In July, we wrote about the ‘ChatGPT flyer pandemic,’ in which, as you’ve surely seen, businesses everywhere are advertising themselves and their products with AI-generated posters that all look the same. Surf lesson coaches; guitar stores; bars; so many takeout places. They’re all doing it. And all the posters suck ass.

Naturally, a new meta is emerging, where some businesses and organizations are now holding up crudely drawn signs saying they’ll never use AI, or fuck AI, or various things like this. And people absolutely love it: some of these posts have tens of thousands of likes.

“I would rather your event flyer look like this than see more AI slop,” one flyer posted to Instagram, written in pencil on a page of lined paper, reads. It then shows a couple of stick figures smiling, with the text “I will come to this event.”

Another Instagram post has a couple of people from a bar holding a clip board. The hand-written note in one picture says, “We will NOT be using any AI post to promote the following…” Other pictures then ask people to apply for job vacancies at the bar.

A library posted a very similar message on a piece of cardboard, that reads, “We will not be using AI to create content.”

A cafe posted a series of photos on Instagram of someone holding a paper sign that says, “We will not be using any AI posters to promote ourselves. Instead I will be using this paper and marker pen.” One of the photos adds, “the pancakes are really really GOOD!”

“I hear ya’ll hate AI flyers! So here I am doing hair,” a hand-written sign from a stylist reads, complete with a picture of someone working on another’s hair.

Rachel Karten, writer of the Link In Bio newsletter, posted some other examples 404 Media came across as well. 

This trend will probably go stale fast. But, hey, jump on it while you can.

A Chinese national studying in Canada allegedly crossed over into the United States earlier this year to take photos of facilities near the Chicago airport at the direction of a suspected Chinese government official, according to newly filed court records. The Chinese official repeatedly told the student to destroy the SIM cards they used to communicate and stick to a Huawei phone.

The records provide insight into how Chinese state actors continue to use students to essentially crowd source imagery of sensitive U.S. locations or military aircraft, and how those students are told to remain undetected.

Seamus Hughes of Court Watch first identified and posted the records on Wednesday. 

Weiheng Zeng is an undergraduate student at the University of Waterloo, Ontario, Canada and has crossed into the U.S. around two dozen times since 2022, according to an affidavit from an FBI Special Agent. 

In April, an unknown person was seen inside the FedEx employee parking lot at O’Hare International Airport in Chicago, Illinois, the document continues. This person looked like they were taking photos of aircraft or other parts of the airport. They climbed onto a forklift to take photos in the direction of the aircraft, and tried to get into a FedEx truck, according to photos included in the document. Authorities later figured out this was Zeng based on the dark blue Chrysler Town & Country vehicle that left the area and that he was connected to

When Zeng tried to enter the U.S. again last Sunday, Customs and Border Protection (CBP) interviewed him repeatedly. At first, Zeng said he planned to travel with his sister and a classmate. CBP agents then reviewed his phone and found multiple photos of aircraft, the document says. Zeng told the agents “he takes pictures of model aircraft being tracked for a flight radar website,” it adds. At one point he said he takes the photos as his hobby. Agents also found photos of Zeng and others in tactical clothing holding rifle-styled firearms. Zeng said this was an airsoft gun.

Zeng changed his story repeatedly, before revealing taking the photos was more than a hobby. Instead, he knows someone referred to in the court record as his “Chinese Contact.” This contact assigned Zeng specific planes and their tail numbers to photograph, and then paid Zeng $20 to $30 per picture. Zeng said this Chinese Contact sent him SIM cards to communicate, and then told him to destroy the cards, their chats, and delete the photos he took. Later Zeng said the contact told him to use his Huawei phone to communicate, and never take that phone into the U.S. 

Zeng claimed the Chinese Contact approached him through “an aviation spotter website” around a year and a half ago, the document continues. Zeng said he believed this person was connected to the Chinese Communist Party, and later told the FBI the person sent a photo of an official looking badge. The language the contact used “was very organized and managed, not language typically used between friends,” the document adds. When the FBI later looked into this site, the agency found it appeared to not exist, according to the court record.

One of the photographed planes was an American United aircraft which had “a unique, temporary paint job, of which photographs were highly desired,” according to Zeng. The contact wanted Zeng to go to places in Orlando, Las Vegas, and Los Angeles to take photographs of specific locations around airports, the document says. Zeng said he denied these requests and accepted two tasks over 18 months. One of those was to get the photos of the interior of the FedEx facility at O’Hare International Airport. In all, he made $500, the document says.

“ZENG stated ‘Chinese Contact’ was not satisfied with the photographs and the photographs were fine, but not what were ‘expected’,” the document adds.

