Daily Surveillance Briefing: July 28, 2026

On July 13 the Fourth Circuit ruled in U.S. v. Belmonte Cardozo that a CBP officer's two-minute manual search of a traveler's phone at Washington Dulles was a routine border search under the Fourth Amendment, requiring no warrant and no individualized suspicion. The EFF, whose amicus brief urged the court to require warrants for all border device searches, called the decision a misread of its own precedent. The same ruling ties itself to the two-minute length of the search in the record, leaving open what happens when an officer scrolls longer. Around the same week, DHS published a plan to nearly triple border surveillance towers (from 830 to 2,300 by 2034), California pulled browsers from its age-gating expansion while leaving the device-level mandate, and a four-three New Orleans City Council vote cleared $250,000 for the NOPD drone program.

State of Surveillance Editorial Team

Today in Surveillance:

  • The Fourth Circuit ruled that CBP can manually scroll through your phone at the border with no warrant and no individualized suspicion. In U.S. v. Belmonte Cardozo (No. 25-4239), decided July 13, the court held that a two-minute manual search of a phone at Washington Dulles was a routine border search under the Fourth Amendment. The ruling ties itself to the two-minute length of the search in the record, leaving open what happens when an officer scrolls longer. The decision is now the controlling rule in Maryland, Virginia, West Virginia, North Carolina, and South Carolina [1][2].
  • DHS plans to nearly triple border surveillance towers, from 830 to 2,300 by 2034. The EFF reported on July 20 that the buildout is funded by $1 billion from the One Big Beautiful Act and that the proposed hardware is Anduril's Sentry tower, paired with AI-based detection using radar, thermal infrared, and optical cameras. The numbers come from the GAO's June 9 annual assessment of DHS acquisitions, GAO-26-108118 [3][4].
  • California pulled browsers from AB 1856 but left the operating-system age gate. EFF announced on July 15 that it had removed its opposition after the July 1 Senate amendment removed the browser-and-website expansion and kept an open-source operating-system exemption. AB 1043 still requires covered operating systems to ask for age and pass age-bracket signals to covered services, beginning January 1, 2027 [5][6].
  • NOPD published, then pulled, a June 21 drone policy that would have allowed weaponized quadcopters. 404 Media reported on July 20 that the current Chapter 43.5 manual, dated July 1, instead states that small unmanned aircraft shall not be equipped with weapons or hazardous materials. The New Orleans City Council had approved a $250,000 budget for the drone program three days after the weaponized draft went up [7][8].
  • ICE is buying credit-card applicants' home addresses from data brokers with no warrant. 404 Media's Joseph Cox reported on July 22 that when a U.S. resident opens a credit card, the issuer ships the home address to data brokers that ICE can search. Senator Ron Wyden called it an outrageous violation of our privacy and said it is impossible for Americans to opt out [9][10].

Also today: A separate 404 Media leak of an ICE surveillance-tech inventory details phone location data, social-media monitoring, and online undercover tooling across the agency, and the same agencies have been pursuing voter-fraud data procurements the EFF and 404 Media have been documenting all summer [11][12]. Flock CEO Garrett Langley told ABC7 that Flock ALPRs do not record video, contradicting the company's own "LPR Cameras Can Become Video Cameras" announcement [13][14]. The EU Court of Justice's July 22 Coyote System ruling (Joined Cases C-188/24 and C-190/24) narrowed platform liability in a way the EFF argues will chill free expression on every recommendation-driven platform [15][16].

The Fourth Circuit Says CBP Can Scroll Your Phone at the Border

On July 13, 2026, the U.S. Court of Appeals for the Fourth Circuit ruled in U.S. v. Belmonte Cardozo (No. 25-4239) that a CBP officer's two-minute manual search of a traveler's phone at Washington Dulles was a routine border search under the Fourth Amendment, requiring no warrant and no individualized suspicion. The Electronic Frontier Foundation, which had urged the court to require warrants for all border device searches, called the ruling a misread of its own precedent [1][2].

