from Grindr were valid, and did not do anything to ensure they had a legal basis for their own processing," Coll stated in the decision.

The investigation turned up a complicating detail. Xandr had been notified of the probe by Datatilsynet in February 2020. Despite that, the company deleted documentation about its processing of Grindr users' data between July 2020 and February 2023, when the authority sent a second information order. Xandr told investigators the deletion had occurred as part of its routine data retention policies. Datatilsynet refused to let that explanation close the gap, noting that the company knew an active investigation was underway when the records were removed.

In setting the penalty at NOK 92 million, Datatilsynet cited the duration of the violations, the direct financial benefit Xandr drew from the unlawful sharing, and the fact that thousands of Norwegian users had their sensitive data exposed to potentially thousands of companies without their knowledge. Crucially, the fine was calculated against Xandr's own annual turnover and not Microsoft's. The authority noted that the violations took place before Microsoft completed its acquisition of Xandr in June 2022, after AT&T sold the unit it had rebranded from AppNexus in 2019.

A Microsoft spokesperson mentioned that the investigation "focused on conduct that predates Microsoft's acquisition of Xandr," adding that interpretations and applications of legal standards have continued to evolve since then. The company said it is reviewing the decision and assessing its options. Xandr, which now operates as Microsoft Advertising, has three weeks to appeal to Norway's Privacy Appeals Board.

The case has roots in January 2020, when the Norwegian Consumer Council filed complaints against Grindr and five ad tech companies: AppNexus, MoPub, OpenX, AdColony, and Smaato. Austrian privacy rights organization noyb joined the action and celebrated the outcome, calling the decision "a major blow to the online adtech industry." This week's fine against Xandr is the downstream enforcement of a broader probe that, on the Grindr side, produced a NOK 65 million penalty against the app itself in 2021. Norway's Borgarting Court of Appeal upheld that fine against Grindr in October 2025 after the company challenged it through two rounds of litigation.

Grindr's data-sharing history has had consequences beyond Norwegian borders as well. In September 2026, the dating app agreed to pay £26 million to settle a UK class action brought by roughly 12,000 users who alleged the platform had shared information including HIV status, sexual orientation, ethnicity, and location with third-party advertising firms before 2020. The London lawsuit, filed in April 2024 by law firm Austen Hays, alleged violations of UK data protection law during roughly the same period covered by the Norwegian proceedings.

The Datatilsynet decision marks one of the more pointed statements yet from a European privacy regulator on how far down an ad supply chain accountability can reach. By treating Xandr as a joint controller rather than an infrastructure provider, the authority made clear that operating the pipes through which sensitive data flows carries its own legal obligations, regardless of which company collected the data in the first place.

Supabase Misconfigurations Leave Customer Data Publicly Exposed



 

Supabase Security

Cloud Database Security Cybersecurity Database Misconfiguration Privacy Sensitive Data Exposure Supabase Data Exposure Supabase Security

Supabase Misconfigurations Leave Customer Data Publicly Exposed

A cybersecurity firm UpGuard has found that thousands of databases hosted on Supabase can expose private information to the public internet. According to the research, approximately 16,000 databases hosted on the platform were able to be accessed by individuals through some form of personal data. The findings indicate that misconfigured databases and applications are a recurring security issue.

Data storage and operations are widely facilitated by Suprabase for web and mobile applications, while the increasing use of artificial intelligence-assisted vibration coding has allowed developers with limited security expertise to create and deploy applications more easily. Among the exposed databases, UpGuard found names, addresses, telephone numbers, and passwords that were publicly accessible. A smaller number also contained authentication tokens.

Various services and projects were connected to the exposed information, demonstrating that the problem is not limited to one type of application or industry. Datasets examined by researchers include private conversations provided by an Indian adult streaming platform, thousands of license plates owned by a valet service in the United States, as well as contacts for immigration and relocation services in the United States.

Another exposed database reportedly served as a gateway to intercepting text messages via a virtual SIM farm. As UpGuard discovered, the database was linked to a consulate of the African government in France. By using these systems, online account holders can receive one-time verification codes, but when their data is left accessible via the internet, additional risks may be incurred.

It is evident that the problem extends beyond isolated incidents; earlier investigations had also identified the public exposure of Supabase databases belonging to startups and widely used applications. UpGuard identified a large number of data sets that were located in the United States; however, the researchers indicated that the exposed databases were part of a global problem.

An analysis performed by UpGuard identified 16,326 databases with Supabase tables that were publicly accessible. Approximately half of the databases contained personally identifiable information, and a smaller number contained passwords, authentication tokens, and payment card information in rare cases. The researchers also tested a sample of the databases to confirm that some of the exposed records contained information that was accurate. There has been prior documentation of this problem.

In 2025, research discovered misconfigured Supabase databases connected to AI-assisted development platforms, and further investigation identified access controls and public key handling issues. The latest findings suggest that similar configuration errors remain widespread as more applications are constructed using AI coding tools for building and deploying.

Although Suprabase has implemented additional security safeguards, researchers noted that they are not necessarily applied automatically when databases are built using programming platforms. Nevertheless, proper configuration remains the only way to prevent unauthorized access to stored data. In addition, the findings highlight the differences between securing the backend of an application and building it.

In contrast to AI-assisted development producing a working application rapidly, security settings around database access remain dependent upon decisions made during deployment. Consequently, access controls that are incorrectly configured can expose a database accessible through a given application when they are incorrectly configured.

Supabase, on the other hand, stated that its projects are automatically secure and that database security is a shared responsibility between all parties. Managing Director of Information Security Bil Harmer stated that customers control how their projects are configured, while Supabase provides security defaults and tools and informs customers as soon as security threats are identified. The company has also implemented security-related changes to its platform over the years.

