Proton, the company behind ProtonMail and other privacy-focused products, told staff on Monday it would be ‘re-interviewing’ staff across the company about how they use AI in their jobs, with the implication that the interviews may decide whether staffers have “continued employment,” according to an internal Proton email obtained by 404 Media.
Garrett Langley, the CEO of automatic license plate reader company Flock, told an audience of police chiefs at a private police conference Sunday that anti-Flock protests around the country are not real, according to leaked audio obtained by 404 Media.
He also said his wife advised him to never apologize, said he would prefer to never do interviews with the press again, and claimed without evidence that the social media opposition to Flock is driven mostly by Russian bots.
“Somebody was paying for [the social media posts and] stopped paying for it,” Langley said about the many viral posts criticizing his company’s technology. “Social media chatter on Flock is down about 95 percent from July. It went down 50 percent last week when Ukraine bombed a Russian data center with a drone. Literally 50 percent overnight. And so look, I’m the last person, my wife as well, she’s like ‘This is crazy, these people are getting paid to say these things,’” he added, repeating a disproven theory that Ukraine’s strikes on Russian data centers had a significant impact on internet bot activity.
We start this week with Jason’s article about how everyone is apparently reverse-engineering everything. After the break, Joseph tells us about a big AI shakeup at consulting giant Accenture. In the subscribers-only section, Sam and Jason discuss the Character[.]ai bankruptcy.
Listen to the weekly podcast on Apple Podcasts, Spotify, or YouTube. Become a paid subscriber for access to this episode's bonus content and to power our journalism. If you become a paid subscriber, check your inbox for an email from our podcast host Transistor for a link to the subscribers-only version! You can also add that subscribers feed to your podcast app of choice and never miss an episode that way. The email should also contain the subscribers-only link for the extended video version too. It will also be in the show notes in your podcast player.
Amanda Smith answered the door one afternoon in April and came face to face with the local Sheriff’s department in upstate Pennsylvania. The officers said they had a warrant for her arrest for a crime she had allegedly committed more than a thousand miles away in Arkansas.
“I was completely confused,” Smith recalled. For one, she had never been to Arkansas. Second, the warrant was for computer fraud. By her own admission, Smith was not a very tech savvy person.
She had a feeling she was being set up. After discussing with the officers the practicalities of what was about to happen — she was allowed to get her contact lenses — they took her away in handcuffs to the local jail where she spent three nights.
The reason for Smith’s arrest, she learned later, was that a scammer had tricked someone on Facebook Marketplace into sending $1,000 to a CashApp account in her name that the scammer controlled. The scammer created the account using her Social Security number and date of birth. Smith said she has never used CashApp.
What developed over the next few days, and has now stretched across six months, is a Kafkaesque situation in which Smith, in her telling, is being asked to prove her innocence in an ongoing criminal case, while CashApp refuses to provide her any information about the account because she couldn’t prove that she was the owner.
When a Department of Homeland Security official sent out an alert to stop Samuel Tunick, a Stop Cop City activist, at an airport in January 2025, they said the reason was because he was suspected of “terrorist activities,” according to new filed court records which include a screenshot of the alert and photos of Tunick’s interrogation.
Tunick ultimately provided Customs and Border Protection (CBP) officials with a code that, when entered, wiped his security- and privacy-focused GrapheneOS phone. Tunick is now being criminally charged for that alleged act, in one of the most high profile technology civil rights cases in recent memory.
The court records also showed that CBP officials lied to Tunick during his interrogation. Instead of saying he was being targeted for suspected terrorism — although this search happened just at the start of the second Trump administration, it has dramatically broadened what organizations or people may be considered such — they said they needed his phone to look for “kiddie porn.”
A Chinese organized crime group hacked into retail giant Staples, used that access to fraudulently issue millions of dollars worth of gift cards for stores like Target and Sephora, then went on a nationwide shopping spree, shipping many of the stolen electronics and other products back to China as part of a massive retail theft operation, 404 Media has learned.
