Daily Surveillance Briefing: August 6, 2026

Flock's Honesty Problem: The Manual, the Memo, and the Walkout

Three 404 Media stories published over four days this week pulled the same thread: the people who sell automatic license plate readers to cities have built a system whose public story keeps shifting. The question is no longer whether Flock Safety's cameras exist in your city. It is whether the contracts, the reports, and the public statements about who can read the data can be trusted at all.

Jason Koebler reported on August 3 on a leaked Flock coaching document written for officers preparing to defend ALPR contracts at city-council votes. The manual tells police to "own the narrative before someone else does," to brief city managers early, and to meet council members before a vote. It instructs officers not to argue against the "mass surveillance" charge but to "reframe the financial discussion" around the cost of unresolved crime. The document acknowledges that the public "increasingly expect transparency, oversight, and accountability," and recommends that departments present "two and a half years of local results" rather than rely on general effectiveness claims ^[1]. The guide is a playbook for winning votes, not for explaining the technology.

One day later, Koebler published a separate investigation: a written Wapello County, Iowa standard-operating-procedure document, dated November 2025, that tells deputies "DO NOT MENTION ALPR USAGE TO THE OCCUPANTS OF THE VEHICLE" and "DO NOT MENTION ALPR USAGE IN YOUR REPORT OR COMPLAINT UNLESS ABSOLUTELY NECESSARY." The policy says officers should describe Flock hits as having used "county resources," and tells them to "treat the ALPR information like you would intelligence." Sheriff Don Phillips told 404 Media the practice is standard and common across law enforcement. The article notes that the FBI and Department of Justice have previously warned agencies to be "as vague as permissible" about Flock use, and draws the parallel to past secrecy around cell-site simulators, where police sometimes dropped cases rather than disclose the technology ^[2]. Read alongside the coaching manual, the pattern is hard to miss: train officers to win the public vote, then instruct them to keep the cameras out of the case file.

Joseph Cox added the third piece on August 3: an account from Jonathan Paz, who worked in Flock's government-affairs operation. Paz told 404 Media he repeatedly asked whether Flock worked with ICE and was consistently told the company did not. He left after 404 Media and 9NEWS in Denver reported that CBP had direct access to Flock cameras through a pilot program, and that ICE had access too. Paz said he was "sold and lied to" and rejected the severance package and equity he had been offered. The reporting that prompted his decision also established that the Secret Service and the Navy's criminal-investigation division had access. Paz said his job was to defend the company in front of city councils, and that he came to see the work as making sure "this resistance doesn't become a vote reflected in the vote of the council" ^[3]. Flock's public posture on federal-immigration access has moved from denial to confirmation as the disclosures accumulated, and the company told 404 Media only that "our conversations with communities are valuable" and that adoption decisions "rest solely with each community" ^[3][4].

The abuse pattern that ties the three pieces together was published on August 5: a Wisconsin sheriff's office used Flock to track Edward Abrams-Phillips across state lines into Michigan, then cited his frequent trips to a state where marijuana is legal as part of the probable cause for a traffic stop and search. Deputies wrote in the complaint that the vehicle "travels to Michigan frequently which is a known source state for marijuana as it is legal there," and made a coordinated intercept on I-41. Abrams-Phillips was originally wanted for bail jumping on a domestic-violence charge, which was dismissed; he was convicted only of marijuana possession ^[5]. The case shows the surveillance question turning into a constitutional question: when the data is the reason for the search, does an "innocent" plate read still count as an innocent read?

The political fight is moving into the open at the same time. Adam Lee Heimerman, an independent candidate running for Tennessee's 2nd Congressional District, faces four felony vandalism charges for allegedly shooting three Flock cameras in Blount County and one in Maryville between July 14 and July 22. The article notes that his Republican opponent, incumbent Tim Burchett, has introduced a bill that would bar federal agencies from purchasing ALPR access and restrict the use of federal funds for state and local ALPR systems. Flock told local news it welcomed that approach ^[6]. Existing State of Surveillance vessels on Flock cameras exposed without passwords, the city-level cancel wave, and the Colorado warrant requirement bill track the parallel pressure points.

