Issue 16 • Wednesday, July 1, 2026
A concise weekly scan of surveillance, privacy, cybersecurity, and the safeguards public officials should keep in view.
At a glance
- The Supreme Court held that obtaining even two hours of precise Google Location History is a Fourth Amendment search.
- Bend strengthened its ALPR policy, but the vendor audits needed to verify compliance had not yet arrived.
- Bipartisan oversight caused ATF to cancel one commercial-location contract, while the broader data-broker loophole remains.
- The House passed a broad youth-online-safety package, keeping age checks and data minimization at the center of the debate.
Using an app is not consent to government access
The Supreme Court has extended Carpenter‘s protection for cell-phone location records to a more precise form of digital location history – and rejected the idea that a short search or an “optional” smartphone feature falls outside the Fourth Amendment.
In Chatrie v. United States, police investigating a Virginia bank robbery used a geofence warrant to make Google identify devices near the crime scene. Google first supplied anonymized data for 19 devices. Investigators selected nine for a broader two-hour view, including movement outside the original geofence, and then selected three users whose identities Google disclosed.
The Court held that police conducted a Fourth Amendment search when they obtained Okello Chatrie’s Location History. That remained true even though the request covered only two hours and the records came from a technology company rather than directly from his phone.
The majority explained why the information is unlike an ordinary business record. At the time, Location History could record a phone roughly every two minutes, locate it within about 20 meters, and sometimes estimate which floor of a building it occupied. A short slice could expose a home, medical visit, political gathering, school, hospital, or place of worship.
The Government argued that the period was too brief and that Chatrie had voluntarily enabled the feature. The Court rejected both arguments. Fourth Amendment protection does not begin only after surveillance “goes too far,” and ordinary use of modern apps does not mean that private information is freely available to government.
The duration issue matters because officers were not following a known suspect for two hours. They were selecting a short interval from an all-encompassing database after the fact. The Court reasoned that a system does not become less intrusive merely because government can use hindsight to choose the most revealing hours. Even one trip can expose a political rally, abortion clinic, criminal-defense lawyer, or other association a person reasonably expects to keep private.
The Court also rejected an app-by-app version of the third-party doctrine. Google repeatedly prompted users to enable Location History, sometimes warning Android users that devices would not work correctly without it, while not fully explaining the frequency, precision, or potential government access. More broadly, the point of a smartphone is to use apps and cloud services. Sending email, storing photos, or adding a calendar entry should not become blanket consent for government access merely because a company hosts the data.
The judgment was 6-3. Justice Elena Kagan wrote for five Justices. Justice Neil Gorsuch supplied the sixth vote through a separate concurrence reasoning that digital location history can be a person’s electronic “papers or effects,” even when a company stores it.
The ruling is important but narrower than saying all geofence warrants are unconstitutional. The Fourth Circuit must still decide whether each stage of this warrant satisfied probable cause and particularity, and whether the good-faith rule affects suppression. Justice Ketanji Brown Jackson, joined by Justice Sonia Sotomayor, would have found at least stages two and three unconstitutional because officers – not a neutral magistrate – chose who received deeper scrutiny.
Why it matters for public officials: A multi-stage search should not become progressively more intrusive through an internal vendor workflow. A judge should define the narrowing criteria and find probable cause before officials expand the time period, follow devices beyond the original location, or reveal identities.
Google told the Court that it moved Location History storage from central servers to users’ devices in July 2025 and can no longer respond to this particular centralized demand. The old Google process may be fading, but the Court’s principle reaches a broader question: using an ordinary digital service does not itself surrender constitutional privacy.
The decision therefore matters beyond geofences. Government databases increasingly allow officials to begin with a place, event, face, plate, device, or pattern and work backward toward a person. The constitutional question is not only whether a warrant exists at the beginning, but whether each material expansion remains tied to probable cause, particularity, and neutral review.
Bend strengthened its ALPR policy. Now the system has to prove it follows it.