The finding, based on a review of court records, reveals the scale at which some organized crime groups are fleecing U.S. retailers, with entire warehouses dedicated to housing the merchandise. The hack of Staples, which has not been previously reported, signals just how sophisticated some of these operations have become.
We start this week with Joseph’s article about Raven, previously known as Geospy. This is an AI tool that can geolocate photos, and now says it can pinpoint a specific house based just on one photo taken inside. After the break, Jason explains why a judge ruled a particular Flock search as unconstitutional. In the subscribers-only section, we talk about the wild AI video that has derailed a manslaughter case.
Listen to the weekly podcast on Apple Podcasts, Spotify, or YouTube. Become a paid subscriber for access to this episode's bonus content and to power our journalism. If you become a paid subscriber, check your inbox for an email from our podcast host Transistor for a link to the subscribers-only version! You can also add that subscribers feed to your podcast app of choice and never miss an episode that way. The email should also contain the subscribers-only link for the extended video version too. It will also be in the show notes in your podcast player.
This article was produced in collaboration with Court Watch, an independent outlet that unearths overlooked court records. Subscribe to them here.
Newly filed court records show exactly what happens when messaging app Telegram provides data to U.S. authorities.
A letter written by Telegram, and providing a specific user’s phone number, user ID, and IP address, reads:
Consulting giant Accenture has told many employees that the company will now only spend $29 a month per person on Claude. Employees subject to the cap, some of whom had been spending as much as $1,000 monthly, are scrambling to find ways to make sure they can keep spending as much as they already are.
The news is a snapshot of what continues to play out across all sorts of industries: companies have spent heavily on AI tools, and are now discovering that many users are burning or “chewing” through AI tokens at a rapid clip. In response, many companies have curbed their employees’ AI use. There is a special irony to Accenture doing much of the same, when it is a company that has encouraged its clients to invest heavily into AI.
There is a lot of stuff about how creepy ad targeting is in today’s newsletter. Our first story is one I did, about how advertisers — or really anyone with 5 minutes on their hands — can inject ads into your ChatGPT session based on your phone number or email address. This is pretty normal in the advertising world, but I seriously doubt that when most of ChatGPT’s many, many users see an ad, they realize that might be because someone, somewhere, uploaded their phone number into OpenAI’s systems. I made my own ad on ChatGPT (without using peoples’ personal data) to test out the system. Then, in other news, there is new research confirming, I think for the first time, that online ads are being used to deliver zero-click mercenary malware against targets.
OpenAI lets anyone inject ads into ChatGPT users’ sessions, targeting specific groups of people based on their email address, phone number, or a unique identifier on their phone, according to 404 Media’s own tests of ChatGPT’s advertising ecosystem.
While the ad targeting available in ChatGPT is somewhat standard practice across the advertising industry, the chatbot’s one billion monthly active users may not understand they, in some cases, are being specifically targeted because of their personal data the advertiser has uploaded to OpenAI. ChatGPT’s ad targeting is also novel in that it is also based on the prompts users enter into the chatbot, prompts that users may assume are private but which, as 404 Media has previously shown, may be reviewed by humans. Or in this case, used for ad targeting purposes.
An AI company now lets cops take a photo and nearly instantly figure out what specific home it was taken in, using only clues in the photo itself, and is clearly pulling data from sites like Zillow and Airbnb.
The tool, called Raven, shows the increasing power of AI capabilities available to local law enforcement agencies. 404 Media previously reported that both the Los Angeles Police Department and Miami-Dade Sheriff’s Office (MDSO) have bought access to Raven, which was previously called GeoSpy. Now, Raven, made by a company called Graylark Technologies, has added features that let cops analyze the interior of homes.
We start this week with a story from our old friend Lorenzo Franceschi-Bicchierai, about how cops can bypass the inactivity reboot on iPhones. After the break, Jason tells us how people are losing their minds over an LLM ‘torture’ prison. In the subscribers-only section, Sam explains what happened in a wild ChatGPT case in New Mexico.
