Daily Surveillance Briefing: August 31, 2026

An Officer Printed Fake Flock Cameras at Home. A Man Faces Three Felonies.

Oviedo, Florida had a vandalism problem. Between July 23 and August 3, someone was knocking down Flock Safety license plate readers along the Lockwood Boulevard corridor. So an officer went home, ran off replicas on a personally owned 3D printer, and donated them to the department, which set them out to catch whoever came back. The police report calls them "clone style Flock cameras." It also calls them "bait." Jason Koebler reported the operation for 404 Media on August 25 ^[1].

It worked. Shortly after midnight on Thursday, August 20, officers arrested Evan Meyer. He faces three felonies: attempted larceny, criminal mischief for property damage over $1,000, and a property crime against computer equipment supplies. The arrest report says Meyer "knew it was an expensive real piece of equipment and not a fake replica." Police put the replacement value of a real Flock camera at $800 plus installation ^[1].

Sit with that. The object he damaged was plastic an officer printed at home, and the mayor confirmed the decoy cost the city nothing. The felony theory turns on what he thought he was breaking. Mayor Megan Sladek, an attorney whose mayoral job is part time, learned about the sting from a resident who had seen it on the news. "I had NO idea," she said. On the price: "Can't do much better than free." On the law: "the whole thing is very interesting from a legal perspective." She is not excusing the vandalism either. "Even if the guy knew it was a fake camera, that would still make it art, and it would still be vandalism" ^[1].

Police Chief Dale Coleman defended the tactic, saying supervisors have latitude in how they solve crimes. Asked for the paper trail, the department told 404 Media there are "no meeting minutes, no text messages, and no emails regarding the production" of the decoys, and that "Our agency does not own a 3D printer" ^[1]. Our guide to the wave of Flock camera destruction tracks why a department would feel the need to bait the vandal in the first place.

Flock's CEO Told Ohio Police the Abortion Story Was "Entirely False"

On an August call with Ohio law enforcement and government officials, Flock CEO Garrett Langley called 404 Media's reporting on an abortion-related camera search "entirely false." Signal Akron journalist Doug Brown sat in on the call with an Ohio lawmaker, recorded it, and shared it with 404 Media. Joseph Cox published the account on August 26 ^[2].

The original May 2025 story reported that Texas authorities searched Flock's nationwide network, including cameras in states where abortion is legal, looking for a woman who had self-administered an abortion. Langley's rebuttal ran on two tracks: that she could never have been under investigation because "it was not illegal to have an abortion in Texas. It's illegal to administer an abortion," and that real reporting would have found she was in an abusive relationship and her family feared for her life ^[2].

Court records the Electronic Frontier Foundation obtained and shared with 404 Media point the other way. An affidavit shows authorities discussed with the District Attorney's office whether they could charge the woman and concluded the state could not statutorily charge her for taking the pill. Police documents categorize the work as a "death investigation" and say nothing about family safety concerns. The investigation started at the urging of her abusive partner, who had seen her the day after the abortion but waited weeks to call police, and the Flock search ran more than two weeks after the fact. A document citing safety concerns appeared only after 404 Media published ^[2].

Langley also had media advice for the officials on the call: "Let me handle The New York Times, you handle your local media. They want to hear from you, you know your reporters, they'll pick up a sob story" ^[2].

EFF's Line on License Plate Readers: Eliminate It

Sarah Hamid, Adam Schwartz, and Hayley Tsukayama published EFF's policy position on automated license plate readers on August 26. The position is that ALPR mass surveillance, the indiscriminate and continuous collection of location data on every driver regardless of suspicion, "should not exist" ^[3].

The receipts come from EFF's review of ten months of nationwide Flock searches, covering millions of queries. San Jose police alone run more than 100,000 warrantless database searches a year. More than 50 federal, state, and local agencies ran hundreds of searches connected to protest activity. More than 80 agencies typed search language that perpetuated stereotypes against Romani people ^[3].

The strategy is three-track: cities refuse to buy, states impose deletion rules and use restrictions, and courts get asked the Fourth Amendment question head on. EFF has filed an amicus brief in the Virginia Court of Appeals arguing warrantless ALPR database searches are unconstitutional, sued under the California constitution in SIREN v. San Jose, and moved to block sharing with federal and out-of-state agencies in Lagleva v. Marin County Sheriff ^[3]. For the wider revolt against the network, see our reporting on cities canceling Flock contracts and our explainer on the San Diego fight for the same cameras.