Bend Police has expanded Policy 428 following Oregon’s new statewide rules for automated license plate readers. The revised policy adds privacy, accountability, and civil-rights language; states that Bend owns its database; and bars use for protected First Amendment activity, federal immigration enforcement, and out-of-state abortion investigations.
Those are meaningful improvements. The remaining question is whether the technical system and vendor relationship can demonstrate compliance. Oregon law requires 30-day and quarterly vendor audits that agencies must publish promptly after receiving them. As of the June 29 reporting, Bend had not received the required reports from Axon and was working with the company on automated delivery.
Until the audits exist, the public cannot examine which agencies queried the system, why they searched, or when the searches occurred. The policy calls for 30-day and quarterly reports to be posted quickly after receipt, which makes vendor delivery part of the safeguard rather than a back-office detail. An audit requirement that the vendor cannot or does not produce is not yet an audit system.
The same distinction applies to encryption. Oregon’s law allows existing contracts to continue for a limited period even if they do not yet meet the new end-to-end-encryption rule, while new contracts and add-ons face the stronger standard. That makes procurement timing, feature activation, and key management important. Officials still need to know what is encrypted, who controls the keys, whether Axon can decrypt or export records, and how support, sharing, legal process, and exceptions are logged.
Database ownership alone does not answer those questions. A city may “own” the records while a vendor controls the hosting environment, administrator privileges, software updates, integrations, or encryption keys. The practical test is whether Bend can independently inspect every local, outside-agency, and vendor action and can prevent access that conflicts with policy.
Questions for the next review: Have the required audits arrived? Do they include case number, purpose, user, agency, date, data source, and result? Can Bend see vendor access? Who holds the decryption keys? What happens when a search is denied, an integration is added, or a new feature changes what the system can reveal?
A written rule is an essential starting point. It becomes a safeguard when the system enforces it and leaves enough evidence for an independent reviewer to verify that it worked.
“A new technology should not transform what individuals had reasonably thought they could withhold from the Government.”
— Justice Elena Kagan, Chatrie v. United States (2026)
Oversight stopped one warrantless tracking contract – not the underlying loophole
The Bureau of Alcohol, Tobacco, Firearms and Explosives has canceled its contract for Penlink’s Webloc location-surveillance product after bipartisan congressional scrutiny. The cancellation is a concrete example of oversight changing agency behavior – but it also shows how much still depends on discovering one contract at a time.
According to Senator Ron Wyden and Representative Michael Cloud, Webloc used location information originating in commercial advertising systems. ATF disclosed 341 searches: 55 for training or demonstrations, 64 related to violent-crime matters, and 222 associated with active case numbers.
In one arson investigation near a defense contractor, the prosecutor and judge reportedly raised serious concerns about the warrantless commercial data. Investigators then obtained a traditional court order for bulk cell-tower information.
ATF canceled the contract six days after a briefing in which congressional staff raised constitutional concerns, state-law restrictions, and Federal Trade Commission actions against sellers of sensitive location data. The agency also committed to reviewing other contracts for similar adtech-derived information.
The episode shows why contract inventories matter. A surveillance capability can enter an agency as a subscription, analytics service, demonstration account, data-enrichment feature, or add-on to a broader platform. If officials and the public cannot see the product name, data sources, authorized uses, and query counts, there may be no practical opportunity to test legality before the tool is used in active investigations.
It also shows that oversight can work. The contract was not canceled because the vendor voluntarily narrowed the product or because an internal policy review happened on schedule. It was canceled after lawmakers obtained records, asked how the data were sourced, compared the practice with constitutional and state-law limits, and forced the agency to explain specific searches.
This story is related to Chatrie, but the legal routes are different. In Chatrie, government compelled a provider to disclose stored account information. With Webloc, an agency purchased commercially collected location data. The first route is governed by warrant and subpoena doctrine; the second is often called the data-broker loophole because agencies argue that information available for purchase can be acquired without the process normally required for a search.
That distinction should not determine whether movements receive protection. A visit to a clinic, religious service, union meeting, political gathering, or private home does not become less revealing because the information reached government through an advertiser rather than a cellular carrier.