Listen to the weekly podcast on Apple Podcasts, Spotify, or YouTube. Become a paid subscriber for access to this episode's bonus content and to power our journalism. If you become a paid subscriber, check your inbox for an email from our podcast host Transistor for a link to the subscribers-only version! You can also add that subscribers feed to your podcast app of choice and never miss an episode that way. The email should also contain the subscribers-only link for the extended video version too. It will also be in the show notes in your podcast player.
Multiple Democrat, Republican, and Independent lawmakers have introduced new pieces of legislation that, if passed, would dramatically curb federal agencies’ access to Flock cameras, with the lawmakers referencing reporting by 404 Media in their explanations for why the legislation is needed.
On Friday Senator Bernie Sanders (I-Vt.), Representative Alexandria Ocasio-Cortez (D-N.Y.), and Senator Jeff Merkley (D-Ore.) announced the Ban Flock Act, which would prohibit federal agencies from using automatic license plate readers (ALPRs) and block federal funding from state and local governments that use the cameras. It would also let Americans sue the federal government for violation of their rights through ALPRs.
“At a time of growing concern about the unchecked power of artificial intelligence, Flock is eviscerating the very notion of privacy by installing tens of thousands of cameras in communities across America without their consent,” Sanders said in the announcement posted to his website. “Going to the doctor? Flock knows. Dropping your kid off at school? Flock is tracking you. Flock is always watching. We cannot allow America to become a surveillance state where a handful of AI oligarchs profit by giving the government the power to track our every movement.”
Ocasio-Cortez said, “AI-powered cameras are keeping track of our every move and weaponizing this data against working people to make record profits. The widespread integration of this technology into American society is unconscionable.” Merkley added, “No one should have this unchecked surveillance power at their fingertips, which is why I’m teaming up with Senator Sanders to rein in this dangerous technology.”
Sanders’ announcement says that one reason for the legislation is Flock has shared state information with federal immigration officials. In May 2025, 404 Media revealed local cops were doing lookups in Flock for Immigration and Customs Enforcement (ICE). After that report, Flock made dramatic changes to its product, including stopping other agencies searching cameras in Illinois, California, and Virginia. Flock said it also introduced a new tool that blocks impermissible searches in real time.
The announcement also said law enforcement have used Flock data to investigate protests against ICE raids and ‘No Kings’ demonstrations. 404 Media revealed both of these, reporting that California cops investigated an “immigration protest” using Flock lookups, and, using data from the Electronic Frontier Foundation, that cops used Flock to monitor No Kings protests around the country. 404 Media also recently reported Flock itself taught cops how to surveil No Kings protesters in a company webinar.
Hajar Hammado, senior policy advisor at activist and progressive policy group Demand Progress, said in a press release “The Ban Flock Act is the gold standard for any legislation working to fight invasive Flock cameras on the federal level. Flock and other ALPR companies have wormed their way into communities across the nation and drastic, all-encompassing action is needed to root them out.”
Senator Josh Hawley (R-Mo.) announced his own piece of proposed legislation late last month. The Stop Flock Abuse Act would require a written approval process for each search; force agencies to delete driver data after ten days, with exceptions for active investigations; and ban ALPR networks from incorporating facial recognition technology. During a recent senate hearing, Hawley pointed to 404 Media’s reporting specifically.
Separately, Representatives Greg Casar and Shontel Brown recently wrote to FBI Director Kash Patel asking how the agency plans to acquire nationwide access to ALPR data, Semafor reported. 404 Media first revealed this plan in May. The letter also referenced 404 Media’s reporting which revealed a cop in Texas used Flock to search ALPRs nationwide for a woman who self-administered an abortion.
We start this week with Joseph’s stories on the massive FBI hack. 404 Media broke this news and continued to cover the breach of data on all FBI employees and their spouses. After the break, Jason tells us how a surveillance company is telling cops it wants to add facial recognition tech to Flock camera data. In the subscribers-only section, Jason and Joseph chat all about Muse, Meta’s new agentic AI, and how humans are actually behind some of the tasks. Because of course.