In an August call with Ohio law enforcement and government officials, Flock’s CEO Garrett Langley repeatedly lied about his surveillance technology’s role in tracking a woman who had self-administered an abortion, the context around the tracking of the woman, and 404 Media’s coverage of that watershed incident. Langley claimed that the story is “entirely false,” despite court records, police reports, and 404 Media’s other reporting documenting the case in detail.

The candid comments were recorded by Signal Akron journalist Doug Brown, who sat in on the call with an Ohio lawmaker and then shared them with 404 Media. The recording shows how Langley speaks in private with government officials when the conversation is not intended to be broadcast, and comes amid a PR campaign to recast his embattled company. Recently Langley has gone on something of a media blitz, speaking to outlets like The New York Times and appearing on the tech-focused All-In Podcast. Those conversations were, obviously, meant to be consumed publicly. Behind the scenes, Langley speaks very differently.

In the call, Langley strategized with cops about how to deal with journalists, suggesting that they avoid talking to national outlets and that cops focus on telling “sob” stories.

“Let me handle The New York Times, you handle your local media. They want to hear from you, you know your reporters, they’ll pick up a sob story,” Langley said.

“There’s a story reported by 404 Media of a Texas officer using Flock to try to find a woman who had an abortion. And it’s entirely false. They knew it was false. Because there’s a few things, right, because one, it’s not illegal to have an abortion in Texas. It’s illegal to administer an abortion. So the woman could never have been under investigation for having an abortion. So that’s problem one,” Langley said in the meeting. 

In fact, court records obtained by the Electronic Frontier Foundation (EFF) and shared with 404 Media show that Texas authorities did discuss whether they could charge the woman with a  crime on the same day they performed the Flock search. An affidavit said, “it was discussed at the time with the District Attorney’s Office and learned the State could not statutorily charge [the woman] for taking the pill to cause the abortion or miscarriage of the non-viable fetus.” Police documents categorize their work on the case as a “death investigation.” 

In that case 404 Media revealed in May 2025 which Langley called “entirely false,” authorities in Texas searched Flock cameras nationwide for a woman who self-administered an abortion. That search included cameras in states where abortion is legal. The incident showed in real terms what healthcare access and privacy advocates had warned about: that in the wake of Roe v. Wade, more law enforcement may use surveillance technology to track down people who are seeking reproductive healthcare. At the time, the Sheriff Adam King of the Johnson County Sheriff’s Office told 404 Media the woman’s “family was worried that she was going to bleed to death, and we were trying to find her to get her to a hospital.” (It later turned out the Flock search was performed more than two weeks after the abortion, making this explanation dubious).

The records were part of an arrest affidavit against the woman’s partner, who was arrested for allegedly threatening her at gunpoint on the day she took an abortion pill. Police investigative documents obtained by 404 Media further show that police were initially treating this as an investigation rather than a wellness check. A police incident report describes the police collecting evidence from the woman’s partner’s home, including the FedEx packaging and instructions for the abortion pill she took, photos her partner took, and other evidence.

In the meeting, Langley continued, “The second problem is if the 404 Media group would have taken the time to conduct an actual journalistic investigation, they would have found out that two weeks later, when all this came out, she was in an abusive relationship and the family was concerned that she was in danger. They were trying to find her because they were worried her life was at risk.”

Langley’s version of events here is misleading, too. 404 Media has repeatedly reported that the police documents do not mention the woman’s family having any concern about her. The entire investigation that led to the Flock searches was performed at the behest of her abusive partner, and the police documents show that the man had seen her a day after the abortion but did not call the police until weeks later. The man’s trial, related to charges around his alleged abuse, is scheduled for later this year.

It is unclear what Langley means by “two weeks later, when all this came out.” He may be referring to the fact that the police investigation and the Flock searches only happened more than two weeks after the woman had the abortion, which is a fact that people only know because of 404 Media’s journalistic investigation and the EFF, which obtained the relevant court records that 404 Media reported on. It was only after our reporting was published that police created a new document retroactively providing the justification as being concerned for the woman’s safety.

When 404 Media asked for comment on Langley’s comments from the call, Flock public relations manager Paris Lewbel said the court documents showed that the woman could not be charged with a crime. This ignores the fact that they did discuss doing so.

Langley has a pattern of making contradictory statements or incendiary ones he later has to walk back. In an interview with Forbes in September, Langley described DeFlock, the open source map of Flock camera locations, as a “terroristic organization.” In July, he apologized for those comments. He mocked people who attended city council meetings to raise concerns about Flock cameras, while also acknowledging that his staff have lobbied at close to 10,000 city council meetings last year.

