Flock Taught Police How to Watch a Protest (09/03/2026)

Surveillance expands most weeks, so the expansion is not what stands out today. What stands out is that in three separate cases the tool worked exactly as designed and the person on the other end had done nothing except show up somewhere, hand over a document, or belong to a student movement. That is a different problem from misuse, and it does not have a policy fix.

Top 5 Critical Privacy Alerts

1. A Flock Webinar Walked Police Through Surveilling Protests

A Flock webinar taught police how to use the camera network to monitor protests, including the No Kings demonstrations, along with parades, fireworks shows, and bike races. Training material is more revealing than deployment data, because it shows what the vendor believes the product is for and what it expects its customers to want. A camera network sold to find stolen cars is being taught as a tool for watching people who assemble in public. 404 Media has the webinar contents.

Operator Note: Every capability you buy gets used for the full range of what it can do, so read the vendor’s training deck before the policy document, because the deck describes the actual product.

2. More Than 170 Million Identity Scans Surface on a Russian Forum

A trove of scanned identity documents holding the biometrics and personal information of more than 170 million people in North America, primarily US driver’s licenses, was found for sale on a Russian cybercrime forum, in a breach allegedly traced to IDScan.net and reported to KrebsOnSecurity. This looks like the same trove that surfaced yesterday at a lower count and with no name attached to it, and the direction of travel is the point. Verification data accumulates in places the people in it have never heard of. Biometric Update has the attribution.

Operator Note: Ask any vendor that scans an ID on your behalf how long they keep the image, and treat a vague answer as the answer.

3. Pegasus Reached a Serbian Student Protester Through iMessage

Citizen Lab, working with the SHARE Foundation, confirmed that an iMessage zero-click exploit delivered NSO Group’s Pegasus spyware to the iPhone of a member of Serbia’s student protest movement. At least 14 Serbians have been targeted with advanced spyware since December, including a member of Parliament, a local opposition politician, and student protesters. A zero-click exploit removes the last thing we tell people to rely on, which is their own judgment about what to open. The Hacker News has the technical findings and The Record has the scope.

4. A Court Says an Unreasonable Belief Can Still Support a Takedown

A federal court in Massachusetts ruled that copyright holders can issue online takedown notices based on a subjective belief of infringement, even when that belief is unreasonable and self-serving, in a case brought on behalf of the citizen journalists at Channel 781. The takedown system was built on the assumption that the party sending the notice is acting in good faith, and this decision says a court will not test that assumption. The people with the least ability to fight a notice are the ones publishing without a legal department. EFF is appealing.

5. The World Bank Counts 2.8 Billion People Outside Digital ID

An estimated 2.8 billion people remain shut out of government-recognized digital identity systems, and the World Bank describes the result as a new divide in the digital economy, with fresh gender gaps appearing even as physical identification gaps narrow. Most coverage of digital identity treats exposure as the risk, and for a very large number of people the risk runs the other way. Being absent from the system means being unable to open an account, claim a benefit, or prove you are you. Biometric Update has the World Bank findings.

Additional Privacy Alerts

Privacy Laws and Regulations

• UK guidance suggests only the government wallet gets primary credentials: An update to Office for Digital Identities and Attributes guidance on the GOV.UK Wallet revealed a testing sandbox and touched a nerve with the UK private sector over which wallets can carry primary credentials. Biometric Update
• Yoti withdraws its ID app from Spain over a biometrics definition: The Spanish data protection regulator AEPD has read the General Data Protection Regulation’s definition of biometrics broadly enough that Yoti says it can no longer offer high assurance identity there without undermining biometric security. Biometric Update
• Age verification arrives inside the vape rather than on the website: Following the FDA’s authorization of its first flavored e-cigarettes, age assurance is moving into the device itself, which puts a verification decision in hardware a person carries. Biometric Update

Cross-Border Data Transfers

• The US mobile driver’s license ecosystem keeps expanding: More states are bringing programs online, adding features to existing credentials, and widening wallet and verification options, with TSA support growing alongside. Biometric Update

The Axe Report is a daily briefing from Grab The Axe. Need help assessing your organization’s security posture? Take our free Human Attack Surface Score assessment.