Listen to the weekly podcast on Apple Podcasts, Spotify, or YouTube. Become a paid subscriber for access to this episode's bonus content and to power our journalism. If you become a paid subscriber, check your inbox for an email from our podcast host Transistor for a link to the subscribers-only version! You can also add that subscribers feed to your podcast app of choice and never miss an episode that way. The email should also contain the subscribers-only unlisted YouTube link for the extended video version too. It will also be in the show notes in your podcast player.
The United States Postal Service is running a pilot program to put cameras in its mail carrier trucks that continuously scan roads and signs, map roadways and sidewalks, and improve “community safety,” according to a letter posted by a labor union and a statement from the agency to 404 Media. The idea is that, since the trucks are constantly traveling anyway, they can be used as a way to collect data, eventually potentially across the nation.
“The purpose of this pilot is to leverage the Postal Service’s unique ability to collect this valuable data due to the scale and frequency with which our fleet of postal vehicles travel the streets of every community across the country,” the letter, posted by NALC Branch 238 to Facebook, reads.
The letter, written by the United States Postal Service (USPS) Labor Relations to Brian Renfroe, the president of the National Association of Letter Carriers, says the USPS will partner with Next Base, a dashcam company, for the pilot. At the moment, the cameras will be used in the Washington, DC area, and will be installed on a hundred vehicles, the letter says.
On its website, Next Base offers a variety of dash cams, marketed to ordinary drivers, fleet operators, and ride share drivers. Its website says Next Base’s cameras record in up to 4K, and can capture every “license plate” with precision. The cameras don’t run automatic license plate reader (ALPR) software, though.
The letter continues, “Next Base cameras will scan and analyze roads, signage, maps roadways [sic] and sidewalks.” It says the cameras will be forward-facing, installed inside the trucks, and will begin recording as soon as the vehicle is in drive and away from the postal facility. “The cameras will not hinder the vehicle operator’s field of vision, nor does it record audio,” it adds.
The pilot was slated to start on September 21, and is expected to last several months, the letter says.
A spokesperson for the USPS told 404 Media in an email “The Postal Service is conducting a limited pilot to assess whether vehicle-mounted cameras can help identify roadway conditions and support community safety. The pilot includes privacy safeguards and requires no additional action from employees. Findings will inform any future decisions.”
USPS trucks already have 360 degree cameras that capture the outside of the vehicle for a period of time.
Surveillance isn’t just about who is collecting the data. Surveillance is, of course, also about who that data ends up with. A great story from Jason today looks at that with Flock and other automatic license plate reader (ALPR) data: some local cops are being forced to feed their ALPR data into obscure federal systems where that data may be kept for much longer than usual, and searched by many more people and agencies than the residents being surveilled probably realize.
And, we now know which birds are the two loudest on the planet. Maybe. Welcome back to our new experiment with daily newsletters. If you like this, subscribe here.
The Trump administration is using an anti-drug trafficking grant program from the 1980s to force cities around the country to funnel their ongoing collection of automated license plate reader data into large federal surveillance centers that fall under the White House’s jurisdiction, according to public records and court documents reviewed by 404 Media.
The hackers behind the massive FBI breach told 404 Media on Monday they do not intend to publish the data.
The breach, in which the hackers stole personal information on “all FBI employees and applicants” including physical addresses, job roles, names of spouses, and medical records, represents a significant national security and counterintelligence threat. Criminals in the same ecosystem as the hacking group, called ShinyHunters, have previously used hacked phone data to track and harass the FBI agents investigating them. When 404 Media first broke news of the breach, the group sent the personal data of an agent and their spouse who they said was investigating the group.
Facial recognition is everywhere now. It’s in surveillance cameras; it’s soon going to be in Meta’s RayBan pervert glasses, and some students already did that. You now have massively viral accounts that take clips of people, run them through facial recognition software, and then post their name and other personal info for everyone to see. We haven’t fully come to terms with what it means to live in a world where anyone can basically dox anyone else now.
To talk through this, Joseph spoke to Kashmir Hill. She’s a reporter at the New York Times, and the author of Your Face Belongs to Us: A Tale of AI, a Secretive Startup, and the End of Privacy.