There have been multiple cases of deception or misleading statements from and inside Flock recently. Jonathan Paz, who used to be a government affairs manager at Flock, told 404 Media he repeatedly asked internally if Flock was working with ICE. He was told no. But, beyond local cops performing lookups for ICE in the Flock system, the company actually did have a pilot program giving a division of ICE direct access to Flock’s network. Paz said he was “lied to.”

The American Civil Liberties Union (ACLU) documented a case in which Flock’s chief information security officer told a city council the tool did not make a heat map of an individual’s movements. The Oshkosh City Council approved its contract with Flock, but then immediately revoked it after learning a day later that Flock had lied.

Regarding that case, Lewbel told 404 Media, “The main assertion in the ACLU article is a misspoken statement by one employee in a contentious meeting in Oshkosh, WI, which we corrected the next day. The assertion that our intent to be anything less than transparent in providing education about our products is false.”

We start this week with Jason’s piece on a cop making a fake Flock camera to catch a vandal. How can you be charged with destroying expensive property if… the camera wasn’t real? After the break, Sam tells us about how Darth Vader loves Flock. In the subscribers-only section, we talk a bit about three years of 404 Media.

Listen to the weekly podcast on Apple Podcasts, Spotify, or YouTube. Become a paid subscriber for access to this episode's bonus content and to power our journalism. If you become a paid subscriber, check your inbox for an email from our podcast host Transistor for a link to the subscribers-only version! You can also add that subscribers feed to your podcast app of choice and never miss an episode that way. The email should also contain the subscribers-only unlisted YouTube link for the extended video version too. It will also be in the show notes in your podcast player.

• ⁠You're Invited: 404 Media's Third Anniversary Live Podcast and Party!⁠
• ⁠RSVP: Killer Technology With 404 Media⁠
• ⁠Man Charged With 3 Felonies For Breaking 3D-Printed ‘Decoy’ Flock Camera⁠
• ⁠The Man Behind the Anti-Flock Darth Vader Mask Wants to Know: 'When Will This End?'⁠

Immigration and Customs Enforcement (ICE) is looking for a federal contractor to provide it with access to the country’s voter registration and voter history data, according to newly released procurement records reviewed by 404 Media.

The procurement records say ICE is seeking the data to help detect fraud. But given the administration’s habit of using fraud as a pretense for large immigration enforcement actions, and President Trump’s constant comments about election security in the lead up to the midterms, the planned hiring of a contractor to handle voter data raises questions around what exactly ICE plans to do with the data.

“The purpose of this acquisition is for the handling and secure delivery of publicly available voter registration files and voter history files to support Homeland Security Investigations (HSI) fraud detection and data segmentation activities,” a section of the procurement records reads. The records are part of a Request for Information, or RFI, which means the government is asking potentially capable contractors to come forward.

The records say the list of jurisdictions ICE wants voter data from is likely to be limited at first, but that the contractor needs to have the capability to get data from all 50 states and other U.S. territories.

Specifically, ICE is seeking “Public voter registration file for each Government-identified jurisdiction,” and “Public voter history file for each Government-specified federal election, when publicly available and separate from the public voter registration file.”

Voter data is public by design and can be obtained in various ways. Some sites collate this data and make it easily searchable. 

But handling such a large volume of data in a clean and reliable manner could be a challenge. ICE is looking for a contractor to essentially help streamline that process, by both obtaining the data and handling it for the agency. 

The purchase specifically is for HSI, the part of ICE traditionally focused on criminal investigations, including money laundering, cybercrime, and various types of fraud. That does include voter fraud.

Earlier this month, the Department of Homeland Security (DHS) highlighted an HSI case that ended in charges against a Chinese national for alleged fraudulent voter registration and fraudulent voting. 

Experts generally agree that voter fraud is exceptionally rare. But constant claims that voter fraud is happening on a wider scale or tangibly impacting elections runs the risk of disenfranchising voters from participating at all. 

In July, 404 Media reported ICE was to pay Thomson Reuters $125 million for access to a wealth of personal data to investigate “voter fraud.” Personal data Thomson Reuters holds includes peoples’ names, addresses, Social Security numbers, ethnicity, and more. 

ICE did not respond to a request for comment.

We start this week with Emanuel’s big story about Amazon buying, and destroying, masses of books to train AI. After the break we talk about a couple of wild cases where people are using AI. In the subscribers-only section, we talk about Meta’s new smart glasses patent and research into how perverts are using them. 

