Daily Surveillance Briefing: August 12, 2026

BTP's Live Facial Recognition Trial Reaches the London Underground

British Transport Police began a four-month live facial recognition trial on London Underground station concourses on August 11, 2026, starting at Victoria. Cameras scan faces in real time and generate alerts only when a face matches an authorized BTP watchlist of people wanted for serious offences including robbery, knife crime, and sexual assault, according to a Transport for London press release dated August 10. Images of non-matches are automatically and immediately deleted, BTP says. Stations are picked by BTP from operational intelligence and crime-data analysis; the full station list is not in the release. Scanners operate in signed zones so customers can choose whether to pass through ^[1].

Siwan Hayward, TfL's director of security, policing and enforcement, framed the trial as a safety move: "Everyone should be able to travel without fear of harassment, intimidation or violence." Chief Superintendent Chris Casey, BTP's senior officer on the project, said the expansion "will help us assess the technology in a different transport environment." Deputy Mayor of London for Policing and Crime Kaya Comer-Schwartz said facial recognition is "already helping the Met get wanted criminals off the streets." TfL has commissioned independent research on public perceptions at the start and end of the trial ^[1][2].

The structural point is that the same scanner model that scanned protest crowds in May is now sitting inside the daily commuter rail network. The surveillance reading is not whether the matches are accurate. It is that the population that passes the camera is no longer choosing to attend a particular event; it is just trying to get to work. The through-line goes to the existing London Met protest-scanning vessel, the Croydon permanent-FR vessel, the Met expansion vessel, and the Met 1.7-million-face biometrics-commissioners vessel. Spain's deepfake glitch, covered below, is the counterweight: the cameras and the people they scan are both worth asking about.

A Malicious SIM Card Can Shut Down Your Phone, Steal Files, and Drag 5G Back to 2G

Researchers at the University of Birmingham, working with Fuzzware's Kristian Covic, presented CATANA at the USENIX WOOT conference in Baltimore this week. The technique abuses a cellular-standard feature called RUN AT, a proactive SIM command channel that lets a SIM ask the host device to execute AT commands, the modem instruction set that dates back to the 1980s. The attacks are spec-compliant, meaning they exploit functionality the cellular standard explicitly defines ^[4][5].

The team's demonstrations showed a malicious SIM can shut down a handset, kill the modem, downgrade a 5G or 4G connection to 2G, execute code on the device's application processor, read arbitrary files, and exfiltrate them to an attacker-controlled server. On one test, opening attacker-controlled websites on a locked phone succeeded without user interaction, tracked as CVE-2025-48618. Toggling airplane mode, disabling the SIM, and changing network settings did not reverse the 2G downgrade. The team tested 26 devices, 18 smartphones plus 8 IoT modems, found 9 devices exposed AT-command interfaces to the SIM, and uncovered 4 vulnerabilities. On the Oppo Reno14 F 5G alone they counted 198 AT commands and variants. Google patched Android 13 through 16 for the locked-phone web-open issue in December 2025; Qualcomm produced a hardened configuration disabling the SIM AT interface by default; GSMA is tracking the work as CVD-2026-0122 ^[4][5].

The cellular layer is the trust root a lot of other surveillance runs through. When a SIM can issue commands the handset respects, the threat model for any mobile-device story shifts. Read the Citizen Lab SS7 ghost-company vessel and the Scattered Spider SIM-swap guilty-plea vessel for adjacent cellular-surveillance coverage.

Signal Adds Automatic Key Verification to Catch MITM Attacks on Encrypted Chats

Signal announced Automatic Key Verification on August 11. To use it, a user opens a contact's profile, taps "View Safety Number," and hits "Verify automatically." A green checkmark confirms the contact's public encryption key matches what Signal's key-transparency server expects. Under the hood, Signal maintains a ledger of public keys on an open-source key-transparency server; an index lets users verify entries have not been altered, and Signal combs the index on the user's behalf. Cloudflare and Trail of Bits act as third-party auditors, checking the transparency server has not been compromised and signing responses that confirm both sides see the same keys ^[6].

