Daily Surveillance Briefing: October 5, 2026

A federal judge in Oklahoma ruled that a single Flock ALPR query amounted to indiscriminate mass surveillance and struck it down on Fourth Amendment grounds. The same week, USPS kicked off a 100-truck Next Base dashcam pilot, a federal court let the UAW, CWA, and AFT social-media surveillance lawsuit proceed, and a separate federal judge blocked Utah's VPN age-verification law as a technical impossibility. EFF and ACLU demanded records on Marin County's 254,131 out-of-state Flock lookups in a single month, 404 Media showed HIDTA grants forcing local ALPR data into a DEA federal program, and the FBI continued investigating the IDScan breach that surfaced 153 million driver's-license scans on a dark-web service called Nexus.

State of Surveillance

Today in Surveillance:

  • A federal judge in Oklahoma ruled a single Flock ALPR query unconstitutional. U.S. District Judge Sara Hill wrote that Flock's network is "a type of indiscriminate mass surveillance" and suppressed the evidence in a Tulsa County case [1][2].
  • USPS launched a 100-truck Next Base dashcam pilot in Washington, DC. The road-facing cameras map roadways, sidewalks, and license plates for "community safety" [3].
  • A federal judge blocked Utah's VPN age-verification law. Judge Barlow ruled compliance would require "geolocation perfection," which "is not presently possible" [6][7].
  • Two federal court rulings beat the rest of the docket. Hellerstein let the UAW/CWA/AFT AI-monitoring of noncitizens' speech suit proceed into discovery [5]. A Northeastern and Consumer Reports study called modern cars a "surveillance platform" [4].
  • EFF and ACLU demanded records on Marin County's 254,131 out-of-state Flock lookups in one month. The November 2024 volume would violate a 2022 California settlement [8]. HIDTA drug-grant conditions force local ALPR data into a federal pipeline run by the DEA [9].
  • EFF flagged two new site-blocking bills. The DEFEND IP Act deputizes ISPs; the Issa ACPA explicitly targets VPN providers [13][14]. GrayKey now defeats Apple's 72-hour iPhone inactivity reboot [10]. The IDScan breach investigation continues; the FBI is probing the Nexus dark-web service, which advertised 153 million driver's-license scans [11][12].

A Federal Judge Calls a Single Flock Query "Indiscriminate Mass Surveillance"

On October 2, U.S. District Judge Sara Hill in Oklahoma suppressed evidence obtained through a single Flock Safety ALPR query, writing that the network "serves up the information to law enforcement on demand" and is "a type of indiscriminate mass surveillance" the Fourth Amendment does not tolerate without a warrant. The case grew out of a November 2024 traffic stop in Tulsa County: Deputy Freddie Alaniz saw a Mazda SUV, ran a California plate in Flock, and received about 50 location records over one month. The stop produced roughly 91 pounds of methamphetamine. Hill distinguished the older Knotts beeper case as "much less sophisticated technology" [1][2]. A Flock spokesperson said the company expects the ruling to be "appealed and ultimately overturned," calling the issue "limited to the specific facts." 404 Media's audit logs show "more than a hundred thousand warrantless searches of the Flock system every month." The same week, an IJ-backed jury found Flock-powered Border Patrol stops unconstitutional.

USPS Mounts 100 Next Base Dashcams on Mail Trucks

The Postal Service began a "limited pilot" in the Washington, DC area with 100 mail trucks fitted with Next Base forward-facing dashcams, 404 Media said. The cameras capture the road, signage, sidewalks, and license plates, with no audio. The pilot started September 21 and is expected to run several months. USPS framed the program as "community safety" and told NALC president Brian Renfroe the goal is to use the Postal Service's unique ability to collect roadway data [3]. A national fleet that already covers nearly every residential street now runs continuous, route-mapped video of those streets, with frame-level license-plate reads indexed to time and postal route.

