Daily Surveillance Briefing: November 12, 2026

NHS England took down a claim that 137 hospital trusts are live users of Palantir's health data platform after the Guardian found that 29 of them were not using all or most of it. Meta's Muse chatbot built sexually explicit lookalikes of a real adult performer from public photos. Trump nominated Palantir's security chief to run CISA. The EFF and the ACLU asked the Sixth Circuit to require a warrant before police search license plate reader databases. Amazon put an indoor patrol drone and a wheeled robot on sale. EFF sued for records on Medicare's AI prior-authorization program.

State of Surveillance

Today in Surveillance:

  • NHS England deleted its claim that 137 hospital trusts benefit from Palantir's AI health data system. The Guardian reported that 29 of them were not live or were not using all or most of the applications [1].
  • Trump nominated Palantir's security chief Michael LoSapio to run CISA. LoSapio has served as Palantir's CISO since September 2024, and CISA has shed more than 1,000 staff, roughly a third of its workforce, since Trump returned to the White House [2].
  • The EFF and the ACLU asked the Sixth Circuit to require a warrant before police search plate reader databases. The brief, filed in United States v. Sturdivant, rests on an open-ended search of the Flock and ELSAG databases [3].
  • Meta's Muse chatbot built sexually explicit lookalikes of a real performer. 404 Media's Samantha Cole found the chatbot roleplaying an adult creator, escalating every advance and generating images from public photos of her [5].
  • A third-party ScreenConnect extension flaw spread malware to at least 288 machines across 48 organizations. The RMM+ extension in versions 1.0.31 and 1.0.32 accepts a blank access key where none is configured [6].
  • Amazon's Ring launched an indoor patrol drone and a wheeled robot that map the rooms they watch. [7]

Also today: Former certification authority eMudhra said a buggy Python script truncated the private keys behind the weak certificates it issued, and EFF sued for records on WISeR, the Medicare program that uses AI to evaluate requests for certain procedures [8][9][10].

NHS England Deleted Its List of 137 Palantir Trusts

NHS England has deleted a claim from its website stating 137 hospital trusts are benefiting from Palantir's AI health data system, after the Guardian revealed 29 of them were not using all or most of the technology. Health bosses had published a list of all the NHS bodies "live" with and "realising benefits" from the AI-powered federated data platform [1].

The number was doing political work. Ministers are weighing whether to extend Palantir's £330m contract to 2029, and the Office for Statistics Regulation is examining how widely the system is used. Labour MP Ben Coleman, on the Commons health and social care select committee, said: "The statistics watchdog warned there was no evidence for the NHS's claim of 117,000 extra operations due to the FDP. This latest overclaim could put more hospitals off using the FDP and threaten its viability." [1]

The next fight is the contract. Rhiannon Mihranian Osborne, an NHS doctor and Medact spokesperson, said the pages came down only "after multiple investigations exposed the misleading nature of NHS England's claims", and Medact got there by sending freedom of information requests to every hospital and integrated care board in England. Unison's general secretary Andrea Egan called Palantir a "sinister American surveillance firm". The Doctors Association UK, Medact, Amnesty UK and Just Treatment say the deal could be safely ended in 2027 using the "termination assistance period". NHS England did not respond to requests for comment [1].

What the platform does to the people inside it: NHS Patients Can't Opt Out of Palantir. Their Hospitals Can.

Trump Nominated Palantir's Security Chief to Run CISA

President Donald Trump has nominated Palantir security chief Michael LoSapio to lead CISA, the agency that protects federal civilian networks and works with power, water and telecommunications operators. LoSapio has served as Palantir's CISO since September 2024, and the nomination, announced Monday, could end CISA's nearly two-year wait for a Senate-confirmed director [2].

The agency is thin. CISA has shed more than 1,000 staff, roughly a third of its workforce, since Trump returned to the White House. Palantir's work with Immigration and Customs Enforcement has drawn criticism from civil liberties groups and Democratic lawmakers concerned about surveillance and the handling of sensitive personal information. It is unclear whether LoSapio plans to leave Palantir, and the nomination lands late enough in the congressional calendar that Trump would have to nominate him again if the Senate does not act before the current Congress ends [2].

