Signals & Safeguards — Issue 13

Issue 13 • Wednesday, June 10, 2026

A concise weekly scan of surveillance, privacy, cybersecurity, and the safeguards public officials should keep in view.

---

Section 702 is now a warrant fight and a governance fight

Section 702 of the Foreign Intelligence Surveillance Act is aimed at foreign intelligence targets outside the United States. But Americans’ communications can be swept in when they communicate with those targets, and federal agencies can later search that data without a warrant.

That is why civil-liberties groups have focused on the search stage, not only the collection stage. The Brennan Center explains the warrant fight around U.S.-person queries; the ACLU is urging Congress to require stronger protections; and Cato warns that AI could raise the stakes by helping generate or launder investigative predicates.

As of June 9, 2026, Reuters reports that Section 702 is set to expire June 12, after multiple short-term extensions and continuing disagreement over privacy protections. The plain-English issue is simple: a foreign-intelligence database becomes more powerful later if searches are too easy, too broad, or too weakly reviewed.

---

Metadata is sensitive data

The Supreme Court’s decision siding with the FCC in the wireless-carrier fine dispute is a useful reminder that location data is not harmless just because it is metadata. Reuters reports that the case involved FCC fines connected to carriers’ sharing of customer location data, including fines of $57 million for AT&T and nearly $47 million for Verizon, with additional fines for T-Mobile and Sprint.

Location metadata can reveal where people live, work, worship, seek care, gather, travel, and protest. The same principle applies beyond telecoms: license-plate scans, ad-tech location trails, smart-device records, voter files, school logs, and vendor-access records can all become sensitive when tied to real people.

“Metadata absolutely tells you everything about somebody’s life. If you have enough metadata, you don’t really need content.”

— Stewart Baker, former NSA General Counsel

---

Breach victims are often the last to know

A breach is not the only harm. Delayed notice can become a second harm. Troy Hunt’s “1000 data breaches later” essay argues that disclosure lag has grown worse even as breach databases, credential stuffing, identity fraud, and public leak sites have made exposed data more immediately useful to attackers.

The people whose data was exposed may be the last ones to know, even when the data is already searchable, traded, or used in phishing. The safeguard lesson is direct: people cannot protect themselves from exposed data they are not told about.

---

Meta smart glasses and Ring show facial recognition moving into ordinary devices

Facial recognition is no longer only a government-system issue. WIRED reported that Meta removed face-recognition components from its Meta AI smart-glasses companion app after WIRED found unreleased face-recognition code. WIRED reported that the system was not publicly activated. The warning is that consumer wearables are moving toward biometric capability before clear public rules are ready.

Reuters separately reports that Amazon’s Ring has been sued in a proposed class action alleging that its “Familiar Faces” feature unlawfully collected and stored face images without consent. That claim is an allegation in a lawsuit, not a court finding. Taken together, smart glasses and doorbells show how biometric infrastructure can enter everyday life through private devices as well as public contracts.

---

Age gates are becoming identity gates

Child safety is a legitimate policy goal. But the design of age-verification systems matters. EFF warns that age gates are spreading globally and can pressure people to prove age or identity before accessing ordinary online services. The risk is not only inconvenience. Broad age verification can normalize government-ID checks, biometric scans, wallet credentials, operating-system-level age signals, or private verification vendors as the price of ordinary internet access.

---

Axon Watch: public-safety platforms keep expanding

Axon should not be understood only as body cameras, Tasers, or ALPR. Its May 2026 release notes and June Records and Standards release notes show continuing software and records-system updates. Echodyne also announced a public-safety radar partnership with Axon on May 27, saying the partnership supports safer and more scalable drone operations across law enforcement, homeland security, and Drone as First Responder programs.

A feature appearing in release notes or a vendor ecosystem does not mean it has been deployed locally. But it does show the direction of the platform public agencies may be buying into.

---

AI developer tools are becoming supply-chain targets

TechCrunch reports that Microsoft shut down dozens of GitHub-hosted open-source projects after hackers apparently injected password-stealing malware into tools used with AI development apps, including Claude Code, Gemini CLI, and VS Code. AI development tools can have access to local files, credentials, API keys, source code, and developer workflows. A trusted tool can become a high-leverage attack path if it is compromised.

