A Secret Program Called Keyhole (08/20/2026)

Keyhole is a good name for what it describes. A program nobody outside it knew existed, watching people who assumed the watching had limits. Today’s other stories are the same shape from different angles: capability expanding faster than anybody’s ability to see it happening.

Top 5 Critical Privacy Alerts

1. A Secret Program Called Keyhole Emerges as ICE Surveillance Widens

A previously undisclosed program named Keyhole has surfaced as ICE surveillance of protesters expands. It arrives on top of the Clearview arrangement and the Operation Metro Surge photo collection we covered earlier this week. Biometric Update

Operator Note: Three separate surveillance capabilities aimed at the same population, disclosed in the same week, each one previously unknown. The pattern to hold onto is that none of these became public through disclosure. They surfaced through litigation and reporting, which means the honest description of what is currently running is that nobody outside knows.

2. Subtlefakes Are Taking Over X

Slightly altered nonconsensual AI images are proliferating on X. The alteration is small enough that the image stays deniable, which is the point. 404 Media

Operator Note: An obvious fake gets removed and generates sympathy for the person in it. A subtle one survives moderation, and the burden lands on the subject to prove a difference nobody can see. This is the harder version of the problem, and it is why detection-first thinking fails. We wrote the organizational answer in deepfake security, where the fix is verification rather than detection.

3. Some Companies Pushed Back on ICE Subpoenas, Quietly

A handful of technology companies have privately challenged ICE subpoenas. Most have complied without objection, and the ones that pushed back did so without saying so publicly. EFF

Operator Note: Private resistance protects the individual case and teaches the requester nothing. If your company holds customer data and receives a demand you believe is overbroad, the decision to challenge it is a policy you should have written before the demand arrived, because in the moment it becomes a question about legal budget and appetite rather than principle.

4. USCIS Plans a $100 Million Biometrics Project

United States Citizenship and Immigration Services is planning a biometrics and identity technology project valued above $100 million. Biometric Update

Operator Note: Nine figures buys permanence. Systems at this scale outlast the administration that commissioned them and the purpose that justified them, and the enrollment set they build never gets deleted because deletion was never anybody’s line item.

5. Scotland’s Police Inspector Wants Facial Recognition Faster

Scotland’s police inspector is backing an accelerated rollout of facial recognition and AI. This lands the same week the Scottish Biometrics Commissioner set out a review schedule running to autumn 2027. Biometric Update

Operator Note: The deployment timeline and the oversight timeline are moving at different speeds, and they always do. By the time the reviews land in 2027 the systems will be installed, staffed, and depended on, which is a much harder thing to withdraw than to decline.

Additional Privacy Alerts

Privacy Laws & Regulations

• The NO FAKES Act is advancing in Congress: A federal move on AI and the right of publicity, which currently varies by state. Byte Back Law
• Peru gave its digital identity equal legal status to the physical credential: Biometric Update

Regulatory Fines & Enforcement Actions

• Privacy advocates are asking Maryland to investigate data brokers: State enforcement remains where most of the practical pressure on brokers comes from. PogoWasRight
• The Meta trial involving Kentucky and three other states reached a second day of testimony: PogoWasRight

Data Minimization & User Consent

• DHS is developing biometric tools for traveler identity verification: Biometric Update
• Wall Street vishing attacks are exposing voice as a weak link in identity: Financial firms that accepted voice as a factor are discovering what that assumption now costs. Biometric Update

The Axe Report is a daily briefing from Grab The Axe. Need help assessing your organization’s security posture? Take our free Human Attack Surface Score assessment.