The scope identified in the latest research, however, indicates that customer-side database configuration remains a critical part of the security equation, given that Supabase continues to be used for applications developed using artificial intelligence-assisted development tools. This study demonstrates that poorly configured cloud databases pose security risks, particularly as AI-assisted development continues to accelerate application deployments.

Maintaining strict access controls and configuring databases carefully remain essential to prevent the public from having access to sensitive information.

Flock Sought to Expand Surveillance Through Uber and Lyft Drivers



 

Uber Surveillance

ALPR Surveillance Automatic License Plate Readers Flock Safety license plate tracking Mobile Surveillance Privacy Privacy Concerns Uber Surveillance

Flock Sought to Expand Surveillance Through Uber and Lyft Drivers

By using rideshare and delivery vehicles as mobile surveillance platforms, Flock Safety may be able to extend its automated license plate reader network beyond fixed roadside cameras. An overview of 404 Media's company presentation outlines a proposal which involves Uber, Lyft, and delivery drivers having dashcams equipped with license plate scanning capabilities.

With the proposed partnership with Nexar, Flock would be able to extend its surveillance reach to approximately 350,000 vehicles by partnering with the dashcam manufacturer. In addition to cameras installed at fixed locations, the system will collect license plate data from participating vehicles as they travel through different areas, creating a more mobile and flexible coverage.

Flock's existing network consists of large number of automatic license plate reader cameras mounted at fixed locations. Those cameras are capable of recording a vehicle's plate, color, and model at a specific point, however mobile coverage may provide additional information about the vehicle's movement beyond the camera location. The proposed expansion thus posed a wider privacy concern regarding the collection and tracking of license plate information across public roads.

The project was of considerable scale. The presentation provided by flock stated that it could build a network of approximately 350,000 rideshare and delivery vehicles and extend its existing fixed-camera infrastructure. With this expansion, the company would be able to obtain license plate information from moving vehicles in areas where roadside cameras are not installed. Additionally, the plan leaves several questions unanswered regarding consent and disclosure.

In the event that Uber, Lyft, delivery companies, or individual drivers were informed that dashcam footage could be used for the purpose of collecting license plate information, it is unclear whether they were informed. According to the details presented by Flock to the Georgia attorney general’s office, passengers could have been recorded without any direct notice.

By obtaining the document through a public records request, a Georgia resident provided 404 Media with a detailed look at how the proposed system was presented to government officials. The partnership with Nexar was not implemented, according to Flock. Although the presentation indicates that the company was considering expanding its surveillance infrastructure by incorporating privately operated vehicles, it still shows that they were considering this option. Uber, Lyft and Nexar did not respond to 404 Media's requests for comment.

The proposal comes after earlier scrutiny of the companies and their data practices. In 404 Media's previous reporting, a security breach involving Nexar resulted in the exposure of a large collection of customer footage, which included recordings of military facilities. Using leaked information, the outlet has also reported on a separate Flock project that attempted to link license plate records with individuals' identities. This initiative has been abandoned. The same model is already being used elsewhere.

The BusPatrol system, which equips school buses with cameras and provides resulting data to law enforcement, illustrates how private surveillance systems can be integrated into larger surveillance programs. Using rideshare and delivery vehicles would have further expanded Flock's model to include a large and continuously moving fleet of delivery vehicles.

As a result of this proposal, growing concerns have been raised regarding automated license plate surveillance, as well as the lack of transparency surrounding the collection and sharing of mobility data with law enforcement agencies.

Flock Cameras Spark Debate Over Surveillance and Civil Liberties



 

Vehicle Tracking

ALPR Surveillance Flock Cameras Flock Safety License Plate Readers Mass Surveillance Privacy Vehicle Tracking

Flock Cameras Spark Debate Over Surveillance and Civil Liberties

With Flock Safety operating one of the largest networks of automatic license plate readers (ALPRs), automatic license plate readers (ALPRs) are becoming more common across the United States as part of surveillance infrastructure. As a result of their rapid expansion, privacy advocates have expressed concern that such systems may create detailed records of vehicle movements in communities across the nation.

How Flock Cameras Work

While traffic enforcement cameras usually focus on specific violations, Flock cameras photograph passing vehicles and translate the images into searchable records. License plates, locations, times, make, model, color and body type can all be included in records, along with distinguishing features such as bumper stickers or visible damage that can assist investigators in finding a particular vehicle or based on broader descriptions.

Watchlists are also available for cars associated with stolen vehicles, missing people, or criminal investigations, triggering alerts in the event that a potential match is detected. It is possible for participating law enforcement agencies to search the data of other agencies, depending on how their networks are configured.

Why Police Departments Use Flock Cameras

A flock camera is a compact device that captures passing vehicles and records information such as license plate numbers, vehicle make and model, color, and location. Throughout the course of the investigation, data will be stored in a searchable system that will allow participating law enforcement agencies and other authorized organizations to access the system, potentially enabling the tracking of individual vehicle movements.

The company claims that its technology does not utilize facial recognition and that customers can manage access to collected data through controls. However, given the extent to which its network is deployed, concerns have been raised about the manner in which vehicle data is shared, retained, and utilized. Approximately 120,000 cameras are now deployed across 49 states in the company's system, which is deployed by police departments, businesses, schools and homeowner associations in more than 6,000 communities.

With the capabilities of the technology, more than just a license plate can be captured, as the records may include distinctive vehicle characteristics such as bumper stickers, dents, and other visible features. With the proliferation of surveillance cameras along public roads as well as private properties, questions regarding data access, civil liberties, and data privacy are becoming increasingly difficult to separate from the broader discussion surrounding public safety technology.

Why Flock Cameras Are Controversial

It is not just about a single camera recording the movement of a vehicle that is of concern, but the network surrounding it at large. By using a large number of cameras, investigators may be able to reconstruct patterns of movement involving individuals who are not suspected of committing crimes by repeating recordings of the same vehicle at various times and locations.