Listen to the weekly podcast on Apple Podcasts, Spotify, or YouTube. Become a paid subscriber for access to this episode's bonus content and to power our journalism. If you become a paid subscriber, check your inbox for an email from our podcast host Transistor for a link to the subscribers-only version! You can also add that subscribers feed to your podcast app of choice and never miss an episode that way. The email should also contain the subscribers-only unlisted YouTube link for the extended video version too. It will also be in the show notes in your podcast player.

• ⁠We Tracked a Shipment of Rare Books. It Ended at an Amazon AI Training Facility⁠
• ⁠‘Show How 3M Is 0% at Fault:’ Expert Witness Used ChatGPT to Write Report Defending Company in Deadly Explosion Lawsuit⁠
• ⁠Person Hides Prompt Injection in Legal Filing Telling AI to Side With Them⁠
• ⁠Meta Patents AI Glasses to Use Facial Recognition to Identify People, Make Highlight Reels of Your Dinner Party⁠
• ⁠Researchers Show How Meta's 'Pervert Glasses' Are Used to Harass Women⁠

The National Park Service (NPS), the agency tasked with managing the U.S. national parks and monuments, has purchased Flock cameras and had them installed at parks including in Yosemite.

Current and former NPS rangers are not happy about it.

“Flock protects property, not people or parks. People should be free to recreate in ways that are respectful to the ecosystem — but the surveillance is a disrespectful invasion of privacy,” a current NPS ranger told 404 Media. 404 Media granted the ranger and others anonymity because they weren’t permitted to speak to the press.

Another current NPS ranger said, “I just think that every American should be free to visit our national parks without their location being traced and tracked by the federal government. Wild places are at the core of American freedom and nobody should be afraid to visit them.”

A former NPS ranger added, “I think if the public knew that their public lands were being surveilled, they would push back.”

Flock cameras constantly scan the license plate, color, model, make, and other identifying features of every vehicle that drives past, creating a timestamped record of where a vehicle was at a particular time, and by extension, a person. This data is then available to Flock’s law enforcement customers and is usually queried by police without a warrant. Many of Flock’s cameras are part of a national network that other law enforcement officials can then query. For example, a cop in Texas might query the network to look for a specific vehicle and search cameras across the country. This, among increased reporting of cops abusing their access to Flock to stalk people with no legitimate investigative purpose, and local cops performing lookups for ICE, has contributed to a nationwide conversation around Flock and whether communities want the company’s cameras in their neighborhoods.

Flock cameras are installed inside Yosemite, WBTW News 13 reported earlier this month. The outlet referenced data from DeFlock, an open source map of Flock and other automatic license plate reader (ALPR) locations. 

There is also a Flock camera on a road towards the Golden Gate National Recreation Area, according to the data.

NPS also plans to install cameras from Verkada, a controversial company with a history of abusing its own products and whose products sometimes have facial detection capabilities, according to an internal NPS document viewed by 404 Media.

The NPS told 404 Media in a statement: “Yosemite National Park uses a traffic-monitoring system to measure vehicle counts, travel times and entrance-station wait times. The system helps the park better understand traffic conditions and provide visitors with information to help them make informed decisions about when to visit and where parking is available. The cameras are not connected to law enforcement or DMV databases.”

One of the current rangers said, “Last year Yosemite changed the rules about hanging flags on El Capitan and tried to backdate the rule change to make it look like the people involved had committed a crime. What happens when that sort of malfeasance is combined with the ability to track any park visitor's location, anywhere in the country? If that happens, we are no longer free in this country.”

They added, “I fear for the day when a visitor's National Park experience is interrupted by being pulled over and held at gunpoint because a license plate reader misread their plate.”

Meta has filed a patent for its AI smartglasses that uses facial recognition to automatically detect who is in the frame, creates a video clip whenever one of those people does something — like picking an item up or walking around — and then generates a highlight reel of what just happened, according to a copy of the patent published Thursday. One example given is the system capturing highlights from a dinner party and then serving those up to the user.

The patent gives new, granular insight into what Meta may be planning around its highly controversial push into facial recognition in combination with its AI glasses, which have already been widely lauded as “pervert glasses.” 

Immigration and Customs Enforcement (ICE) plans to spend tens of millions of dollars on buying specialized gloves that pulse with electrical energy, which make it easier for agents to subdue people, the Associated Press reported on Tuesday.

A user manual for G.L.O.V.E, or Generated Low Output Voltage Emitter, sold by a company called Compliant Technologies, provides more specifics on how the gloves are supposed to work and allegedly be used.

We start this week with Jason’s article about Mark Zuckerberg’s plan for Meta’s AI agents. They don't sound fun at all. After the break, Emanuel tells us how a company offering “100% human-written” medical research is actually all AI. In the subscribers-only section, Joseph explains why some cities are ditching Flock then immediately replacing those cameras with Axon ones.

