Daily Surveillance Briefing: October 15, 2026

A DHS Inspector General audit found that TSA's Credential Authentication Technology 2 (CAT-2) vendor extracted passenger driver's-license and passport images without the agency's knowledge, with one of three recommendations still open and unresolved. EFF and ACLU of Wisconsin asked the Wisconsin Supreme Court to require warrants for retrospective ALPR database searches. EFF's EFFector 38.18 newsletter reported a court ruling that lets EFF's First Amendment challenge to the DHS social-media program known as Catch and Revoke move forward. The Register reported that a weak password at a small Danish IT vendor exposed 8.8 million people's CPR records. State of Surveillance published a 2026 ShinyHunters tracker covering the vishing-driven extortion operation behind the September FBI jobs-website breach and the Dutch arrest announced on September 29.

State of Surveillance

Today in Surveillance:

  • A DHS Inspector General audit found that TSA's CAT-2 vendor extracted passenger passport and license images without the agency's knowledge. Sophia Cope and Gabrielle Ladun at EFF reported on October 14 that the audit (OIG-26-27-Sep26) flagged a "significant weakness" in protecting passenger data privacy, and one of three recommendations remains open and unresolved [1].
  • EFF and ACLU of Wisconsin asked the Wisconsin Supreme Court to require warrants for ALPR database searches. Andrew Crocker filed the petition on October 14 on behalf of the Wisconsin Council of Churches and a Green Bay pastor against Milwaukee, Racine, Kenosha, and Green Bay [2].
  • EFF's EFFector 38.18 newsletter reported a court win on the Catch and Revoke lawsuit. Hudson Hongo's October 14 summary says a court ruling is allowing EFF's First Amendment challenge to a DHS social-media surveillance program to move forward [3].
  • A weak password at a small Danish IT vendor exposed 8.8 million people's CPR records. The Register reported on October 13 that three accounts at Pays ApS, including an administrator account, used the password "123456," and the breach surfaced after a department staffer picked up an unusually high invoice [4].
  • State of Surveillance published its 2026 ShinyHunters tracker. The page compiles GTIG, CBS News, The Record, ReliaQuest, SOC Radar, and Obsidian Security reporting on the vishing-driven extortion operation, including FBI Cyber Division Assistant Director Brett Leatherman's statement that the group has "breached more than 140 organizations and taken at least $70 million in extortion payments" since last year [5][6][7][8][9][10].

Continuing threads: Yesterday's Oct 14 briefing covered the California dismissal of SIREN v. San Jose, Senator Wyden's demand for the 2024 MITRE privacy review of HIDTA, the Anthropic Claude Haiku 4.5 fake homicide tip in Philadelphia, Tesla's security protocols stopping an HSI tracker, and the Ledger hardware-implant confirmation in Malaysia. The Oct 13 briefing covered the Raven interior-photo tool, Booz Allen's OT lab tests of frontier AI models, the Marin County ALPR records demand, and the First Amendment ruling in the DHS social-media surveillance case.

DHS Inspector General: TSA's CAT-2 Vendor Pulled Passenger Images Without Notice

Sophia Cope and Gabrielle Ladun at EFF wrote on October 14 that the Department of Homeland Security Office of Inspector General released an audit, numbered OIG-26-27-Sep26, finding a "significant weakness" in how the Transportation Security Administration protects passenger biometric data [1]. The audit covers TSA's Credential Authentication Technology 2 (CAT-2) system, the camera-equipped kiosks that scan a traveler's face next to the boarding-pass reader at airport security lanes.

The specific failure, per Cope and Ladun: CAT-2 vendor "was able to access and extract sensitive passenger information, including driver's license and passport images, during system troubleshooting and enhancements, without TSA's knowledge." TSA "lacked clear policies, did not track when this data was extracted, could not verify that extracted information was properly deleted, and did not notify passengers." TSA concurred with all three recommendations; the audit's status block shows two "open and resolved" and one "open and unresolved" [1]. EFF's piece does not name the CAT-2 vendor, and the OIG summary posted publicly does not name the vendor either.

The audit is the first federal fault-finding against a system TSA has been expanding across more U.S. airports. TSA's own website says a traveler can opt out of the facial-recognition step "without any delay, disruption, or recourse." Cope and Ladun call CAT-2 a "governmental system of mass surveillance" and note EFF's long history of opposing governmental facial recognition. The unresolved recommendation is the practical follow-up: if TSA does not know what the vendor pulled, what is the path to deletion [1][11]?