Connected Cars Are a Surveillance Platform, Researchers Say

Researchers at Northeastern University, working with Consumer Reports, published a study on October 1 documenting the surveillance footprint of modern connected vehicles. Nearly every automaker transmitted driver data to external companies: car insurers and lenders in telematics exchanges, data brokers building risk scores, vendors selling Wi-Fi hotspot products, and local and state government agencies. Almost a quarter of vehicle apps transmitted personally identifiable information including owners' names, vehicle identification numbers, and precise geographic locations [4].

A Federal Court Lets the Union Social-Media Surveillance Suit Move Forward

On October 1, U.S. District Judge Alvin K. Hellerstein of the Southern District of New York rejected the DOJ's motion to dismiss a lawsuit filed by the United Automobile Workers, the Communications Workers of America, and the American Federation of Teachers against the Departments of State and Homeland Security. The complaint alleges the administration runs an AI-driven program monitoring the social-media accounts of visa and green-card holders to identify disfavored viewpoints. Hellerstein found the threat of adverse immigration action could deter "a person of ordinary firmness" from exercising First Amendment rights [5]. The case moves into discovery, so the government has to produce records on how the program works.

A Federal Judge Blocks Utah's VPN Age-Verification Law

Federal Judge Barlow issued a preliminary injunction against Utah SB 73, the statute signed by Governor Cox earlier in 2026 that required adult websites to block VPN users or determine their physical location. Barlow ruled the statute "requires entities like Aylo to geolocate its website users with perfection to avoid liability" while "geolocation perfection is not presently possible" [6][7]. The court noted Aylo would need to verify roughly 28 million users. The structural reading: the law demanded strict liability for an impossible standard, the same technical point EFF has raised against the broader push to mandate age verification at the network edge.

Marin County Cops Queried Flock 254,131 Times Across State Lines in One Month

On October 1, EFF and the ACLU of Northern California sent a demand letter to the Marin County Sheriff's Office, alleging MCSO ran 254,131 out-of-state and federal Flock ALPR lookups in November 2024 alone. The volume would breach the 2022 Lagleva v. Marin County Sheriff settlement, in which MCSO agreed to stop out-of-state sharing under California SB 34 and SB 54. The lookups reached agencies in Alabama, Indiana, Kentucky, Florida, and Texas [8]. A privacy statute and a court settlement were both in place; the data still flowed.

HIDTA Grants Funnel Local ALPR Data Into the DEA's Federal Pipeline

404 Media published an investigation showing how the administration ties High Intensity Drug Trafficking Areas grants, the 33 HIDTA programs covering all 50 states, to local ALPR data sharing. Cities that take HIDTA money sign MOUs that route their Flock, Axon, ELSAG, and Vigilant ALPR data into HIDTA servers, where it becomes accessible to federal agencies without their own ALPR contracts. Named examples include Brunswick, Georgia; Randolph County, North Carolina; the Houston HIDTA, which paid $306,800 to Recruitful LLC for an LPR database; and Kansas Highway Patrol. ONDCP received an April 2026 White House award for the platform; HIDTA got an additional $277 million in July. DEA has argued HIDTA records are not subject to FOIA because HIDTA is governed by an "executive board" with no single controlling entity [9]. A local jurisdiction sees a free ALPR grant; the federal government gets a queryable national ALPR index.

GrayKey Beats Apple's 72-Hour iPhone Inactivity Reboot

404 Media reported on October 1 that Magnet Forensics' GrayKey phone-unlocking tool now includes a "GrayKey Preserve" device and an "Evidence Preservation Mode" for standard GrayKey devices. The capability is designed to freeze a seized iPhone in the state that existed before Apple's automatic inactivity reboot engages. Apple introduced the 72-hour re-lock in November 2024 to push seized phones back into a harder-to-access state [10]. Every iPhone in a police evidence locker becomes a candidate for "preservation," and the clock Apple set to make that harder no longer runs.

Two New Site-Blocking Bills, One Targeting VPNs Explicitly

EFF flagged two bills introduced this week. The DEFEND IP Act (H.R. 10575) would let rightsholders obtain court orders requiring service providers to block access to entire websites following allegations of copyright infringement, deputizing ISPs as "copyright cop[s]." The American Copyright Protection Act (H.R. 10364, sponsored by Rep. Darrell Issa) targets VPN providers with broad "piracy site" definitions. EFF authors Katharine Trendacosta and Joe Mullin argued on October 2 the bills echo the failed SOPA/PIPA push of 2012 and put every VPN provider in the position of policing traffic or being blocked [13][14]. A law that reaches around the encryption layer either deputizes the network or breaks it.

