What your devices do when you're not looking, and the switch that stops it.
Cities Are Ditching Flock for Axon. Nothing Stops Axon From Becoming Flock.
Thirty-nine Flock Safety contracts were canceled in just the first five months of 2026 alone -- after Mountain View and Ventura County discovered Flock's own "nationwide" sharing setting had been quietly active, feeding roughly 600,000 unauthorized searches to agencies that never signed a data agreement. Most of those cities are hiring Axon to do the identical job. Axon's contracts genuinely lack Flock's national lookup network -- that part is real. But so far that's a competitive selling point, not a locked-in architecture: Flock proved it can build hard technical guardrails when it wants to (encrypted storage, true data deletion); the one setting that caused two scandals was left as a switch instead of a wall. Axon has already announced plans to build the same kind of interoperable network, and its own leadership overrode its ethics board on a different surveillance product four years ago.
Home Depot Is Being Sued Three Times This Year Over How It Watches You. Its Camera Vendor Has a Playbook for Backlash Like It.
Home Depot faces three separate privacy lawsuits in 2026 across three states. The most serious: a California class action says its Flock Safety license-plate cameras at 233 stores feed a searchable, nationwide police database, with a policy that doesn't meaningfully restrict sharing with ICE or out-of-state agencies. That's not hypothetical -- the same complaint documents two real cases where cities that explicitly disabled nationwide Flock access got it secretly turned back on anyway. Separately -- and not shown to be connected to Home Depot's case specifically -- a leaked Flock coaching guide obtained by 404 Media shows the company has a practiced playbook for handling this kind of backlash generally: don't deny it's mass surveillance, reframe the debate around "accountability," and get to officials before the public can organize against it.
He Gave Border Agents a Passcode. It Wiped His Phone Instead of Unlocking It. Now He's Facing Federal Charges.
CBP stopped Samuel Tunick at the Atlanta airport in January 2025, saying they suspected child exploitation material on his phone. He gave them a passcode; instead of unlocking the device, GrapheneOS's built-in duress feature wiped it permanently. Federal prosecutors indicted him in November 2025 for destroying property to prevent its seizure — the first known US case charging someone specifically over a phone's duress-wipe feature. His lawyers say the child-exploitation justification doesn't hold up and that the real target was his connection to the "Stop Cop City" activist movement. Neither claim has been ruled on yet.
I Graded Every App on My Phone From A to E. Instagram and PayPal Both Failed.
A volunteer project called Terms of Service; Didn't Read has spent since 2012 reading the agreements nobody else does, grading them A through E. I checked what's actually on my phone: Instagram and PayPal both land at E, the worst grade, for reasons including PayPal tracking you even after you opt out of tracking. Headspace — the meditation app — isn't much better. There's a free browser extension that shows you the grade before you tap agree, which is the closest thing to actually reading the fine print that most people will ever do.
San Francisco Police Put Five Drone Feeds Behind a Link With No Password. The Leak Showed How Much the Drones See.
Color video, thermal images, locations and pilot identities were accessible from the open web. The exposure was a security failure—and an accidental window into a surveillance system expanding faster than its safeguards.
The Government Pulled Anthropic's Newest Model in Three Days. Getting It Back Took 19 — and a New Kind of Deal.
In one week in June, Anthropic launched its most powerful model, got caught quietly hobbling it, apologized — and then watched the U.S. government pull it off the market entirely, worldwide. Two of those stories are connected. The third one isn't, and that's the part to get right. (Update: the government restored full access on July 1, after 19 days offline.)
Researchers Found a Way to Turn 9 Popular AI Coding Tools Into a Botnet. It Exploits How Often AI Assistants Guess Wrong About Where Code Lives.
Ask an AI coding assistant to fetch a brand-new, trending code repository, and it guesses wrong an average of 92% of the time — confidently. Researchers found those wrong guesses are predictable enough to register in advance and load with malware, so the assistant infects itself just by doing normal work. They call it "HalluSquatting," and they've shown it works against nine of the most popular AI coding tools, including Cursor, GitHub Copilot, and Gemini CLI. It's a responsibly disclosed research finding, not an active attack in the wild — but the mechanism is real, and it's the first prompt-injection technique with the potential to scale into a genuine botnet.
Your Phone Never Stops Talking. I Put a $20 Filter on Mine to Hear What It Was Saying.
In under a week, my phone made 91,118 requests to the internet — about one every six seconds, awake or asleep. A $20-a-year filter called NextDNS flagged 5,937 of them (7%) as ads, trackers, and junk I never agreed to, and blocked them before they connected. I didn't feel one. Here's why you'd want it, what it actually does for you, and where it falls short.
Your TV Is Watching You Watch It. Here's the Setting That Makes It Stop.
Almost every smart TV ships with a feature called ACR — automatic content recognition — switched on by default. It snapshots whatever's on your screen (even from your console or laptop), fingerprints it, and sends it back to be matched and sold. In 2017 the FTC caught Vizio doing it on 11 million TVs — over 100 billion data points a day, tied to your age and income. It's still standard. Here's the buried toggle on every major brand, and why you should block the TV at your network too.
Your Car Is a Data Broker With Wheels. Here's How to Make It Stop Selling You.
Your car may be one of the worst privacy threats you own. Mozilla reviewed 25 brands in 2023 and every one failed — 19 of 25 said they can sell your data. And it's not hypothetical: from 2020 to 2024, GM sold driving data — your speed, hard braking, late-night trips — to brokers like LexisNexis, who fed it to insurers and quietly raised people's premiums. The FTC banned GM from doing it and California reached a $12.75 million settlement with them. Here's how to find what your car shares, and shut it off.
We've All Done Time in Facebook Jail. Nobody Has Ever Met the Sheriff — and You Can't Find a Single Human to Appeal To.
Facebook polices three billion people with an automated force that warns you, then locks you out for days over something you posted years ago — and gives you no human to ask why. I know what the opposite looks like: twelve years ago I emailed the CEO of Amazon, and a human fixed it in five weeks.
My Smart Glasses Record for Meta by Default. I Found the Switches That Make Them Stop.
I almost stopped wearing my Ray-Ban Meta glasses — all I'd heard was that footage gets reviewed by some company to train an AI, with no real oversight. The fear isn't a myth: in April 2025 Meta turned the AI on by default, made your photos and voice usable for training, and removed the opt-out for storing your voice. But you can't fix it by installing anything — the glasses are locked. You fix it in three settings, one network block, and how you wear them. Here's exactly where the switches are.