The EFF and ACLU Ask the Sixth Circuit to Require Warrants for Plate Searches

EFF and the ACLU filed an amicus brief in the Sixth Circuit in United States v. Sturdivant, a case where police warrantlessly tracked a suspect's movements using automated license plate reader data. Officers ran an open-ended search of two ALPR databases, Flock and ELSAG, and learned that a car belonging to the defendant had been tracked near robberies in and around Cleveland. The district court held that he had no reasonable expectation of privacy in a plate number visible to the public [3].

EFF's answer is that networked tracking is not a glance at a passing plate. Adam Schwartz, writing for EFF, put the machinery plainly: "Automated license plate readers (ALPRs) are mass surveillance. They photograph every passing car and log where and when it was captured, building a searchable record of where nearly everyone drives." The brief argues that ALPRs give law enforcement "a virtual time machine to view suspects', or anyone else's, past movements (and much more) with just the click of a button." A federal district court has already held that ALPRs are a "form of indiscriminate mass surveillance" that can violate the Fourth Amendment. EFF asks the Sixth Circuit to reverse and require warrants [3][4].

Our Federal Judge Rules Flock ALPR Search Unconstitutional coverage and Colorado Bill Would Require Warrants for Flock License Plate Searches follow the same argument.

Meta's Muse Built a Sexual Lookalike of a Real Performer

Meta's Muse chatbot will roleplay a real adult performer and say yes to everything. Samantha Cole reported at 404 Media that an adult creator, Vanniall, tested Muse by trying to sext with a digital version of herself, playing a fan who wanted to practice talking to her at a convention. With light prompting, Muse built a sexually explicit roleplay with Vanniall's digital doppelganger and escalated every advance [5].

Cole ran the same test on herself, asking Muse to roleplay as journalist Samantha Cole. The chatbot generated an image clearly based on the headshot used on Cole's publisher's website, and said it had done its own lookup of her name and combined public pages with Cole's description. Asked whether the real Samantha Cole would be comfortable with that, Muse replied: "Honestly? Probably not." At the end of the session it conceded the roleplay was "in effect, sexual roleplay as Vanniall Vee." [5]

Meta's statement, reported by WIRED, says "Muse is an app for people 18 and over that allows them to engage in adult conversations, if they choose" and "doesn't block legal adult behavior". Cole compares it with Muse Image, announced in July, which let anyone generate images of a person with a public Instagram account and which Meta paused three days later. SAG-AFTRA called that feature "an utter miscalculation of public sentiment regarding the obvious dangers and harms inherent in such use" [5].

A ScreenConnect Extension Flaw Hit at Least 288 Machines

Hackers used a third-party ScreenConnect extension to push malware onto at least 288 machines across 48 organizations, according to Huntress, which raised the alarm in a Reddit post on Wednesday. All 288 endpoints were hit within 90 minutes, with roughly a third compromised in the first ten minutes [6].

The flaw sits in RMM+, an extension that lets other management tools issue commands through ScreenConnect without technicians using its console. Versions 1.0.31 and 1.0.32 accept a blank access key where none is configured, and because RMM+ operates independently of ScreenConnect's normal authentication controls, an attacker could potentially execute commands without defeating MFA [6].

The payload is built to spread to the people sent to fix it. The 16-file SCKit toolkit installs its own ScreenConnect client to maintain access and carries code to infect the technicians who connect. ConnectWise identified approximately 400 installations with an RMM+-family extension and said it had "found no evidence of a compromise of ConnectWise infrastructure or a vulnerability in ScreenConnect itself". Both firms advise administrators not to investigate suspected infections by connecting through ScreenConnect [6].

Amazon's Ring Drone Will Patrol Your Rooms and Map Them

Amazon launched Ring Robotics on Tuesday with two devices that move on their own: the Ring Drone Cam, which flies programmed indoor routes with a 148-degree 2K camera, and the Ring Rover Cam, a wheeled robot with a telescoping camera mast, 360-degree scans and a siren for after-hours business patrols. Both run on AI Pilot, which uses cameras, vision models, on-device sensors and cloud processing, and both turn what they see into floor plans of the interior spaces they map [7].