San Diego: A Year in Suits, Then a Cape

Anthony Ralphs spent a year showing up to San Diego City Council in suits, citing Chatrie v. United States and asking for a vote on the city's Flock Safety camera contract. After the council voted in December 2025 to keep the program anyway, the room emptied, and the movement deflated. On August 19, Ralphs walked back to the podium in a Darth Vader cape and mask, with mechanized breathing and a voice changer. He opened: "The emperor is a fan of Flock." Samantha Cole profiled Ralphs for 404 Media on August 25 ^[4].

For three minutes, speaking as Vader, he laid out why the Empire depends on Flock's warrantless network of automatic license plate readers. Coverage of the speech was translated and republished internationally, including in Singapore and in Spanish- and Arabic-language press. On the afternoon of Monday, August 25, Ralphs came back to the chamber without the mask. He set the wheezing mask on the council table and asked: "Of the five council members that voted for Flock: When will this end?" ^[4]

The pitch for what comes next is unusually practical for a protest leader. "Now we need the musicians, we need the artists, we need the painters, the actors, we need the thespians to bring this together and get some wheels on the movement." He founded DeFlock San Diego and works with the TRUST SD Coalition, a local anti-surveillance group ^[4]. If you want to see what is being protested, our guide to how the national Flock database actually works walks through what a single camera does once it reads a plate.

EFF: Meta and Reddit Quietly Won DHS Subpoenas. They Should Go Public.

Mario Trujillo at EFF published on August 19 a survey of cases in which US tech companies have privately pushed back on Immigration and Customs Enforcement administrative subpoenas targeting users who criticized the agency's enforcement operations. None of the wins are public. The argument is that private wins leave the practice intact: the next subpoena writer sees nothing in the docket that says don't try this ^[5].

The clearest case is Meta's. On September 11, 2025, DHS issued two administrative summonses to Meta under 19 U.S.C. § 1509, the customs statute, demanding the identities and IP addresses behind a Facebook and Instagram account called "MontCo Community Watch" that documented immigration enforcement in Montgomery County, Pennsylvania. Eight days later, Meta's Law Enforcement Response Team wrote back that the summons lacked statutory authorization, in language EFF quotes: "Meta will take no further action with respect to this summons until it receives this information." DHS withdrew both summonses ^[5].

Reddit disclosed a parallel pattern through its own transparency reporting. In the second half of 2025, the platform received three DHS subpoenas seeking information on eleven accounts whose posts had been critical of immigration enforcement activity. Reddit objected on First Amendment grounds. Law enforcement withdrew the requests. The published explanation, as EFF reproduces it: "Reddit objected to these legal demands because the users appeared to be engaged in protected activity under the First Amendment, and law enforcement withdrew their requests" ^[5].

The structural failure mode shows up in the ACLU of Pennsylvania J. Doe v. DHS case. In October 2025, a user who sent a critical email to a DHS attorney received a DHS subpoena for the user's Google account information four hours later. Several weeks later two DHS agents and a police officer showed up at the user's home to interrogate the user in person. ACLU of Pennsylvania attorneys filed a motion to quash on February 2, 2026. Google did not move to quash; the company handed the subpoena response window to the user and waited ^[6].

EFF's case for public resistance reaches back to the April 6, 2017 Twitter v. DHS case, in which Twitter sued DHS over an administrative subpoena for an account parodying the immigration agency. DHS withdrew the subpoena within a day, and the DHS Inspector General opened an investigation that produced report OIG-18-18-Nov17 criticizing the tactic. The 2017 sequence is the only case in the public record where a tech company's resistance produced a lasting structural outcome ^[5]. Read the EFF survey alongside our prior coverage of the separate Reddit grand-jury case and our write-up on why companies should go public when they resist ICE.

France's Top Court Killed the Under-15 Social Media Ban

France's Conseil constitutionnel struck down the country's under-15 social media ban on August 14 in decision n° 2026-911 DC, finding that it infringed freedom of expression "in a manner that is not appropriate, necessary, or proportionate." The law was due to take effect in January 2027. EFF's Paige Collings wrote it up on August 26 ^[7].

