Daily Surveillance Briefing: July 24, 2026

ICE is buying credit-card applicants' home addresses from data brokers without a warrant, 404 Media reports, with Senator Ron Wyden calling it an outrageous violation of privacy. The Fourth Circuit ruled that border agents can manually search your phone at the border without any individualized suspicion. The EFF reported that more than 1,000 public-safety agencies now hold FAA waivers for autonomous drone-first-responder flights. The EU's Court of Justice narrowed platform liability in a way EFF says could cause collateral damage to free expression. Flock's CEO claimed the company's ALPRs do not record video, contradicting the company's own product announcements. A separate 404 Media leak laid out the surveillance tech available across ICE agency-wide.

State of Surveillance Editorial Team

Today in Surveillance:

  • ICE is buying credit-card applicants' home addresses from data brokers without a warrant. 404 Media's Joseph Cox reported on July 22 that when a U.S. resident opens a credit card, the issuer ships the home address to data brokers that ICE can search. Senator Ron Wyden called it "an outrageous violation of our privacy" and said it is impossible for Americans to opt out [1][2].
  • The Fourth Circuit ruled that border agents can manually search your phone without any individualized suspicion. The EFF reported on July 22 on U.S. v. Belmonte Cardozo, decided July 13, in which the court held that a CBP officer's two-minute manual search of a phone at Washington Dulles was "routine" and reasonable under the Fourth Amendment, even though manual searches reach the same data as forensic searches that do require a warrant [3][4].
  • More than 1,000 public-safety agencies now hold FAA waivers for drone-first-responder flights. The EFF reported on July 23 that the FAA streamlined Part 91 waivers in April 2025 and issued 976 of the total since the first DFR program in 2018, with the rest clustered in the past 15 months. The waivers authorize autonomous BVLOS flights from rooftop stations that stream footage to police [5][6].
  • The EU's Court of Justice narrowed platform liability in a way the EFF says could cause collateral damage to free expression. The July 22 analysis of the Coyote System ruling (Joined Cases C-188/24 and C-190/24) warns that platforms whose algorithms "control" the order or priority of information dissemination may lose hosting liability protection [7][8].
  • The EFF warned that the New York "Stealth Crawler Protection Act" would let publishers unmask anonymous web crawlers without evidence of wrongdoing. The July 20 analysis argues the bill reaches far beyond AI scraping and would chill investigative journalism, watchdog research, and tools like Privacy Badger [9][10].
  • Flock CEO Garrett Langley said on ABC7 that the company's ALPRs "don't do video." 404 Media's Jason Koebler reported on July 23 that the claim contradicts Langley's own prior statements and a Flock blog post that announced "LPR Cameras Can Become Video Cameras" as a free over-the-air update [11][12].
  • A separate 404 Media leak laid out the surveillance tech available across ICE agency-wide. Joseph Cox's July 23 piece describes a leaked document covering phone location data, social media monitoring, and online undercover tools, sitting alongside the prior week's $125 million Thomson Reuters contract for "voter fraud" data [13][14].

Also today: The browser-side California AB 1856 rollback we covered July 22 cleared the California legislature, with EFF opposition removed after the open-source operating-system exemption [15]. The House-passed KIDS Act remains the next federal move on age verification, and the open-source exemption California adopted is the floor to watch [16].

ICE Is Buying Credit-Card Applicants' Home Addresses from Data Brokers

404 Media's Joseph Cox reported on July 22 that when a U.S. resident opens a credit card, the card issuer ships the applicant's home address to commercial data brokers, and ICE can search those brokers without a warrant. Senator Ron Wyden told 404 Media that "no one signing up for a credit card thinks they're giving data brokers a thumbs-up to sell their personal information to ICE. Not only is it an outrageous violation of our privacy, it's impossible for Americans to opt out" [1][2].

