Sunday, December 22, 2025. Four days until CBP starts photographing everyone crossing the border. The surveillance state isn't taking Christmas off.
New Orleans became the first American city with a live facial recognition network, run by a private non-profit that answers to no one. ICE hired bounty hunters from a private prison company to track down immigrants. Dallas police want to use Clearview AI to catch package thieves. And a court threw out Vermont's lawsuit against Clearview, showing how hard it is to hold surveillance companies accountable.
The week before Christmas, they're still watching. Here's everything that went down.
New Orleans: First US City With Live Facial Recognition
Monday, December 16 - NPR reported that New Orleans has become the first American city known to operate a live facial recognition surveillance network [1].
The twist: It's not run by the government. A private non-profit called Project NOLA operates the system, feeding real-time tips to police while sidestepping regulations meant to govern government surveillance.
How it works:
- Cameras throughout the city capture faces in real time
- Facial recognition searches for violent offenders and outstanding warrants
- Matches get sent directly to police
- Most people walking past have no idea they're being scanned
Why it's worse: Because Project NOLA is private, they set their own "guardrails." No public oversight. No city council approval. No transparency requirements. They claim this makes them more flexible. Critics say it makes them unaccountable.
The pattern: When cities ban facial recognition, the surveillance just moves to private companies. San Francisco banned police use of facial recognition. But private landlords, businesses, and non-profits can still deploy it, and share data with cops anyway.
Deep dive: For the full story on how a private non-profit runs America's first live facial recognition network, see Project NOLA: Private Surveillance With Public Consequences.
For more on how facial recognition is spreading: Your Face Is Your Prison ID
ICE Hires Private Prison Company as Bounty Hunters
Thursday, December 19 - The Intercept revealed that ICE has contracted with BI Incorporated, a subsidiary of for-profit prison giant GEO Group, to hunt down immigrants [2].
The deal:
- BI gets monetary bonuses for locating immigrants at their homes and workplaces
- They specialize in remote surveillance and person-monitoring
- They've already made hundreds of millions from ICE ankle monitor contracts
- Now they're literally bounty hunters with surveillance technology
The history: GEO Group runs private prisons and immigrant detention centers. They profit from incarceration. Now they profit from hunting people down too. It's a full-service deportation pipeline: find them, track them, lock them up.
The surveillance arsenal: BI's tools include GPS bracelets, ankle monitors, and now location surveillance services. The same company that tracks people after arrest is now helping find them before arrest.
Deep dive: For the full story on how a private prison company became ICE's bounty hunting arm, see ICE's Bounty Hunters: GEO Group's Surveillance-to-Incarceration Pipeline.
Related: The Complete ICE Surveillance Tech Stack
Dallas Police Want Clearview AI for Package Theft
This week - Dallas Police are pushing to expand their use of Clearview AI's facial recognition from violent felonies to minor crimes like trespassing and package theft [3].
The scope creep:
- Originally adopted only for murder, rape, and serious felonies
- Now proposing to search for Class B misdemeanors
- Police used Clearview 156 times so far, contributing to 25 arrests
- Department calls the technology "vital"
The playbook: Every surveillance tool starts with promises: only violent criminals, only terrorism, only the worst of the worst. Then the scope creeps. Package theft today. Jaywalking tomorrow. Political protests next year.
Clearview AI has scraped over 30 billion facial images from the internet. They've done over a million police searches. And they're actively pitching departments on expanding use cases.
The resistance: Civil liberties groups are pushing back, but Dallas isn't listening. The proposal moves forward.
Vermont's Clearview AI Lawsuit Thrown Out
Wednesday, December 18 - A Vermont judge dismissed the state's lawsuit against Clearview AI, ruling the court lacks jurisdiction over the company [4].
What happened:
- Vermont sued Clearview in 2020 for violating consumer protection laws
- Clearview argued Vermont courts can't touch them
- Judge Daniel Richardson agreed: Clearview's connections to Vermont are too limited
- The case is dismissed
The implications: Clearview scraped the faces of Vermont residents without consent. But because the company isn't based there and doesn't specifically target Vermont, the state can't do anything about it. The scraping continues.
The bigger picture: States trying to protect residents from facial recognition companies keep hitting walls. Illinois's BIPA is the exception. Most state laws are too weak, too narrow, or can be dodged with jurisdictional arguments.
Meanwhile, Clearview's database keeps growing. Your face is probably in it. And there's very little you can do.