The court balked at the thing that makes every age-verification law a surveillance law: to keep under-15s out, a platform has to check everyone, adults included. France now sits opposite the UK and Australia, which both have under-16 bans, while the European Commission works on an EU-wide access-restriction bill alongside the EU Digital Identity Wallet and a smaller age-verification app ^[7]. Read our coverage of California's AB 1709 for the US version of the same argument, and our state-by-state index at age verification laws by state for the map of pending mandates.

ICE Wants Voter Files From All 50 States

ICE is shopping for someone to hand it voter data. A request for information reviewed by 404 Media states the purpose is "the handling and secure delivery of publicly available voter registration files and voter history files to support Homeland Security Investigations (HSI) fraud detection and data segmentation activities." The initial jurisdiction list is "likely to be limited," but the contractor must be able to obtain data from all 50 states and other US territories. ICE did not respond to a request for comment. Joseph Cox reported the story for 404 Media ^[8].

This is a second front. In July, 404 Media reported ICE would pay Thomson Reuters $125 million for personal data to investigate "voter fraud," including names, addresses, Social Security numbers, and ethnicity. Voter rolls are public records in most states, and that is exactly the trap in the word "public." Aggregated across every state and handed to an immigration enforcement agency, a public record becomes a targeting list. Our earlier coverage of the Thomson Reuters contract tracks the money, and EFF has been pressing companies to fight ICE subpoenas in public rather than quietly.

EFF: The Meta Settlement Bakes Age Checks Into Everything

Same day as the ALPR position, EFF's David Greene took apart the Meta settlement. His objection is not that Meta got off easy. It is that the deal embeds age assurance into every Meta product, which means collecting more personal information from users of every age. Greene argues the settlement's data minimization and security terms do not stop states from using what gets collected for other law enforcement purposes, including criminal investigations into abortion or gender-affirming care ^[9].

The pattern is the same as the one we traced in age verification as identity infrastructure: the check is the excuse, the identity record is the product. France's top court just told Europe's age-verification lawmakers the same thing. The Meta deal turns the same move into private consumer policy.

Also Today

AliExpress played a silent tone to fingerprint your browser. Software engineer Matt Callaghan noticed his Bluetooth headphones would stop playing audio from his phone whenever an AliExpress tab was open. Muting the tab did nothing, because there is no media element for the browser's tab mute control to stop. AliExpress was running a sawtooth oscillator through the WebAudio API with the gain set to zero, feeding the output into an analyzer and reading the frequency data back. Connor Jones reported it for The Register ^[10]. Firefox says its protections put 99.24% of users into three buckets. Brave injects random data so the fingerprint resets between sessions, and blocks the AliExpress scripts by default. Chrome does none of this ^[10].

The FBI seized the domains behind a Chinese hacking toolkit. The FBI seized three domains, qtproxy.xyz, qt-proxy.org, and qt-team.com, that prosecutors say served QScan and QTRouter, the scanning and obfuscation tools of a PRC-backed group called QTFY. Victims named in the court documents include NASA, the US Senate, the Department of Energy and three of its national laboratories, the Federal Reserve, the Justice Department, Health and Human Services, and the National Institutes of Health. Jessica Lyons reported the seizure for The Register ^[11]. Court documents say QTFY is operated by a private Chinese company, Nanjing Xinjiuwei, and that "Payments from the PRC's Ministry of State Security (MSS) to Nanjing Xinjiuwei, for example, indicate that the company conducts malicious cyber activities on behalf of the PRC Government." The way in was not exotic: known CVEs against Ivanti Pulse Secure VPN, Citrix, and Ivanti Cloud Services Appliance ^[11].

What to Watch

Oviedo. Whether three felony charges survive contact with the fact that the damaged object was a free plastic replica, and whether any record surfaces of who authorized the decoy program. The department says no minutes, texts, or emails exist ^[1].

San Diego. Anthony Ralphs returned to the council mask-off on August 25, asking the five members who voted for Flock when this ends. Watch for council re-vote pressure from TRUST SD, DeFlock San Diego, and the rest of the council defund movement ^[4].

The California courts. SIREN v. San Jose and Lagleva v. Marin County Sheriff are the two cases that could put real limits on warrantless ALPR searches and interstate data sharing. EFF is simultaneously pushing Virginia, California, and the warrant question in federal appellate courts ^[3].

