Daily Surveillance Briefing: August 27, 2026

An Officer Printed Fake Flock Cameras at Home. The City Charged a Man With Three Felonies.

Oviedo, Florida had a vandalism problem. Between July 23 and August 3, someone was knocking down Flock Safety license plate readers along the Lockwood Boulevard corridor. So an officer went home, ran off replicas on a personally owned 3D printer, and donated them to the department, which set them out to catch whoever came back. The police report calls them "clone style Flock cameras." It also calls them "bait." Jason Koebler reported the operation for 404 Media on August 25 ^[1].

It worked. Shortly after midnight on Thursday, August 20, officers arrested Evan Meyer. He faces three felonies: attempted larceny, criminal mischief for property damage over $1,000, and a property crime against computer equipment supplies. The arrest report says Meyer "knew it was an expensive real piece of equipment and not a fake replica" ^[1].

Sit with that. The object he damaged was plastic an officer printed at home, and the mayor confirmed the decoy cost the city nothing. The felony theory turns on what he thought he was breaking. Police put the replacement value of a real Flock camera at $800 plus installation ^[1].

Mayor Megan Sladek, an attorney whose mayoral job is part time, learned about the sting from a resident who had seen it on the news. "I had NO idea," she said, describing herself as "speechless." On the price: "Can't do much better than free." On the law: "the whole thing is very interesting from a legal perspective." She is not excusing the vandalism either. "Even if the guy knew it was a fake camera, that would still make it art, and it would still be vandalism" ^[1].

Police Chief Dale Coleman defended the tactic, saying supervisors have latitude in how they solve crimes and that his investigators had run operations like this before and knew how to do it lawfully. "This operation is similar to a drug operation or a theft ring at the mall," he said. Asked for the paper trail, the department told 404 Media there are "no meeting minutes, no text messages, and no emails regarding the production" of the decoys, and that "Our agency does not own a 3D printer" ^[1]. If you want to know what a real one looks like before you go near it, our guide on how to find and avoid Flock cameras covers the hardware, and we have tracked the wave of camera destruction driven by the ICE backlash.

Flock's CEO Told Ohio Police the Abortion Story Was "Entirely False"

On an August call with Ohio law enforcement and government officials, Flock CEO Garrett Langley called 404 Media's reporting on an abortion-related camera search "entirely false." Signal Akron journalist Doug Brown sat in on the call with an Ohio lawmaker, recorded it, and shared it with 404 Media. Joseph Cox published the account on August 26 ^[2].

The original May 2025 story reported that Texas authorities searched Flock's nationwide network, including cameras in states where abortion is legal, looking for a woman who had self-administered an abortion. Langley's rebuttal ran on two tracks: that she could never have been under investigation because "it was not illegal to have an abortion in Texas. It's illegal to administer an abortion," and that real reporting would have found she was in an abusive relationship and her family feared for her life ^[2].

Court records the Electronic Frontier Foundation obtained and shared with 404 Media point the other way. An affidavit shows authorities discussed with the District Attorney's office whether they could charge the woman and concluded the state could not statutorily charge her for taking the pill. Police documents categorize the work as a "death investigation" and say nothing about family safety concerns. The investigation started at the urging of her abusive partner, who had seen her the day after the abortion but waited weeks to call police, and the Flock search ran more than two weeks after the fact. A document citing safety concerns appeared only after 404 Media published ^[2].

Langley also had media advice for the officials on the call: "Let me handle The New York Times, you handle your local media. They want to hear from you, you know your reporters, they'll pick up a sob story" ^[2].

EFF's Line on License Plate Readers: Eliminate It

Also on August 26, Sarah Hamid, Adam Schwartz, and Hayley Tsukayama published EFF's policy position on automated license plate readers. The position is that ALPR mass surveillance, the indiscriminate and continuous collection of location data on every driver regardless of suspicion, "should not exist" ^[3].

The receipts come from EFF's review of ten months of nationwide Flock searches, covering millions of queries. San Jose police alone run more than 100,000 warrantless database searches a year. More than 50 federal, state, and local agencies ran hundreds of searches connected to protest activity. More than 80 agencies typed search language that perpetuated stereotypes against Romani people ^[3].

