Daily Surveillance Briefing: October 21, 2026

A federal judge in New York ruled on October 20 that the Office of Personnel Management violated the Privacy Act twice when it gave DOGE agents broad access to its systems of records, resolving the legal question on summary judgment while leaving the remedy open. The Firefox Security Team disclosed that eight eMudhra intermediate certificates had their private keys exposed, a compromise that could let an attacker issue fraudulent HTTPS certificates for sites they do not control. Newly filed court records show DHS flagged a Stop Cop City activist for suspected terrorism while border officers told him they wanted his phone for child abuse material. Britain's ministers scrapped the compulsory digital ID card and left GOV.UK One Login, digital wallets, and more than 80 document credentials running. DHS ordered every federal civilian agency off DeepSeek. ICANN began testing the authentication that would let police reach non-public WHOIS data. The EFF argued that police should need a warrant to search stored license plate reader data.

State of Surveillance

Today in Surveillance:

  • A federal judge ruled that OPM broke the Privacy Act twice by handing DOGE agents broad access to federal employee records. Judge Denise Cote of the Southern District of New York issued summary judgment on October 20, finding one violation in disclosing personal records between agencies and a second in failing to protect the security and confidentiality of those records. The remedy is still open [1].
  • Eight eMudhra intermediate certificates had their private keys exposed. The Firefox Security Team reported that Mozilla received word of the compromise on October 17 and that the keys could let an attacker issue fraudulent HTTPS certificates for any site. Mozilla revoked them through OneCRL in under three hours, then shipped Firefox 158.0.1 and updated NSS to 3.131.1 for everything else [2].
  • Court records show DHS flagged an activist for suspected terrorism, then border officers told him they wanted his phone for child abuse material. Samuel Tunick handed CBP a code that wiped his GrapheneOS phone and now faces criminal charges over it [3].
  • Britain scrapped its digital ID card and kept the infrastructure. GOV.UK One Login, digital wallets, a trust framework, and more than 80 document credentials are still in progress [4].
  • DHS ordered every federal civilian agency off DeepSeek. The order reaches third-party products and services built on DeepSeek implementations, which is where the enforcement difficulty sits [5].
  • ICANN is testing single sign-on for police requests against non-public WHOIS data. Registrars would get 24 hours to answer, and could refuse a request below the threshold of an imminent threat to life, serious bodily injury, critical infrastructure, or child exploitation [6].

Also watching: The EFF is pressing states and courts to require a warrant before police search stored license plate reader data, on a documented record of searches run for racial profiling, protests, abortion investigations, immigration enforcement, retaliation, and stalking, with no judicial review before the query [7].

A Judge Ruled OPM Broke the Privacy Act Twice Over DOGE Access

A federal judge in New York ruled on October 20 that the Office of Personnel Management violated the Privacy Act when it gave DOGE agents broad access to its systems of records. The summary judgment from Judge Denise Cote of the Southern District of New York found one violation in disclosing personal records between agencies and a second in failing to protect the security and confidentiality of those records. Millions of federal employee records moved into an office created to cut a federal workforce, and the modernization explanation did not survive the ruling. As Cote put it in the decision: "The record also provides no support for a finding that it was the pursuit of a modernization agenda that prompted OPM to grant sweeping and expedited access to a score of DOGE Agents to its systems of records containing PII." [1]

What separates this from another filing in the DOGE litigation is the posture. Summary judgment resolves the legal question on the existing record rather than sending it to trial, so the finding about what OPM did is not provisional. EFF is representing the American Federation of Government Employees, the Association of Administrative Law Judges, and individual employees, with co-counsel from Lex Lumina LLP, the State Democracy Defenders Fund, and The Chandra Law Firm.

The remedy is still open. OPM has rescinded the DOGE agents' database access and many of those agents have left government, which closes the immediate exposure without settling what OPM owes for the period the access ran. The court will decide the remedy at a later date. We have been following this thread since DOGE Is Building a Master Database of Every American and across the Privacy Act lawsuits DOGE faces. This is the payoff to that thread, and the remedy phase is where the accountability lands.

Eight Certificate Keys Exposed. Firefox Revoked Them in Under Three Hours

Eight intermediate certificates issued by the Indian certification authority eMudhra had their private keys exposed. The Firefox Security Team reported that "On Saturday, October 17, at 20:06 UTC, Mozilla received a report that private keys associated with eight eMudhra intermediate certificates had been compromised." The consequence is blunt: an attacker could issue fraudulent HTTPS certificates for websites they do not control, and anyone able to intercept a connection could then impersonate a site and potentially read or modify the traffic. That turns a key leak into a way to sit invisibly inside encrypted traffic [2].