The use of vehicle-location data has also been criticized by privacy advocates, who have noted that it may reveal visits to sensitive areas, such as health facilities, protest sites, and churches. Searches based on historic ALPR records are still subject to legal uncertainty, including when warrants are required. Flock rejects the characterization that its system constitutes mass surveillance, however.

Data Sharing Raises Additional Concerns

In addition to bringing Flock into the debate about immigration enforcement, data sharing has brought Flock into the public eye. According to a 2025 review of search logs, there were more than 4,000 Flock searches conducted by local and state police at the request of federal authorities, including searches that may have been related to immigration enforcement.

An investigation conducted in 2026 revealed that outside police departments searched school cameras. It has been contested that the federal government has direct access to Flock's cameras, claiming it does not have a contract with U.S. Immigration and Customs Enforcement and does not have the right to access its data or cameras directly.

Unauthorized Access and Personal Misuse

In addition to allegations of misuse, there have been 28 documented cases in which officers are alleged to have abused license plate reader systems to monitor spouses, former spouses, colleagues, or romantic interests.

Another instance occurred in July 2026 when North Carolina authorities arrested a Charlotte-Mecklenburg police officer who was accused of conducting an unauthorized license plate search for a non-law enforcement purpose using Flock and the state criminal justice database.

Flock Cameras Can Also Produce False Alerts

If surveillance data is inaccurate, it can also pose problems. During June 2026, a driver in Minnesota was stopped by Flock alerts triggered by license plates that were similar to license plates reported stolen in another state. According to Flock, license plate translations are sometimes incomplete or inaccurate, which can result in negative consequences when automated alerts are used to influence police conduct.

Communities Push Back Against Flock Surveillance

Over 80 municipalities have reported terminating or refusing to renew their Flock agreements, while Washington has imposed restrictions on how license plate data can be collected, searched, and shared as a result of the debate.

Opposition to the technology has gone beyond policy debates. There have been at least 33 incidents in which Flock cameras have been damaged or destroyed, including cases where cameras have been painted, blocked, cut down, or burned in 23 states.

Sunbird Brings iMessage to Android Back After 2023 Security Scandal



 

Sunbird

AI Assistant Apple cybersecurity concerns Encrypted RCS iMessage Messaging Privacy sms Sunbird

Sunbird Brings iMessage to Android Back After 2023 Security Scandal

Sunbird has relaunched its iMessage app for Android users nearly three years after security issues forced the company to pause the service in 2023.

The app is now available on the Google Play Store and allows Android users to access iMessage conversations, including blue-bubble messages and group chats with iPhone users. Sunbird has also combined iMessage with Google Messages, RCS and SMS/MMS in the same application.

The company says the new version has been rebuilt with changes to how messages, Apple ID credentials and media are handled. Sunbird claims messages are encrypted on the Android device before they leave it, protected while travelling through its infrastructure and encrypted at rest using AES-256. It also says Apple ID passwords are used once to establish an iMessage session and then deleted.

The relaunch comes after researchers identified serious security problems in Sunbird's earlier implementation, including the transmission of Apple ID credentials over an unencrypted HTTP connection and access to messages and media stored through Firebase. Those findings led to the removal of Nothing Chats, an iMessage app developed by Nothing using Sunbird's technology, and Sunbird subsequently paused its own service.

Sunbird returns to the Google Play Store

Sunbird Messaging announced on August 5 that its Android application was open to all users through Google Play following an early-access period. The company said more than 181,000 people had signed up before the public launch.

The application is designed to allow Android users to participate in iMessage conversations without owning an iPhone, Mac or another Apple device. Sunbird says users can appear in blue-bubble conversations on iPhones and participate in iMessage group chats through the Android application.

The new app also acts as a unified messaging platform. Instead of limiting the application to iMessage, Sunbird has brought iMessage, Google Messages through RCS and SMS/MMS into one inbox.

The application now includes a Primary and Secondary inbox. Sunbird says the Primary section is intended for important conversations, while less important messages can be placed in Secondary. Users can control how their conversations are organised.

The company has also said it plans to add WhatsApp and Facebook Messenger support later in 2026.

The service is available with a 14-day free trial, after which Sunbird charges $2.99 per month or $24.99 annually.

What happened to Sunbird in 2023

Sunbird's return follows a security incident that brought its earlier service offline in November 2023.

The issue became widely known after Nothing announced Nothing Chats, an Android application that used Sunbird's technology to provide iMessage functionality on the Nothing Phone (2). Users were required to provide their Apple ID credentials to connect the service to iMessage.

Security researchers then examined the application and identified several problems with how the service handled authentication and user data.

One of the issues involved Apple ID credentials being transmitted to Sunbird's servers over HTTP. Because HTTP does not encrypt the connection, the credentials could potentially be intercepted while being transmitted.

Researchers also found that messages and other user data were being sent to and stored through Firebase without encryption. An investigation by 9to5Google found that researchers could use insecurely transmitted JSON Web Tokens to access Sunbird's Firebase database and view messages and files belonging to users.

The exposed information was not limited to text messages.

Researchers reported that the database contained media files including images, videos, PDFs and audio files. More than 630,000 media files were reportedly stored through Sunbird's Firebase infrastructure at the time. Researchers also found vCards containing information such as names, phone numbers and email addresses.

The problem also involved Sentry, an error-monitoring service. Researchers reported that messages and attachments were being sent to Sentry in plaintext, meaning information intended to be part of private conversations could appear in an error-reporting system.

These findings conflicted with Sunbird and Nothing's earlier statements about encryption. The companies had presented the service as providing end-to-end encryption, but researchers found that data could be accessed through the systems supporting the application.

Nothing removed Nothing Chats from the Google Play Store less than 24 hours after its launch. The company said it was delaying the application while working with Sunbird to address the security problems. Sunbird also paused its own service shortly afterward.