The Senate Prepares to Vote on Four Privacy Bills at Once

The Senate Commerce Committee is set to mark up four bills EFF described in an August 4 letter as "censorious and privacy invasive" and said "impossible to ignore" as a single direction. The package includes KOSA, the Kids Online Safety Act; the SCREEN Act, introduced by Senator Mike Lee of Utah with Senators John Curtis, Jim Banks, and Representative Mary Miller; the Youth AI Privacy Act; and the CHATBOT Act. EFF sent its objections to the committee before the markup ^[7].

The SCREEN Act (Shielding Children's Retinas from Egregious Exposure on the Net) would require age verification on every website that contains even one piece of content deemed "harmful to minors" under a definition that includes material that "depicts, describes, or represents, in a patently offensive way with respect to what is suitable for minors, an actual or simulated sexual act," "lewd exhibition of the genitals," or content that "appeals to the prurient interest in nudity, sex, or excretion." Samantha Cole's August 4 explainer at 404 Media noted the bill "attacks virtual private networks by requiring sites to verify based on IP addresses," a mechanism EFF says would force identity collection at the network layer rather than the application layer ^[8]. Public backers include the National Center on Sexual Exploitation, the National Decency Coalition, the Ethics and Public Policy Center, the Family Policy Alliance, the Family Research Council, and Heritage Action, the sister organization to the Heritage Foundation that authored Project 2025 ^[8]. EFF calls the bill "a privacy and free speech disaster" ^[8].

The Youth AI Privacy Act has its own paradox. Maddie Daly at EFF argued on August 3 that protecting information for only some users would force AI companies to impose age gates to identify who qualifies, requiring the data collection the bill claims to prevent. The bill also contains what EFF calls a "vague provision" allowing companies to collect a known minor's personal data to test, identify, and address "harm to users" ^[9]. The EFF "four bills" explainer pushes the same argument: "age-gate the internet and block young people from speaking" produces "more information being collected, more surveillance" ^[7]. Our existing Cory Doctorow age-verification op-ed brief and the Wisconsin-Michigan VPN ban brief carry the prior week's thread.

A WebKit Bug Is Punching Through iCloud Private Relay

Joseph Cox reported on August 5 that security researchers Tommy Mysk and Talal Haj Bakry found a WebKit flaw that defeats iCloud Private Relay and exposes the real IP address of paying subscribers who chose the feature specifically for IP protection. The mechanism is the passkey (WebAuthn) flow. When a website asks for a passkey, the operating system's credential service issues a web request outside the browser itself, and that fetch never enters Private Relay's proxied path. The destination server sees the device's true IP ^[10]. Cox confirmed the leak using the researchers' test site, leaks.psylo.app, which returned the real IP of a Private Relay subscriber. Mysk's framing is blunt: "any website that supports, or pretends to support, passkeys can see the user's real IP address despite having iCloud Private Relay on" ^[10].

The same mechanism affects OnionBrowser on iOS, the Tor-based browser that users rely on for stronger anonymity than Private Relay. Mike Tigas, OnionBrowser's creator, said two of the leaks are "entirely based on how iOS and WebKit work and solely in Apple's hands," and that Apple told him the issue was "dire" while allowing disclosure but did not commit to a fix date. The official Tor Browser from the Tor Project is not affected, according to the report ^[11]. Apple told 404 Media only that it is investigating the researchers' report ^[10]. The practical point is structural: a privacy feature that depends on a single browser engine is only as strong as that engine's edge cases, and the WebKit passkey path was not on the threat model most subscribers had in mind.

The UK's ICO Reprimanded the Met for Handing a Stalking Victim to Her Stalker

The Information Commissioner's Office issued an enforcement notice and a reprimand against London's Metropolitan Police on August 5, after the force handed unredacted documents to a man arrested on suspicion of harassment and malicious communications. The documents revealed the new home address and phone number of the woman he was accused of stalking, along with the names of her friends and family. The stalker fled the UK, breached bail, then contacted the victim on her new number; he was arrested again in July 2024 on his return and imprisoned after a guilty plea ^[12].