The case involved Jose Belmonte Cardozo, who flew into Washington Dulles from Bolivia. A CBP officer met him and, without a warrant, manually searched his cell phone. The search lasted approximately two minutes. Officers found child sexual abuse material on the device, and Belmonte Cardozo was already on the U.S. government's radar before he boarded the flight [1]. The facts make this a hard case for privacy advocates. The search found genuinely horrific material. But constitutional rights get tested on ugly facts. If the Fourth Amendment only protects people we like, it protects no one.

The Fourth Circuit drew four distinctions between manual and forensic searches: in a manual search, a person does the searching rather than a machine; a manual search's breadth depends on the officer's time and energy, while forensic searches are comprehensive; manual searches reveal only what a user can typically access, while forensic searches can recover deleted files, cached fragments, and metadata; and manual searches are limited by an officer's fading memory or imperfect notes, while forensic searches create a permanent copy [1]. Forensic device searches at the border remain subject to the standard set out in U.S. v. Kolsuz (2018) and U.S. v. Aigbekaen (2019), which require at least some measure of individualized suspicion tied to the border search exception's purposes [1].

None of the four distinctions turn on the privacy interest of the person whose phone is open. All four turn on the limits of the officer doing the searching. EFF's framing of the loss: scrolling for two minutes through someone's personal text messages or photos is an invasion of privacy [1]. The site's vessel carries the four-factor test and the EFF's read in full [2].

By tying its holding to the duration of the search, the court left a narrow path open. EFF's read: by relying on the fact that the search lasted two minutes, the Fourth Circuit left open the possibility that lengthier manual searches could trigger heightened suspicion requirements [1]. No clear line was drawn. A line will have to be litigated in a future case, with facts that push past the two-minute mark. For now, "routine" means an officer at Dulles, Reagan National, BWI, Charlotte, Raleigh-Durham, or any other Fourth Circuit port of entry can ask a traveler to unlock a phone, scroll through texts and photos, and walk away without writing a single word down. No judge. No probable cause. No record.

Two structural counterweights sit behind the ruling. Riley v. California (2014) already held unanimously that police need a warrant to search the cell phone of someone they have arrested, because a phone contains the sum of an individual's private life and bears little resemblance to the physical containers the border search exception was written to handle [1]. EFF, the national ACLU, the ACLU affiliates in Maryland, North Carolina, South Carolina, and Virginia, and the National Association of Criminal Defense Lawyers had urged the Fourth Circuit to extend that reasoning to the border. They lost on manual searches, and the manual-versus-forensic split between circuits is sharper, not narrower [1][2].

DHS Plans to Nearly Triple Border Surveillance Towers by 2034

Karen Gullo of the EFF reported on July 20 that DHS plans to nearly triple the number of surveillance towers along U.S. borders, going from the current 830 to 2,300 by 2034. The $1 billion cost comes from the One Big Beautiful Act, the tax and spending law President Trump signed in 2025 [3]. The numbers come from the GAO's June 9 annual assessment of DHS acquisitions, GAO-26-108118, titled DHS Annual Assessment: Dynamic Environment Affects Efforts to Manage Acquisition Risks. DHS expects to spend at least $55 billion across its acquisition portfolio, with at least $14 billion in additional funding under current legislation flowing mostly to Coast Guard and Customs and Border Protection programs [4].

The proposed hardware is Anduril's Sentry tower, part of CBP's Autonomous Surveillance Tower program. The sensor stack is described as AI-based systems using radar, thermal infrared, and optical systems to track targets over long distances, paired with the same Lattice AI software already running the more than 300 towers Anduril has deployed along the southern border [3]. The buildout adds about 1,470 towers over the next decade, plus upgrades to autonomous capability on existing installations. A single agent can monitor dozens of towers remotely across multiple CBP sectors, with alerts in seconds of detection.

The buildout does not stop at towers. DHS is also adding tethered aerostats, unattended ground sensors, drones, automated license plate readers, and game cameras disguised as trail cams [3]. A separate GAO assessment, GAO-25-107302, found that CBP failed to address six out of six main privacy protections across three of its border surveillance programs: surveillance towers, aerostats, and unattended ground sensors [17]. The June 9 report also notes that some DHS programs lost as much as 20% of their staff, putting program goals at risk, and that in October 2025 DHS dissolved a key acquisition oversight office [4]. The privacy baseline for the existing programs failed, the oversight office is gone, and the buildout target is 2034.