A durable rule should follow the sensitivity and use of the data, not the route by which it was obtained. Otherwise, a warrant requirement can be bypassed by purchasing a commercially assembled substitute, and a restriction on one agency can be bypassed by a contractor or another agency with access to the same market.
The safeguard: Require a warrant or equivalent judicial authorization for sensitive location information regardless of whether the source is a carrier, platform, advertiser, broker, or contractor. Agencies should also disclose the products they use, the legal process attached to each search, and the number and purpose of queries.
A procurement test for commercially sourced data
Before buying any investigative dataset, an agency should document the original collector, every intermediary, the collection method, consent or notice, accuracy controls, retention, permitted uses, opt-out process, and whether the seller obtained the information in compliance with law and platform rules. The contract should prohibit substitution of a new source without notice and review.
Facial recognition cannot remain invisible when it helps identify a defendant
The New Jersey Supreme Court has unanimously ruled that prosecutors must give criminal defendants basic information about facial-recognition technology used during an investigation – even when the State describes the result only as an investigative lead and does not plan to introduce the software output at trial.
The case concerns Tybear Miles, who was identified as one of several possible matches after police submitted an Instagram image to a facial-recognition system during a murder investigation. Miles sought information about the system and its use so he could test reliability, examine whether police pursued other candidates, and challenge later identifications influenced by the initial search.
The court rejected a rigid universal checklist but held that defendants generally must receive information identifying the tool and explaining how it was used in the investigation and prosecution. That basic disclosure can expose the source image, database, candidate list, analyst choices, investigative sequence, and possible alternatives to meaningful review.
The distinction between a “lead” and evidence can be misleading. A facial-recognition result may never be shown to a jury, yet it can determine whose social-media account is examined, which person is placed in a photo array, which witnesses are re-interviewed, and which competing suspects receive less attention. Later evidence may appear independent even when the initial algorithmic match shaped the entire path of the investigation.
The justices did not automatically require proprietary source code. A defendant seeking trade-secret material must first show a particularized need. The ruling therefore distinguishes between the minimum facts needed to test a government’s case and deeper technical discovery that may depend on the circumstances.
That approach also avoids a false choice between total secrecy and unlimited disclosure of proprietary material. Agencies can preserve and disclose operational facts – the probe image, database, candidate rankings, thresholds, analyst steps, and corroboration – without assuming that every case requires the vendor’s source code. If those basic facts reveal a specific reliability problem, a court can then decide whether deeper technical material is necessary.
The policy lesson is broader than one criminal case. Facial recognition should not be insulated from scrutiny merely by placing its output at the beginning of an investigation rather than in the trial exhibit list. An algorithmic lead can shape who police question, which images witnesses see, what evidence receives attention, and whether another candidate is ignored.
The safeguard: Preserve the original probe image, all preprocessing, vendor and product version, database description, search settings, complete candidate results, analyst actions, and corroborating steps. Disclose that record early enough for meaningful review.
What minimum disclosure should answer
A useful record should show what image entered the system, how it was cropped or enhanced, which database was searched, what threshold or ranking method applied, how many candidates were returned, who reviewed them, and what investigators did next. It should also identify any witness procedure influenced by the result and preserve evidence about candidates who were not pursued.
Shared pattern
Congress could challenge Webloc because it learned the contract existed. A defendant can challenge facial recognition only if the State reveals that the tool was used. Oversight fails when the decisive system remains outside the record.
Visibility is not paperwork. It is the condition that makes constitutional, contractual, and technical safeguards enforceable.
For public bodies, that means maintaining a current surveillance inventory, publishing contracts and policies, recording each sensitive query, preserving investigative provenance, and giving an independent reviewer enough detail to reconstruct what happened. A safeguard that cannot be inspected or challenged is ultimately dependent on trust.