Listen to the weekly podcast on Apple Podcasts, Spotify, or YouTube. Become a paid subscriber for early access to these interview episodes and to power our journalism.If you become a paid subscriber, check your inbox for an email from our podcast host Transistor for a link to the subscribers-only version! You can also add that subscribers feed to your podcast app of choice and never miss an episode that way. The email should also contain the subscribers-only unlisted YouTube link for the extended video version too. It will also be in the show notes in your podcast player.
This piece contains references to eating disorders. If you or someone you know needs help, support is available.
Human contractors hired to improve Microsoft’s Copilot AI chatbot are constantly bombarded with lewd or sexually explicit photo editing requests and images that users have uploaded, including upskirt photos or putting women into sexual positions. These contractors are then asked to review whether the generated image successfully fulfilled the prompt — such as, did the image generator make the woman’s AI-enlarged breasts big enough.
We start this week with Jason’s story about OpenAI and Microsoft’s big admissions from court records that they are destroying the internet in all sorts of ways, and stealing intellectual property on an unprecedented scale. He admit it. After the break, Emanuel explains how he hijacked a real band’s Spotify page with AI-generated slop. In the subscribers-only section, we hear all about iLands, the AI agent platform that is basically just spam.
Listen to the weekly podcast on Apple Podcasts, Spotify, or YouTube. Become a paid subscriber for access to this episode's bonus content and to power our journalism. If you become a paid subscriber, check your inbox for an email from our podcast host Transistor for a link to the subscribers-only version! You can also add that subscribers feed to your podcast app of choice and never miss an episode that way. The email should also contain the subscribers-only unlisted YouTube link for the extended video version too. It will also be in the show notes in your podcast player.
The catastrophic hack of at least thousands of FBI officials’ personal data, including their addresses, phone numbers, and even their spouses, includes members of the FBI’s secretive hacking team, potentially revealing who exactly is in that unit, 404 Media has found.
The findings further highlight how sensitive the stolen data is, and how valuable it may be to criminals or to foreign intelligence agencies. There is very little public information about the FBI’s hacking unit, including the operations it conducts, the tools it uses, or which agents are part of it.
A high profile hacking group claims it has breached multiple FBI-related services and stolen data “on all FBI employees and applicants.” A representative of the group, called ShinyHunters, told 404 Media the data includes FBI agents’ names, home addresses, phone number, and information on their spouse.
The data breach could be massively significant and may have all sorts of national security and counterintelligence implications. Criminals from the same ecosystem as ShinyHunters have previously used hacked data like phone records to track, intimidate, and harass the FBI agents investigating them. The highly sensitive data could also be a boon to foreign intelligence agencies who want to better understand how one of the most important law enforcement and intelligence agencies in the U.S. operates. And if the data fell into the hands of more criminals, FBI agents and their spouses could face serious threats to their safety.
“We hacked the FBI. We hold data on all FBI employees and applicants,” the representative of the group told 404 Media.
OpenAI has an army of contractors who read real ChatGPT users’ prompts and other data to help improve the chatbot’s responses. The idea is that the contractors provide an, obviously, human touch to OpenAI’s models. Well, not all of the contractors are doing that. 404 Media has found multiple contractors hired to improve OpenAI’s models have been fired for using AI to train the AI. That’s not great for the models themselves, but there is also obviously a great irony in AI training companies working for OpenAI firing people for using AI when OpenAI’s whole thing is to make people use AI at work.
Some AI models already exhibit signs of “model collapse,” which is where AI models further trained on AI-generated text can become worse and worse. In this case, some of the people hired to partially stop that happening are themselves using AI-generated responses to train OpenAI’s models.
One contractor said they see people using AI “all the time and people are let go for it all the time, it’s pretty much the one thing that will get you kicked off ASAP.” The person said, “in a group of thousands there are tons that have been caught.”
Cities around the country are ditching Flock’s automatic license plate reader (ALPR) cameras, and replacing them with equivalent cameras from law enforcement contracting giant Axon. That move in large part comes in response to 404 Media’s coverage of how local cops performed lookups in Flock for Immigration and Customs Enforcement (ICE), and how a cop in Texas searched Flock cameras nationwide to look for a woman who self-administered an abortion.
