Daily Surveillance Briefing: September 8, 2026

A Texas sheriff's sergeant used Axon's Draft One to generate the report describing his own agency's Flock search for a woman who self-administered an abortion pill, 404 Media reported. The AI-drafted narrative even discusses whether she could be charged. In London, peers in Grand Committee pressed the government to put personal liability on executives under the Cyber Security and Resilience Bill and were refused. In Cardiff, Natural Resources Wales left the ethnicity, disability, religion, and sexual-orientation records of roughly 2,000 staff sitting in a published Freedom of Information response for about five years. And a Canadian engineer factored the 512-bit RSA keys of two certificate authorities on a desktop PC over a weekend.

State of Surveillance

Today in Surveillance:

  • A Texas sergeant used Axon's Draft One AI to write the report on his agency's Flock search for a woman who self-administered an abortion pill. 404 Media's Jason Koebler reported that Johnson County Sheriff's Office Sergeant Damien Bethel's report carries the line "I acknowledge this report was generated using Draft One by Axon," and that the AI-generated narrative includes a passage on the legal implications of the case [1].
  • UK peers asked why the Cyber Security and Resilience Bill leaves executives off the personal-liability hook, and the government said no. In Grand Committee on September 7, Lord Clement-Jones argued that an executive drawing a multimillion-pound salary at a critical national provider "must be prepared to carry personal responsibility for securing it." Cybersecurity minister Baroness Lloyd of Effra pointed to maximum fines of £17 million or 4% of annual turnover instead [2].
  • Natural Resources Wales exposed the equality-monitoring records of about 2,000 staff through its own transparency process. The Register reported that a spreadsheet published with a 2021 Freedom of Information response included ethnicity, disability, religion or belief, sexual orientation, Welsh language ability, and caring responsibilities. A member of the public flagged it on August 23, 2026. The regulator has reported itself to the ICO [3].
  • Flock's own sales pitch describes Nova as a Google-style search across agency records plus open-source intelligence. In the internal webinar 404 Media obtained, Flock employee Matt Patin said New Orleans shared 7 terabytes of information with its fusion center, Homeland Security, HSI, and the FBI while reconstructing the Bourbon Street attacker's movements [4].
  • England's Children's Commissioner cannot see the risk assessments she is supposed to judge. Dame Rachel de Souza told the Lords Communications and Digital Committee that Ofcom will resist disclosure even against her statutory powers, citing section 393(1) of the Communications Act 2003, and said she is "pretty furious about that" [5].
  • Two 512-bit certificate-authority root keys from 1999 fell to a single desktop PC. Matthew McPherrin factored the E-Certify RSA 512 Gold Server and Gold Client roots that shipped in Netscape 4.51 using CADO-NFS on a Ryzen 9 5950X, in 32 and 29 hours. He published the private keys [6].

Also today: Yesterday's briefing carried the Flock No Kings protest-monitoring webinar, the FBI probe into the dark-web service advertising driver's-license scans, and Comcast's WiFi Motion [7]. The Texas and Florida pullback from state-funded ALPRs remains the policy backdrop to the Johnson County story [8].

An AI Wrote Up the Flock Search for a Woman Who Ended Her Own Pregnancy

The Johnson County Sheriff's Office search of Flock Safety's national license-plate-reader network for a woman who self-administered an abortion pill has been public since May 2025. What 404 Media's Jason Koebler reported on September 2 is the part nobody had looked at: the report documenting that search was drafted by Axon's Draft One. Sergeant Damien Bethel's write-up carries the disclosure line "I acknowledge this report was generated using Draft One by Axon" [1].

Draft One transcribes body-camera audio and generates a narrative in roughly five minutes, according to the description Johnson County's Keven George gave 404 Media. The officer then reviews, edits, and digitally signs it, and the tool inserts placeholders rather than guessing at facts it does not have. That is the vendor's account of the safeguard. Here the machine-written narrative went further than transcription: it records that deputies "discussed the legal implications of the situation, noting that while the girlfriend self-administered the abortion pill, there were no criminal charges applicable under current Texas law," and that they weighed a possible civil suit against the pharmaceutical supplier [1].

Two systems stack here, and each launders the other. The Flock lookup ran on a suspicion the deputy described as the call "not making sense," with the search requested by the woman's abusive partner. Flock CEO Garrett Langley has defended the case to police audiences by saying the family feared for her life, and Flock's Paris Lewbel points out that the report itself states she could not be charged. Neither answer addresses what the record shows: a nationwide camera network and a credit-header database were pointed at a woman on a domestic-abuser's request, and the account of that decision was composed by a language model reading body-camera audio. The sheriff's department has refused to release the body-camera, in-car, and scene footage to EFF and 404 Media, which leaves the AI draft as the primary account of what happened [1].

This site has covered what Draft One does when it hallucinates outright, in the Heber City report that claimed an officer turned into a frog [9], and what Flock's people-search tooling reaches beyond plates [10]. Johnson County is the version where nothing obviously breaks. The output reads clean, the officer signed it, and the only evidence of the search is a document a vendor's model wrote.

Peers Wanted Executives Personally on the Hook. The Government Said No.

