Daily Surveillance Briefing: October 16, 2026

A federal court denied the government's motion to dismiss EFF's First Amendment challenge to the DHS Catch and Revoke program, the same day Citizen Lab and The Register reported that an Israeli adtech firm called Discover-Tech used real-time ad bidding to deliver Candiru-class spyware to at least 45 Al Jazeera journalist devices. 404 Media reported that ChatGPT is letting advertisers target users by email, phone, and current chat topic. The UK's ICO reprimanded London's Met Police for 18 months of unchecked use of the Auror retail-crime platform. The Register disclosed about 250,000 UK Legal Aid records dating to 1978 plus 2010 to 2017 probation data from a 2025 attack. X removed more than 13,000 accounts it tied to foreign influence operations without publishing the underlying evidence.

State of Surveillance

Today in Surveillance:

  • A federal court let EFF's First Amendment challenge to the DHS Catch and Revoke program move forward. Lisa Femia at EFF reported on October 15 that Judge Alvin K. Hellerstein of the Southern District of New York denied on October 1 a motion to dismiss filed by State and Homeland Security, ruling that the Immigration and Nationality Act does not bar the lawsuit and that the UAW, CWA, and AFT unions have standing [1].
  • Citizen Lab and The Register reported that an Israeli adtech firm called Discover-Tech used real-time bidding to deliver Candiru-class spyware to at least 45 Al Jazeera journalist devices. Ads placed through the firm also reached government, defense, and NATO endpoints, with delivery running across more than 70,000 mobile apps and 120,000 websites between March and June 2026 [2][3].
  • 404 Media reported that ChatGPT now lets advertisers upload email and phone lists to target users, and to scope delivery by current chat topic. Inclusion lists must top 25,000 entries per the report; OpenAI told the outlet that being on an advertiser's list does not by itself trigger an ad [4].
  • The UK's data-protection watchdog reprimanded London's Metropolitan Police for 18 months of unchecked use of the Auror retail-crime platform. The ICO found no DPIA, no data-sharing agreement with Auror Europe, and data on 179 people, including three children, uploaded without proper governance [5].
  • The Register reported a 2025 attack on the UK Legal Aid Agency and HMPPS, surfacing about 250,000 pre-2007 records dating back to 1978 plus 2010 to 2017 probation data. Names, addresses, dates of birth, National Insurance numbers, financial details, and criminal-case information are listed as potentially compromised [6].
  • X removed more than 13,000 accounts and attributed the activity to Iran, Russia, and China ahead of the November 3 US midterms. The Register writes that X did not publicly explain the evidence behind its attribution [7].

Continuing threads: The October 15 briefing covered the DHS Inspector General audit of the TSA CAT-2 biometric system, the EFF and ACLU of Wisconsin petition to the Wisconsin Supreme Court on warrantless ALPR searches, the EFFector 38.18 summary of the Catch and Revoke ruling, the Danish CPR breach at Pays ApS via the password "123456," and the new ShinyHunters 2026 tracker.

A Federal Court Lets EFF's "Catch and Revoke" Lawsuit Move Forward

Lisa Femia at EFF reported on October 15 that Judge Alvin K. Hellerstein of the U.S. District Court for the Southern District of New York denied on October 1 a motion to dismiss EFF's First Amendment challenge to a DHS and State Department social-media surveillance program EFF calls "Catch and Revoke" [1]. The plaintiffs are the United Auto Workers, the Communications Workers of America, and the American Federation of Teachers, represented by EFF, Muslim Advocates, and the Media Freedom & Information Access Clinic at Yale Law School.

The court rejected the government's argument that the Immigration and Nationality Act foreclosed review, relying on Ozturk v. Hyde in the Second Circuit, and ruled that the unions have both organizational and associational standing. Hellerstein wrote that the freedom of the plaintiffs' members "to speak, associate, and appear publicly is not incidental to union work, but rather is the mechanism through which unions recruit, organize, communicate, and bargain" [1]. The decision lets the case reach discovery, where EFF expects to obtain more information about how the program works.

