Postal Service Records Show Protest Monitoring (11/04/2026)

The Postal Service’s covert social media program first became public in 2021, and the question then was what it watched and under what rules. Five years and a lawsuit later, the records answer the first half: protests from every direction, from a “Million MAGA March” to Black Lives Matter. The second half may never be answered, because the emails that would show how the bulletins were used were lost to a damaged hard drive and a deletion schedule.

Top 5 Critical Privacy Alerts

1. Records Show the Postal Service Monitored Protests With Few Rules

Records released to the EFF after a Freedom of Information Act lawsuit show the Postal Service’s internet Covert Operations Program, iCOP, issued bulletins in 2020 and 2021 on social media posts about protests across the political spectrum, including a “Million MAGA March,” a gun rights event in Virginia, the “Save the Post Office Saturday” protests, protests at the Postmaster General’s home, and Black Lives Matter protests, per the EFF. Very few rules, guidance, or training documents were released, key emails were lost when a hard drive was damaged, and the agency says it renamed the program and stopped the bulletins, though the records do not show the monitoring ended.

Operator Note: The lesson for any organization that monitors social media, including for brand or threat purposes, is to write down what you watch, why, and who sees it before anybody asks. A program that cannot produce its own rules looks like it never had any.

2. The UK Plans a Law and a Regulator for Police Facial Recognition

The Home Office said a new law would require police use of facial recognition to be “intelligence-led and proportionate,” require independent evidence that systems do not discriminate by age, gender, or race, and create an independent oversight body with power to pause deployments and consult on a code of practice, per Biometric Update. The government has not yet said who can access the data, how it can be reused, or how long it is kept.

3. Western Australia’s Trial Scanned 1.38 Million Faces

Western Australia Police scanned 1,380,882 faces with 100 cameras at 43 locations during a five-month live facial recognition trial, producing 292 alerts, 9 of them incorrect, and 122 arrests, per Biometric Update. Police say the system does not store biometric data on people not matched to a watchlist, and the state’s Information Commissioner’s office says it was not invited into formal consultation.

Operator Note: Set this beside the London rail trial we reported on September 30, which scanned more than 500,000 faces for one wrong alert. The same technology produces very different results depending on watchlists and placement, which is why the evaluation has to come before the purchase.

4. The EFF and ACLU Ask a Court to End Tower Dump Warrants

The EFF and ACLU filed a brief in United States v. Spurlock asking the Ninth Circuit to hold tower dump warrants unconstitutional as general warrants, after one warrant in the case revealed location data on nearly 1,700 phones, per the EFF. It is the first federal appeal on tower dumps since the Supreme Court held in June that geofence warrants are Fourth Amendment searches.

5. California Proposes Rules on Honoring Opt-Out Signals

California Privacy Protection Agency staff proposed amendments naming the Global Privacy Control as a signal businesses that sell or share personal information must treat as a valid opt-out, and barring browser features that act for consumers from blocking the signal, per Inside Privacy. The board considers the package at its November 5 and 6 meeting, and the Opt Me Out Act, which requires browsers to offer the signal, takes effect January 1, 2027.

Operator Note: Test your own sites with Global Privacy Control turned on in a browser and confirm the tracking you disclose actually stops.

Additional Privacy Alerts

Identity & Biometrics

• Identity risk models built for people fall short for AI agents: Kantara Initiative found that risk models built for human identity assurance fall short when applied to agents. Biometric Update

Policy

• Voters reject AI data centers: 404 Media reports that American voters overwhelmingly oppose AI data center projects, published the day after the midterm elections. 404 Media

The Axe Report is a daily briefing from Grab The Axe. Need help assessing your organization’s security posture? Take our free Human Attack Surface Score assessment.