EFF Asks the Wisconsin Supreme Court to Require Warrants for ALPR Searches

Andrew Crocker at EFF filed a petition on October 14 asking the Wisconsin Supreme Court to require law enforcement to obtain a warrant before searching Automated License Plate Reader databases. The clients are the Wisconsin Council of Churches and a pastor in Green Bay; the petition lists Milwaukee, Racine, Kenosha, and Green Bay as defendants. ACLU of Wisconsin is a partner on the filing [2]. The article does not name any specific ALPR vendor.

The argument is a state-constitution analog to the federal Fourth Amendment fight EFF and ACLU ran in California. Crocker's brief quotes the line he frames as the Wisconsin angle: "Right now, Automated License Plate Readers ('ALPRs') are recording the movements of vast numbers of Wisconsin drivers…" and closes with "We all deserve to be free of warrantless mass surveillance." The petition argues that retrospective database searches reveal visits to "medical care, 12-step recovery meetings, religious services, protests, political meetings, pastoral care, confidential counseling, domestic violence survivor meetings" [2].

The Wisconsin filing is the second EFF ALPR challenge in a week. The first, SIREN v. San Jose, lost at the trial court in California last week; the Oklahoma federal court in the same week called ALPRs "a type of indiscriminate mass surveillance" and suppressed evidence from a warrantless Flock search. Crocker cites the Oklahoma ruling as the contrast [2][12][13]. The Wisconsin Supreme Court has not yet set a date for response or argument.

EFFector 38.18: A Court Lets the Catch and Revoke Lawsuit Move Forward

Hudson Hongo at EFF wrote on October 14 that EFFector 38.18, the organization's newsletter, highlights a court ruling that allows EFF's lawsuit against a DHS social-media surveillance program known as "Catch and Revoke" to proceed. Hongo's framing: "No one should have to think twice before criticizing the government online," and the program, per EFF, is "a mass surveillance program known as 'Catch and Revoke'" that "was created to make millions do just that" [3].

The October 14 EFFector post does not name the court, the judge, the specific plaintiffs, or the specific DHS officials. The newsletter also covers the October launches for "Opt Out October," the fight against anti-VPN laws, and a podcast guest appearance by EFF's Lisa Femia on how the government is using AI to suppress protected speech online. The underlying court ruling in the Catch and Revoke challenge is the development worth watching [3][14].

Denmark's CPR Breach: One IT Vendor, One Weak Password, 8.8 Million People

The Register reported on October 13 that attackers accessed Denmark's Central Register of Persons (CPR) through a small Funen-based IT vendor named Pays ApS, which held authorized access for validating business customer records. Three accounts at Pays, including an administrator account, used the password "123456." Between September 10 and September 20, the attacker ran roughly 14 million automated searches against the CPR. The intrusion was detected on October 2, the Danish data protection authority Datatilsynet was notified on October 4, and the government disclosed the breach publicly on October 5 [4].

The Register reports 8.8 million people were affected out of roughly 11 million records in the CPR. Pays ApS managing director Sophie Laursen confirmed the exploited access on October 9. The director of the higher education and science ministry, Mikkel Leihardt, is the government official named in the disclosure. Discovery came after "a department staffer picked up an invoice indicating unusually high activity from Pays." The attacker told Politiken they had "no intention of selling or leaking the data." The Register says Pays' website was taken offline and that the company had not responded to inquiries at publication [4].

For readers, the lesson is the credential policy. A single reused weak password at a small vendor is a national-scale incident when that vendor holds administrative access to a population register. The Register's headline figure, 8.8 million of roughly 11 million records, is the kind of coverage you get when one credential gates a country's identity database [4].

ShinyHunters 2026 Tracker: The Vishing Crew Behind the FBI Jobs Website Breach

State of Surveillance published a 2026 ShinyHunters tracker today, compiling the public reporting on the voice-phishing-driven extortion operation that hijacks Okta and Salesforce tenants and publishes stolen data when victims refuse to pay. Google's Threat Intelligence Group (GTIG) tracks the 2026 wave across three clusters: UNC6661, UNC6671, and UNC6240. The earlier 2025 cluster IDs UNC6040 and UNC6395 are not named in GTIG's January 30, 2026 writeup [5][8][9].