Per EFF's complaint and Femia's writeup, "Catch and Revoke" uses "AI and other automated tools" to scan the social-media and online speech of visa and green-card holders for views including criticism of the Trump administration, support for Palestine, criticism of Israel, rationalizing the murder of Charlie Kirk, and speech the government describes as "hostile" to American culture or traditional American views. The program also requires applicants for certain immigration benefits to disclose all social-media handles used in the past five years, and in some cases to maintain public accounts [1]. Hellerstein framed the constitutional question sharply: "viewpoint discrimination" is "presumptively unconstitutional," and "the chilling effect" of the program can "itself be an injury when the plaintiffs are surveilled" [1]. The Catch and Revoke beat already has a deep file on the site: see DHS ICE Instagram subpoenas and the older DHS social-media subpoena coverage.

Israeli Adtech Firm "Discover-Tech" Tied to Candiru Spyware Delivered via Real-Time Ad Bidding

Carly Page at The Register reported on October 15, on top of Citizen Lab's primary technical writeup, that an Israel-based adtech firm called Discover-Tech used real-time ad bidding to deliver Candiru spyware to at least 45 Al Jazeera journalist devices in 2024 and 2025 [2][3]. Citizen Lab describes Discover-Tech as "appearing to be a front for large-scale ad espionage abuse," and concludes that "serving as this bridge is Discover-Tech's primary purpose" [3].

The targeting mechanism is the part that changes the threat model. Rather than relying on phishing or malicious links, Discover-Tech bought its way into legitimate ad inventory. The Register reports that nearly 4 billion ad-bidding records were processed, with delivery running across more than 70,000 mobile apps and 120,000 websites between March and June 2026. Ads placed through Discover-Tech reached government, defense, and NATO endpoints, although Citizen Lab does not report successful infections outside the journalist set [2]. Candiru, the underlying spyware, is now known publicly as Integrity Labs. Google and IAB Europe have since revoked Discover-Tech's approved-vendor status; The Register names Beeswax, Vungle, and Eskimi as partners whose inventory passed through the firm [2][3]. Page reads the discovery as the next step in adtech-as-surveillance: "For years, the worst thing about targeted advertising was that it knew far too much about you. Turns out some advertisers were interested in much more than your shopping habits" [2]. The story sits next to the site's Pentagon adtech-as-location-data piece as the second public "ad network to zero-click spyware" pipeline this cycle.

ChatGPT Now Lets Advertisers Target Users by Email, Phone, and Chat Topic

Joseph Cox at 404 Media reported on October 15 that OpenAI is letting advertisers upload email addresses, phone numbers, hashed versions, or Android advertising IDs and target matched ChatGPT users directly, with inclusion lists required to top 25,000 entries [4]. Smaller lists can only be used for exclusion targeting. Advertisers can also submit "context hints" describing relevant topics; 404 Media notes the hints "guide matching but aren't exact-match targeting rules" [4].

ChatGPT had one billion monthly active users at last disclosure, and ads launched in the United States in February 2026. Turning off "ads personalization" in settings does not stop ads; current chat content can still trigger them, per Cox. OpenAI told 404 Media that "being on an advertiser's list does not, by itself, cause an ad to be shown," and that uploaded files are deleted within roughly 24 hours. The company's own ChatGPT Ad Library recorded 43,410 ads captured across 415,289 placements [4]. Cox quotes DecryptAds co-founder Zach Edwards: OpenAI is "boiling the frog and hoping their users won't notice the privacy implications from their new ads" [4]. For prompt-content targeting as a new surveillance-of-speech vector, the story sits next to the site's OpenAI ChatGPT tracking class action and OpenAI transnational-repression coverage.

ICO Reprimands London's Met Police for 18 Months of Unchecked Auror Platform Use

Connor Jones at The Register reported on October 15 that the UK's Information Commissioner's Office issued a reprimand and enforcement notice against the Metropolitan Police Service over its use of the Auror retail-crime platform between March 2023 and September 2024, with access blocked September 26, 2024 [5]. The UK product is operated by Auror Europe, a subsidiary of the New Zealand parent.

The ICO found that the Met uploaded data on 179 individuals, including three children, with names for 128 of them, names plus dates of birth for 49, and names plus dates of birth plus home addresses for 2. The force ran the platform for 18 months without completing a data-protection impact assessment, without data-sharing agreements with Auror Europe, and with only "soft controls" such as policy reminders and training in place of technical blocks [5]. The ICO cited the Met's 2021 Clearview AI incident as a prior repeat failure and called the governance failures ongoing because the force had not demonstrated its safeguards would prevent recurrence. Auror is now used in 14 London boroughs after formal approval and a pilot [5]. The reprimand joins a Met Police FR beat that includes the Croydon permanent-facial-recognition rollout and the handheld facial-recognition pilot.