Trade secrecy should not erase government accountability. Agencies may protect genuinely proprietary material while still disclosing the tool’s identity, data source, purpose, user, query terms, outputs, human decisions, and consequences. When a vendor cannot support that record, the product is not ready for a public-sector decision that affects liberty.
“Such basic information will, in most cases, constitute the minimum necessary to safeguard a defendant’s right to a fair trial.”
— Justice Douglas M. Fasciale, State v. Miles (2026)
Warning Signals
Early indicators of how surveillance expands: through network defaults, age checks, credential phishing, and reusable search tools.
Woodburn’s experience shows why sharing architecture must be understood before deployment
Woodburn has permanently removed its Flock Safety cameras after an audit showed that outside agencies – including federal immigration agencies – had been able to include Woodburn’s network in broad searches.
The city’s public Q&A provides important context. It reports 3,318,618 searches during the period reviewed, but says 99.99% were multi-network searches rather than searches aimed only at Woodburn; 306 uniquely targeted Woodburn. Homeland Security Investigations and U.S. Border Patrol were among the federal agencies whose broader queries included Woodburn during a Flock pilot program that city officials say they had not been told about.
The document says the city disabled national lookup in October 2025 and found no federal searches after June 24, 2025. But the most important fact is that Woodburn did not knowingly approve the pilot architecture that allowed its network to appear in those searches. The cameras were ultimately removed in May 2026 after the city ended the contract.
That nuance does not erase the governance failure. It explains it. A local agency can believe it has not affirmatively shared data while a vendor’s network design silently makes its cameras part of a much larger search surface.
Before deployment, officials should see the default sharing settings, national-search capabilities, pilot programs, vendor administrator access, notification rules, and every route by which a local database can be included in another agency’s query.
They should also require a change-control rule: no pilot, federation, network expansion, integration, or new search mode should apply to local data without written notice, legal review, and affirmative approval. Vendor defaults are policy choices when they determine who can search a community’s records.
The procurement lesson: Ask for a live demonstration of every sharing screen and administrator setting, then attach the approved configuration to the contract. Require notice before the vendor changes a default, joins a pilot, or makes local data searchable through a new network path.
The KIDS Act clears the House – with age checks still the privacy fault line
The House passed H.R. 7757, the Kids Internet and Digital Safety Act, on June 29 by a bipartisan 267-117 vote. The package now moves to the Senate and is not law. It combines proposals involving platform design, youth privacy, targeted advertising, AI chatbots, online games, data brokers, parental controls, audits, and research.
The House package is not the same as the stronger KOSA framework the Senate passed in 2024, and key senators have criticized the compromise. That makes House passage a major status change, not a final policy settlement. Any Senate amendment would require further agreement between the chambers.
The age-verification provisions require careful attention. The SCREEN Act title directly requires covered platforms substantially devoted to sexual material harmful to minors to use commercially available verification technology and prevent minors from accessing that material. It also limits collection, use, retention, and disclosure of verification data to what is strictly necessary.
The KOSA title separately says it should not be construed to require age gating or age verification. But other provisions impose duties when a service “knows or should have known” a user is a child or teen. The Electronic Frontier Foundation argues that this pressure will lead broader services to determine users’ ages, including by asking adults to prove they are adults.
That is an advocacy interpretation, not a settled outcome. But it identifies the key implementation question: Can a service comply without building a persistent identity or age-classification system for everyone?
The privacy question is not whether protecting children is worthwhile. It is what infrastructure compliance creates. A system that collects identity documents, biometric estimates, device signals, or persistent age labels can become useful for advertising, account linkage, content control, or government access unless reuse and retention are technically and legally prohibited.
Any final bill should minimize data, prohibit reuse, protect anonymous and pseudonymous access, avoid biometric estimation where less intrusive methods work, publish error rates, and require independent testing for demographic bias. The strongest design proves only the necessary threshold and then forgets the underlying evidence.
What to watch in the Senate: whether the final package changes the “knows or should have known” standard, narrows or expands direct age-verification duties, preserves state protections, limits data retention, and creates a realistic enforcement path when an age system is inaccurate or discriminatory.