Mozilla's response is worth reading as a model for the rest of the industry. The team blocked the affected certificates through OneCRL, its centralized revocation list, which reaches users with no update and no restart. Their own timing: "By 22:59 UTC that same day, in less than 3 hours after we received the report, the updated OneCRL distribution was complete for all Firefox users with standard configurations." [2] They then shipped Firefox 158.0.1 for desktop and Android, plus ESR 115.43.1 and ESR 153.5.1, for the minority of users whose custom settings may have kept the revocation push from arriving.

The extra releases exist because of the long tail. Mozilla also updated the trusted certificate list in NSS to 3.131.1 to remove the root that signed the affected intermediates. Applications that use Mozilla's trust store, or a version derived from it, do not receive OneCRL updates, so they depend on that change for protection. For most Firefox users the risk is already closed. For everything else, it is not.

The Alert Said Terrorism. The Officers Said Child Abuse Material.

Newly filed court records in the Samuel Tunick case show a Department of Homeland Security alert telling agents to stop a man at an airport because he was suspected of "terrorist activities." Joseph Cox at 404 Media reported the documents, which include a screenshot of the alert and photographs of the interrogation. Tunick is a Stop Cop City activist who was stopped in January 2025. Customs and Border Protection officers told him they needed his phone to look for "kiddie porn." He handed over a code, and entering it wiped his security- and privacy-focused GrapheneOS phone. He is now being criminally charged for that act [3]

The gap between the two stories is the story. The alert that stopped him cited terrorism. The officers who searched him said something else entirely. As Cox reports it, the records show CBP officials lied to Tunick during the interrogation, and the internal reason they gave for targeting him was suspected terrorism [3].

A phone built to be erased on command became the evidence in a criminal case about erasing it. That puts this alongside our coverage of GrapheneOS reaching Android 17 and of the FBI reading deleted Signal messages anyway. When a device is engineered to resist seizure, the contest moves out of the hardware and into the courtroom, where the defense is a criminal charge.

The UK Killed Its Digital ID Card and Kept the Rest

Britain's ministers scrapped the compulsory digital ID card scheme and left the identity infrastructure running underneath it. Carly Page at The Register reported that Susannah Storey, the Department for Culture, Media and Sport permanent secretary, was pressed on what survives the cancellation when she appeared before the Public Accounts Committee [4]

Most of it. Still in progress are GOV.UK One Login, GOV.UK digital wallets, a digital identity trust framework, private-sector integration testing, and more than 80 planned document credentials, including proof of benefits, driving test certificates, and Disclosure and Barring Service certificates. Digital driving licences remain targeted for a national rollout in 2027. Storey was joined at the hearing by Rod Latham, the department's director for cybersecurity and digital identity, Natalie Jones, the senior responsible owner for GOV.UK One Login, and Christine Bellamy, interim director general for digital products at the Government Digital Service [4]

Officials draw a line between the scrapped ID card product and the pre-existing digital identity work below it. The question worth watching is whether that line survives a national login combined with 80-odd credentials, since the scope of what a single identity resolves is the part readers actually feel. We tracked the same identity layer in its policing form in UK Lords Approve Police Facial Recognition on 50 Million Licence Records.

DHS Ordered Every Federal Civilian Agency Off DeepSeek

The Department of Homeland Security ordered every federal civilian agency to stop using DeepSeek and to remove what it already had. Thomas Claburn at The Register reported the Monday order: "The US Department of Homeland Security on Monday issued an order directing federal civilian agencies not to use technology products from Chinese AI lab DeepSeek, and to remove any existing implementations." [5]

The wording reaches further than the product name. Agencies are told to drop "all DeepSeek and DeepSeek-affiliate products, and third-party products and services developed using DeepSeek implementations." [5] That last clause is where the enforcement difficulty sits. A model reached through someone else's API gateway is not a DeepSeek deployment by name, and each agency has to work out for itself what counts before it can certify compliance.

The order lands years after the No DeepSeek on Government Devices Act, which Representatives Darin LaHood and Josh Gottheimer introduced on February 6, 2025. That bill never left committee, so agencies moved on their own instead. We covered the earlier stage in US Holds Off Blacklisting DeepSeek, Adds 100+ Other Chinese Firms and the global bans in DeepSeek Banned: How a Chinese AI Chatbot Triggered a Global Backlash.