---

Campus safety systems are becoming campus surveillance systems

CBS8 reports that more than 1,300 AI-enabled cameras have been installed across San Diego State University. Times of San Diego, republishing Daily Aztec reporting, says cameras are placed in hallways, entryways, common areas, and dorm buildings. Public institutions may deploy AI-enabled surveillance under a safety rationale before students, staff, or the public fully understand scope, capabilities, retention rules, access permissions, or oversight.

---

Sanctuary policy only works if data channels cannot route around it

Immigration enforcement does not depend only on government-owned databases. WIRED reported earlier this year that ICE issued a request for information about commercial “Big Data and Ad Tech” products that could support investigations, including tools that may involve location data from advertising technology. A formal state or local policy can be weakened if enforcement agencies route around it through commercial data, shared databases, vendors, ALPR networks, or ad-tech data.

---

Public memory is becoming harder to preserve

Techdirt, citing Nieman Lab, reports that more than 340 local news sites are now limiting the Internet Archive’s ability to preserve their stories. Publisher concerns about AI scraping are real, but the public-interest cost is also real: local accountability depends on records people can find, compare, cite, and revisit after a contract, policy, meeting, or public-safety decision fades from the front page.

For surveillance oversight, archiving is not nostalgia. It is evidence. If local reporting, meeting records, procurement pages, and public explanations disappear or become hard to retrieve, residents and officials lose the timeline needed to evaluate promises, changes, renewals, and vendor claims.

---

Data-center opposition is becoming a surveillance issue

Communities may oppose AI data centers for ordinary civic reasons: electricity, water, land use, rates, noise, transparency, and local control. The warning signal is what happens when lawful opposition is pulled into threat-intelligence, extremism, or security-monitoring frames without clear boundaries.

Public agencies should distinguish credible threats from lawful civic participation. Protest, petitions, testimony, public-records requests, and neighborhood organizing should not become surveillance triggers merely because the underlying project is politically or economically important.

---

Direction of travel

This week’s Signals point toward one pattern: identity, access, and memory are becoming control layers. Age checks, Axon platform features, AI development tools, campus cameras, ad-tech data, smart glasses, doorbells, telecom location records, and local archives all shape who can be identified, searched, remembered, or forgotten.

---

Require breach notice people can act on

Breach notice should not be vague, delayed, or written mainly to reduce institutional embarrassment. People need facts they can use: when the organization first learned of the incident; what categories of data were affected; whether data was accessed, copied, sold, posted, or merely exposed; what systems were involved; what users should do next; what the organization has already done; whether law enforcement or regulators were notified; and where the public can find updates.

This applies to public agencies, schools, utilities, healthcare providers, nonprofits, civic groups, and vendors holding resident data.

---

Patch what attackers are already exploiting

CISA’s Known Exploited Vulnerabilities catalog exists because some vulnerabilities are not theoretical. They are already being used. CISA added one known-exploited vulnerability on June 5 and two more on June 8. Public officials should ask vendors and internal IT teams whether any systems touching public records, evidence, payments, schools, utilities, emergency services, or public-facing portals are exposed to KEV-listed vulnerabilities.

• Are we affected?
• When was it patched?
• Were logs reviewed after patching?
• Were admin accounts created, changed, or accessed?
• Were customers or partner agencies notified?
• What systems depend on this vendor or platform?
• What is the backup plan if access has to be shut down?

---

Protect recovery keys, backup codes, and high-risk credentials

TechCrunch reports that hackers are targeting Signal users’ backups in a phishing campaign. The important point is not that Signal’s encryption was broken. The risk is social engineering: tricking people into surrendering backup or recovery material.

Recovery keys, backup codes, password-manager secrets, API keys, admin tokens, and emergency access codes should be treated as high-risk secrets. Secure services should not proactively ask users to send them. Good safeguards include phishing-resistant MFA, hardware security keys for high-risk accounts, password managers with strong recovery practices, offline backup codes, and clear rules for how staff verify security requests.

---

Treat school platforms as civic infrastructure

Federal Student Aid has posted a technology-security alert for an ongoing cybersecurity incident involving Canvas, updated May 29. Reuters and AP reported in May that Instructure reached an agreement with the ShinyHunters hacking group after the Canvas incident. Instructure said affected data included names, email addresses, student ID numbers, and messages, but not passwords, birth dates, government IDs, or financial data.