Deep dive: For the full analysis of why states struggle to hold Clearview accountable, and what Illinois did differently, see Clearview AI's Legal Shield: Why States Can't Touch Them.
New York Signs RAISE Act: Second State With AI Safety Law
Friday, December 20 - Governor Kathy Hochul signed the RAISE Act, making New York the second US state to enact major AI safety legislation [5].
What it requires:
- Large AI developers must publish safety protocols
- Companies must report AI incidents to the state within 72 hours
- Up to $1 million in fines for failing to submit safety reports
- $3 million for subsequent violations
The catch: Last week, Trump signed an executive order creating an "AI Litigation Task Force" specifically to sue states that regulate AI. Colorado's AI discrimination law is already in the crosshairs. New York's RAISE Act might be next.
The irony: The federal government that refuses to regulate AI is actively trying to stop states from doing it. OpenAI and Google lobbied hard for federal preemption. They got it.
Deep dive: For the full analysis of state AI laws vs federal preemption, see New York vs. Trump: The AI Regulation War.
ACLU Report: License Plate Readers Are Tracking You
Thursday, December 19 - A new ACLU of Iowa report documents how automated license plate readers (ALPRs) have spread with almost no oversight [6].
Key findings:
- 1 in 10 ALPR readings contains an error
- Innocent people, including families with children, have been stopped at gunpoint due to misreads
- No warrant required to search the massive databases
- Data gets shared across national surveillance networks
The abuse: Texas police used their ALPR network access to search 83,000 cameras nationwide, to track down a woman who had a legal abortion in Illinois. License plate surveillance is abortion surveillance. It's immigration surveillance. It's political surveillance.
The lawsuit: EFF and ACLU are suing San Jose over their 500-camera Flock network that retains location data for a full year. They want warrants required before searching.
Deep dive: For the full investigation into ALPR error rates and interstate abortion tracking, see License Plate Readers: 37% Error Rate and Interstate Abortion Tracking.
Related: Border Patrol's Nationwide ALPR Dragnet
More on the pushback: The Flock Rebellion: Cities Pull the Plug on License Plate Surveillance
ICE's Mobile Fortify App: Biometrics in the Field
This week - Documents reveal ICE agents are using a mobile app called "Mobile Fortify" to capture facial images and fingerprints in the field, storing biometric data for up to 15 years, even when no match is found [7].
How it works:
- Agents can point phones at people's faces to identify them on the spot
- Contactless fingerprint and iris scanning in the field
- Geolocation data attached to every encounter
- Data stored even when the person is a US citizen
- No consent required: "ICE does not provide the opportunity for individuals to decline"
The expansion: The app is now on the Google Play store. Local law enforcement can use it too. What started as a border tool is now street-level surveillance nationwide.
Democratic senators have raised concerns about "the apparent use of facial recognition technology indiscriminately on Americans." ICE continues anyway.
Deep dive: For the complete breakdown of ICE's street-level biometric surveillance app, see ICE Mobile Fortify: Biometric Surveillance in Every Agent's Pocket.
More on field biometrics: Real-Time Facial Recognition for Deportation
Related: ICE Scans Your Face Against 200 Million Photos. Congress Wants to Stop It.
California Cracks Down on Data Brokers
December 3-17 - California's privacy regulators issued two major enforcement actions against data brokers [8].
ROR Partners fined:
- Nevada marketing firm fined for selling "custom audiences" without data broker registration
- They used "billions of data points" to build detailed consumer profiles
- Key message: "a sale is a sale": can't bundle data sales with advertising services to dodge the law
New enforcement advisory:
- Data brokers must disclose all trade names and websites
- Can't point to parent company registration: must register independently
- $200 per day fines for non-compliance
What's coming: January 1, 2026, the DELETE platform (DROP) launches. One request deletes your data from all registered data brokers. Companies that don't comply face fines potentially in the billions.
Start opting out now: Complete Data Broker Opt-Out Guide
Congress Debates Section 702 Renewal
Thursday, December 11 - House Judiciary Committee heard testimony on Section 702 of FISA, the warrantless surveillance authority set to expire next year [9].
What witnesses said:
- Intelligence agencies have queried Section 702 data on protesters, campaign donors, and members of Congress
- The "backdoor search loophole" lets agencies search Americans' communications without warrants
- Reform is needed before reauthorization
The fight ahead: Civil liberties groups want warrant requirements for searches of American communications. Intelligence agencies want clean reauthorization. Congress will decide next year.