Listen to the weekly podcast on Apple Podcasts, Spotify, or YouTube. Become a paid subscriber for access to this episode's bonus content and to power our journalism. If you become a paid subscriber, check your inbox for an email from our podcast host Transistor for a link to the subscribers-only version! You can also add that subscribers feed to your podcast app of choice and never miss an episode that way. The email should also contain the subscribers-only unlisted YouTube link for the extended video version too. It will also be in the show notes in your podcast player.

• ⁠Mark Zuckerberg Posts Deranged 6,500-Word Essay About Giving Everyone AI Superintelligence⁠
• ⁠Company Offering ‘100% Human-Written, Never AI’ Peer Review Is Entirely AI⁠
• ⁠Cities Are Ditching Flock, Immediately Replacing It With Axon License Plate Readers

Immigration and Customs Enforcement (ICE) plans to pay LexisNexis millions more dollars for continued access to data it can feed into a Palantir platform, according to newly published procurement records. The data is to help, among other sections, ICE’s Enforcement and Removal Operations (ERO), the part of ICE focused on deportation.

The documents provide some more insight into the sort of information ICE intends to use Palantir to process. In January, 404 Media revealed the existence of ELITE, a system Palantir made for ICE that helps the agency find which neighborhoods to target by bringing together data from private suppliers and government agencies.

The news comes as ICE arrested more than 51,000 people in July, many of those at airports.

Flock planned to use dashcams installed in hundreds of thousands Uber, Lyft, and delivery drivers’ vehicles to scan license plates those drivers travelled passed, essentially turning Uber and Lyft drivers into roaming surveillance vehicles, according to a Flock presentation shared with 404 Media.

The document provides more details on Flock’s planned partnership with Nexar, a popular dashcam company. 404 Media first revealed the intended partnership last August when multiple sources provided information on the plan. The presentation shows Flock was actively pitching this partnership, and its use of Uber and Lyft drivers, to potential customers right around the time 404 Media reported on it.

Flock told 404 Media in an email it never executed the partnership with Nexar. But the presentation still shows Flock’s ambitious plan to conscript rideshare and delivery drivers to collect license plate data for its network. It is not clear whether Uber or Lyft, or drivers working for those apps, would have been aware of the data collection.

“Hundreds of Commercial Business and HOA [home owners associations] in GA [Georgia] are part of the network,” the presentation, written by Flock to present to the Georgia Office of the Attorney General last August, reads. “Plus Nexar partnership which includes 350k Uber/Lyft and other delivery service devices.”

Jason Hunyar, a Dunwoody, Georgia, resident who obtained the presentation through a public records request, shared the document with 404 Media.

Flock’s automatic license plate reader (ALPR) cameras are usually stationary cameras installed on tall poles that constantly scan the license plate, color, make, and brand of every vehicle that drives past. The Nexar partnership would have made those data collection efforts mobile. Axon, the law enforcement contracting giant that also sells ALPR cameras, sells some of its cameras to be installed in police officers’ roaming cars. Vigilant Solutions and the Digital Recognition Network (DRN), two ALPR companies now owned by Motorola, perform similar license plate data collection through cameras in vehicles belonging to repossession agencies.

Nexar sells various different models of dashcams providing front, cabin, and rear views, and already can provide “clear license plate capture with Full HD video,” according to its website. Nexar markets the cameras to rideshare drivers and also “commuters,” “long-distance drivers,” and “casual drivers.”

In September, 404 Media reported that a hacker broke into Nexar and accessed a database of terabytes of video recordings taken by customers’ cameras. Those included footage of people driving around sensitive Department of Defense locations.

Flock has explored obtaining other unusual datasets too. Last May, 404 Media reported Flock was building a massive people lookup tool that would use hacked data to “jump from LPR to person,” according to leaked audio. Flock scrapped those plans after 404 Media’s coverage and internal pressure.

Neither Uber nor Lyft responded to a request for comment. Neither did Nexar.

In May, 404 Media reported a company called BusPatrol, that has cameras installed in tens of thousands of school buses, plans to turn those cameras into ALPRs and give access to that data to law enforcement.

SAP, one of the world’s biggest software companies, suspended most travel and hiring last month because of AI’s soaring cost, with exceptions only being made for AI-related travel or hires, according to an internal SAP email obtained by 404 Media. 

Bloomberg reported on the email and the freezes in July, but a current SAP employee said the bans are still in effect. The employee said the company had a global employee meeting recently where this was brought up again. They added SAP is currently rolling out a newly created AI tool to the entire company “which I can only imagine massively increases the costs.” 404 Media granted the source anonymity to protect them from retaliation.