The pipeline itself is the story. A routine financial product triggers a flow of personal data into the commercial data-broker layer, and federal immigration enforcement can query it with no warrant because the data was purchased, not collected under process. The article also notes ICE is using the same datasets for "voter fraud" investigations, which is the policy payload Wyden has been pushing for months [1]. The same data-broker-to-ICE pipeline sits on top of the Fourth Amendment fight the EFF describes below, and the site has been tracking the consumer-side data-broker angle since the DROP tool launched [2].

Fourth Circuit: Border Agents Can Manually Search Your Phone Without Suspicion

The EFF's Sophia Cope reported on July 22 on the Fourth Circuit's July 13 ruling in U.S. v. Belmonte Cardozo, which held that a CBP officer's manual search of a phone at Washington Dulles was "routine" and reasonable under the Fourth Amendment. The court treated the two-minute manual search differently from a forensic search because, in its reasoning, a manual search is done by a person rather than a machine, its breadth depends on the officer's time and energy, it reveals only user-accessible content, and it is limited by fading memory[3][4].

The EFF's argument is that the four distinctions do not actually hold up. A person manually scrolling a phone can reach the same data categories as a forensic tool, organized by search and time rather than by software, and the user still walks out of the border with their entire digital life exposed. The court's broader framing, that the Government must have individualized suspicion of an offense that bears some nexus to the border-search exception's purposes, is the rule the ruling carves around. The site has tracked the manual-versus-forensic line since the 55,000-searches round earlier this year, and the Belmonte Cardozo ruling is the Fourth Circuit's first explicit answer to it [4].

Drone-First-Responder: 1,000+ Public-Safety Agencies Hold FAA Waivers

The EFF's Beryl Lipton reported on July 23 that more than 1,000 public-safety agencies (police, fire, and emergency management) now hold FAA waivers for Drone-as-First-Responder operations, per an EFF FOIA release. The FAA streamlined the Part 91 waiver process in April 2025, and the EFF reports that more waivers were issued between April 2025 and February 2026 than in the prior seven years combined. The first DFR program dates to 2018, and 976 of the total have been issued since then, with the count crossing 1,000 before the EFF published the FOIA log [5][6].

The waivers authorize BVLOS (Beyond Visual Line of Sight) operations and flights above 200 feet, the two limits that previously kept a single operator from flying multiple drones from automated rooftop stations. The EFF describes AI-driven autonomous flight, footage streamed to police, stored, shared, and analyzed, and integration with ALPR networks. The deployment triggers in the agency's account are low-risk calls: unhoused individuals, mental health crises, loud music. The Atlas of Surveillance tracker shows how many departments have built out drone programs in the cycle since the first BVLOS night-operations approval went to Campbell, California in October 2024 [5]. The Skydio commercial-drone program in Delaware and the FBI drone-deployment vessel track the same procurement pipeline [6].

EU Court of Justice Narrows Platform Liability, EFF Says Free Expression Pays the Price

The EFF's Christoph Schmon argued on July 22 that the EU Court of Justice's Coyote System ruling (Joined Cases C-188/24 and C-190/24) is narrower than it looks and broader than it should be. The Court held that when an intermediary's algorithm determines the conditions, order, or priority of information dissemination, the intermediary "controls" that information and can lose its e-Commerce Directive hosting liability protection. The underlying case concerned a navigation system relaying user alerts about roadside checks, but the EFF argues the reasoning sweeps in every recommendation algorithm on every major platform [7][8].

The substantive worry is that proactive monitoring becomes the only way to keep liability protection, which is a direct pressure on platforms to police users' speech. The EFF frames the ruling as "collateral damage" to free expression, sitting alongside Russmedia on data protection and AGCOM on YouTube. The Court's "control" test conflicts with the Digital Services Act, which explicitly accepts recommendation algorithms and leaves hosting liability intact, and with the YouTube and Cyando precedent, where ranking and categorization still qualified for protection. The implementation fight to watch is whether the European Commission narrows the e-Commerce Directive to match the new case law [8].