Belmonte Cardozo is the legal carve-out the new towers will operate inside. A tower records the plate and the time of every vehicle that crosses its field of view. A CBP officer at a primary inspection booth can run that plate and pull the border-crossing history. Under Belmonte Cardozo, the officer does not need individualized suspicion before pulling out the phone. The towers and the legal carve-out together form the entry pipeline [3]. The site's vessel tracks the buildout, the GAO numbers, and the Belmonte Cardozo wiring [4].

California Pulls Browsers From AB 1856, but the Device-Level Age Gate Stays

California lawmakers removed provisions from AB 1856 that would have expanded the state's age-gating system to browsers and websites. The July 1 Senate amendment also keeps an exemption for open-source operating systems. That is a real retreat. It does not erase AB 1043, the law requiring covered operating systems and app stores to collect age information and pass age-bracket signals to online services [5].

California came close to turning browsers into age-verification checkpoints. AB 1856 originally expanded the state's Digital Age Assurance Act beyond operating systems and app stores, reaching browsers and websites. The EFF opposed that version because it would have pushed age checks deeper into ordinary internet access. The Senate amended AB 1856 on July 1. The revised text removes the browser and website expansion that drove EFF's opposition [6].

EFF announced on July 15 that it had removed its opposition after the change. Its position is narrow, not celebratory. The group wrote that no one should have to provide or verify their age to access the internet [5]. California stopped this bill from spreading the mandate further. It did not dismantle the system already signed into law.

AB 1043 still requires covered operating-system providers with account setup features to ask an account holder for a user's birth date or age, then divides users into age brackets and makes those signals available through a secure interface to covered services. For new devices, the requirements begin January 1, 2027. Existing devices must be brought into the system before July 1, 2027 [6]. The law allows the California attorney general to seek civil penalties of up to $2,500 per affected child for a negligent violation and up to $7,500 for an intentional violation [6]. The site's vessel walks through what is actually live, what got pulled, and what the open-source exemption covers [5].

That changes the privacy bargain at the device level. Before opening an app or visiting a service, a person may have to disclose age information to the software controlling the device. A service receiving the signal is treated as having actual knowledge of the user's age range. EFF argues that no available age-verification option perfectly protects private information, keeps services accessible, and handles sensitive data safely. It also warns that imposing liability based on age signals can push developers toward blocking lawful material rather than accepting legal risk [18].

NOPD Reversed Its Weaponized-Drone Policy Within Ten Days

A June 21, 2026 NOPD draft of its drone operations manual would have let the Superintendent of Police authorize weaponized quadcopters. A week later, the current published version of Chapter 43.5 instead states that small unmanned aircraft shall not be equipped with weapons or hazardous materials of any kind [7].

404 Media's Matthew Gault reported on July 20 that NOPD's drone operations manual, formally Chapter 43.5 of the department's policy series on small unmanned aircraft systems, had a clear rule in its February 7, 2024 version: the sUAS shall not be equipped with weapons of any kind [7]. On June 21, 2026, a new version of Chapter 43.5 appeared on the NOPD website, removing the weapons ban and, according to 404 Media's reading, allowing weaponized drones with written approval from the Superintendent of Police. The local transparency group Eye on Surveillance flagged the change the same day, with the headline noting that NOPD had previously assured the public and City Council that these drones would not carry weapons [8].

By July 1, the manual on the NOPD site read differently. The current published version states that the sUAS shall not be equipped with weapons or hazardous materials of any kind. In a statement to 404 Media, the department said the manual published on July 1 is the current published version of the policy, and earlier versions were draft versions presented for review before adoption of the current policy. NOPD also told 404 Media: NOPD has made it clear we are not and will not be equipping drones with weapons or other hazardous materials [7].