The email highlights how companies both big and small are coming to grips with the reality of AI’s cost. Rather than being a massive cost saver, in some cases companies are throttling employees’ AI use as it spirals out of control, and scrambling to find other ways to keep costs down.

A handful of cities across the U.S. have ditched Flock’s automatic license plate reader (ALPR) cameras and immediately replaced them with equivalent systems from law enforcement contracting giant Axon, according to local media reports and government documents from around the country. Axon, for example, advertises AI-powered cameras that attach to an existing streetlamp and are designed to completely blend in with their surroundings, and also collects license plate data with cameras installed inside police officers’ patrol vehicles.

We start this week with Joseph’s article about Samuel Tunick, the man charged with allegedly wiping his phone before DHS officials could search it. It’s a wild case with a lot to unpack. After the break, Jason tells us all about a TikTok Shop scheme powered by AI. In the subscribers-only section, we talk about possibly the dumbest AI tool ever made.

Listen to the weekly podcast on Apple Podcasts, Spotify, or YouTube. Become a paid subscriber for access to this episode's bonus content and to power our journalism. If you become a paid subscriber, check your inbox for an email from our podcast host Transistor for a link to the subscribers-only version! You can also add that subscribers feed to your podcast app of choice and never miss an episode that way. The email should also contain the subscribers-only unlisted YouTube link for the extended video version too. It will also be in the show notes in your podcast player.

• ⁠You're Invited: 404 Media's Third Anniversary Live Podcast and Party!⁠
• ⁠‘The Government Hopes To Set a Precedent’: An Interview With the Man Charged for Allegedly Wiping His GrapheneOS Phone⁠
• ⁠Inside an AI TikTok Shop Slop Factory That Shills Supplements Recalled By the FDA⁠
• ⁠Google Earth’s New AI Lets Anyone Fabricate Completely Bullshit Satellite Images⁠

A series of issues in Apple’s web browser engine — the tech underlying all browsers on iOS — means that Apple’s iCloud Private Relay tool, which is supposed to hide a user’s IP address, in many cases doesn’t actually work. Instead, the issues mean a malicious attacker can set up a website to learn a Private Relay user’s real IP address, or that many websites have also already collected this information incidentally. The issues also impact OnionBrowser, an iOS app for browsing the web through the Tor anonymity network, the researchers who discovered the issues say.

The Private Relay leak is the second issue to recently impact Apple’s paid-for privacy products. Last month 404 Media reported a bug in Apple’s Hide My Email feature was actually revealing peoples’ real email addresses. Apple knew about that issue for more than a year before fixing it.

The Securities and Exchange Commission (SEC) bought access to what it described as more than a billion airline ticketing records, related to not just U.S. domestic flights or those landing in the country, but also flights between foreign countries, according to SEC documents obtained by 404 Media. A group of the world’s airlines, including Delta, United, and American, previously sold the data under the company name ARC; that is where the SEC bought the data from.

ARC, or the Airlines Reporting Corporation, stopped selling airline ticketing records after repeated coverage from 404 Media and pressure from lawmakers last year. But the newly obtained records provide additional insight into the breadth of data that airlines were selling without their customers' knowledge, and that law enforcement agencies were tapping into, likely without a warrant.

This is an adaption of a podcast interview 404 Media recorded with Jonathan Paz, a former Flock employee who is now running running for Congress in Massachusetts’ 5th District. Check out the whole thing here on YouTube.

Jonathan Paz was initially nervous when he started working at the surveillance company Flock. It was his first tech job. But he was interested in the company’s mission. Flock’s cameras, which constantly scan the license plate of every vehicle driving past, were for finding missing people. Staff at the company were able to solve real issues.

In his job as a government affairs manager a couple of years ago, Paz represented Flock in public hearings, with the goal of getting a city to purchase Flock cameras. These sorts of hearings are happening on a near constant basis all across the country, as cities and towns participate in a national conversation about whether they want Flock cameras in their community or not.

On Thursday, Google introduced a new AI feature into Google Earth which lets anyone fabricate all sorts of misleading or straight up inaccurate satellite imagery, from making it look like a specific place has suffered a drone strike to manifesting a nuclear plant in Iran.

Usually, Google Earth is an exceptionally useful tool for open source intelligence (OSINT) analysts to digitally monitor areas of interest and see how they change over time, say, during a conflict or disaster. Now, Google Earth can easily be used as a tool for disinformation. 

LinkedIn, a social network awash with long AI-generated posts from executives and other corporate workers, has introduced a new button that users can click to flag if a post “seems like AI slop,” according to 404 Media’s own tests.