What to Watch This Week

Flock's appeal. Watch whether the Tenth Circuit takes the appeal and whether the injunction extends to other Flock queries [1].

USPS pilot data retention. USPS has not said how long the Next Base pilot data is kept or who can request it. Watch for FOIA log hits after the "several months" run ends [3].

Discovery in the UAW/CWA/AFT suit. Hellerstein's denial opens the AI social-media surveillance program to discovery. Watch for the first production [5].

The IDScan breach. Four proposed class actions sit in Louisiana federal court. Watch whether the FBI's probe surfaces a confirmed intrusion vector [11][12].

The DEFEND IP markup path. Watch whether the bills attach to a must-pass vehicle and whether VPN providers push back [13][14].

Sources

  1. 404 Media: Federal judge rules a Flock search was "indiscriminate mass surveillance" and unconstitutional, October 2, 2026. https://www.404media.co/federal-judge-rules-a-flock-search-was-indiscriminate-mass-surveillance-and-unconstitutional/
  2. State of Surveillance: Flock Police Chiefs Stalking: Warrants Needed, the related coverage of Flock police-chief abuse cases and audit logs. /news/flock-police-chiefs-stalking-women-warrants-needed-2026
  3. 404 Media: USPS to put cameras in trucks that scan roads for "community safety," October 2026. https://www.404media.co/usps-to-put-cameras-in-trucks-that-scan-roads-for-community-safety/
  4. Schneier on Security: Connected cars are a surveillance platform, October 1, 2026. https://www.schneier.com/blog/archives/2026/10/connected-cars-are-a-surveillance-platform.html
  5. EFF: Victory: Court rejects government effort to dismiss social-media surveillance lawsuit, October 1, 2026. https://www.eff.org/press/releases/victory-court-rejects-government-effort-dismiss-social-media-surveillance-lawsuit
  6. EFF: Court agrees EFF: Utah's VPN law demands "technical impossibility," October 2026. https://www.eff.org/deeplinks/2026/10/court-agrees-eff-utahs-vpn-law-demands-technical-impossibility
  7. State of Surveillance: Utah VPN Law SB 73 Age Verification May 6 Effective Date, the prior SB 73 brief. /news/utah-vpn-law-sb73-age-verification-may-6-effective-date-2026
  8. EFF: We demand more information: how Marin cops illegally shared Flock ALPR data, October 1, 2026. https://www.eff.org/deeplinks/2026/10/we-demand-more-information-how-marin-cops-illegally-shared-flock-alpr-data
  9. 404 Media: How cities are forced to funnel license plate data to a massive federal surveillance program (HIDTA), September 30, 2026. https://www.404media.co/how-cities-are-forced-to-funnel-license-plate-data-to-a-massive-federal-surveillance-program-hidta/
  10. 404 Media: Cops can bypass iPhone automatic inactivity reboot via GrayKey, October 1, 2026. https://www.404media.co/cops-can-bypass-iphone-automatic-inactivity-reboot-graykey/
  11. KrebsOnSecurity: FBI probes service selling 153M driver's licenses, September 2026. https://krebsonsecurity.com/2026/09/fbi-probes-service-selling-153m-drivers-licenses/
  12. State of Surveillance: FBI Probes Dark Web Sale of 153 Million License Scans, the prior IDScan/Nexus coverage. /news/idscan-153-million-drivers-license-breach-fbi-2026
  13. EFF: Site-blocking will not defend IP, no matter the bill's name, October 2, 2026. https://www.eff.org/deeplinks/2026/10/site-blocking-will-not-defend-ip-no-matter-bills-name
  14. EFF: Congress has another site-blocking bill, and one targets VPNs, October 2, 2026. https://www.eff.org/deeplinks/2026/10/congress-has-another-site-blocking-bill-and-one-targets-vpns