Schools should treat learning-management systems as civic infrastructure, not just classroom software. These systems can hold assignments, grades, accommodations, messages, family contacts, student IDs, staff information, and records students need during high-pressure periods.

---

Public-safety grants need technology and data guardrails

The Justice Department announced the Model Cities Initiative on June 3, describing it as a whole-of-city approach directing nearly $300 million in federal funding toward selected cities. The safeguard is not to reject every public-safety grant. The safeguard is to read the conditions before a community accepts the money.

Before accepting funds, officials should disclose required technology tools, data-sharing conditions, federal task-force participation, ALPR, facial-recognition, drone, AI, or real-time operations components, reporting obligations, vendor platform commitments, audit logs, retention rules, and whether data can be searched or shared outside the local agency.

---

Before AI touches public systems, set the purpose limits

EFF reports that Dr. Matthew Guariglia testified to a House Homeland Security subcommittee that governments should not adopt powerful AI technologies without strong safeguards to protect constitutional rights. For this safeguards page, the practical rule is simple: do not connect AI to records, cameras, case files, benefits systems, schools, evidence platforms, or enforcement workflows until the purpose, data access, human review, error process, logs, retention, and vendor-use limits are clear.

“At this level the question is not how do we rein in AI, it’s how do we rein in the agencies that would unleash AI on the American public.”

— Dr. Matthew Guariglia, Electronic Frontier Foundation

---

The question is no longer whether sensitive data exists. It does. The question is whether public institutions can prove who accessed it, why, and under what enforceable limits.

Treat metadata as sensitive data

Metadata can describe a life without quoting a message. Location pings, plate scans, search logs, device identifiers, camera detections, call records, badge swipes, student-platform logs, and vendor access records can reveal patterns of movement, association, belief, health, work, school, and protest.

For Oregon policymakers, the key move is to stop treating metadata as harmless simply because it is not message content. Useful safeguards include purpose limits, shorter retention, access logs, case-number requirements, warrant requirements where appropriate, vendor-use restrictions, and public reporting.

Require audit logs before launch, renewal, or expansion

Do not approve surveillance or sensitive-data systems that cannot answer basic questions: who searched; what they searched; why they searched; what they accessed; whether the result was shared; whether the search was tied to a case number, warrant, emergency, or documented purpose; and whether an outside reviewer can verify the answer.

A system without usable audit logs does not merely have a technical gap. It has an accountability gap.

Limit vendor, outside-agency, federal, and immigration-enforcement access by default

Access should be narrow by default and expanded only with clear legal authority, documented purpose, logs, retention limits, and review. That means no outside-agency access unless explicitly approved; no vendor access except for documented support needs; no sales, demo, training, or product-development use without written permission; no immigration-enforcement access unless legally required; no federal or out-of-state access without a clear legal basis and logged review; and no data sharing without purpose fields, retention limits, and periodic public reporting.

Make public reporting routine, not exceptional

Oversight works better when public reporting is scheduled before controversy begins. Agencies should publish enough information to evaluate sensitive systems without exposing individual residents’ raw data.

Public reporting should include: system purpose, data collected, vendor, retention period, outside-agency access, vendor access, number of searches, number of hits, false matches or complaints, policy violations, corrective action, and renewal dates.

That is especially important for systems that can expand through software updates, new integrations, agency-to-agency sharing, or vendor platform changes. A public report should show whether a system is still doing what officials said it would do.

Use a pre-approval checklist before sensitive systems go live

Before launch, renewal, expansion, or feature activation, officials should be able to answer: What data is collected? Who can access it? What outside agencies can search it? What can the vendor see? How long is data retained? What requires a warrant, case number, or documented purpose? What audit logs exist? Who reviews the logs? What is reported publicly? What happens if the system is misused?

Before approval, renewal, or feature activation, the public should be able to see the purpose, the data, the access rules, the logs, the retention period, and the consequences for misuse.

A simple governance test for sensitive systems

Bottom line

The best safeguards this week are upstream safeguards: collect less, connect less, search less, retain less, and log every exception. Whether the system is Section 702, telecom location data, ALPR, Axon software, school platforms, public-safety grants, or AI, the oversight problem is the same once data becomes searchable.

“Sensitive data should not become useful faster than oversight becomes enforceable.”

Public trust depends on private protections.