EFF: New York's "Stealth Crawler Protection Act" Would Unmask Anonymous Researchers

The EFF's Tori Noble argued on July 20 that the New York Stealth Crawler Protection Act, purported to target AI scrapers, would actually let publishers obtain court orders that "unmask anyone using an unidentified crawler, without any evidence that they broke the law." The bill would make it illegal to crawl news websites without revealing the operator's identity and all possible future uses of collected data, and the EFF argues the language sweeps far beyond AI and fails to address the actual harm (server strain from overaggressive crawling) [9][10].

The EFF's named examples are the ones this publication has tracked. The Markup used anonymous crawlers to expose Amazon prioritizing its own brands, and ProPublica used similar methods to expose Amazon's pricing algorithm steering shoppers to more expensive products. Academic and watchdog researchers, including the Facebook misinformation studies that Facebook ultimately shut down, plus cybersecurity professionals monitoring the web for threats, and EFF's own Privacy Badger, which crawls sites to identify trackers, would all be exposed. The substantive policy ask is narrower technical measures that target the volume of harmful crawling rather than the identity of the crawler[9].

Flock's CEO Says ALPRs Don't Do Video. His Own Blog Disagrees.

404 Media's Jason Koebler reported on July 23 that Flock CEO Garrett Langley told ABC7 that Flock's ALPRs capture "a static picture" of a car and that the technology is "pretty simple." The claim contradicts Langley's own 2024 Forbes statement: "We will just open up the five nearest cameras in real time and say, here's what's happening right now." It also contradicts a Flock blog post that announced "Fixed live video is coming to all LPR cameras, free by end of 2025" and a separate product launch titled "LPR Cameras Can Become Video Cameras" [11][12].

The credibility hit lands at a moment when cities are voting to keep or cancel Flock. After 404 Media published, a Flock spokesperson said the feature was "a limited pilot" at five agencies, and that Flock discontinued it for law enforcement in March. The company also produced an internal text exchange from a Dunwoody, Georgia officer obtained via FOIA by Jason Hunyar, in which an officer wrote that live LPR video had been available "about a month" and described it as "pretty cool." The Austin Trust Act and the Colorado SB 26-070 warrant bill are the policy fights already in motion, and the company's own announcements are now public evidence in those fights [12].

Leaked Document Lays Out the Surveillance Tech at ICE's Fingertips

404 Media's Joseph Cox reported on July 23 on a leaked internal document obtained by 404 Media that lays out the surveillance technology available across ICE agency-wide. The categories described include phone location data, social media monitoring, and online undercover tools. The leak sits alongside the credit-card address pipeline above and the prior week's $125 million Thomson Reuters contract for "voter fraud" data, including names, SSNs, and ethnicity, plus a $10 million procurement of immigrants' tax identifiers from a data broker [13][14].

The structural reading is the same one the site's ICE surveillance coverage has been tracking for months. Each individual procurement is a single contract, but the assembled pipeline is the same: a commercial data broker layer, a federal query layer, and a series of statutory loopholes that turn a credit-card signup into a hit in a federal database. The site published the 404 Media ICE-surveillance zine as a free download for readers who want the full map [14].

What to Watch This Week

Friday July 24 to Sunday July 26. The Fourth Circuit's Belmonte Cardozo ruling is the current rule in Maryland, Virginia, West Virginia, North Carolina, and South Carolina, and the losing defendant has the window to seek rehearing en banc or a cert petition to the Supreme Court. Watch that filing window and the docket for any consolidation with the parallel forensic-search cases [3][4].

The California AB 1043 rollback. The open-source operating-system exemption is now the floor to watch as the federal KIDS Act moves to the Senate. EFF removed its opposition after the rollback, and the open-source carve-out is the structural lever for the federal fight [15][16].

The Flock rollout after the 404 Media story. Watch for additional FOIA releases from cities running Flock, the Flock spokesperson's next message, and any council votes the company's stability claims touch. The federal warrant-pre-query bills in Washington and Colorado are the legislative vehicle [11][12].

Sunday August 2. The EU AI Act high-risk compliance deadline phases in, including biometric-inference rules that touch age-verification and identity systems. Expect the first member-state enforcement signals in the weeks after, and watch whether the European Commission moves to codify the Coyote System liability narrowing in the same window [17][7].