Sunbird says the new architecture handles data differently

For the relaunched application, Sunbird says it has changed how messages and authentication information are processed.

According to the company's security documentation, messages are encrypted on the user's phone before they leave the device. The data is then encrypted while travelling through Sunbird's infrastructure and remains encrypted on the user's device using AES-256. Sunbird also says its connections use certificate pinning.

The company says it does not retain copies of users' conversations on its own servers. Instead, message history remains on the sender's and recipient's devices.

Sunbird says messages passing through its infrastructure are released after delivery. It also says photos and videos sent through the service are automatically deleted from its systems, normally within 48 hours and no later than 72 hours.

The handling of Apple ID credentials has also been changed.

Users still need an Apple ID to connect Sunbird to iMessage. However, Sunbird says the Apple ID password is used only once to establish the session and is then destroyed. The company says it does not retain the password or an authentication token that could later be used to sign into the account.

Sunbird also says each user's iMessage connection operates inside its own private environment. According to the company, that environment is destroyed when the user disconnects or deletes their account.

For messages travelling to an iPhone, Sunbird says Apple's existing iMessage end-to-end encryption protects the final part of the communication. The company says it does not modify or weaken Apple's encryption.

These changes address several of the areas that created problems in the previous version. However, they remain claims made by the company and need to be considered separately from what independent researchers have been able to verify.

Company says independent testing found no critical vulnerabilities

Sunbird CEO Danny Mizrahi has said that an independent security firm tested the rebuilt application and found no critical vulnerabilities. The company is using this assessment as part of its security case for the relaunched service.

The distinction between an independent assessment being conducted and its findings being publicly available is important here.

A publicly available audit would allow security researchers and other experts to examine what was tested, which parts of the application were included, what methodology was used and what limitations applied to the assessment.

For now, Sunbird's public security information provides details about the architecture and the company's data-handling practices, but users should still distinguish between those statements and independent verification of the complete system.

That is particularly relevant because Sunbird's previous service also made strong security claims before researchers found problems with the implementation.

The current application may have been rebuilt to address those problems, but continued independent testing would provide a stronger way to determine whether the new security controls work as intended.

Sunbird adds an AI assistant

Security is not the only area Sunbird is changing with the relaunch.

The company is preparing an AI assistant called Sunbird Intelligence, which is expected to arrive later in 2026. Sunbird says the AI will run directly on the user's phone rather than sending conversations to a remote service for processing.

One planned feature, called "Catch Me Up," is designed to summarise conversations that users have missed. The company also plans features that can draft replies and suggest actions based on conversations.

Sunbird says its AI system will eventually be able to perform tasks such as moving conversations between inbox categories, archiving chats and drafting or sending replies.

The planned AI features introduce another privacy consideration because the assistant would need to process the content of users' conversations to provide summaries and generate replies.

Sunbird's decision to run the AI on the device is therefore relevant to its privacy claims. However, the actual privacy protections will depend on how the system is implemented, what information it can access and whether any conversation data leaves the device when the feature is used.

RCS has also changed the reason for using Sunbird

The messaging market has changed since Sunbird's first attempt to bring iMessage to Android.

Apple introduced support for RCS with iOS 18, giving Android-to-iPhone conversations access to features such as higher-quality media, read receipts and typing indicators when RCS is supported.

This reduces some of the practical differences that previously existed between Android and iPhone messaging.

Sunbird is therefore returning to a market where Android users already have a better cross-platform messaging experience than they did in 2023. The main distinction Sunbird offers is continued access to Apple's iMessage system and the blue-bubble experience.

There are also technical differences. Sunbird's iMessage service does not register a user's Android phone number with iMessage. According to MacRumors, users appear to iPhone contacts through their email address when using Sunbird.

This means the company's proposition has changed from simply providing Android users with features that were missing from SMS-based conversations. It is now combining iMessage access with a broader messaging application that brings several services together.

Sunbird now has to prove its security claims

Sunbird's new application contains several changes compared with the service that was paused in 2023.

The company says messages are encrypted on the device and during transmission, Apple ID passwords are used once and destroyed, media is automatically deleted from its infrastructure, and conversations are not permanently stored on its servers.

These changes address some of the security problems researchers identified in the previous implementation.

However, the history of the service makes independent verification particularly important. In 2023, researchers were able to demonstrate that sensitive information could be accessed through Sunbird's infrastructure despite the company's previous claims about encryption.

Sunbird now has another opportunity to establish whether its redesigned architecture can provide the privacy and security protections it promises.

More than 181,000 people signed up during the early-access period, showing that there is still interest in using iMessage from Android. But with RCS now supported on both major mobile platforms and with the security problems of the previous Sunbird implementation still part of the company's history, the new application's long-term success will depend heavily on whether its security controls withstand continued independent testing.

For Sunbird, bringing back the blue bubble is only one part of the challenge. The larger test is whether users can trust the infrastructure carrying their messages this time.

Vatican’s Official Prayer App Exposed Data of Over 700,000 Users



 

Vatican Prayer App

API Vulnerability Click To Pray Data Breach IDOR vulnerability Privacy User Data Exposure Vatican Cybersecurity Vatican Prayer App

Vatican’s Official Prayer App Exposed Data of Over 700,000 Users

There was a security flaw in the Vatican's official Click to Pray application that exposed personal information linked to more than 700,000 registered users, but the vulnerability remained unknown until it was detected by an independent security researcher earlier this year.

A worldwide prayer network developed by La Machi Communication for Good Causes for the Pope's Worldwide Prayer Network, Click to Pray was launched in 2019 with the endorsement of Pope Francis. Through this service, three daily prayers are delivered as well as papal content on Android, iOS and the web as part of a digital prayer platform.

Independent researcher BobDaHacker discovered in January that API endpoints could provide information about users beyond the accounts associated with their requests. The underlying user IDs were sequentially assigned, making accessing records belonging to other registered accounts possible.