If you have been anywhere near LinkedIn in the past couple of years, you have undoubtedly seen users posting blatantly AI-generated missives. Often these posts take some sort of news event, and opine on how this relates to thought leadership, or some other LinkedIn brainrot term. It’s also pretty wild the button specifically uses the term “AI slop” and not, say, “It seems this was generated with AI.”

We start this week with Matthew’s experience of what happened when Flock came to his small town. It’s a microcosm of what is happening all across the United States. After the break, Sam tells us about a bunch of no phone Luddite events. In the subscribers-only section, Jason explains why anti-Flock influencers making up BS are bad, actually.

Listen to the weekly podcast on Apple Podcasts, Spotify, or YouTube. Become a paid subscriber for access to this episode's bonus content and to power our journalism. If you become a paid subscriber, check your inbox for an email from our podcast host Transistor for a link to the subscribers-only version! You can also add that subscribers feed to your podcast app of choice and never miss an episode that way. The email should also contain the subscribers-only unlisted YouTube link for the extended video version too. It will also be in the show notes in your podcast player.

• ⁠Our New FOIA Forum! 7/30, 1PM ET⁠
• ⁠What Happened When Flock Came to My Town⁠
• ⁠Being a Luddite Is Fun Again⁠
• ⁠The Rise of Anti-Flock Influencers Who Make Things Up for Clout⁠

In charging a man for allegedly typing in a duress password which wiped his privacy-focused GrapheneOS phone, the U.S. government is trying to intimidate other activists from protecting their data and participating in social movements, Samuel Tunick, the man charged, told 404 Media in an interview on Tuesday.

The case of Tunick, who participated in the Stop Cop City movement in Atlanta, has resonated across privacy and civil liberties circles. 404 Media first broke news of the case in December. Last week, The Guardian reported additional details including from a court hearing in the case. The maximum sentence for the alleged crime is five years in federal prison.

In a video my friend’s dog is laying on her back, her little paws in the air, while my friend rubs the dog’s chest. You can see most of the dog — who I’m not naming for very important privacy reasons — from her head to her belly. On closer inspection, you’ll notice the picture includes some dog nipples. 

Apple’s iMessage thought this video was so inappropriate that it flagged the video as potentially containing nudity and blurred it. When someone else received the video over iMessage, the app displayed the message “This may be sensitive.” They had to purposefully tap to reveal the video of a dog laying on her back being petted.

This week Joseph talks to Mike Yeagley. As you’ll hear, he is a very interesting guy. He introduced parts of the government to the whole idea of commercially sourced location data. He spent hundreds of thousands of dollars buying the data, and showing what could be done with it. It’s a fascinating conversation.

Listen to the weekly podcast on Apple Podcasts, Spotify, or YouTube. Become a paid subscriber for access to this episode's bonus content and to power our journalism. If you become a paid subscriber, check your inbox for an email from our podcast host Transistor for a link to the subscribers-only version! You can also add that subscribers feed to your podcast app of choice and never miss an episode that way. The email should also contain the subscribers-only unlisted YouTube link for the extended video version too. It will also be in the show notes in your podcast player.

- How the Pentagon Learned to Use Targeted Ads to Find Its Targets—and Vladimir Putin

Claude is exposing a wealth of users’ chats and creations in Google search results, meaning anyone can dig through conversations or other material that people used Claude to make but may not have realized were publicly available for strangers to see.

It’s that time again! We’re planning our latest FOIA Forum, a live, hour-long or more interactive session where Joseph and Jason will teach you how to pry records from government agencies through public records requests. We’re planning this for Thursday, July 30th at 1PM ET. That's in just one week today! Add it to your calendar! 

So, what’s the FOIA Forum? We'll share our screen and show you specifically how we file FOIA requests. We take questions from the chat and incorporate those into our FOIAs in real-time. This time we're particularly focused on city council meetings. Jason watches a lot of these and has tips for more quickly navigating and finding information within them. He then does a bunch of public records requests based on what happened in the meeting. He'll explain all of this, from Flock to other topics too.

If this will be your first FOIA Forum, don’t worry, we will do a quick primer on how to file requests (although if you do want to watch our previous FOIA Forums, the video archive is here). We really love talking directly to our community about something we are obsessed with (getting documents from governments) and showing other people how to do it too.

Paid subscribers can already find the link to join the livestream below. We'll also send out a reminder a day or so before. Not a subscriber yet? Sign up now here in time to join.

We've got a bunch of FOIAs that we need to file and are keen to hear from you all on what you want to see more of. Most of all, we want to teach you how to make your own too. Please consider coming along!