Sources

  1. 404 Media, Joseph Cox: You Opened a Credit Card. ICE Now Knows Where You Live, July 22, 2026. https://www.404media.co/you-opened-a-credit-card-ice-now-knows-where-you-live/
  2. State of Surveillance: California DROP 215,000 Users Data Broker Victory, the parallel California data-broker deletion platform vessel. /news/california-drop-215000-users-data-broker-victory-2026
  3. EFF Deeplinks, Sophia Cope: The Fourth Circuit Says Border Agents Can Search Your Phone By Hand, No Suspicion Required, July 22, 2026. https://www.eff.org/deeplinks/2026/07/fourth-circuit-says-border-agents-can-search-your-phone-hand-no-suspicion-required
  4. State of Surveillance: EFF Fourth Circuit Border Device Search Warrant 55,000 CBP Searches, the prior Fourth Circuit border-search vessel. /news/eff-fourth-circuit-border-device-search-warrant-cbp-55000-searches-2026
  5. EFF Deeplinks, Beryl Lipton: Hundreds of Drone-as-First-Responder Programs Could Soon Be Launched Across the Country, July 23, 2026. https://www.eff.org/deeplinks/2026/07/hundreds-drone-first-responder-programs-could-soon-be-launched-across-country
  6. State of Surveillance: Denver Police Drones Flock Skydio Surveillance, the parallel municipal-drone procurement vessel. /news/denver-police-drones-flock-skydio-surveillance-2026
  7. EFF Deeplinks, Christoph Schmon: New EU Court of Justice Ruling on Platform Liability Could Cause Collateral Damage to Freedom of Expression, July 22, 2026. https://www.eff.org/deeplinks/2026/07/new-eu-court-justice-ruling-platform-liability-could-cause-collateral-damage
  8. State of Surveillance: FISA 702 51 Days White House Clean Extension Showdown, the structural surveillance-authority vessel. /news/fisa-702-51-days-white-house-clean-extension-showdown-2026
  9. EFF Deeplinks, Tori Noble: "Stealth Crawlers" Are Not a Threat to the Open Web. Bills Targeting Them Would Be., July 20, 2026. https://www.eff.org/deeplinks/2026/07/stealth-crawlers-are-not-threat-open-web-bills-targeting-them-would-be
  10. State of Surveillance: Cory Doctorow Age Verification Is Mass Surveillance, the structural anonymity critique vessel. /news/cory-doctorow-age-verification-is-mass-surveillance-2026
  11. 404 Media, Jason Koebler: Flock's CEO Says its ALPRs Don't Do Video After Repeatedly Announcing They Can, July 23, 2026. https://www.404media.co/flocks-ceo-says-its-alprs-dont-do-video-after-repeatedly-announcing-they-can/
  12. State of Surveillance: Colorado SB 26-070 Flock ALPR Warrant Bill, the parallel municipal-Flock warrant-bill vessel. /news/colorado-sb26-070-flock-alpr-warrant-bill-2026
  13. 404 Media, Joseph Cox: Leaked Document Shows the Surveillance Tech at ICE's Fingertips, July 23, 2026. https://www.404media.co/leaked-document-shows-the-surveillance-tech-at-ices-fingertips/
  14. State of Surveillance: 404 Media Publishes Free Zine on ICE Surveillance Tech, the parallel consumer-reader ICE-surveillance resource. /news/404-media-ice-surveillance-zine-free-download-2026
  15. State of Surveillance: California AB 1856 Browser Age Gating Rollback, the California-side age-gating rollback vessel. /news/california-ab-1856-browser-age-gating-rollback-2026
  16. State of Surveillance: 42 State AGs AI Chatbot Safety Ultimatum, the parallel state-level AI safety coordination vessel. /news/42-state-ags-ai-chatbot-safety-ultimatum-2026
  17. State of Surveillance: EU AI Act August 2026 Biometric Surveillance Explainer, the dedicated EU AI Act vessel. /news/eu-ai-act-august-2026-biometric-surveillance-explainer