Background: Section 702: The Warrantless Surveillance Law
The reform fight: The SAFE Act Is Back: What the Bipartisan FISA Reform Bill Would Actually Do
India Mandates Always-On Satellite Tracking
This week - India's Modi government announced plans to require smartphone makers to enable always-on satellite tracking [10].
The proposal:
- Mandatory satellite connectivity on all smartphones
- Tracking would be persistent and always active
- Ostensibly for "emergency services"
The reaction: Amnesty International called the move "deeply concerning," warning it would put human rights defenders, journalists, and activists at severe risk.
The context: India has been escalating digital surveillance for years. This would be one of the most invasive tracking mandates any democracy has proposed.
The Week in Breaches
Another week, another round of companies leaking your data. For the full 2025 breakdown, see The Breachies 2025: The Worst Data Breaches of the Year.
Coupang: 33.7 Million Customers
South Korea's largest retailer suffered a massive breach tied to a former employee who retained system access after leaving. The CEO resigned. 33.7 million people's data is in the wind [11].
MedStar Health: 7 Million Patients
Maryland-based hospital operator is notifying patients about a ransomware attack. The Rhysida group claims to have 3.7 terabytes of data, including 7 million patient records [12].
SoundCloud: Email and Profile Data
The audio streaming platform confirmed a security breach caused the outages and VPN issues users experienced. Threat actors stole email addresses and profile information [13].
PornHub Premium: 200 Million Records Claimed
The ShinyHunters extortion gang claims to have 94GB of data from a third-party vendor breach, including search and watch history of Premium members. They're demanding ransom [14].
What's Coming
December 26: CBP mandatory facial recognition for all non-citizens begins. Four days.
January 1: California's DELETE platform launches for one-click data broker opt-out
2026: Section 702 expires unless Congress reauthorizes
2026: TSA plans facial recognition at 400+ airports
Immediate Actions
Do this week:
- Freeze your credit - Breaches keep coming. Don't wait for the notification letter.
- Start data broker opt-outs - Get ahead of California's DELETE platform launch. The more you remove now, the less is out there.
- Review facial recognition defenses - New Orleans proves it's not theoretical. It's live.
- Plan for December 26 - If you're a non-citizen traveling, mandatory biometric collection starts in four days.
- Know your rights - ICE's bounty hunter program means more encounters. Know what to say and what not to say.
The Pattern
This week shows the surveillance state's three-headed strategy:
Privatize: New Orleans' facial recognition isn't government surveillance: it's a private non-profit. ICE isn't doing the hunting; they hired GEO Group bounty hunters. When public agencies face restrictions, they outsource to private companies with no oversight.
Expand scope: Dallas started with Clearview AI for murder and rape. Now they want it for package theft. Every surveillance tool follows this arc. The justification gets broader. The targets get more ordinary.
Block accountability: Vermont tried to sue Clearview. Case dismissed. New York passed an AI safety law. Trump's task force might sue them. States that try to protect residents get challenged by companies and the federal government alike.
The week before Christmas, the surveillance infrastructure keeps growing. Private bounty hunters with GPS tracking. Real-time facial recognition in American cities. Biometric collection apps on every ICE agent's phone.
December 26, the biometric border goes live. January 1, California's DELETE platform launches. The battle lines are drawn.
They're watching. But they're not unstoppable.
References
- NPR - New Orleans is pioneering live facial recognition surveillance (December 16, 2025)
- The Intercept - ICE Hires Immigrant Bounty Hunters From Private Prison Company GEO Group (December 19, 2025)
- Biometric Update - Dallas police plan most expansive local facial recognition program in US (December 2025)
- VTDigger - Judge throws out Vermont's lawsuit against Clearview AI (December 18, 2025)
- TechCrunch - New York Governor Kathy Hochul signs RAISE Act (December 20, 2025)
- ACLU of Iowa - ALPRs are tracking you with little oversight (December 19, 2025)
- Biometric Update - ICE's use of CBP biometric surveillance app (December 2025)
- CalPrivacy - Enforcement Advisory on Data Broker Registration (December 17, 2025)
- Military.com - Congress faces new reckoning over warrantless surveillance powers (December 15, 2025)
- Prism Reports - ICE surveillance (2025)
- Privacy Guides - Data Breach Roundup Dec 12-18, 2025
- DataBreachToday - MedStar Health breach (December 2025)
- BreachSense - SoundCloud breach (December 2025)
- TechCrunch - The worst data breaches of 2025 (December 19, 2025)