Researchers identified 719,517 registered user IDs within the affected system, which indicates how much information is contained within that system. The vulnerability was addressed by the application developers earlier this year. There was a separate vulnerability in the Click to Pray API that also affected the verification process of email addresses.

The vulnerability is not limited to user details. This API provided the validation hash that was used to verify an account's email address, which enabled attackers to potentially verify an account's email address without accessing the inbox itself. As a result of these weaknesses, multiple points of vulnerability were identified within the application's account system, in addition to the IDOR vulnerability.

Researchers reported the vulnerability to the Pope's Worldwide Prayer Network and Click to Pray on January 3, 2026; however, no response has been received. Multiple attempts to contact relevant contacts have been made, but no response has been received. Over six months later, the issue was finally addressed after the researcher contacted a journalist, who brought the matter to the attention of the Vatican.

A number of security issues have also occurred regarding Vatican-related applications in the past. According to reports, a vulnerability in the Vatican’s Bluetooth eRosary application has exposed account verification PINs in web responses, creating a potential route for account theft. In the latest incident, insufficient access controls highlight the risks associated with applications handling personal information.

Although the Click to Pray vulnerability was reported to have been addressed, the episode raises broader concerns regarding security testing, vulnerability reporting processes and the protection of personal data within religious and public-facing digital services. The user information exposed to the exposure was not limited to this.

Click to Pray API also suffered a separate weakness, which affected the email verification process. A vulnerability in this API allowed attackers to potentially verify an account's email address without access to the actual inbox, resulting in multiple points of vulnerability within the application's account system.

Combined with the IDOR flaw, the vulnerabilities created multiple points of vulnerability. Researchers indicated that the vulnerability was first reported to Click to Pray and the Pope's Worldwide Prayer Network on January 3, 2026. Multiple attempts were made to contact relevant contacts, however none were received. More than six months later, the researcher contacted a journalist, who raised the issue with the Vatican. This incident is the latest in a long-standing history of security issues involving Vatican-linked applications.

A vulnerability in an application associated with the Vatican's Bluetooth eRosary app in 2019 led to the leaking of account verification PINs into web responses, resulting in the possibility of account hijacking. The latest incident illustrates the risks associated with applications handling personal information that lack adequate access controls.

Despite the fact that the Click to Pray vulnerability has reportedly been rectified, the incident raises additional concerns regarding the security testing process, vulnerability reporting processes, as well as data security within religious and public-facing digital services.

Google’s Incognito Mode Does Not Make Users Invisible. Here’s What It Actually Protects



 

Privacy

Browser Browser VPN Security Chrome Data Cookies DNS Google HTTP Incognito mode ISP Privacy

Google’s Incognito Mode Does Not Make Users Invisible. Here’s What It Actually Protects

Google’s Chrome Incognito mode can keep browsing history off a device, but it was never designed to make users anonymous online. A class-action lawsuit over the feature exposed how far that distinction could be misunderstood, with Google agreeing to delete or remediate billions of private-browsing records and change how it explains Incognito to users.

The lawsuit, Brown v. Google, was filed in 2020 and alleged that Google continued collecting information about users while they browsed through Chrome’s Incognito mode and other browsers’ private-browsing modes.

The plaintiffs initially sought billions of dollars in damages, with their claims eventually putting at least $5 billion at stake. However, Google did not ultimately agree to pay $5 billion. Under the settlement, there was no class-wide monetary payout. Instead, Google agreed to data deletion and remediation measures, changes to its privacy disclosures, and additional restrictions on data collection. Plaintiffs’ lawyers valued the settlement’s non-monetary relief at more than $5 billion, with estimates reaching $7.8 billion.

The case nevertheless exposed a fundamental problem with private browsing: preventing a browser from retaining a user's history is not the same thing as preventing websites, network operators or online services from observing that user's activity.

Google employees raised concerns about Incognito

The legal dispute became particularly notable after internal Google communications surfaced during litigation.

In one email, Google Chief Marketing Officer Lorraine Twohill told CEO Sundar Pichai that the company should make Incognito "truly private." She also warned that Google could not market the feature too strongly because it was "not truly private," requiring what she described as "fuzzy, hedging language."

Other internal communications were even more critical of the feature. According to material cited in the litigation, Google employees described Incognito as "misleading" and "effectively a lie," while another employee argued that Google should stop using the Incognito name and its spy-themed icon because users could misunderstand the protection it provided. Another recommendation suggested replacing the messaging with a warning that users were not protected from Google.

These discussions mattered because the lawsuit was not simply about whether Incognito stored browsing history locally. It questioned whether users were being given a sufficiently accurate understanding of what happened to their data after it left the browser.

Google disputed the allegations and maintained that the limitations of Incognito had been communicated to users. A Google spokesperson said the company believed the lawsuit was without merit and argued that Incognito was intended to provide a private browsing experience, rather than prevent websites and services from collecting information.

What Incognito actually does

Chrome's Incognito mode does provide a real privacy function, but that function is primarily local.

When a user opens an Incognito window, Chrome starts a separate browsing session. Once all Incognito windows are closed, Chrome does not retain the browsing history, cookies and site data, or information entered into forms from that session in the normal browser profile. Third-party cookies are also blocked by default in current versions of Chrome, although users can temporarily allow them for particular sites.

This makes Incognito useful in situations where the concern is another person accessing the same device.

Someone using a shared computer, for example, can browse for a gift without leaving the visited pages in Chrome's ordinary history. It can also provide a separate browsing session when a user does not want existing cookies and account sessions to carry over.

But there is an important limitation.

Incognito does not erase everything created during a session. Downloads remain on the device, and bookmarks saved during the session remain available after Incognito is closed. Signing into a website can also allow that service to associate activity with the account being used.

The key distinction is therefore simple: Incognito primarily limits what Chrome stores locally. It does not turn the internet connection into a private tunnel.

