You send your child to school expecting teachers to protect their education. You probably don't think much about what happens to their personal information after they take a standardized test. But a massive data breach in California is raising some uncomfortable questions about who has access to student records and how safely that information is stored.

Hackers accessed and copied sensitive records belonging to millions of current and former California public school students. The stolen information includes home addresses, birth dates and even details about disabilities. And here's something families need to know. You could live thousands of miles from California today and still be caught up in this breach if you or your child previously attended a public school there.

Join our upcoming CyberGuy LIVE class: 5 Ways to Travel Smarter and Save Money

In this free live online class, Kurt "CyberGuy" Knutsson will share five practical ways to protect your trip and your wallet this holiday travel season. You’ll learn how to secure your phone and personal information, find better travel deals, avoid common scams, save money on bookings and use technology to make your travels easier and less stressful. No technical experience is needed.

Join us Saturday, October 31, at 11 AM ET / 8 AM PT. Register for free now at CyberGuyLive.com.

ORACLE HEALTH DATA BREACH EXPOSES NEARLY 20 MILLION PATIENTS

How millions of California student records were stolen

The breach involves Educational Testing Service (ETS), a nonprofit organization that works with the California Department of Education. ETS helps administer statewide student assessments and maintains information connected to those tests. According to state officials, someone gained unauthorized access to an ETS-operated secure file transfer site. Investigators determined that the attacker used a compromised login credential to enter the system. The intruder then copied files containing student information at various times between May 22 and Sept. 18, 2026.

ETS discovered the suspicious activity on Sept. 25. The company disabled the affected account and took the file transfer site offline. It also brought in outside cybersecurity specialists to investigate. The company says it has since built a replacement system with stronger security controls. So far, ETS reports finding no evidence that the stolen information has been made publicly available. However, investigators have confirmed that someone accessed and copied the records.

What personal information was stolen in the student data breach?

The California student data breach involved far more than test scores. Depending on the student, the compromised files may contain information that could help someone identify a child or learn personal details about their family circumstances.

The exposed records may include:

• Student names and dates of birth
• Home addresses, school names and grade levels
• Statewide and local student identification numbers
• Race, ethnicity and primary language
• Country of origin and English learner status
• Disability information and testing accommodations
• Participation in certain educational assistance programs
• Statewide assessment participation and test results

Some records also identified whether a student qualified for programs serving children experiencing homelessness or other educational needs. Fortunately, officials say the stolen files did not contain Social Security numbers, financial account details, driver's license numbers, passwords or parent and guardian personal information.

However, there is still plenty to be concerned about. Someone who knows a child's name, school and address could potentially use that information to create a convincing message that appears to come from a teacher or school administrator. Disability information also raises additional privacy concerns because those details are particularly personal.

Why this California breach could affect families nationwide

This is where the story gets especially troubling. Although the breach involves California's public school system, the people whose records were stolen may now live anywhere in the United States. According to the California Department of Education, the compromised information includes records covering all students enrolled during the previous three school years. However, the affected population extends beyond those students.

The state also identifies a group of former students who left California public schools as far back as 2006 and whose transfers to another school were never confirmed with the department. That creates a situation many families may never have considered. Say your child attended elementary school in Los Angeles before your family relocated to Texas. Perhaps you graduated from a California public school years ago and now live in Florida. Your old student information could still be among the compromised records if it falls within the affected groups.

Former students who are now adults may also be eligible for the free identity-protection services being offered. Importantly, this does not mean every student attending school outside California has been affected. In a statement to CyberGuy, ETS confirmed that no other ETS customers were affected by the incident. The concern for families elsewhere comes from their past connection to California's public schools. California has roughly 5.7 million public school students, according to reporting on the breach. Since the compromised files span multiple school years, millions of people are potentially involved. Officials have not yet released a final count of unique affected individuals.

Where the student data breach investigation stands

The California Department of Education and the State Board of Education are coordinating with cybersecurity specialists and other state agencies. The California Cybersecurity Integration Center is assisting with the technical investigation. Meanwhile, state officials are reviewing ETS's compliance with applicable data security requirements and its contractual obligations.

In its statement to CyberGuy, ETS said, "We have implemented additional safeguards, including enhanced monitoring, strengthened access controls, and further third-party review of our security practices." ETS says it continues monitoring for signs that the stolen information has surfaced publicly. For families, the unresolved question is what happens to the copied information next. Even without evidence of a public leak, sensitive student records in unauthorized hands create a privacy risk that deserves continued attention.

A SCAMMER HAS YOUR NAME, PHONE NUMBER AND ADDRESS. WHAT CAN THEY ACTUALLY DO?