Three days after the weaponized-draft was published, the New Orleans City Council approved a $250,000 budget for the NOPD drone program on June 24, 2026. The vote ran four to three, with Jean-Paul "JP" Morrell, Freddie King III, Eugene J. Green, and Jason Hughes voting in favor; Matthew Willard and Aimee McCarron voting against; Lesli Harris absent [7][8]. The drone program sits alongside a separate surveillance footprint in New Orleans: NOPD already runs a Drone-as-First-Responder program in the French Quarter, and the city has spent years in a public fight with the ACLU over NOPD's use of Project New Orleans, a private facial recognition system that records live camera feeds from around the city [7].

Skydio, the U.S. drone manufacturer that supplies most of NOPD's fleet, signed a 2020 statement with the company's Engagement Principles pledge: we will not put weapons on our drones and will oppose fully autonomous lethal weapons systems [7]. Six years later, Skydio CEO Adam Bry told 404 Media that the pledge was a mistake. Asked what Skydio would do if a police customer wanted to weaponize one of its drones, Bry was blunt: it is not our place to tell them what they can and can't do [7]. The site tracks the company position and the federal framework, including the FAA Reauthorization Act of 2018 ban on operations involving a dangerous weapon, in its NOPD vessel [8].

ICE Is Buying Credit-Card Applicants' Home Addresses From Data Brokers

The data-broker pipeline sits underneath everything else on this week's docket. 404 Media's Joseph Cox reported on July 22 that when a U.S. resident opens a credit card, the card issuer ships the applicant's home address to commercial data brokers, and ICE can search those brokers without a warrant. Senator Ron Wyden told 404 Media that no one signing up for a credit card thinks they're giving data brokers a thumbs-up to sell their personal information to ICE [9]. Wyden's framing of the loophole: not only is it an outrageous violation of our privacy, it is impossible for Americans to opt out [9].

The article also notes ICE is using the same datasets for "voter fraud" investigations, the policy payload Wyden has been pushing for months [9]. The same data-broker-to-ICE pipeline sits on top of the Fourth Amendment fight the Fourth Circuit just ruled on, and the site has been tracking the consumer-side data-broker angle since the DROP tool launched [10].

A separate 404 Media leak of an internal document lays out the surveillance technology available across ICE agency-wide, including phone location data, social media monitoring, and online undercover tools [11]. The structural reading is the one the site's ICE surveillance coverage has been tracking for months. Each individual procurement is a single contract, but the assembled pipeline is the same: a commercial data broker layer, a federal query layer, and a series of statutory loopholes that turn a credit-card signup into a hit in a federal database. The site published the 404 Media ICE-surveillance zine as a free download for readers who want the full map [12].

What to Watch This Week

The Belmonte Cardozo window. The losing defendant has the window to seek rehearing en banc or a cert petition to the Supreme Court. Watch that filing window and the docket for any consolidation with the parallel forensic-search cases. The Eleventh Circuit's U.S. v. Touset ruling already goes the other direction, holding that no suspicion is ever required for device searches at the border, so the manual-versus-forensic split between circuits is sharper than it was a week ago [1][2].

The AB 1856 Senate floor. AB 1856 is still moving through the California Senate. Watch the bill text, not the sales pitch: a later amendment could restore broader coverage or alter the open-source exemption. The bigger deadline is January 1, 2027, when the underlying AB 1043 requirements start applying to new devices [6][5].

The Campus Guardian Angel pilots. Fall 2026 start dates in Georgia (five high schools) and additional Florida high schools are the next test of whether armed or irritant-deploying drones actually deploy against a live threat, and whether the NOPD reversal causes Skydio's other police customers to follow the same path [8][7].

Sunday August 2. The EU AI Act high-risk compliance deadline phases in, including biometric-inference rules that touch age-verification and identity systems. Expect the first member-state enforcement signals in the weeks after, and watch whether the European Commission moves to codify the Coyote System liability narrowing in the same window [15][19].