Your ISP and network administrator can still see activity

Opening an Incognito window does not prevent an internet service provider from observing network activity.

Google's own documentation states that organizations managing a network, including schools, employers and internet service providers, may be able to observe activity while a user is browsing in Incognito. Incognito also does not hide activity or location from the websites being visited.

This is an important distinction from encryption.

Chrome's HTTPS protections can encrypt traffic between a browser and an HTTPS-enabled website, helping prevent someone monitoring the connection from reading the contents of that traffic. Chrome also warns users when they are about to load sites without HTTPS, while Secure DNS can encrypt DNS lookups in supported configurations.

But HTTPS does not make the user anonymous.

The network still has visibility into connection metadata, while the destination website receives the request and can process information available to it.

In other words, Incognito and HTTPS solve different problems. Incognito reduces local traces. HTTPS protects communications in transit. Neither one, by itself, is an anonymity system.

Websites can still identify and track users

The privacy boundary becomes even clearer once a user reaches a website.

Google's current Chrome documentation explicitly states that Incognito does not change how websites collect data or how the services those websites use collect information. Sites can continue gathering information even when a user is not signed in.

Websites can also use first-party technologies and other mechanisms to understand activity within a session. Third-party cookies are only one part of the tracking ecosystem. Google itself notes that websites can use different mechanisms to personalize content and advertising and learn about activity across sites.

This is also where the distinction between an IP address and browser history matters.

Incognito can prevent a local Chrome profile from retaining the list of pages a user visited. It does not automatically conceal the network address from the websites receiving the connections.

And if a person voluntarily signs into a service while using Incognito, the service has an obvious account-level identifier with which to associate the activity. Google's own documentation warns that signing into a Google service or another website during an Incognito session can allow that site to remember the activity.

The lawsuit forced changes to Incognito

The settlement went further than simply changing a warning message.

According to the court filing, Google agreed to delete or remediate billions of records reflecting class members' private browsing activities. The company also agreed to continue blocking third-party cookies in Incognito for five years.

The filing provides an unusually detailed picture of why the cookie change mattered.

Google had historically collected its own third-party cookies when users visited non-Google websites. After the lawsuit was filed, Google implemented third-party-cookie blocking for Incognito users. Under the settlement, that protection had to remain in place for five years. The plaintiffs' filing said blocking data associated with Google's third-party cookies in Incognito could reduce Google's global annual revenue by nearly $500 million.

Google also agreed to remove four identified private-browsing detection signals. According to the plaintiffs' filing, those signals could reveal that a user had chosen private browsing and were then used to label the resulting data as private. The settlement required Google to delete those signals and agree not to use such detection mechanisms to identify or track private browsing.

The class covered an estimated 136 million users, according to court-related filings.

Google eventually changed the warning

The dispute also changed the language presented to Chrome users.

Chrome's current Incognito documentation now makes the limitation explicit. It says that Incognito does not change how data is collected by websites users visit and the services those websites use, including Google. Google also says that websites, network administrators and ISPs may still be able to observe activity during an Incognito session.

That clarification is arguably more important than the Incognito icon itself.

The familiar private-browsing interface can create an intuitive association between the words "Incognito" and anonymity. Technically, however, the feature is much narrower. Chromium describes Incognito as a window-level mode in which pages are not persisted to browsing history and a temporary cookie store is used for the session.

That is a local privacy mechanism, not an invisibility cloak.

So, is Incognito worth using?

Yes, if the objective is local privacy.

If you share a computer with other people, do not want a particular browsing session stored in your ordinary history, or want a temporary browser session separated from your normal cookies, Incognito remains useful.

It is also useful for testing how a website behaves without the cookies and account state associated with a normal session.

But users should not treat the Incognito icon as a guarantee that their online activity is hidden.

It does not prevent an ISP or network administrator from observing activity. It does not stop websites from collecting information. It does not automatically hide an IP address. It does not prevent a user from being identified after signing into an account. And it does not protect files downloaded to the device after the session ends.

Users seeking stronger privacy need to think in layers rather than relying on a single browser setting.

A privacy-focused browser can reduce tracking at the browser level. Tracker and content blockers can limit third-party collection. A properly configured VPN can conceal the user's IP address from the websites they visit and hide destination traffic from the ISP, although the VPN provider itself becomes part of the trust model. Keeping the browser, operating system and extensions updated remains essential because privacy controls cannot compensate for an unpatched security vulnerability.

Chrome itself should also not be treated as static. Google continues to modify its privacy and security architecture. Third-party-cookie protections in Incognito are already part of the browser's privacy model, while Google has also explored additional protections for IP addresses in Incognito.

The larger lesson from the Incognito lawsuit is therefore not that private browsing is useless.

It is that privacy has layers, and the word "private" can mean very different things depending on where the data is stored, who controls the network and which services receive the user's requests.

Incognito can hide your browsing history from someone checking the same device.

It cannot make you disappear from the internet.

ICE Can Now Buy Your Credit Card Information



 

Thomson Reuters

Credit Card data security ICE Privacy Thomson Reuters

ICE Can Now Buy Your Credit Card Information

Every time you apply for a credit card or update your account details, you may be sharing your data with ICE.

A research by 404 Media said that personal information stored by credit card firms can sail through a network of data brokers and can become accessible to US Immigration and Customs Enforcement (ICE). ICE can then search and investigate your personal data without any warrant.

“No one signing up for a credit card thinks they’re giving data brokers a thumbs-up to sell their personal information to ICE. Not only is it an outrageous violation of our privacy, [but] it’s impossible for Americans to opt out,” Senator Ron Wyden said to 404 Media in a statement.

What private information is compromised?

According to 404 media, when someone opens a credit card or updates their personal data, credit card firms share that data with credit bureaus.

The personal information consists of Social Security numbers, addresses and email addresses, names, and phone numbers. Contrary to credit reports, this data does not have robust legal security.