The first platform to file a public motion to quash. The structural change EFF is asking for requires Meta, Reddit, or any other major social media platform, to litigate an ICE subpoena past the point of withdrawal. The first such filing is the inflection point ^[5].

Brussels. France's ruling is a top constitutional court rejecting a youth social media ban on proportionality grounds, and it lands while the European Commission drafts an EU-wide version. Watch for whether the Commission's bill cites the Conseil decision in its explanatory memorandum, and whether any US state legislature cites it back when age-verification bills come up ^[7].

The ICE solicitation. Watch whether the voter-data request for information turns into an actual solicitation and an award, and which states object ^[8].

Sources

1. 404 Media, Jason Koebler: Man Charged With 3 Felonies for Breaking 3D-Printed "Decoy" Flock Camera (August 25, 2026). https://www.404media.co/man-charged-with-3-felonies-for-breaking-3d-printed-decoy-flock-camera/
2. 404 Media, Joseph Cox: Flock's CEO Is Lying to Cops About 404 Media's Reporting on Abortion Case (August 26, 2026). https://www.404media.co/flocks-ceo-is-lying-to-cops-about-404-medias-reporting-on-abortion-case/
3. Electronic Frontier Foundation, Sarah Hamid, Adam Schwartz and Hayley Tsukayama: EFF's Policy Position on ALPR Surveillance: Eliminate It and Reduce Its Harms (August 26, 2026). https://www.eff.org/deeplinks/2026/08/effs-policy-position-alpr-surveillance-eliminate-it-and-reduce-its-harms
4. 404 Media, Samantha Cole: The Man Behind the Anti-Flock Darth Vader Mask Wants to Know: 'When Will This End?' (August 25, 2026). https://www.404media.co/darth-vader-flock-san-diego-city-council-interview/
5. Electronic Frontier Foundation, Mario Trujillo: Some Tech Companies Have Privately Pushed Back on ICE Subpoenas. They Should All Do It Out Loud (August 19, 2026; the Meta Law Enforcement Response Team September 19, 2025 letter, the October 3, 2025 user notification, the Reddit transparency-report quote, and the 2017 Twitter v. DHS sequence with DHS Inspector General report OIG-18-18-Nov17). https://www.eff.org/deeplinks/2026/08/some-tech-companies-have-privately-pushed-back-ice-subpoenas-they-should-all-do
6. American Civil Liberties Union of Pennsylvania: J. Doe v. DHS (case page; the October 2025 DHS subpoena, the four-hour turnaround on the Google subpoena, the post-subpoena home interrogation, and the ACLU of Pennsylvania motion to quash filed February 2, 2026). https://www.aclupa.org/en/cases/j-doe-v-dhs
7. Electronic Frontier Foundation, Paige Collings: French Top Court Gets It Right, Strikes Down Social Media Ban for Youths (August 26, 2026; the Conseil constitutionnel decision n° 2026-911 DC of August 14, 2026, and the proportionality analysis on age checks). https://www.eff.org/deeplinks/2026/08/french-top-court-gets-it-right-strikes-down-social-media-ban-youths
8. 404 Media, Joseph Cox: ICE Wants the Country's Voter Data (August 25, 2026; the request for information reviewed by 404 Media). https://www.404media.co/ice-wants-the-countrys-voter-data/
9. Electronic Frontier Foundation, David Greene: EFF Statement on Meta Settlement (August 26, 2026). https://www.eff.org/deeplinks/2026/08/eff-statement-meta-settlement
10. The Register, Connor Jones: AliExpress accused of fingerprinting shoppers with silent audio trick that also muted a dev's headphones (August 24, 2026; the WebAudio sawtooth oscillator and Firefox 99.24%/0.76% bucketing). https://www.theregister.com/security/2026/08/24/aliexpress-accused-of-fingerprinting-shoppers-with-silent-audio-trick-that-also-muted-a-devs-headphones/5291662
11. The Register, Jessica Lyons: FBI seizes hacking tools it says China used to attack NASA, DOE, US Senate and other critical networks (August 27, 2026; the qtproxy.xyz, qt-proxy.org, and qt-team.com domain seizures, the QTFY / Nanjing Xinjiuwei attribution, and the MSS payment description in court documents). https://www.theregister.com/security/2026/08/27/fbi-seizes-hacking-tools-it-says-china-used-to-attack-nasa-doe-us-senate-and-other-critical-networks/5292742