Daily Surveillance Briefing: October 17, 2026

GAO: Only One of 24 Federal Agencies Has Started the Post-Quantum Move

A U.S. Government Accountability Office report published October 7 and written up by Cybersecurity Dive on October 8 has the post-quantum cryptography migration sitting at a near-standstill across the federal government ^[1]. Among 24 major federal agencies surveyed, one had completed the inventorying step (identifying priority computer systems and the cryptographic algorithms they rely on). Zero identified all the funding the transition will need. Zero had fully tested the post-quantum cryptography algorithms that NIST standardized. Five used automated inventorying tools; 19 did not.

The framing in the report is that "threats from a CRQC could have devastating impacts to federal systems reliant on vulnerable cryptography," and that "the impact of such a computer on unprepared federal systems could be catastrophic to the nation's economy and security" ^[1]. The catch-up vector is the "harvest now, decrypt later" tactic. Cybersecurity Dive reports that U.S. intelligence officials and private analysts say the Chinese government is likely stockpiling stolen U.S. data now in order to decrypt and exploit it once a quantum computer becomes available ^[2]. The same logic that lets a future quantum adversary decrypt yesterday's intercepted traffic is the logic that turns today's encrypted backups, biometric templates, and sealed court records into tomorrow's plaintext. Encryption migration is a surveillance-resistance policy, even when the report frames it as a cybersecurity one.

The agency-level reasons cited in the report make the lag plain. Of the agencies that had not identified funding, the Office of the National Cyber Director told the GAO that vendor landscape immaturity was "the biggest factor" behind the gap. Of the agencies that had not tested algorithms, 16 said testing was "too early" because vendors had not integrated the new algorithms into commercial products yet. Of the agencies that received GAO recommendations, 23 of 24 produced recommendations (89 in all); only 12 of those 23 fully agreed to implement them ^[1]. The unresolved recommendations are the place to watch: until they are implemented, the GAO's framing is that agencies "will not be well-positioned to identify and quickly replace certain systems (e.g., legacy systems and custom software) that may not support PQC" ^[1]. The agency's overall read: "Federal agencies recognize the quantum computing threat and have taken some actions to partially address it. However, agencies have not fully carried out initial steps to prepare for this threat."

For everyday privacy posture, the report is the federal-side companion to a story the site has covered before in the consumer-key-management frame: the encryption choices made now are the encryption choices a future adversary will face. The clock for that switch is not in the hands of one agency. It is shared across all of them, and 23 of 24 of them are behind on the first step ^[2].

Catch and Revoke: Discovery Open, the Program's Design Goes Up for Disclosure

Lisa Femia at EFF reported on October 15 that Judge Alvin K. Hellerstein of the U.S. District Court for the Southern District of New York denied the government's motion to dismiss EFF's First Amendment challenge to the State and Homeland Security social-media surveillance program EFF calls "Catch and Revoke" ^[3]. The ruling was entered on October 1. Discovery now opens for the United Auto Workers, the Communications Workers of America, and the American Federation of Teachers, who are represented by EFF, Muslim Advocates, and the Media Freedom & Information Access Clinic at Yale Law School.

What is now in play is the mechanics of the program. The Hellerstein ruling, surfaced through EFF's writeup, frames the constitutional question sharply: viewpoint discrimination is "presumptively unconstitutional," and "the chilling effect" of the program can "itself be an injury when the plaintiffs are surveilled" ^[3]. The court also relied on the Second Circuit's Ozturk v. Hyde for the proposition that the Immigration and Nationality Act does not bar review of immigration-adjacent surveillance, a doctrinal anchor EFF will want to keep. The court found the unions had standing both organizationally and associationally, writing that the freedom of the plaintiffs' members "to speak, associate, and appear publicly is not incidental to union work, but rather is the mechanism through which unions recruit, organize, communicate, and bargain" ^[3]. Per EFF, the case now turns on whether EFF's clients can compel the production of records showing how the screening and the five-year social-media handle disclosure actually run.

The surveillance angle the ruling raises for workers is direct. EFF describes the program as using "AI and other automated tools" to scan the social-media and online speech of visa and green-card holders for views including criticism of the Trump administration, support for Palestine, criticism of Israel, rationalizing the murder of Charlie Kirk, and speech described as "hostile" to American culture or traditional American views. The program also requires some immigration-benefit applicants to disclose every social-media handle they have used in the past five years, and in some cases to maintain public accounts. Hellerstein framed the workaday effect plainly: under a government whose immigration crackdowns have been heavily publicized, the threat of adverse immigration consequences is "certainly enough to deter a person of ordinary firmness from the exercise of First Amendment rights" ^[3]. The DHS ICE Instagram subpoena beat and the older DHS voluntary-compliance subpoena coverage carry the federal-vs-ICE side of the same surveillance-on-speech question; Catch and Revoke is the visa-holder-side version.