Personal information is then sent to credit bureaus, who give the data to Thompson Reuters. From there, the data is incorporated into CLEAR, the firm’s investigative data product. Thomson Reuters sells access to CLEAR to law enforcement authorities, including ICE.

After gaining access to CLEAR, ICE can search through personal information without a warrant. "404 Media has mapped out this supply of data by reviewing U.S. government procurement records and internal documents from companies providing the information." The platform is also combined with a tool that suggests ICE to decide which neighbourhoods to raid.

"Anytime we update our home addresses on these accounts, credit bureaus get the updates within 24 hours and share it broadly with other data brokers, thanks to legal loopholes that leave our personal information open to misuse and abuse," Just Futures attorney Laura Rivera said to 404 Media.

Thomson Reuters providing personal data to US government

Another report enquired Thompson Reuter’s increasing role in providing personal data to the US Government.

The Department of Homeland Security (DHS) is planning to pay Thomson Reuters $125 million to give access to its databases as part of enquiries into suspected immigration fraud and voter fraud. The agreement will be worth $25 million annually for five years respectively.

Child Safety and Platform Accountability: The Debate Over Online Privacy



 

Social Media

Big Tech Cloud CSAM GenAI Internet Platform Accountability Privacy Social Media

Child Safety and Platform Accountability: The Debate Over Online Privacy

The surge in child sexual abuse material, generally called CSAM, is compelling technology companies and government to face internet’s serious concern about platform accountability and how can platforms protect children without impacting their privacy?

The scale of the issue is immense. According to the Center for Missing and Exploited Children, US, CyberTipline got 21.3 million reports of suspected child sexual exploitation last year.

These reports consisted of 61.8 million videos, images, and other files, while incidents associated with GenAI also showed an increase. International hotline networks (INHOPE) have also recorded a transition in distribution of materials from traditional websites to online communities and forums, where material can distribute quickly and escape conventional security mechanisms.

What is CSAM?

CSAM contains videos, pictures, and other digital media that depict the sexual exploitation or abuse of minors. CSAM may be disseminated through social media, messaging platforms, online forums, cloud-storage services, or websites.

How tech is making CSAM detection a problem?

Technology has made it easier for criminals to create, store, and share CSAM material. Encrypted messaging, private groups, and anonymous accounts makes it difficult for authorities to catch criminals. GenAI has created new problems as it can be used to produce sexual deepfakes of minors.

Therefore, social media platforms and online communities are under pressure to find, report, and remove CSAM. According to experts, platforms should hold active responsibility when their algorithms, recommendation systems, file-sharing tools, flawed content moderation or private groups can enable sexual abuse or exploitation. Platforms should provide an easy reporting system and co-ordinate with authorities.

Platform accountability

But, taking down content after it is posted is not enough. Platforms should also check if their apps undermine children's privacy or make them more weak. For instance, unrestricted communication, disappearing messages, and anonymous messages between children and adults can increase the risk sexual abuse.

For platform accountability, companies should take responsibility for how their tech is built and used, by ensuring stronger security policies, effective systems to detect illegal content and trained content moderation teams. Companies should also

In India, Section 67B of the Information Technology Act penalises the posting or distribution of sexually explicit material involving minors. India also imposes due-diligence on digital platforms, such as action against illegal content and robust compliance systems for big-tech social media giants. Recent rules also look out for GenAI, as it can be used to create sexual CSAM content.

The main concern is not if platforms should act, but how. Safeguarding children demands responsible technology and firm enforcement.

The Future of Age Verification Shifts to On-Device Privacy



 

Privacy

Age Verification AI Fraud Prevention biometric privacy Digital Identity Verification Facial Age Estimation On-Device Age Verification Privacy

The Future of Age Verification Shifts to On-Device Privacy

It has become increasingly common for governments around the world to tighten online age verification requirements, as well as to incorporate a new approach to digital identity verification, which keeps facial data on the user's device rather than sending it to an external server.

In addition to the United Kingdom, Australia, Brazil, and several US states introducing stricter rules to protect minors online, more than 30 age assurance laws are now in effect worldwide. There has been a growing concern about the gathering and storage of biometric information as platforms race to comply with regulations.

Major technology companies have also explored alternative means of verifying the age of users in order to protect privacy. As opposed to requiring users to upload government-issued identification or selfies, newer systems are increasingly designed to collect only the essential information such as confirming that a user is part of a particular age group helping platforms comply with legal requirements while limiting the amount of personal information they collect.

A facial age estimation system traditionally captures a user's face, uploads the image to a cloud server, and is then processed remotely. This model has been effective, however it raises significant privacy and cybersecurity concerns, particularly as biometrics become increasingly valuable targets for cybercriminals.

As reported by the Identity Theft Resource Center's 2025 Annual Data Breach Report, 3,322 data breaches were reported in the United States in 2025, an increase of 79% compared to the previous five years. There was also a significant concern among consumers regarding how their biometric data is collected and utilized by 63% of respondents.

Identity verification company Incode has launched an on-device age estimation system to address these concerns. Under this approach, facial images are not sent to remote servers or stored after verification, but are only processed on smartphone, tablet, or laptop devices. Only the verification result-that is, whether the user complies with the required age threshold-is shared with the requesting platform. These approaches follow the principle of data minimization, where systems only collect the information necessary to carry out a specific task.

A developer can offer age-appropriate services while limiting the exposure of sensitive personal data by confirming the eligibility of users instead of storing facial images or identity documents. Additionally, the system incorporates passive liveness detection in order to verify the presence of a real person, which prevents fraud associated with photographs, replayed videos, or artificial intelligence-generated deepfakes.

If the age check cannot be completed successfully, users are automatically offered an alternative verification method. While facial data remains on the user's device, limited session metadata, such as device and connection characteristics, is analyzed on the server to detect tampering, injected camera feeds, and other sophisticated fraud attempts.