ICANN Is Building the Login That Lets Police Reach Hidden WHOIS Data

ICANN has started testing the authentication that would let law enforcement agencies make urgent requests for non-public WHOIS information. Simon Sharwood at The Register reported that the ICANN Input Group on Law Enforcement Agency Authentication Mechanisms presented its progress at ICANN 87 in Bali [6]

The mechanism is single sign-on. Authenticated law enforcement users would reach ICANN's Registration Data Request Service through SAML, with a token exchanged during the handshake restricting which personnel may submit a request. Testing is running with the FBI and Interpol, and the group aims to publish a conformance spec. Registrars would get 24 hours to respond, or 72 for complex queries, and could refuse a request they judge falls short. The Register gives the threshold the group is working to: "Imminent threat to life, of serious bodily injury, to critical infrastructure, or of child exploitation." Namecheap and Verisign spoke in support of the proposal [6]

Two frames point in opposite directions here. WHOIS data is hidden because rules like the GDPR push registrars to hide it. The same proposal carves out a police access path gated on an urgency assessment the requesting agency makes for itself. ICANN says the work is technical and that acceptable-use policy belongs to other groups later, which means the standard could exist before anyone has settled what counts as a valid request.

The EFF Wants a Warrant Before Any Plate Reader Database Search

The Electronic Frontier Foundation is arguing that police should need a warrant before searching stored license plate reader data. Adam Schwartz laid out the case: "Automated license plate readers (ALPRs) are mass surveillance. They photograph every passing car and log where and when it was captured, building a searchable record of where nearly everyone drives. Cities should not buy them, and cities that already have them should shut them down." [7]

The documented search reasons Schwartz describes run from racial profiling and monitoring protesters to abortion-related investigations, immigration enforcement, retaliation against critics, and stalking. He names California, Texas, Wisconsin, Indiana, Florida, Arizona, and Oklahoma, and notes that a federal judge in Oklahoma has agreed warrants should be required [7]

The policy ask is deliberately narrow. The EFF does not argue that a warrant makes plate readers acceptable. It argues that a judge should have to sign off before a query runs rather than the audit trail arriving afterward to explain it. Colorado's warrant bill for Flock searches is the legislative version of that argument, and EFF work on cops hiding reader use from courts covers the disclosure problem underneath it.

What to Watch

The remedy phase of the OPM case. Summary judgment settles the legal question. What the court orders OPM to do about the records DOGE agents accessed, and whether OPM contests the scope of any remedy, is the next thing to watch.

Who picks up the certificate revocation. Mozilla handled Firefox in under three hours. Everything using a Mozilla-derived trust store without OneCRL updates needs the NSS change, and the exposure there depends on which devices get patched and which do not.

The ICANN conformance spec. The group aims to publish one after testing with the FBI and Interpol. The acceptable-use policy sits with other ICANN groups, so the order in which those two arrive decides how much scrutiny a request gets before a registrar has to answer it.

DeepSeek behind a gateway. The order's reach into third-party products and services is broad enough that agencies will have to interpret it themselves, and the first interpretation to be published will set the template.

Sources

  1. Electronic Frontier Foundation, Mario Trujillo - Victory! Court Rules OPM Data Disclosure to DOGE Is Unlawful (October 20, 2026). https://www.eff.org/deeplinks/2026/10/victory-court-rules-opms-disclosure-personal-records-doge-unlawful
  2. Mozilla Security Blog, Firefox Security Team - Protecting Firefox users following the compromise of eMudhra intermediate certificates (October 20, 2026). https://blog.mozilla.org/security/2026/10/20/protecting-firefox-users-following-the-compromise-of-emudhra-intermediate-certificates/
  3. 404 Media, Joseph Cox - DHS Said They Searched Man Who Wiped GrapheneOS Phone for Child Abuse Material. They Lied (October 20, 2026). https://www.404media.co/dhs-said-they-searched-man-who-wiped-grapheneos-phone-for-child-abuse-material-they-lied/
  4. The Register, Carly Page - Whitehall shuts the front door on digital ID but leaves the back open (October 20, 2026). https://www.theregister.com/public-sector/2026/10/20/whitehall-shuts-the-front-door-on-digital-id-but-leaves-the-back-open/5304100
  5. The Register, Thomas Claburn - DeepSeek deep-sixed at all US federal civilian agencies (October 20, 2026). https://www.theregister.com/security/2026/10/20/deepseek-deep-sixed-at-all-us-federal-civilian-agencies/5304010
  6. The Register, Simon Sharwood - ICANN testing tech to let law enforcement access non-public WHOIS info (October 20, 2026). https://www.theregister.com/networks/2026/10/20/icann-testing-tech-to-let-law-enforcement-access-non-public-whois-info/5304036
  7. Electronic Frontier Foundation, Adam Schwartz - Require Police to Get a Warrant to Search ALPR Data (October 19, 2026). https://www.eff.org/deeplinks/2026/10/require-police-get-warrant-search-alpr-data