Discover-Tech: The Ad Bidding Volume Is In, the Partner Inventory Is Open

Carly Page at The Register reported on October 15, sitting on top of Citizen Lab's primary technical writeup, that an Israel-based adtech firm called Discover-Tech used real-time bidding to deliver Candiru spyware to at least 45 Al Jazeera journalist devices in 2024 and 2025 ^[5][6]. Citizen Lab describes Discover-Tech as the operator of a technique the researchers dubbed "AdFection," which turns the real-time bidding system into a spyware delivery channel. The Register writes that the technique required no clicks from the target and exploited the bidding layer of online advertising rather than any user-visible link.

The scale cited in the technical writeup is the part that changes the threat model. Researchers sifted through about 4 billion ad-bidding records and traced ad delivery across more than 70,000 mobile apps and 120,000 websites between March and June 2026 ^[6]. Ads placed through Discover-Tech reached networks belonging to government agencies, defense organizations, and NATO endpoints, although Citizen Lab did not report successful infections outside the journalist set. The Register names Beeswax, Vungle, and Eskimi as named adtech partners through whose inventory the operation routed. Google and IAB Europe have revoked Discover-Tech's approved-vendor status; Discover-Tech had been listed as an approved vendor by both since 2020 ^[5][6].

Citizen Lab's framing for the specific role Discover-Tech played is the part the partner companies now have to answer: "Discover-Tech... appears to be a front for large-scale ad espionage abuse," with "serving as this bridge is Discover-Tech's primary purpose" ^[6]. Citizen Lab called this "the first publicly confirmed case of a zero-click mercenary spyware attack" delivered through the advertising system. The Register's read on the structural finding: the ad bidding system as a whole failed to detect or prevent the abuse, and the worst case for any user who opens a popular app or visits a major publisher site is that the same channel used to sell them shoes is also the channel through which a nation-state-grade implant can land ^[5]. This sits beside the site's existing Pentagon commercial-location-data adtech piece as the second public "ad network to zero-click spyware" pipeline this cycle; the threat model is the same, and the operator roster is now an audit trail.

Met Police and the Auror Platform: ICO Frames the Sector-Wide Message

Connor Jones at The Register reported on October 15 that the UK Information Commissioner's Office issued a reprimand and enforcement notice against the Metropolitan Police Service for its use of the Auror retail-crime platform between March 2023 and September 2024, with access blocked on September 26, 2024 ^[7]. The UK product is operated by Auror Europe, a subsidiary of the New Zealand parent. The ICO's investigation was formally launched in April 2025 after the force self-reported in December 2024.

Per The Register, the ICO found that officers uploaded personal data on 179 individuals without a completed data-protection impact assessment and without a data-sharing agreement with Auror Europe. Of the 179, 128 had names uploaded; 49 had names plus dates of birth; 2 had names, dates of birth, and home addresses. Three of the 179 were children. Roughly 500 free accounts had been registered by MPS officers ^[7]. ICO head of investigations David Doodson framed the message beyond the Met itself: "This action should send a message across the policing sector, and beyond: If you are using new technology to process people's information you must do so lawfully..." ^[7]. The regulator also pointed to the 2021 Clearview AI misuse finding against the Met as a prior repeat failure.

What the reprimand changes for the wider policing sector is the soft-controls finding. The Met ran Auror for 18 months on policy reminders and training rather than technical blocks, and the ICO called the governance gap ongoing because the force had not demonstrated its safeguards will prevent recurrence. Auror is now in use across 14 London boroughs after a formal approval and pilot, a fact that the reprimand does not unwind but does bookend. The reprimand now sits next to the Met's other surveillance beats on the site, including the Croydon permanent facial-recognition rollout and the handheld facial-recognition pilot.

Continuing Threads From the October 16 Cycle

ChatGPT prompt-targeted ads. Joseph Cox at 404 Media reported that OpenAI is letting advertisers upload email lists, phone numbers, hashed identifiers, and Android advertising IDs to target ChatGPT users directly, with inclusion lists required to top 25,000 entries ^[8]. Smaller lists can only be used for exclusion targeting. Advertisers can also submit "context hints" describing chat topics, which 404 Media notes guide matching rather than acting as exact-match targeting rules. OpenAI told 404 Media that being on an advertiser's list does not by itself cause an ad to be shown, and that uploaded files are deleted within about 24 hours. The story sits next to the site's existing OpenAI ChatGPT tracking class action and the older ChatGPT transnational-repression coverage as a new prompt-content-as-targeting dimension.