Treat messaging-app recovery keys like master passwords
The FBI warns that Russian intelligence-linked actors are impersonating messaging-app support services and trying to obtain verification codes, account PINs, and backup recovery keys.
A recovery key can be more damaging than an ordinary password. An attacker who obtains one may be able to download historical private and group messages and later take over an account. The old key can remain useful even after the victim creates a new account with the same phone number.
No legitimate support agent should ask for a backup key, verification code, or PIN. After suspected exposure, generate a new recovery key from inside the application; changing the account alone may not invalidate the compromised key. Regeneration cannot retrieve a backup already downloaded, but it can block future use of the old credential.
Civic organizations should write this into incident-response plans. If a member reports a suspicious support message, the response should include regenerating the key, reviewing linked devices and active sessions, preserving the phishing message, warning affected groups through a trusted channel, and assuming that messages already restored by the attacker may have been copied.
The broader lesson is that encrypted messaging still depends on unencrypted human workflows. Attackers often do not break the cryptography; they persuade a user to hand over the recovery path.
Axon Watch: better logs, easier recurring searches
Axon’s June 30 Records and Standards notes describe a report-redaction tool that records who made a redaction, when it occurred, and the reason – if the user provides one. They also add reusable saved searches and more precise audit-log timestamps. The rollout began at 11 a.m. Pacific and may continue into the following day; Axon says availability can change.
These are governance changes, not merely interface changes. A redaction log is stronger when the reason is mandatory and tied to a policy category. If the reason remains optional, an audit may prove that a field was hidden without explaining the legal basis for hiding it.
Saved searches can improve efficiency, but they can also turn a one-time query into a standing practice. A reusable search may silently encode a broad location, person category, vehicle pattern, or data combination that is run again and again. Agencies should control who may create, share, and execute saved searches, require a purpose and expiration date, and review recurring sensitive queries as surveillance programs rather than personal shortcuts.
More precise timestamps are useful only if records are retained, protected from alteration, and connected to user identity, case number, query terms, and result handling. Better software fields become safeguards when policy makes them complete and review makes them consequential.
Safeguards
The strongest protections this week control who can take the next, more intrusive step – and make that step provable.
Put a judge at every material expansion point
A digital warrant should specify more than the first geographic circle or time window. When a search proceeds in stages, define objective narrowing criteria and require renewed judicial approval before investigators expand the period, follow devices beyond the original location, or reveal identities.
The order should identify the offense, factual basis, data source, geographic boundary, duration, expected number of affected people, minimization procedure, deletion rule, and the evidence required before moving to the next stage. Investigators should not receive a “roving commission” to decide whose private movements deserve deeper review.
Apply one constitutional standard to sensitive location data
Do not let the purchase route determine the privacy rule. Require a warrant or equivalent judicial authorization for sensitive location information obtained from carriers, platforms, advertisers, brokers, or contractors. Record the legal authority, requesting official, case number, purpose, date range, geographic scope, and disposition for every query.
The rule should cover direct access, subscriptions, trial accounts, demonstrations, enrichment services, federated searches, and records received from another agency. A restriction on compelled disclosure is incomplete if the same movement history can be bought from a commercial intermediary.
Verify vendor promises with deliverables
A contract should identify the exact audit reports a vendor must produce, their fields and format, delivery schedule, retention period, public-posting process, and consequences for nonperformance. Encryption terms should state what is encrypted, when, who possesses the keys, and whether the vendor can decrypt or export records.
A practical contract checklist:
- Can the agency inspect every local, outside-agency, and vendor action?
- Must each search include a case number, purpose, and legal authority?
- Are outside networks and new integrations disabled by default?
- Must the vendor give notice and resist conflicting legal demands?
- Does the agency approve pilots, feature activations, and policy-changing updates?
- Can the agency terminate, obtain deletion certification, and recover fees after a material breach?
“We own the data” is not enough if the vendor controls administrator access, encryption keys, integrations, or the audit evidence needed to prove compliance.