The company states that this information does not include biometric data and is used solely to maintain session integrity. It is nonetheless important to note that, despite these improvements, there is no foolproof age verification system. Determined users may attempt to overcome restrictions, but developers must adhere to applicable privacy regulations and implement verification technologies correctly. Generally speaking, it remains difficult to strike a balance between safeguarding children online, maintaining user privacy, and preventing unauthorized access.

AI-powered identity fraud has become a growing concern, resulting in the shift. Incode reports that in 2024, AI-aided fraud represented only 3% of fraud attempts, but by 2026, it had increased to 40%. The company believes that figure will exceed 90% in the next 18 months.

Besides launching its on-device authentication technology, Incode recently announced an investment of $100 million in privacy-protecting identity infrastructure and the acquisition of Identiq, a company focused on privacy. As a result of this initiative, fraud prevention is enhanced while sensitive user information is reduced through the elimination of the need for central collection or storage.

There is continued debate among policymakers worldwide about the operation of age assurance systems, with privacy advocates arguing that online platforms should collect as little personal information as possible. It is a reflection of an industry-wide initiative to comply with evolving regulations while reducing the risks associated with storing biometric information by switching to on-device processing and limited data sharing.

The adoption of digital age verification has become a legal requirement across a growing number of jurisdictions. Privacy-first technologies that minimize the exposure of biometric data may increasingly influence compliance standards in the future.

Governments are increasing age verification requirements, and privacy-preserving technologies are transforming the verification of digital identity. A pivotal role in the future of online safety will be played by solutions that minimize the collection of biometric information while maintaining security and regulatory compliance.

Meta Faces Privacy Questions After Employee Data Exposure Report



 

Workplace Surveillance

Artificial Intelligence data security Employee Data Tracking Meta AI Model Capability Initiative Privacy Workplace Surveillance

Meta Faces Privacy Questions After Employee Data Exposure Report

After sensitive employee information was reportedly made available throughout the organization, Meta has suspended an internal employee monitoring initiative intended to assist in the development of artificial intelligence systems.

Initially introduced in April, the Model Capability Initiative was intended to collect workplace activity data to assist Meta in improving its artificial intelligence models through the collection of work activity data. The system was reportedly used by employees to monitor interactions across various workplace applications including Gmail, Google Chat, and Meta’s AI assistant, as well as capture screenshots and usage patterns.

In response to concerns about privacy and consent, the initiative quickly drew criticism from employees. More than 1,600 Meta employees, including engineers, researchers, and designers, have signed a petition advocating the discontinuation of this program. Prior to the latest incident, the monitoring initiative had already been under scrutiny. A Reuters report reported that the program collected more information than originally indicated and stored some of the data unencrypted, raising concerns among employees about privacy.

In internal discussions, employees were also concerned that personal information, including tax and medical records accessed from work devices, could be disclosed, despite assurances that the data would be protected and used solely for legitimate business purposes. According to the petition, employees argued that responsible AI development should not be compromised by individual privacy concerns.

A company's stated commitment to building trustworthy and responsible artificial intelligence systems is in conflict with the company's collection of workplace data without meaningful consent. Following reports that sensitive employee information had been accessed internally by employees, the controversy became more intense.

According to information cited in media reports, the exposed data could have included private communications, AI prompts, transcriptions, as well as performance data. The incident has sparked an internal investigation, though there is no evidence of the information being improperly accessed or misused. Meta, according to Reuters, suspended the initiative after filing an internal security incident (SEV) in response to employee data being widely accessible within the organization.

As indicated in internal documentation, this information included artificial intelligence prompts and transcriptions, private conversations, personnel records, and classifications of data sensitivity. This incident raised new concerns regarding the collection, storage, and protection of employee information. The Meta program has been suspended while the matter is being investigated.

A company spokesperson confirmed the initiative was designed with privacy safeguards and stressed the absence of any indication of unauthorized access during the investigation. As of the time of the investigation, Meta had not announced when the initiative might resume, and executives of Meta indicated that it would remain halted while the investigation continued. As Meta stated, the Model Capability Initiative will be suspended gradually and might not reach all employees immediately.

A source familiar with the matter told Reuters that the monitoring tool was still recording employee activity on Monday afternoon while the company attempted to disable it across all its systems. An additional clarification of the incident was provided by Meta Chief Technology Officer Andrew Bosworth in a later interview, in which he stated that the incident was not the result of an external security breach. Bosworth reported that employee information generated through the program initially could only be accessed by a small number of authorized employees, but was accidentally stored in an internal location incorrectly by a researcher.

According to Meta, there was no evidence of malicious activity found, and the incident was an internal error that caused the company to suspend the initiative while investigating the matter. The development indicates growing tensions between rapid advancement of artificial intelligence and employee privacy rights. The majority of technology companies are exploring new sources of training data to enhance the performance of their models, as well as investing heavily in artificial intelligence.

Despite increasing competition in the AI industry, Meta is expected to spend more than $135 billion on infrastructure in 2018. According to leaked audio from an internal Meta meeting, Mark Zuckerberg was in favor of using employee-generated data for AI training, asserting that highly skilled employees could serve as valuable examples for AI systems. It has been criticized by privacy advocates, however.

Digital rights experts have argued that extensive workplace monitoring raises serious concerns about employee consent and transparency. According to the incident report, maintaining employee trust and protecting sensitive information are critical challenges that organizations should not overlook as they accelerate the development of artificial intelligence.

A growing concern is how to strike a balance between rapid AI innovation and employee privacy and data security, as exemplified by the incident. As Meta continues its internal investigation, the outcome will likely influence how organizations approach AI training, workplace monitoring, and responsible data governance in the years to come.

Search This Blog

Sections

Popular Posts

Blog Archive

Labels

Report Abuse

About Me

Footer About