FBI Cyber Division Assistant Director Brett Leatherman said in a video statement after a September 15, 2026 Dutch arrest that "Since last year, this cybercriminal and his co-conspirators have allegedly breached more than 140 organizations and taken at least $70 million in extortion payments." FBI Director Kash Patel announced the arrest on September 29, 2026. CBS News reported on September 22, 2026, via 404 Media, that ShinyHunters had claimed responsibility for defacing the FBI's jobs website the prior week, using "a new vulnerability in Oracle PeopleSoft" and exfiltrating "two to three terabytes of data related to FBI and Justice Department workers" [6][10].

The 2020 to 2021 wave ended in federal court. The Record reported on January 10, 2024, that French hacker Sébastien Raoult (alias "Sezyo Kaizen") was sentenced to three years in U.S. federal prison and ordered to pay $5 million in restitution for his role in the earlier ShinyHunters wave that hit "more than 60 companies" and stole "hundreds of millions of customer records" with estimated losses of $6 million. SOC Radar's January 23, 2026 writeup links the 2026 vishing operation to three organizations, Crunchbase, SoundCloud, and Betterment, with claimed counts of more than 2 million, more than 30 million, and more than 20 million records respectively [7][9]. Obsidian Security documents the FastPass enrollment via emulated Android, with the user agent "com.okta.android.auth/8.19.0 ... Android/16 ... Genymobile/Phone" flagged as a detection signal [10].

The State of Surveillance tracker cross-links to the existing running ShinyHunters article on the Salesforce, Carnival, and Canvas campaign, and the FBI wiretap-and-surveillance-system breach article on the bureau's broader 2026 breach sequence [15][16].

What to Watch This Week

TSA's response to the open OIG recommendation. The audit's third recommendation is "open and unresolved." TSA's posture in writing determines what the agency is actually committing to do about the biometric data the vendor extracted [1].

The Wisconsin Supreme Court's response schedule. EFF's petition to the Wisconsin high court is the first time the question of warrantless ALPR database searches is going to a state supreme court. The schedule for the city's response and any amicus briefs is the next signal [2].

The Catch and Revoke docket. EFF's newsletter confirms the lawsuit is moving forward but does not name the court or judge. The next public filing is the moment to look at the specifics [3].

Datatilsynet and the Pays ApS post-mortem. The Register's last note is that Pays' website was taken offline and the company had not responded. The data protection authority's findings, when published, will say whether the vendor still has CPR access [4].

The Dutch prosecution of the ShinyHunters suspect. The September 15 arrest is the first public law-enforcement action against the 2026 wave. The next signal is what Dutch authorities charge, and whether any U.S. indictment follows [6].

Sources

  1. EFF, Sophia Cope and Gabrielle Ladun: DHS Inspector General Finds That TSA is Not Properly Safeguarding Passenger Facial Recognition Data, October 14, 2026. eff.org
  2. EFF, Andrew Crocker: We're Asking the Wisconsin Supreme Court to End Warrantless ALPR Searches, October 14, 2026. eff.org
  3. EFF, Hudson Hongo: A Victory for Freedom of Speech Online, EFFector 38.18, October 14, 2026. eff.org
  4. The Register: '123456' password linked to Denmark data breach affecting 8.8M people, October 13, 2026. theregister.com
  5. Google Threat Intelligence Group: Tracking the Expansion of ShinyHunters-Branded SaaS Data Theft, January 30, 2026. cloud.google.com
  6. CBS News: Dutch arrest in ShinyHunters FBI hack case, September 2026. cbsnews.com
  7. The Record: French hacker Sébastien Raoult of ShinyHunters sentenced in U.S. federal court, January 10, 2024. therecord.media
  8. ReliaQuest: ShinyHunters Targets Salesforce Amid Clues of Scattered Spider Collaboration, August 12, 2025. reliaquest.com
  9. SOC Radar: Okta Vishing Campaign Allegedly Linked to ShinyHunters, January 23, 2026. socradar.io
  10. Obsidian Security: Behind the breach: ShinyHunters' 2026 voice phishing campaign, March 11, 2026. obsidiansecurity.com
  11. State of Surveillance: TSA Facial Recognition Under Federal Audit
  12. State of Surveillance: Daily Surveillance Briefing, October 14, 2026 (SIREN v. San Jose)
  13. State of Surveillance: Federal Judge Rules Flock ALPR Search Unconstitutional
  14. State of Surveillance: Daily Surveillance Briefing, February 19, 2026 (Catch and Revoke context)
  15. State of Surveillance: ShinyHunters 2026 Tracker, Salesforce, Carnival, Canvas Campaign
  16. State of Surveillance: FBI Wiretap-and-Surveillance-System Breach