The Cyber Security and Resilience Bill went through Grand Committee scrutiny on September 7, and the fight was over who pays when a critical provider fails. Amendments would have let regulators penalise senior executives where non-compliance involved their "consent, connivance, or deliberate or careless neglect." Baroness Kidron backed them on the grounds that "culture change starts at the top." Lord Clement-Jones put it more bluntly: an individual fit to draw a multimillion-pound executive salary running a critical national provider "must be prepared to carry personal responsibility for securing it." The government did not support the amendments [2].

Cybersecurity minister Baroness Lloyd of Effra defended the existing plan, citing maximum fines of £17 million or 4% of annual turnover, whichever is higher, as a meaningful enforcement regime, and said forthcoming secondary legislation will mandate board-level governance aligned with the NCSC Cyber Assessment Framework. The reporting side drew its own fight. Baroness Harding, the former TalkTalk chief executive, proposed a 14-day intermediate report and a one-month final report on top of the bill's 24-hour initial notification and 72-hour fuller report, on the reasoning that "it's really only after a couple of weeks that you've got a proper sense of what has happened." Lord Clement-Jones warned in the other direction about "an administrative tsunami of defensive reporting" [2].

Corporate fines land on shareholders. Personal liability lands on the person who chose not to fund the fix. The UK has already conceded the failure side of this argument, pledging £210 million to repair government cyber weaknesses earlier this year [11], and has watched attackers sit inside the Criminal Records Office for seven months [12]. What the Lords were testing is whether anyone in a corner office ever answers for it.

Wales Published Its Own Staff's Sexual Orientation in an FoI Response

Natural Resources Wales, the Welsh government-sponsored environmental regulator, inadvertently included a staff equality-monitoring spreadsheet in a Freedom of Information response published in 2021, The Register's Connor Jones reported. The data covers roughly 2,000 current and former employees who worked there between April 2013 and March 2018, and the fields include ethnicity, disability status, religion or belief, sexual orientation, Welsh language ability, and caring responsibilities, though not every category applied to every employee [3].

It sat live until a member of the public flagged it on August 23, 2026. NRW says it took immediate steps to contain the incident once aware, has completed a full investigation, and is reviewing its processes and controls. It reported the breach to the Information Commissioner's Office and says it is not aware of any evidence the information has been misused [3].

This is special-category data under UK GDPR, the tier that requires the strongest justification to hold at all, leaked by the mechanism designed to make government legible. No attacker was involved. Someone attached the wrong file to a transparency response and nobody checked. The lesson for anyone filling in an employer's diversity form: that form is a data set, it will outlive your employment, and its security depends on whoever handles the next records request.

Where Flock Data Goes: 7 Terabytes From One City to DHS, HSI, and the FBI

The internal Flock webinar 404 Media obtained covered protest monitoring, which yesterday's briefing carried [7]. Two other pieces of it deserve their own attention. The first is what Flock Nova actually merges. In the company's own description, Nova joins license-plate-reader data with agency records including person data, IP data, email data, sex-offender data, and vehicle data, plus open-source intelligence, and searches across CAD, records-management systems, jail records, and other integrated sources [4].

The second is the federal pipeline. Matt Patin, a Flock employee and former New Orleans police officer, described reconstructing the movements of the man who carried out the January 1, 2025 Bourbon Street attack that killed 14 people. "We were able to use our network of cameras and license plate readers to map out what he did when he entered the city a day or two before the event, up until he executed the event," Patin said. The volume he named: "7 terabytes of information, which was a lot of data, and we were able to share that with our fusion center and our federal partners. Homeland Security, HSI, and FBI" [4].

HSI is an ICE division. The case that produced this transfer is about as sympathetic as a surveillance case gets, and that is exactly what makes it useful to Flock's sales team. The plumbing built for a mass-casualty attack is the same plumbing available for anything a fusion center wants to run next, which is the argument in the California class action over Flock sharing plate data with federal agencies [13].

The Children's Commissioner Cannot See What She Is Meant to Judge

Dame Rachel de Souza, England's Children's Commissioner, told the opening session of the Lords Communications and Digital Committee inquiry into the Online Safety Act that children report the law has made "absolutely no difference" to their ability to reach harmful content. Yesterday's briefing carried that finding [7]. The unresolved piece is the disclosure fight underneath it [5].

De Souza wants the platform safety risk assessments companies submit under the Act. Ofcom has refused, and indicated it will resist even if she invokes her statutory powers, citing section 393(1) of the Communications Act 2003. Her objection is that the refusal makes evaluation impossible: "If we cannot even see the risk assessments that may well have put these mechanisms into place, how on earth can we judge the efficacy of it?" On Ofcom's record she was direct: "how effective do I think they've been? Not effective enough." She asked the committee for help and said, "I am planning to use my powers." Ofcom's spokesperson said it works closely with the Commissioner, published its analysis of first-year risk assessments in December, and is restricted by law in what business information it can disclose [5].

Age verification is the part of this Act readers feel, because it is the part that asks for their face or their ID [14]. The risk-assessment fight is the part that decides whether any of it worked. Right now the statutory advocate for children cannot read the documents, and the regulator holding them is not required to hand them over.