That brings up questions: what are cities and law enforcement agencies using Axon ALPRs for? And who are they in turn sharing that data with? 404 Media has started to find out, but needs the help of local residents and community members to figure out what is happening across the country.
Over the last few weeks, 404 Media has filed requests with various cities and police departments for Axon “activity reports” and “sharing reports.” These show in granular detail when a police officer searched Axon’s ALPRs, the name of the officer, their badge number, the license plate they reached, and, most importantly, the stated reason why. These activity reports are essentially Axon’s version of Flock’s “network audits,” which has been the basis of much of 404 Media’s Flock reporting, and local and national media outlets’ around the country. You can see an example of one here:
So far, 404 Media has obtained activity reports from the Benton County Sheriff's Office, WA; Falmouth Police Department, ME; Johns Creek Police Department, GA; Ocean Shores Police Department, WA; Pleasanton Police Department, TX; and Red Wing Police Department, MN.
But we need your help. Has your local police department or city switched to Axon ALPR cameras? Were they already using Axon? And do you want to know what they’re using those cameras for?
We’re asking interested readers to file the below public records request. You can simply copy this language, tweak it a little if necessary to apply to your state, then file the request with the relevant agency. You can do this by finding their relevant public records request email address, or by filing it through Muckrock. This is the platform we use for sending and organizing our records requests.
The Internal ALPR Activity report is the one shown above. The Network ALPR Activity report shows what other agencies the police department or city shares their data with. The ALPR Data Sharing report provides a history of when other agencies were invited, or removed, to receive the data. And the ALPR Hostlist Management Audit report details changes made to alerts the agency may receive.
If you file a request and get data back, please feel free to email it to us at joseph@404media.co. We’ve seen with the nationwide conversation about Flock that local residents can do a lot to reveal how surveillance technology is being used in their own communities. We hope we can find out a bit more about how agencies are using Axon’s cameras too.
To Whom It May Concern:
Pursuant to the [YOUR STATE’S PUBLIC RECORDS LAW], I hereby request the following records:
1. Internal ALPR Activity report in Axon.
The report should include data logged from the period of January 1, 2025, to the date this request is processed. Per Axon's documentation, the Internal ALPR Activity report is available within the LPR > ALPR Search > LPR Audit menu. You can find instructions to locate this here: https://www.axon.com/help/fusus/software/fusus/alpr/alpr-audit.htm
2. Network ALPR Activity report in Axon.
The report should include data logged from the period of January 1, 2025, to the date this request is processed. Per Axon's documentation, the Network ALPR Activity report is available within the LPR > ALPR Search > LPR Audit menu. You can find instructions to locate this here: https://www.axon.com/help/fusus/software/fusus/alpr/alpr-audit.htm
3. ALPR Data Sharing report in Axon.
The report should include data logged from the period of January 1, 2025, to the date this request is processed. Per Axon's documentation, the ALPR Data Sharing report is available within the LPR > ALPR Search > LPR Audit menu. You can find instructions to locate this here: https://www.axon.com/help/fusus/software/fusus/alpr/alpr-audit.htm
4. ALPR Hotlist Management Audit report in Axon.
The report should include data logged from the period of January 1, 2025, to the date this request is processed. Per Axon's documentation, the ALPR Hotlist Management Audit report is available within the LPR > ALPR Search > LPR Audit menu. You can find instructions to locate this here: https://www.axon.com/help/fusus/software/fusus/alpr/alpr-audit.htm
The requested documents will be made available to the general public, and this request is not being made for commercial purposes.
In the event that there are fees, I would be grateful if you would inform me of the total charges in advance of fulfilling my request. I would prefer the request filled electronically, by e-mail attachment if available or CD-ROM if not.
Thank you in advance for your anticipated cooperation in this matter. I look forward to receiving your response within the time period that the statute requires.
Sincerely,
[YOUR NAME]
Connexion