The Reason Field Said LMAO (09/14/2026)

Every surveillance system that survives public scrutiny does so on the strength of one promise, which is that each query has a documented reason and somebody can review it later. The EFF went and read the reasons. A great many of them are jokes, and one of them is the word “idk” attached to a search across eighty-two thousand cameras.

Top 5 Critical Privacy Alerts

1. The Audit Trail Is Full of Keyboard Mashing

The EFF examined the justification field on automated license plate reader searches and found officers entering “LMAO,” “idk,” “hehe,” “asdfg,” “idiot,” “WEIRD KID,” “blah,” and “leave me alone.” One Goshen Police Department officer searched 6,474 ALPR networks covering data from 82,413 cameras on a single day in May 2025 and left the reason as “idk.” The audit field is the entire accountability mechanism these systems were sold on, and treating it as a required box rather than a record is how a control becomes decoration. EFF has the analysis and 404 Media has the reporting.

Operator Note: Pull a sample of the justification text from your own privileged access logs and read it. A field nobody audits fills up with whatever is fastest to type.

2. Humans Are Reading ChatGPT Prompts Under Project Lily

Leaked internal documents and real prompts obtained by reporters describe an OpenAI program called Project Lily in which human contractors read user conversations to improve the models, including chats containing sensitive personal information. Most people using these tools have formed a mental model closer to a search box than to a message somebody might open, and nothing in the interface corrects that impression. The review is legitimate and disclosed in the terms, which is precisely the gap worth naming, since disclosure in a policy is not the same as expectation in a user. 404 Media has the documents and The Decoder has the scale.

Operator Note: When you tell staff which AI tools are sanctioned, tell them plainly that a person may read what they type, because that single sentence changes behavior more than a policy document does.

3. New York Seizes Twelve Celebrity Deepfake Sites

District Attorney Alvin Bragg announced the seizure of 12 websites hosting hyper-realistic sexual imagery using the likenesses of roughly 1,200 people. Seizure is a meaningful escalation from takedown requests, because it treats the infrastructure as the thing to remove instead of asking a host to cooperate. The number of people involved is the part worth holding onto, since each site was operating at a scale that makes individual enforcement impossible. 404 Media has the announcement.

4. Meta’s Capture Light Stays Off When the AI Looks

Meta has defended its AI glasses by pointing to the small white capture LED that signals when someone is taking a photograph or recording, and reporting indicates the light does not activate when the onboard AI uses the camera without recording. We covered the same indicator last week when a researcher showed it could be disabled outright. A consent signal with a documented exception is a signal that bystanders cannot rely on, and bystanders are the only people it was ever for. Biometric Update has the finding.

5. California Moves to Curb Pen Register Claims

The California Legislature passed SB 690 and sent it to the Governor, a bill that would eliminate the private right of action behind the wave of “pen register” demand letters and lawsuits filed under the California Invasion of Privacy Act. The litigation it targets has been aimed at ordinary website analytics, and reasonable people disagree about whether that was the statute working or the statute being mined. Either way the practical effect is a large reduction in one category of exposure for anybody running a website that serves California. Inside Privacy has the bill.

Additional Privacy Alerts

Digital Identity

• Germany unveiled its national EUDI wallet: Branded d-you, it will hold digital IDs and driver’s licenses on smartphones from January 2, 2027. Biometric Update
• Nine Schengen countries can delay full biometric entry checks: France, Germany, Italy, Belgium, the Netherlands, Greece, Malta, Portugal, and Switzerland were given flexibility on the Entry/Exit System to keep border flow moving. Biometric Update

Consumer Protection

• A California bill would stop apps changing privacy settings without consent: AB 2561 passed the legislature and would prohibit an operating system or application from altering a user-configured privacy preference without explicit permission. Fox Rothschild

The Axe Report is a daily briefing from Grab The Axe. Need help assessing your organization’s security posture? Take our free Human Attack Surface Score assessment.