The ICO's second finding against the Met in the same notice concerned a separate breach: a Met officer emailed 18 people targeted in a parliamentary honeytrap operation to update them on a suspect's bail answer date, and failed to use BCC. Three of the recipients' accounts had since been deactivated. The ICO said training completion rates were low across the force and that the officer had not completed data-protection training for more than four years ^[13]. Jo Stones, the ICO's group manager for civil and cyber investigations, said "people entrust the police with some of their most sensitive personal information, often at moments when they are vulnerable or at risk" ^[12]. The Met has 12 months to bring training to 100 percent completion, audit bulk-email practices, and report progress back to the ICO. The structural point is the same one the Flock stories make: the danger in surveillance systems is not the existence of the data but the people and processes that handle it.

Also Today

EFF named four mobile ad SDKs that share location data by default. Lena Cohen and Bill Budington reported on August 4 that InMobi, BidMachine, Verve's HyBid, and Huawei's Petal Ads all collect and forward location whenever the underlying app has the permission. EFF's investigation reviewed "dozens" of widely used advertising SDKs and singled out these four because of privacy-invasive defaults, financial incentives, and unclear documentation. EFF did not name specific data brokers in the release, but pointed to its broader location-data-brokers work and listed harms from misuse: ICE investigations, global spy tools, outing a gay priest, tracking union organizers, and tracking US military personnel ^[13][14]. The four-SDK list is the actionable part: anyone auditing a phone for unexpected location sharing can start by checking which apps bundle these libraries.

Microsoft attributed a public-Wi-Fi captive-portal campaign to Russia's SVR. Connor Jones reported at The Register on August 3 that researchers tied the "CaptiveCrunch" operation to Storm-2945, a subdivision of Midnight Blizzard (also tracked as Nobellium). The campaign compromised captive portals at hotels and conference venues, manipulated DNS and HTTP traffic to put an adversary-in-the-middle in front of users, and delivered a Go-based Windows RAT called CornFlake with keylogging, clipboard monitoring, audio and video surveillance, browser credential theft, file exfiltration, and remote shell access. A secondary payload, ChocoShell, ran in-memory to steal browser session cookies, saved passwords, SSO tokens, and Wi-Fi credentials ^[15]. The Travelers' Wi-Fi Surveillance Guide covers the same threat surface for readers who want the practical layer.

A Tennessee candidate faces felony charges for allegedly shooting Flock cameras. Adam Lee Heimerman, 37, of Lenoir City, faces four felony vandalism charges for allegedly damaging three cameras in Blount County and one in Maryville between July 14 and July 22. At least one was a Flock camera. Police say he accessed one of the cameras through the grounds of a place of worship while a service was in progress. The Register notes Flock operates in roughly 5,000 communities across 49 states, with 80,000 to 120,000-plus cameras estimated nationwide ^[6]. The felony charges are the first time an active congressional candidate has crossed from Deflock-style activism into a federal-grade case.

What to Watch This Week

The Senate Commerce Committee markup. Watch whether KOSA, the SCREEN Act, the Youth AI Privacy Act, and the CHATBOT Act advance together or are pulled apart. The single most consequential provision in the package is the SCREEN Act's IP-based age-verification requirement, which critics say would put VPNs in the same enforcement lane as the age-check itself ^[7][8].

Flock's federal access disclosures. Paz's account and the underlying 404 Media and 9NEWS reporting show the company's public posture on federal access has shifted as disclosures accumulated. Watch for congressional investigators to publish any internal documents the company has shared, and for further whistleblower accounts ^[3].

Wisconsin pretext-search litigation. Abrams-Phillips was convicted only of marijuana possession after the bail jumping charge was dismissed. Whether his lawyers or others raise a Fourth Amendment challenge to ALPR-based probable cause will determine whether the case becomes precedent or stays local ^[5].