A Desktop PC Broke Two Certificate Authorities From 1999

Matthew McPherrin factored the private keys of the E-Certify RSA 512 Gold Server and E-Certify RSA 512 Gold Client roots, a Canadian certificate authority whose certificates shipped in Netscape 4.51 in March 1999 and were removed by Netscape in 2002. He used CADO-NFS on a single Ryzen 9 5950X desktop, taking 32 hours for the SSL root and 29 for the S/MIME root. Steve Weis separately factored a VeriSign test code-signing CA that shipped in Internet Explorer 3.02, in about an hour on a GPU cluster. McPherrin published all three private keys, a demo TLS server, and his tooling [6].

He is careful about the risk, and so are we: the E-Certify root expired on October 16, 2003, so exploiting it means running Netscape 4.51 with the clock set back, which he estimates applies to zero people other than his own test virtual machine. IE shipped no 512-bit SSL roots. Modern browsers reject these certificates outright [6].

The value is the timeline. A key length that a commercial CA considered adequate for public trust in 1999 now falls to a gaming PC over a long weekend, without a research budget or a cluster. Every current claim that a key size, a hash, or an encryption scheme is strong enough carries an unstated expiry date, which is the whole argument for crypto-agility over a one-time procurement decision.

What to Watch

Johnson County's withheld footage. The sheriff's department has refused EFF and 404 Media access to the body-camera, in-car, and scene imagery from the case. If it is released, it becomes possible to compare what the deputies actually said against what Draft One wrote from that audio, which is the first real audit anyone has had of the tool on a consequential case [1].

The Cyber Security and Resilience Bill's next stages. The executive-liability amendments failed in Grand Committee, and Baroness Lloyd promised secondary legislation mandating board-level governance aligned with the NCSC Cyber Assessment Framework. Whether that carries any personal consequence, or only a documentation duty, is the thing to read when the drafts appear [2].

The ICO's response to NRW. A public body publishing special-category data about its own staff and leaving it up for years is a straightforward case on the facts. Whether the ICO issues a reprimand or a fine will signal how it is treating public-sector breaches this year [3].

De Souza's statutory powers. She said she plans to use them, and Ofcom has already said section 393(1) will be its answer. If she forces the question, it turns into a test of whether the Online Safety Act can be independently evaluated at all [5].

Sources

  1. 404 Media, Jason Koebler - Texas Police Used AI to Write Report About Using Flock to Search for Woman Who Had Abortion (September 2, 2026). https://www.404media.co/texas-police-used-ai-to-write-report-about-using-flock-to-search-for-woman-who-had-abortion/
  2. The Register - Peers ask why UK cyber bill leaves execs off the personal liability hook (September 7, 2026). https://www.theregister.com/security/2026/09/07/peers-ask-why-uk-cyber-bill-leaves-execs-off-the-personal-liability-hook/5294586
  3. The Register, Connor Jones - Welsh environment regulator's FoI blunder exposes diversity data of 2,000 staff (September 7, 2026). https://www.theregister.com/security/2026/09/07/welsh-environment-regulators-foi-blunder-exposes-diversity-data-of-2000-staff/5294748
  4. 404 Media, Jason Koebler - Flock Taught Cops How to Surveil No Kings Protesters (September 3, 2026). https://www.404media.co/flock-taught-cops-how-to-surveil-no-kings-protesters/
  5. The Register - UK's Online Safety Act has made 'absolutely no difference,' kids say (September 3, 2026). https://www.theregister.com/security/2026/09/03/uks-online-safety-act-has-made-absolutely-no-difference-kids-say/5293893
  6. Matthew McPherrin - I've factored the RSA keys of a Certificate Authority from the 90s (September 7, 2026). https://mcpherrin.ca/2026/09/07/rsa.html
  7. State of Surveillance - Daily Surveillance Briefing, September 7, 2026: Flock Trained Cops. /news/daily-surveillance-briefing-september-7-2026
  8. State of Surveillance - Texas Halted Flock Funding. Florida Ordered Cameras Off Highways. /news/texas-florida-flock-pullback-abbott-funding-fdot-highway-removal-2026
  9. State of Surveillance - AI Police Report Claimed an Officer Turned Into a Frog. /news/ai-police-report-frog-heber-city-axon-2026
  10. State of Surveillance - Flock's FreeForm AI Searches for People, Not Just Cars. /news/flock-freeform-ai-people-search-2026
  11. State of Surveillance - UK Government Admits Cyber Failures, Pledges £210 Million to Fix Them. /news/uk-cyber-action-plan-210-million-january-2026
  12. State of Surveillance - Attackers Spent Seven Months Inside the UK Criminal Records Office. /news/uk-acro-criminal-records-office-ico-reprimand-kentico-breach-2026
  13. State of Surveillance - Class Action: Flock Shared California Plate Data With Feds. /news/flock-safety-class-action-lawsuit-california-federal-data-sharing-2026
  14. State of Surveillance - Age Verification Is Building a Mass Surveillance System, ID by ID. /news/age-verification-surveillance-infrastructure-id-system-2026