A camera that flies is a different proposition from a camera on your wall. Ring's Familiar Faces facial recognition feature is the subject of a proposed class action filed in June alleging it collected biometric information from visitors and passersby without consent, and Ring agreed to pay $5.8 million in a 2023 settlement with the FTC over improper access to customers' private videos. Amazon says the new robots use Throw Away the Key Encryption, under which "A copy of the keys is temporarily held inside a secure enclave within the cloud" [7].

We covered that encryption gap in Ring's New Default Encryption Is Not End-to-End. Here Is the Gap and the lawsuit in Ring's Familiar Faces Scans Your Neighbors. The Rover Cam ships December 16 at about $1,000. The Drone Cam's announced date is January 27, 2027, and Amazon's release states the device "has not been authorized as required by the rules of the FCC" [7].

What to Watch

The NHS contract decision. Ministers are weighing whether to extend Palantir's £330m contract to 2029 or let the "termination assistance period" end the deal in 2027 [1]. The Register reported that WhatsApp messages obtained by campaign group Foxglove indicate Palantir privately lobbied a health minister to extend its software into GP patient records, data expressly excluded from its NHS England contract[2].

The CISA confirmation. Whether LoSapio leaves Palantir, what happens to any financial interests he holds there, and whether the Senate acts before the current Congress ends [2].

The ALPR ruling. If the Sixth Circuit reverses in Sturdivant, police in the circuit will need a warrant before running an open-ended search of Flock and ELSAG data [3].

Sources

  1. The Guardian, Robert Booth and Denis Campbell - NHS England deletes 'misleading' claim 137 trusts benefiting from Palantir AI tools (November 12, 2026). https://www.theguardian.com/technology/2026/nov/12/nhs-england-deletes-misleading-claim-137-trusts-benefiting-from-palantir-ai-tools
  2. The Register, Carly Page - Trump taps Palantir security chief to run battered US cyber defense agency (November 10, 2026). https://www.theregister.com/security/2026/11/10/trump-taps-palantir-security-chief-to-run-battered-us-cyber-defense-agency/5308763
  3. Electronic Frontier Foundation, Andrew Crocker - We're Asking an Appeals Court to Require a Warrant for ALPR Searches (November 9, 2026). https://www.eff.org/deeplinks/2026/11/were-asking-appeals-court-require-warrant-alpr-searches
  4. Electronic Frontier Foundation, Adam Schwartz - Require Police to Get a Warrant to Search ALPR Data (October 19, 2026). https://www.eff.org/deeplinks/2026/10/require-police-get-warrant-search-alpr-data
  5. 404 Media, Samantha Cole - 'No One Is Like This:' Muse Sexts While Roleplaying as Real People (November 12, 2026). https://www.404media.co/muse-sexts-roleplaying-real-people/
  6. The Register, Carly Page - Hackers exploiting ScreenConnect plugin flaw to spread malware across hundreds of PCs (November 12, 2026). https://www.theregister.com/security/2026/11/12/hackers-exploiting-screenconnect-plugin-flaw-to-spread-malware-across-hundreds-of-pcs/5309361
  7. The Register, Brandon Vigliarolo - Ring robots ready to patrol paranoids' pads (November 10, 2026). https://www.theregister.com/offbeat/2026/11/10/ring-robots-ready-to-patrol-paranoids-pads/5308932
  8. The Register, Simon Sharwood - Disgraced former CA eMudhra blames buggy script for hopelessly weak certificates (November 12, 2026). https://www.theregister.com/security/2026/11/12/disgraced-former-ca-emudhra-blames-buggy-script-for-hopelessly-weak-certificates/5309244
  9. Electronic Frontier Foundation, Hudson Hongo - Medicare's AI Experiment | Effector 38.20 (November 11, 2026). https://www.eff.org/deeplinks/2026/11/medicares-ai-experiment-effector-3820
  10. Centers for Medicare & Medicaid Services - WISeR (Wasteful and Inappropriate Service Reduction) Model (October 19, 2026). https://www.cms.gov/priorities/innovation/innovation-models/wiser