The feature targets a specific attack class: an adversary that intercepts messages by corrupting a centralized directory of accounts and impersonating someone the user trusts. The catch is that auditors can verify the index and server have not been tampered with, but cannot verify the accuracy of the data itself. Users who do not want a third party involved can disable Automatic Key Verification and fall back to the existing safety-number and QR-code checks. The MITM threat is the same one the CISA spyware advisory and the Paragon Graphite cases sat on: the device on the other end is the variable, not the cryptography. See the CISA spyware-warning vessel and the ICE Paragon Graphite vessel for the device-side coverage, and the Canada lawful-access vessel for the legislative lane ^[6][7].

Mozilla Revokes a Firefox Signing Key After an Unencrypted Copy Hits GitHub

Mozilla disclosed on August 10 that a GPG private subkey used to sign Firefox and Thunderbird releases was accidentally committed, unencrypted, to a private GitHub repository accessible only to a small number of Mozilla employees, all of whom were already authorized to access the key through other means. Audit records "found no evidence that the key was accessed by an unauthorized party," Mozilla said. Mozilla did not say how long the key was in GitHub or how it got there, and did not answer The Register's questions on exposure duration. The subkey signed Linux tarballs, RPM packages, and checksum files for both browsers ^[8][9].

Most users need to do nothing. Users manually verifying GPG signatures have to import the new signing key and the revocation for the old one; older releases signed with the revoked subkey will fail verification. On Fedora 43 and later, DNF pulls the updated key during the next Firefox update, with user approval required. Fedora 42 or earlier, RHEL, Rocky Linux, AlmaLinux, openSUSE, and SUSE users have to remove the old key and import the replacement by hand. Thunderbird users need to do nothing; Mozilla does not ship official RPM packages for it. The browser supply-chain story keeps repeating: when the build pipeline and the signing key are both inside the same trust zone as the code, a single mistake becomes a window into the update channel for every user. The Google Workspace Firefox and Chrome warning vessel sits in the adjacent lane ^[8][9].

A Spanish Man's Deepfake Glitched, and a Live Facial Recognition Check Caught Him

Spain's national police arrested a man on suspicion of repeatedly forging official documents after a deepfake tool he used to impersonate other people glitched during a live facial recognition check. The check was part of a digital-certificate application process run by a security company authorized to issue the certificates. The verification compares the applicant's face against the photograph on the applicant's identity document. A momentary processing delay caused the face-altering software to slip, exposing his real face for "barely a second." That gave investigators the break they needed to identify and locate him ^[10][11].

The suspect had reportedly made 38 attempts to impersonate 30 people, succeeding on multiple occasions, using more than 320 phone lines across 24 devices, most registered under stolen identities, alongside forged documents, altered photographs, custom household spotlights with colored bulbs to simulate document holograms, and VPNs. A search of his home turned up an encrypted laptop, mobile phones, storage devices, and documents. The investigation connected to phone sales in the Murcia region. The surveillance angle is the verification step, not the police work. The case is the counterweight to the day's London Underground story: the same biometric technology the BTP scanner runs on, run on a man trying to abuse it, caught him because the deepfake pipeline stuttered for a fraction of a second. The reliability of the check is the only thing standing between an identity-verification database and a deepfake bypass. See the deepfakes-bypass-KYC vessel, the Hany Farid deepfake-detection-lost-race vessel, and the UK deepfake-intimate-image criminal vessel ^[10][11].

EFF Asks a Court to Throw Out the LDS Church's Trademark Suit Against Mormon Stories

EFF filed an amicus brief on August 10, with attorneys from Ballard Spahr, asking the court to dismiss the LDS Church's trademark suit against the Mormon Stories podcast. EFF argues the lawsuit is the wrong use of trademark law, which EFF says is "supposed to be about helping consumers identify the sources of the products they buy, not controlling criticism." EFF presses for the more speech-protective Rogers test, which EFF says "makes it easier to throw out meritless trademark claims before the most expensive parts of litigation." The brief also argues "Mormon" should be treated as a generic term, since trademark law "isn't even supposed to extend to generic terms" ^[12][13].

EFF has opposed LDS Church trademark actions since 2014, including the Mormon Match, Mormon Mental Health Association, and Mormon News Roundup cases. The brief is on the EFF side of the speech-versus-platform-control boundary. Read the EFF Encrypt It Already campaign vessel for the longer EFF arc.