Make facial recognition reproducible
Preserve the original image, all preprocessing, vendor and version, database searched, settings, complete candidate results, analyst decisions, later witness procedures, and corroborating evidence. Disclose the system’s use even when prosecutors call it only a lead.
Do not treat a candidate list as an identification. Require trained human review, independent corroboration, and a record of why other candidates were rejected. Later witnesses should not be shown a single algorithm-selected person in a way that converts a tentative lead into an apparently independent identification.
Map every route into and out of the system
A sharing diagram should identify local users, outside agencies, vendor administrators, subcontractors, federated networks, application-programming interfaces, exports, backups, and legal-process pathways. For each route, specify who can authorize access, what purpose is allowed, what data leave the system, how long the connection lasts, and what evidence the action creates.
Review the diagram whenever a contract is renewed, a pilot begins, an integration is enabled, or a software update changes search or sharing. Woodburn’s experience shows that an agency can misunderstand its own exposure when the vendor’s network architecture changes the practical meaning of “sharing.”
Make audit evidence usable, not ceremonial
A useful audit record needs the user and agency, date and time, case number, stated purpose, legal authority, search terms, datasets queried, result count, exports, sharing, and final disposition. It should also record denied attempts, administrator changes, vendor access, retention overrides, and creation or reuse of saved searches.
Assign someone independent of day-to-day users to review the logs on a fixed schedule. Publish aggregate reports quickly, investigate anomalies, document corrective action, and preserve detailed records long enough for litigation, public-records review, and contract enforcement. A log no one reads is storage, not oversight.
Build age assurance to forget, not remember
Reveal no more than the minimum fact necessary – such as whether an age threshold is met – and do not create a reusable identity record. Prohibit secondary use, advertising, cross-service tracking, indefinite retention, and conversion of an age check into a biometric profile. Require appropriate legal process before government access.
Legislation should require public documentation of the method, error rates, demographic testing, retention schedule, appeal process, and all downstream recipients. A child-protection system should not quietly become identity infrastructure for every adult who uses the service.
Treat recovery keys as offline secrets
Store backup recovery keys separately from the device and account they protect. Never send them through chat, email, forms, or a support conversation. Regenerate the key immediately after suspected exposure and review linked devices and active sessions.
Organizations should designate a trusted channel for security alerts and rehearse what happens after compromise. Preserve the fraudulent message, warn affected groups, rotate related credentials, and assume that any backup already downloaded may be outside your control.
Govern recurring searches as policy, not convenience
Saved searches, alerts, watchlists, and automated recurring queries can become standing surveillance programs. Require a documented purpose, owner, approval period, review date, access list, and deletion rule. Audit not only who ran a search but also who created the template and how often it was reused.
A recurring query should expire unless someone affirmatively renews it. Material changes to search terms, geography, datasets, or sharing should trigger a new review. The easier software makes repetition, the more important it becomes to distinguish a lawful one-time inquiry from ongoing monitoring.
Plan for failure before deployment
Every sensitive system should have an incident plan that covers unauthorized access, inaccurate matches, vendor nonperformance, exposed credentials, unlawful outside queries, and policy-changing software updates. Name the decision-maker, evidence-preservation steps, notification duties, suspension authority, correction process, and conditions for terminating the system.
Failure planning changes incentives before anything goes wrong. Vendors know which records they must preserve and what breach consequences apply; staff know when to stop using a tool; affected people have a correction path; and elected officials receive facts rather than reassurances.
Bottom line
The strongest safeguards this week all control the next step. A judge must control when a location search widens. A contract must control whether a vendor delivers an audit. Discovery must reveal when an algorithm shaped an investigation. An age check must not become a lasting identity system. And a recovery key must remain outside the reach of anyone pretending to offer support.
The common test is operational: Who can take the next step? What evidence must they provide? What does the system prevent? What does it log? Who can inspect the record, correct an error, or impose a consequence?
A safeguard is not what a policy promises. It is what the system prevents, records, reveals, and allows someone to challenge.
Leave a Reply