How to find out if your information was exposed

ETS began notifying affected students and families on October 16, 2026. The state expects notifications to continue through early November. Letters and emails will explain the incident and identify the types of information involved. They will also include instructions for accessing complimentary identity-protection services. However, here's an important warning. Not receiving a notification does not necessarily mean your information is safe. Some former students may have outdated contact information on file.

Families who are concerned should visit the official California ETS incident webpage. It contains frequently asked questions and links to breach notifications available in 27 languages. You can also call the incident assistance line at 833-931-8488, Monday through Friday, from 6 a.m. to 6 p.m. Pacific Time.

Affected students can get two years of free identity protection

ETS is offering affected current and former students 24 months of free identity theft protection. Parents or legal guardians can enroll eligible children under 18, while adults, including former students, can enroll themselves. The services are designed to help monitor for potential identity theft and provide assistance if someone misuses their personal information.

The enrollment deadline is March 19, 2027. Eligible minors who turn 18 before March 19, 2029 may also qualify for adult coverage using the activation code provided in their notification. Enrollment is free, and no credit card is required. Identity restoration assistance is also available to eligible individuals for 24 months from their notification date, even without enrolling in monitoring services. For complete eligibility details and enrollment instructions, visit the California Department of Education's official incident webpage at at cde.ca.gov/nr/in/ets-incident.asp.

How to protect your child after the California student data breach

Even without stolen passwords or financial account numbers, student records deserve serious attention. Here are practical steps I recommend taking if your family may be affected.

1. Verify the breach notification before responding

Scammers frequently use real data breaches as an excuse to send fraudulent emails. A message claiming to come from ETS or Experian could direct you to a fake enrollment website. Instead of clicking an unexpected link, open your browser and visit the official California Department of Education incident page. Follow the verified instructions from there.

2. Consider identity theft protection

Eligible families should take advantage of the 24 months of free identity-protection services being offered following this breach. Follow the enrollment instructions in your official notification and keep a copy for your records. No credit card is required.

For additional protection, consider an identity theft protection service which offers identity monitoring, alerts about suspicious activity and access to restoration specialists if identity theft occurs. Some services also offer paid family plans that can cover children, making it an option for parents concerned about protecting their family's personal information over the long term. Coverage and benefits vary by plan. See my tips and best picks on Best Identity Theft Protection at CyberGuy.com.

3. Consider freezing your child's credit

One of the strongest steps you can take against certain forms of identity theft is placing a security freeze on a child's credit file. The Federal Trade Commission says parents and legal guardians can request a free credit freeze for children under 16. Teenagers ages 16 and 17 can request their own freezes. Contact Equifax, Experian and TransUnion separately. Each bureau has its own process for handling minors. A freeze can make it harder for criminals to open new credit accounts using a child's identity. However, it cannot prevent every form of fraud.

4. Watch for suspicious school-related messages

Pay closer attention to unexpected emails or text messages claiming to involve school records. A scammer with access to personal details could make a fraudulent communication seem unusually credible. For example, someone might claim that your child's testing account requires immediate verification. Before responding, contact the school using a phone number you already trust. Avoid sharing personal information through unexpected links or attachments. Consider using strong antivirus software on your family's devices. It can help detect malicious links, suspicious downloads and malware hidden in fake school notifications. While it cannot recover stolen student information, it adds another layer of protection against scammers who may try to exploit the breach. Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android & iOS devices at Cyberguy.com

5. Remove your family's personal information from the internet

Scammers can use information found online to build a more detailed profile of you or your family. That's why I recommend considering a personal data removal service. These services can help remove personal information from data broker websites that collect and sell details such as names, addresses and phone numbers. While these services cannot retrieve information stolen in this breach, they can help reduce how much additional information is publicly available. If you're concerned about your child's information, check whether the service offers protection for minors before signing up. Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting CyberGuy.com.

6. Check for signs of identity theft

Adults who may have been affected can review their credit reports for unfamiliar accounts or suspicious activity. Visit AnnualCreditReport.com to obtain free reports from the three major credit bureaus. Parents should also watch for unexpected bills or collection notices addressed to their children. Those can be warning signs that someone has misused a minor's identity. If you discover evidence of identity theft, report it through IdentityTheft.gov . The FTC provides a recovery plan to help you address fraudulent accounts and document the problem.

7. Ask what information your child's school retains

You can also contact your child's school district to better understand how it handles student records. Ask what information outside contractors receive and how long they retain it. Schools may have legal obligations to maintain certain records. Still, parents can ask about retention policies and security safeguards. This conversation is worthwhile regardless of where your family lives.