What to Watch

The remaining BTP trial stations and the perception-research readouts. TfL has commissioned independent research on perceptions of safety at the start and end of the trial; the next milestone is which Underground stations get scanned next and what the public-facing signage actually says ^[1][2].

GSMA's response to the CATANA disclosures. The team disclosed to GSMA in May 2026 and is tracked as CVD-2026-0122. Watch for a standards-track response on RUN AT and the broader proactive SIM command set, especially for IoT modems ^[4][5].

Signal's transparency-tree cadence. Automatic Key Verification depends on Signal's key-transparency server and Cloudflare plus Trail of Bits signing responses. The first public auditor report, or any disclosure of a failed audit, is the next event worth watching ^[6][7].

How long the revoked Firefox signing key was in GitHub. Mozilla has not disclosed that. A future post-mortem, or an independent auditor's note, would close the open question ^[8][9].

Whether the Spain digital-certificate issuer updates its live verification pipeline. A deepfake glitch catching a suspect is good for that suspect, and bad for every other applicant whose verification depends on the same live face match. The next public writeup on what the issuer changes is the next signal ^[10][11].

Sources

1. Transport for London: British Transport Police trialling live facial recognition at Transport for London stations, August 10, 2026. https://tfl.gov.uk/info-for/media/press-releases/2026/august/british-transport-police-trialling-live-facial-recognition-at-transport-for-london-stations
2. British Transport Police: LFR Pilot Launch in London (February 11, 2026, railway-station pilot; the August 11 Underground expansion is covered by ref-1). https://www.facebook.com/britishtransportpolice/videos/lfr-pilot-launch-in-london/1405131664405588/
3. State of Surveillance: London Metropolitan Police Live Facial Recognition Protests First Time 2026, the prior vessel on Met LFR scanning at protests. /news/london-metropolitan-police-live-facial-recognition-protests-first-time-2026
4. The Register, Carly Page: Malicious SIMs can shut down phones, steal files, and drag 5G back to 2G, August 11, 2026. https://www.theregister.com/security/2026/08/11/malicious-sims-can-shut-down-phones-steal-files-and-drag-5g-back-to-2g/5285482
5. State of Surveillance: Citizen Lab Bad Connection SS7 Ghost Companies Telecom Location Tracking, the prior vessel on cellular-layer surveillance. /news/citizen-lab-bad-connection-ghost-companies-telecom-ss7-location-tracking-2026
6. The Register: Signal adds an extra layer of security to make sure you're actually chatting with the right person, August 11, 2026. https://www.theregister.com/security/2026/08/11/signal-adds-an-extra-layer-of-security-to-make-sure-youre-actually-chatting-with-the-right-person/5286461
7. State of Surveillance: CISA Spyware Warning Signal WhatsApp State Sponsored, the prior vessel on the device-side threat against Signal. /news/cisa-spyware-warning-signal-whatsapp-state-sponsored-2026
8. The Register, Carly Page: Mozilla revokes Firefox signing key after unencrypted copy lands in GitHub, August 11, 2026. https://www.theregister.com/security/2026/08/11/mozilla-revokes-firefox-signing-key-after-unencrypted-copy-lands-in-github/5285908
9. State of Surveillance: Google Workspace Firefox Chrome Warning, the prior vessel on browser-trust events. /news/google-workspace-firefox-chrome-warning-2026
10. The Register: Deepfake hiccup unmasks suspected digital certificate fraudster, August 11, 2026. https://www.theregister.com/security/2026/08/11/deepfake-hiccup-unmasks-suspected-digital-certificate-fraudster/5285934
11. State of Surveillance: Deepfakes Bypass KYC Bank Identity Verification, the prior vessel on deepfake-driven identity-verification bypasses. /news/deepfakes-bypass-kyc-bank-identity-verification-2026
12. EFF Deeplinks: Dismiss Church's Trademark Lawsuit Against Mormon Stories Podcast, EFF Urges Court, August 10, 2026. https://www.eff.org/deeplinks/2026/08/dismiss-churchs-trademark-lawsuit-against-mormon-stories-podcast-eff-urges-court
13. State of Surveillance: EFF Encrypt It Already Campaign Tech Companies, the prior vessel on EFF's longer campaign arc. /news/eff-encrypt-it-already-campaign-tech-companies-2026