Sources

  1. EFF Deeplinks, Sophia Cope with Suzanne Castillo: The Fourth Circuit Says Border Agents Can Search Your Phone By Hand, No Suspicion Required (July 22, 2026). https://www.eff.org/deeplinks/2026/07/fourth-circuit-says-border-agents-can-search-your-phone-hand-no-suspicion-required
  2. State of Surveillance: Fourth Circuit Manual Border Phone Searches Need No Warrant, the day's topical vessel with the case number, four-factor test, and amicus-stage coverage. /news/fourth-circuit-border-phone-search-routine-no-warrant-2026
  3. EFF Deeplinks, Karen Gullo: An Explosion of Surveillance Towers is Coming to U.S. Borders, Costing Over $1 Billion (July 20, 2026). https://www.eff.org/deeplinks/2026/07/explosion-surveillance-towers-coming-us-borders-costing-over-1-billion
  4. State of Surveillance: DHS Plans 2,300 Border Surveillance Towers by 2034, the dedicated DHS towers vessel with the GAO-26-108118 source. /news/dhs-border-surveillance-towers-2300-2034-gao-2026
  5. State of Surveillance: California Pulls Browsers From Its Age-Gating Expansion, the AB 1856 rollback vessel with EFF's announcement and the open-source exemption. /news/california-ab-1856-browser-age-gating-rollback-2026
  6. EFF Deeplinks: California Steps Back from Dangerous Expansion of Its Age-Gating Law (July 15, 2026). https://www.eff.org/deeplinks/2026/07/california-steps-back-dangerous-expansion-its-age-gating-law
  7. 404 Media, Matthew Gault: New Orleans Cops Published Policy Document Allowing Weaponized Drones (July 20, 2026). https://www.404media.co/new-orleans-cops-published-policy-document-allowing-weaponized-drones/
  8. State of Surveillance: NOPD Published a Weaponized Drone Policy. Then It Reversed., the dedicated NOPD weaponized-drone vessel. /news/nopd-weaponized-drone-policy-published-then-replaced-2026
  9. 404 Media, Joseph Cox: You Opened a Credit Card. ICE Now Knows Where You Live (July 22, 2026). https://www.404media.co/you-opened-a-credit-card-ice-now-knows-where-you-live/
  10. State of Surveillance: California DROP 215,000 Users Data Broker Victory, the parallel California data-broker deletion platform vessel. /news/california-drop-215000-users-data-broker-victory-2026
  11. 404 Media, Joseph Cox: Leaked Document Shows the Surveillance Tech at ICE's Fingertips (July 23, 2026). https://www.404media.co/leaked-document-shows-the-surveillance-tech-at-ices-fingertips/
  12. State of Surveillance: 404 Media Publishes Free Zine on ICE Surveillance Tech, the parallel consumer-reader ICE-surveillance resource. /news/404-media-ice-surveillance-zine-free-download-2026
  13. 404 Media, Jason Koebler: Flock's CEO Says its ALPRs Don't Do Video After Repeatedly Announcing They Can (July 23, 2026). https://www.404media.co/flocks-ceo-says-its-alprs-dont-do-video-after-repeatedly-announcing-they-can/
  14. State of Surveillance: Colorado SB 26-070 Flock ALPR Warrant Bill, the parallel municipal Flock warrant-bill vessel. /news/colorado-sb26-070-flock-alpr-warrant-bill-2026
  15. EFF Deeplinks, Christoph Schmon: New EU Court of Justice Ruling on Platform Liability Could Cause Collateral Damage to Freedom of Expression (July 22, 2026). https://www.eff.org/deeplinks/2026/07/new-eu-court-justice-ruling-platform-liability-could-cause-collateral-damage
  16. State of Surveillance: FISA 702 51 Days White House Clean Extension Showdown, the structural surveillance-authority vessel. /news/fisa-702-51-days-white-house-clean-extension-showdown-2026
  17. Government Accountability Office: GAO-25-107302, CBP Privacy Assessment for Surveillance Programs (cited in EFF July 20, 2026 article).
  18. EFF Deeplinks: A.B. 1043's Internet Age Gates Hurt Everyone (March 12, 2026). https://www.eff.org/deeplinks/2026/03/ab-1043s-internet-age-gates-hurt-everyone
  19. State of Surveillance: EU AI Act August 2026 Biometric Surveillance Explainer, the dedicated EU AI Act vessel. /news/eu-ai-act-august-2026-biometric-surveillance-explainer