UK Legal Aid Agency historical records. The Register reported that a 2025 cyberattack on the UK Legal Aid Agency and HM Prison and Probation Service surfaced roughly 250,000 records dated before 2007, including one record going back to 1978 ^[9]. HMPPS probation records cover offenders supervised between 2010 and 2017. Compromised categories include names, addresses, dates of birth, National Insurance numbers, financial details, and information on legal proceedings, criminal charges, pleas, convictions, and sentences. The disclosure is a delayed post-mortem of the April 2025 attack, landing alongside the ACRO and EHRC breach threads already covered on the site.

X's 13,000-account purge. The Register also reported that X removed more than 13,000 accounts it attributed to Iran, Russia, and China ahead of the November 3 U.S. midterm elections ^[10]. The Register notes that X did not publicly explain the evidence behind its attribution. With three weeks to Election Day, the practical question is whether X or the affected governments release any of the underlying data, or whether the attribution stands without it.

What to Watch

Federal post-quantum migration deadlines. The GAO's recommendations to the 12 agencies that agreed-to-implement status is unresolved are the next milestone. A formal OMB deadline for full algorithm testing is the policy move that would convert the GAO's findings from a report into a calendar that vendors can plan around.

Discovery in Catch and Revoke. Hellerstein's ruling lets the union plaintiffs reach DHS and State Department records on how the social-media screening and the five-year handle-disclosure mandates actually run. The first batch of produced documents is the moment the program's design becomes public.

The Discover-Tech partner inventory. With Google and IAB Europe having already revoked Discover-Tech's approved-vendor status, the watch is on whether other exchanges and supply-side platforms follow, whether Beeswax, Vungle, and Eskimi clarify their role, and whether named victims beyond the Al Jazeera set come forward.

OpenAI's prompt-content targeting policy. 404 Media's piece leaves room for OpenAI to refine or constrain chat-topic targeting. The next signal is whether OpenAI documents the matching rules, and whether EU and California regulators ask how prompts become a targeting dimension under existing data-protection law.

ICO follow-up on the Met. The reprimand and enforcement notice leave the governance failure unresolved in the regulator's own framing because the Met has not shown its safeguards will prevent recurrence. The next signal is whether the Met's promised safeguards satisfy the ICO and whether a fine follows.

The X attribution evidence. With US midterms three weeks out, the practical question is whether X or the affected governments release the underlying data behind the 13,000-account removal, or whether the attribution stands without it.

Sources

1. U.S. Government Accountability Office, via Cybersecurity Dive: GAO flags federal quantum-encryption migration lag, October 8, 2026. https://www.cybersecuritydive.com/news/government-quantum-encryption-migration-gao/832377/
2. Cybersecurity Dive, commentary on GAO findings on post-quantum cryptography migration, October 8, 2026. https://www.cybersecuritydive.com/news/government-quantum-encryption-migration-gao/832377/
3. Electronic Frontier Foundation, Lisa Femia: Our lawsuit against the Trump administration's social-media surveillance moves forward, October 15, 2026. https://www.eff.org/deeplinks/2026/10/our-lawsuit-against-trump-administrations-social-media-surveillance-moves-forward
4. State of Surveillance: Daily Surveillance Briefing, October 16, 2026 (Catch and Revoke coverage and the day's slate). /news/daily-surveillance-briefing-october-16-2026
5. The Register, Carly Page: Spyware vendors found a way to make targeted ads even worse, October 15, 2026. https://www.theregister.com/security/2026/10/15/spyware-vendors-found-a-way-to-make-targeted-ads-even-worse/5303334
6. Citizen Lab: How Discover-Tech turned targeted ads into a pipeline for spyware, October 15, 2026. https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/
7. The Register, Connor Jones: Metropolitan Police's unchecked use of shoplifting platform lands force in trouble with data watchdog, October 15, 2026. https://www.theregister.com/security/2026/10/15/metropolitan-polices-unchecked-use-of-shoplifting-platform-lands-force-in-trouble-with-data-watchdog/5303061
8. 404 Media, Joseph Cox: How ChatGPT Targets Ads to You Based on Your Prompts, Phone Number, and Email, October 15, 2026. https://www.404media.co/how-chatgpt-targets-ads-to-you-based-on-your-prompts-phone-number-and-email/
9. The Register, Carly Page: Legal Aid Agency hackers made off with records dating back to 1978, October 15, 2026. https://www.theregister.com/security/2026/10/15/legal-aid-agency-hackers-made-off-with-records-dating-back-to-1978/5303243
10. The Register, Connor Jones: X purges 13,000 accounts linked to suspected meddling ahead of US midterms, October 15, 2026. https://www.theregister.com/security/2026/10/15/x-purges-13000-accounts-linked-to-suspected-meddling-ahead-of-us-midterms/5303234