We start this week with Joseph’s story on how cops are using Flock to track actual people, not just cars, with searches like “male with tattoos.” After the break, Emanuel tells us all about the company that is explicitly selling mountains of books to AI companies and promising to keep the sales a secret. In the subscribers-only section, Jason tells us how he learned about the Suno hack and what it showed us.

Listen to the weekly podcast on Apple Podcasts, Spotify, or YouTube. Become a paid subscriber for access to this episode's bonus content and to power our journalism. If you become a paid subscriber, check your inbox for an email from our podcast host Transistor for a link to the subscribers-only version! You can also add that subscribers feed to your podcast app of choice and never miss an episode that way. The email should also contain the subscribers-only unlisted YouTube link for the extended video version too. It will also be in the show notes in your podcast player.

• ⁠You're Invited: 404 Media's Third Anniversary Live Podcast and Party!⁠
• ⁠How Cops Use Flock to Track People, Not Cars⁠
• ⁠AI Companies Are Buying Tons of Old Books Because They're Free of AI Slop⁠
• ⁠Hack Reveals Suno AI Music Generator Scraped YouTube, Deezer, and Genius⁠

When you open a new credit card, you necessarily give the credit card company your address. You probably expect that information to remain with your bank.

But when you open a new credit card or change your address on file, your address leaves your credit card provider, travels through a web of middlemen companies, and ends up with Immigration and Customs Enforcement (ICE), which can then search, analyze, or pair that data with other pieces of information about your life without a warrant.

404 Media has mapped out this supply of data by reviewing U.S. government procurement records and internal documents from companies providing the information. It highlights the sometimes unexpected ways ICE is gaining access to peoples’ personal information as the agency continues to acquire and leverage all sorts of data. 

The agency is buying information not just for immigration enforcement but to also investigate what the administration describes as ‘voter fraud.’ ICE officials have also repeatedly attempted to intimidate legal observers of ICE activity.

“No one signing up for a credit card thinks they're giving data brokers a thumbs-up to sell their personal information to ICE. Not only is it an outrageous violation of our privacy, it's impossible for Americans to opt out,” Senator Ron Wyden told 404 Media in a statement.

Apple says it has fixed a vulnerability in its Hide My Email feature which let essentially anyone figure out a user’s real email address which was supposed to be protected by the feature. Apple only fixed the vulnerability after 404 Media wrote about it at the start of July, despite Apple knowing about the issue for more than a year.

The news also follows the filing of a class action lawsuit against Apple over the vulnerability.

On Wednesday Apple told 404 Media it deployed a patch for the issue on July 3, which the company says has fully resolved the issue. 

Hide My Email is part of Apple’s paid iCloud+ product. It lets customers quickly create a new, anonymous email address they can then use to sign up to websites, services, or email people with. The generated email addresses typically contain two random words followed by a number and the @icloud.com domain. I use it heavily so hackers may have a harder time cross-referencing my activity and accounts across data breaches, for example. 

Tyler Murphy, co-founder of EasyOptOuts, discovered he was able to find the real email address of Hide My Email users. At the time, Murphy said, “We don't know the full scope of the issue, but in our limited tests with volunteers, 100% of Hide My Email addresses were exploitable.” That included mine, which we tested.

Murphy first reported the issue to Apple in June 2025. Over the subsequent months, Apple said it was looking into the issue and said it had fixed it; Murphy found it was still exploitable; and Apple again said it was looking into it. Murphy, thinking Apple may not fix the issue at all, then contacted 404 Media, around a year after Apple learned of the vulnerability.

When 404 Media first covered the issue several weeks ago, we did not include any details on how it worked because Apple had not fixed it. Meaning, if we published more specifics, third parties might figure out how to exploit it and reveal peoples’ real email addresses.

Now Apple says it has been fixed, we can add that, in simple terms, it required sending a target Hide My Email user a message that got rejected as spam. “We don't know how often hidden email addresses were leaked in email logs. For many major email hosts, the leak was triggered simply by an email being automatically rejected as spam, even if it was a legitimate message. Such emails probably didn't make it to your inbox, so you can’t review your spam folder to learn whether you were affected,” Murphy and EasyOptOut co-founder Ben Weiner said in a new statement.

“The bug that caused Apple's Hide My Email to leak hidden email addresses to senders has been fixed. However, we don't think the risk to Hide My Email users has been eliminated. Because non-malicious emails could bounce, revealing your hidden email address, and because mail transfer logs are often retained, we'd assume that any hidden email address linked to a Hide My Email address created before July 7, 2026, may have been exposed and could still be in third-party logs,” they added.

The class action lawsuit against Apple seeks full recovery of the subscription costs customers paid for the feature and an injunction against Apple for its “deceptive conduct,” PCMag reported.