Daily Surveillance Briefing: May 3, 2026

Adobe-style buildings under a dramatic cloudy sky in the American Southwest — Photo via Unsplash

Today in Surveillance:

Meta threatens to quit New Mexico. Rather than comply with child safety reforms (age verification, algorithm limits, a court-appointed monitor), Meta says it might pull Facebook, Instagram, and WhatsApp from the entire state. Phase 2 of the trial starts tomorrow.
EU CSAR trilogue also tomorrow. Parliament vs. Council on whether your encrypted messages get scanned. The fight for end-to-end encryption in Europe enters its defining round.
Pentagon keeps Anthropic blacklisted. But the NSA is quietly using Anthropic's Mythos anyway. The DoD CTO says Mythos is a "separate national security moment." Make it make sense.
FISA 702: 43 days and counting. The 45-day extension clock is ticking toward a mid-June deadline. Congress is on recess. No reform talks scheduled.

Meta to New Mexico: Let Us Harm Kids or We Leave

Meta would rather pull Facebook, Instagram, and WhatsApp from an entire US state than implement child safety measures. That's the company's actual legal position heading into Monday's bench trial in Santa Fe [1].

The backstory: in March, a Santa Fe jury found Meta liable for 75,000 violations of New Mexico's Unfair Practices Act. The penalty: $375 million (the statutory maximum). Phase 1 is over. Meta lost [2].

Phase 2 starts May 4. Judge Francis Mathew will now decide whether Meta's platforms constitute a "public nuisance" and what remedies to impose. Attorney General Raúl Torrez is asking for $3.7 billion to fund a 15-year youth mental health abatement plan. He wants age verification, a ban on under-13 accounts, mandatory guardian accounts for minors, algorithm redesigns to remove addictive features like infinite scroll and autoplay, and a court-appointed child safety monitor with investigative powers for at least five years [3].

Meta's response? A legal filing stating that "it does not make economic or engineering sense for Meta to build separate apps just for New Mexico residents" and that the state's demands would force the company to withdraw entirely [4].

AG Torrez called it a "PR stunt," pointing out that Meta has built custom versions of its platforms for authoritarian governments when profits demanded it. "Meta is showing the world how little it cares about child safety," Torrez said in a statement.

Here's what's actually unprecedented: a tech company threatening to cut off an American state to avoid accountability for documented harm to children. This trial could set the template for every other state AG building similar cases.

Deep dive: Meta Would Rather Quit New Mexico Than Stop Harming Kids. The State Called Their Bluff.

EU CSAR Trilogue Tomorrow: Encryption's Defining Fight

The fourth trilogue meeting between the European Parliament, Council, and Commission on the Child Sexual Abuse Regulation (CSAR) is scheduled for May 4. This is where Europe decides whether encrypted messaging survives [5].

The positions remain far apart. The Parliament passed its stance in March: no scanning of end-to-end encrypted communications. Period. The Council wants to keep "voluntary" scanning alive, with a framework that could escalate to mandatory detection orders. The Commission is trying to bridge the gap [6].

The voluntary scanning derogation already expired on April 3. We covered that. Companies that were scanning under the old rules had to stop. CSAR is supposed to replace that framework with something permanent. The question is whether "permanent" means mass surveillance of private messages or targeted, court-ordered measures with real safeguards.

A political deal is targeted for July, with the fifth and presumably final trilogue scheduled for June 29. Tomorrow's meeting sets the negotiating boundaries. If the Council gets its way, client-side scanning could become EU law by fall.

Pentagon Keeps Anthropic Blacklisted While NSA Uses Mythos Anyway

Department of Defense CTO Emil Michael confirmed on Thursday that Anthropic remains designated as a supply chain risk. Defense contractors must certify they don't use Claude in any military work. The ban is active. The lawsuits continue [7].

But there's a wrinkle: the NSA is using Anthropic's Mythos Preview (a model with advanced cyber vulnerability detection capabilities) despite the blacklist. Michael called Mythos a "separate national security moment" that requires "government-wide attention" rather than just DoD policy [8].

The whole saga started in February when the Pentagon tried to renegotiate Anthropic's acceptable use policy. Anthropic's original contract prohibited using Claude for mass domestic surveillance of Americans or fully autonomous weapons. The Pentagon wanted those restrictions removed. Anthropic refused. Trump signed an order on February 27 severing all federal ties [9].

A federal judge in California blocked the Pentagon's supply chain risk designation in March, calling it "Orwellian." An appeals court in DC then denied Anthropic's request to pause the blacklisting while litigation continues. So the ban stands (legally contested but operationally enforced) while a different intelligence agency uses the company's most powerful model anyway.

Meanwhile, the Pentagon struck deals with seven other AI companies to fill the gap Anthropic left. None of those companies have equivalent acceptable use policies restricting military surveillance applications.

Deep dive: The Pentagon Banned Anthropic. The NSA Kept Using Its Most Powerful Model Anyway.

FISA 702: Clock Running, Nobody Working

It's been three days since Congress passed the 45-day extension, and already the pattern is clear: nobody's doing anything. Both chambers are on recess until mid-May. No reform discussions are scheduled. No committee hearings announced. The new deadline is approximately June 14 [10].

The extension was supposed to create space for compromise. The Freedom Caucus wants warrant requirements. The intelligence community says warrants would "cripple" the program. Democrats are split: four members (Golden, Gottheimer, Suozzi, Gluesenkamp Perez) voted for the clean extension after voting against reform. The FISA Court found ongoing compliance failures as recently as March. None of it has moved the needle.

If you've followed this story since 2023, you know how this ends: another deadline, another extension, another promise to "get it right next time." The program continues unreformed. Your data stays in the database, searchable without a warrant.

What to Watch

Tomorrow: Meta v. New Mexico Phase 2. The bench trial starts Monday, May 4. Judge Mathew will hear arguments on public nuisance and remedies. If Meta actually follows through on its withdrawal threat, it would be the first time a tech platform cut off a US state. More likely: months of legal wrangling and eventual settlement.
Tomorrow: EU CSAR Trilogue #4. The fourth formal negotiation on chat control. We'll publish an outcome piece as soon as results emerge.
Mid-May: Congress returns from recess. FISA 702 reform theoretically back on the table. Don't hold your breath.
June 14 (approx): FISA 702 extension expires. The third deadline in three months. Each time, reform dies and the program gets another temporary reprieve.
June 29: EU CSAR Trilogue #5. If tomorrow doesn't produce a deal, this is the backup. The final negotiation round before summer recess.