The strategy is three-track: cities refuse to buy, states impose deletion rules and use restrictions, and courts get asked the Fourth Amendment question head on. EFF has filed an amicus brief in the Virginia Court of Appeals arguing warrantless ALPR database searches are unconstitutional, sued under the California constitution in SIREN v. San Jose, and moved to block sharing with federal and out-of-state agencies in Lagleva v. Marin County Sheriff ^[3]. For the wider revolt, see our reporting on cities canceling Flock contracts and our explainer on how the national database actually works.

ICE Wants Voter Files From All 50 States

ICE is shopping for someone to hand it voter data. A request for information reviewed by 404 Media states the purpose is "the handling and secure delivery of publicly available voter registration files and voter history files to support Homeland Security Investigations (HSI) fraud detection and data segmentation activities." The initial jurisdiction list is "likely to be limited," but the contractor must be able to obtain data from all 50 states and other US territories. ICE did not respond to a request for comment ^[4].

This is a second front. In July, 404 Media reported ICE would pay Thomson Reuters $125 million for personal data to investigate "voter fraud," including names, addresses, Social Security numbers, and ethnicity ^[4]. Voter rolls are public records in most states, and that is exactly the trap in the word "public." Aggregated across every state and handed to an immigration enforcement agency, a public record becomes a targeting list. Our earlier coverage of the Thomson Reuters contract tracks the money, and EFF has been pressing companies to fight ICE subpoenas in public rather than quietly.

France's Top Court Killed the Under-15 Social Media Ban

France's Conseil constitutionnel struck down the country's under-15 social media ban on August 14 in decision n° 2026-911 DC, finding that it infringed freedom of expression "in a manner that is not appropriate, necessary, or proportionate." The law was due to take effect in January 2027. EFF's Paige Collings wrote it up on August 26 ^[5].

The court balked at the thing that makes every age-verification law a surveillance law: to keep under-15s out, a platform has to check everyone, adults included. France now sits opposite the UK and Australia, which both have under-16 bans, while the European Commission works on an EU-wide access-restriction bill alongside the EU Digital Identity Wallet and a smaller age-verification app ^[5]. If you are trying to keep track of the US version of this fight, we maintain a guide to age verification laws by state and covered California's AB 1709.

EFF: The Meta Settlement Bakes Age Checks Into Everything

Same day, EFF's David Greene took apart the Meta settlement. His objection is not that Meta got off easy. It is that the deal embeds age assurance into every Meta product, which means collecting more personal information from users of every age. Greene argues the settlement's data minimization and security terms do not stop states from using what gets collected for other law enforcement purposes, including criminal investigations into abortion or gender-affirming care ^[6]. That is the same pattern we traced in age verification as identity infrastructure: the check is the excuse, the identity record is the product.

AliExpress Played a Silent Tone to Fingerprint Your Browser

Software engineer Matt Callaghan noticed his Bluetooth headphones would stop playing audio from his phone whenever an AliExpress tab was open. Muting the tab did nothing, because there is no media element for the browser's tab mute control to stop. AliExpress was running a sawtooth oscillator through the WebAudio API with the gain set to zero, feeding the output into an analyzer and reading the frequency data back. Silent to you, distinctive to the tracker. Connor Jones reported it for The Register on August 24 ^[7].

The audio trick travels with screen dimensions, device memory, browser plugins, WebGL rendering, and mouse events, encrypted and shipped off to Alibaba's telemetry services. Alibaba did not respond to The Register ^[7].

Your browser choice decides how much of this lands. Firefox says its protections, in place since version 118 in September 2023, put 99.24% of users into three buckets, with the script failing outright for 0.76%. Brave injects random data so the fingerprint resets between sessions, and blocks the AliExpress scripts by default. Safari feeds errors into the audio buffer. Chrome does none of this, and privacy consultant Alexander Hanff was blunt about it: "There are at least thirty distinct fingerprinting techniques that work in Chrome right now, today" ^[7].