X Purges 13,000 Accounts Tied to "Suspected Meddling" Without Public Evidence

Connor Jones at The Register reported on October 15 that X removed more than 13,000 accounts it attributed to foreign influence operations tied to Iran, Russia, and China ahead of the November 3 US midterm elections [7]. The accounts posted and amplified political content targeting candidates and public figures across the political spectrum, X told readers on the platform.

The Register writes that "X did not publicly explain the evidence behind its attribution." X's own statement said: "People come to X to talk about what's happening in the world, including the upcoming 2026 US midterms," and "Free speech is the bedrock of a functioning democracy, and we are proud that X is the global town square where these debates happen" [7]. The company's framing of its own role: "Our job is to keep that conversation authentic, open, and safe" [7]. The action and the absent evidence are the relevant pair: when a major platform removes tens of thousands of accounts on foreign-attribution grounds without releasing the underlying data, the speech-removal decision is hard to challenge from outside. This is the platform-transparency counterpart to the Discover-Tech piece: two removals, on the same day, both justified by unseen evidence.

What to Watch

Discovery in Catch and Revoke. Hellerstein's ruling lets the UAW, CWA, and AFT plaintiffs reach discovery on DHS and State Department records about how the social-media screening and handle-disclosure mandates actually operate. The first set of produced documents is the moment the program's design becomes public [1].

The Discover-Tech partner inventory. With Google and IAB Europe already having revoked Discover-Tech's approved-vendor status, the next signal is whether other exchanges and SSPs follow, whether the named partners (Beeswax, Vungle, Eskimi) clarify their role, and whether named victims beyond the Al Jazeera set come forward [2][3].

OpenAI's prompt-content targeting policy. 404 Media's piece leaves room for OpenAI to refine or constrain chat-topic targeting. The next signal is whether OpenAI documents the matching rules, and whether EU and California regulators ask how prompts become a targeting dimension under existing data-protection law [4].

ICO follow-up on the Met. The reprimand and enforcement notice leave the governance failure unresolved in the regulator's own framing because the Met has not shown its safeguards can prevent recurrence. The next signal is whether the Met's promised safeguards satisfy the ICO and whether a fine follows [5].

The X attribution evidence. With US midterms three weeks out, the practical question is whether X or the affected governments release the underlying data behind the 13,000-account removal, or whether the attribution stands without it [7].

Sources

  1. EFF, Lisa Femia: Our lawsuit against the Trump administration's social-media surveillance moves forward, October 15, 2026. https://www.eff.org/deeplinks/2026/10/our-lawsuit-against-trump-administrations-social-media-surveillance-moves-forward
  2. The Register, Carly Page: Spyware vendors found a way to make targeted ads even worse, October 15, 2026. https://www.theregister.com/security/2026/10/15/spyware-vendors-found-a-way-to-make-targeted-ads-even-worse/5303334
  3. Citizen Lab: How Discover-Tech turned targeted ads into a pipeline for spyware, October 15, 2026. https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/
  4. 404 Media, Joseph Cox: How ChatGPT Targets Ads to You Based on Your Prompts, Phone Number, and Email, October 15, 2026. https://www.404media.co/how-chatgpt-targets-ads-to-you-based-on-your-prompts-phone-number-and-email/
  5. The Register, Connor Jones: Metropolitan Police's unchecked use of shoplifting platform lands force in trouble with data watchdog, October 15, 2026. https://www.theregister.com/security/2026/10/15/metropolitan-polices-unchecked-use-of-shoplifting-platform-lands-force-in-trouble-with-data-watchdog/5303061
  6. The Register, Carly Page: Legal Aid Agency hackers made off with records dating back to 1978, October 15, 2026. https://www.theregister.com/security/2026/10/15/legal-aid-agency-hackers-made-off-with-records-dating-back-to-1978/5303243
  7. The Register, Connor Jones: X purges 13,000 accounts linked to suspected meddling ahead of US midterms, October 15, 2026. https://www.theregister.com/security/2026/10/15/x-purges-13000-accounts-linked-to-suspected-meddling-ahead-of-us-midterms/5303234