Apple's response to the WebKit passkey leak. Apple told 404 Media only that it is investigating. Watch for a security advisory that explains whether the fix lands in iOS settings, a Safari update, or both, and whether OnionBrowser's affected paths can be mitigated until WebKit itself changes ^[10][11].

Sources

1. 404 Media, Jason Koebler - "Own the Narrative": Leaked Flock Guide Shows How It Teaches Cops to Promote Its Tech (August 3, 2026). https://www.404media.co/own-the-narrative-leaked-flock-guide-shows-how-it-teaches-cops-to-promote-its-tech/
2. 404 Media, Jason Koebler - "Do Not Mention ALPR Usage": How Cops Are Trying to Hide the Existence of Flock (August 4, 2026). https://www.404media.co/do-not-mention-alpr-usage-how-cops-are-trying-to-hide-the-existence-of-flock/
3. 404 Media, Joseph Cox - Why a Flock Worker Quit: "They Lied" (August 3, 2026). https://www.404media.co/why-a-flock-worker-quit-they-lied/
4. State of Surveillance - Flock Safety Rebellion: Cities Cancel Federal Access, the prior vessel on local cancellations. /news/flock-safety-rebellion-cities-canceling-federal-access-2026
5. 404 Media, Jason Koebler - Cops Used Flock to Track a Man Across State Lines to Create Pretext to Search His Car for Weed (August 5, 2026). https://www.404media.co/cops-used-flock-to-track-a-man-across-state-lines-to-create-pretext-to-search-his-car-for-weed/
6. The Register, Connor Jones - US House Candidate Allegedly Shoots Down Four Flock Cameras (August 4, 2026). https://www.theregister.com/security/2026/08/04/us-house-candidate-allegedly-shoots-down-four-flock-cameras/5282696
7. Electronic Frontier Foundation, India McKinney - Senate Vote "Tomorrow" on Four Internet Bills in One Wrong Direction (August 4, 2026). https://www.eff.org/deeplinks/2026/08/senate-vote-tomorrow-four-internet-bills-one-wrong-direction
8. 404 Media, Samantha Cole - What Is the SCREEN Act, the Age Verification Bill That Targets VPNs? (August 4, 2026). https://www.404media.co/what-is-the-screen-act-age-verification-porn/
9. Electronic Frontier Foundation - The Youth AI Privacy Act's Privacy Paradox (August 3, 2026). https://www.eff.org/deeplinks/2026/08/youth-ai-privacy-acts-privacy-paradox
10. 404 Media, Joseph Cox - Apple's Private Relay Is Exposing Users' Real IP Addresses (August 5, 2026). https://www.404media.co/apples-private-relay-is-exposing-users-real-ip-addresses/
11. State of Surveillance - Apple Hide My Email Useless Private Relay, the prior vessel on Private Relay limits. /news/apple-hide-my-email-useless-private-icloud-subdomain-2026
12. The Register, Connor Jones - London Cops Handed Victim's New Address and Number to Her Stalker, Watchdog Says (August 5, 2026). https://www.theregister.com/security/2026/08/05/london-cops-handed-victims-new-address-and-number-to-her-stalker-watchdog-says/5283382
13. Electronic Frontier Foundation, Lena Cohen and Bill Budington - Mobile Ad Software Encourages Location Data Sharing, EFF Report Finds (August 4, 2026). https://www.eff.org/press/releases/mobile-ad-software-encourages-location-data-sharing-eff-report-finds
14. State of Surveillance - Location Data Brokers and Your Phone, the prior guide on data-broker exposure. /articles/corporate/location-data-brokers
15. The Register, Connor Jones - Russia's SVR Borks Public Wi-Fi for Digital Surveillance: "CaptiveCrunch" (August 3, 2026). https://www.theregister.com/security/2026/08/03/russias-svr-borks-public-wi-fis-for-digital-surveillance/5282399