The FBI Seized the Domains Behind a Chinese Hacking Toolkit

The FBI seized three domains, qtproxy.xyz, qt-proxy.org, and qt-team.com, that prosecutors say served QScan and QTRouter, the scanning and obfuscation tools of a PRC-backed group called QTFY. Victims named in the court documents include NASA, the US Senate, the Department of Energy and three of its national laboratories, the Federal Reserve, the Justice Department, Health and Human Services, and the National Institutes of Health. Jessica Lyons reported the seizure for The Register on August 27 ^[8].

The attribution is the part worth reading closely. Court documents say QTFY is operated by a private Chinese company, Nanjing Xinjiuwei, and that "Payments from the PRC's Ministry of State Security (MSS) to Nanjing Xinjiuwei, for example, indicate that the company conducts malicious cyber activities on behalf of the PRC Government." They add that QTFY includes former People's Liberation Army members who use those relationships to win offensive cyber contracts. The way in was not exotic: CVE-2019-11510 in Ivanti Pulse Secure VPN, CVE-2019-19781 in Citrix, and a 2024 zero-day against Ivanti's Cloud Services Appliance ^[8].

What to Watch

Oviedo. Whether three felony charges survive contact with the fact that the damaged object was a free plastic replica, and whether any record surfaces of who authorized the decoy program. The department says no minutes, texts, or emails exist ^[1].

Ohio. The officials on that call heard Langley's version before the recording went public. Watch whether any of them revisit their Flock arrangements now that the court records are on the table ^[2].

The California courts. SIREN v. San Jose and Lagleva v. Marin County Sheriff are the two cases that could put real limits on warrantless ALPR searches and interstate data sharing ^[3].

Brussels. France's ruling is a top constitutional court rejecting a youth social media ban on proportionality grounds, and it lands while the European Commission drafts an EU-wide version ^[5].

The ICE solicitation. Watch whether the voter-data request for information turns into an actual solicitation and an award, and which states object ^[4].

Sources

1. 404 Media, Jason Koebler - Man Charged With 3 Felonies for Breaking 3D-Printed "Decoy" Flock Camera (August 25, 2026). https://www.404media.co/man-charged-with-3-felonies-for-breaking-3d-printed-decoy-flock-camera/
2. 404 Media, Joseph Cox - Flock's CEO Is Lying to Cops About 404 Media's Reporting on Abortion Case (August 26, 2026). https://www.404media.co/flocks-ceo-is-lying-to-cops-about-404-medias-reporting-on-abortion-case/
3. Electronic Frontier Foundation, Sarah Hamid, Adam Schwartz and Hayley Tsukayama - EFF's Policy Position on ALPR Surveillance: Eliminate It and Reduce Its Harms (August 26, 2026). https://www.eff.org/deeplinks/2026/08/effs-policy-position-alpr-surveillance-eliminate-it-and-reduce-its-harms
4. 404 Media, Joseph Cox - ICE Wants the Country's Voter Data (August 25, 2026). https://www.404media.co/ice-wants-the-countrys-voter-data/
5. Electronic Frontier Foundation, Paige Collings - French Top Court Gets It Right, Strikes Down Social Media Ban for Youths (August 26, 2026). https://www.eff.org/deeplinks/2026/08/french-top-court-gets-it-right-strikes-down-social-media-ban-youths
6. Electronic Frontier Foundation, David Greene - EFF Statement on Meta Settlement (August 26, 2026). https://www.eff.org/deeplinks/2026/08/eff-statement-meta-settlement
7. The Register, Connor Jones - AliExpress accused of fingerprinting shoppers with silent audio trick that also muted a dev's headphones (August 24, 2026). https://www.theregister.com/security/2026/08/24/aliexpress-accused-of-fingerprinting-shoppers-with-silent-audio-trick-that-also-muted-a-devs-headphones/5291662
8. The Register, Jessica Lyons - FBI seizes hacking tools it says China used to attack NASA, DOE, US Senate and other critical networks (August 27, 2026). https://www.theregister.com/security/2026/08/27/fbi-seizes-hacking-tools-it-says-china-used-to-attack-nasa-doe-us-senate-and-other-critical-networks/5292742