Kurt's key takeaways

I've covered plenty of data breaches over the years, but this one bothers me because we're talking about children who had no choice about handing over their information. They went to school, took required tests and trusted the adults and organizations handling their records. Now, some of those details have ended up in the wrong hands. What I find especially troubling is how far back some of these records could go. Think about someone who left California years ago and has no reason to believe their old student information is still sitting on a testing company's system. That person could be living on the opposite side of the country and suddenly have to worry about a breach involving records from childhood. I appreciate that ETS is offering free identity protection, but I'd like to see schools and testing companies explain more clearly how long they keep sensitive student information and why. Parents deserve answers before a breach happens.

Should schools and outside testing companies be allowed to keep sensitive student records for years after a child leaves, or should families have more control over when that information gets deleted? Let us know by writing to us at CyberGuy.com.

Sign up for my FREE CyberGuy Newsletter

• Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox.
• For simple, real-world ways to spot scams early and stay protected, visit CyberGuy.com – trusted by millions who watch CyberGuy on TV daily.
• Plus, you'll get instant access to my Ultimate Scam Survival Guide free when you join.

CLICK HERE TO DOWNLOAD THE FOX NEWS APP

Copyright 2026 CyberGuy.com. All rights reserved.

The Department of Homeland Security (DHS) is investigating a potentially massive data breach that may have exposed the identities and contact information of tens of thousands of employees, sources told Fox News.

The suspected breach, which sources described as a "catastrophic" security incident, may have exposed the names, titles, locations and, in some cases, phone numbers and email addresses of approximately 40,000 DHS employees and contractors, including roughly 10,000 ICE personnel, according to sources familiar with the data.

The data also includes records associated with more than 20,000 U.S. Customs and Border Protection (CBP) employees, including Border Patrol personnel.

Multiple sources confirmed the authenticity of portions of the data.

EXCLUSIVE: DHS SECRETARY MULLIN SLAMS SANCTUARY POLITICIANS AS ATTACKS ON ICE OFFICERS SKYROCKET

The data leak website Distributed Denial of Secrets said Wednesday it had released information about the employees.

Fox News independently confirmed that the leaked records include the names of several undercover ICE agents working in different parts of the country.

An anti-fascist hacking group calling itself the "Department of Peace" claimed responsibility for obtaining the data.

"DHS is aware of a potential breach and is actively working to address the situation swiftly and effectively," a department spokesperson told Fox News.

NY COP CALLS FOR POLICE PROTECTIONS AFTER PROTESTER HE ARRESTED SHOWED UP TO HIS HOUSE, HARASSED HIS FAMILY

"We take all security threats against our employees and officers seriously and will work to ensure all are properly protected," the statement continued. "We will update the public when more information is available."

Distributed Denial of Secrets co-founder Emma Best said in a statement that a tool had been developed to allow the public to search the data, saying it would "replace anonymity with accountability."

The Department of Peace said in its own statement that DHS employees "have our information, so it's only fair that we have theirs" and that it hoped the data "can be used to limit further harm by the DHS and supports all efforts in that direction."

The reported breach comes amid broader concerns about the security of government personnel records.

FOREIGN ENEMIES HAVE A SHOCKINGLY SIMPLE WAY TO TRACK US TROOPS OVERSEAS, LAWMAKERS WARN

Last month, a Pentagon personnel database breach exposed sensitive personal information belonging to more than 2.76 million living U.S. military and civilian personnel and 294,000 deceased individuals.

Unauthorized users accessed unencrypted files containing Social Security numbers and military or civilian employment information between October 2025 and July 2026, a Pentagon official previously confirmed to Fox News.

CLICK HERE TO DOWNLOAD THE FOX NEWS APP

Fox News Digital's Brittany Miller and Fox News' Liz Friden, along with Reuters, contributed to this report.

A new investigation into the activities of Google, Meta and other technology companies has intensified scrutiny of EU plans to revise data-protection legislation, placing Ireland and Germany at the centre of a dispute over corporate influence and European digital sovereignty.

European technology policy has become the focus of a dispute over corporate lobbying after researchers documented extensive contacts between major technology companies and political decision-makers during negotiations to revise EU data-protection rules.

An investigation published on 28 October by Corporate Europe Observatory and the German transparency organisation LobbyControl alleges that leading technology companies mounted a coordinated campaign to influence European governments and legislators.

The findings come one week after EU member states agreed a negotiating position on the Digital Omnibus, a legislative package intended to simplify aspects of European data-protection, privacy and cybersecurity regulation.

The campaigners argue that the proposed changes risk weakening existing safeguards in order to accommodate the commercial requirements of artificial intelligence developers.

Ireland, which holds the rotating presidency of the Council of the European Union, has rejected suggestions that its handling of the legislation was improperly influenced by technology companies.

The dispute exposes a fundamental disagreement over the balance between commercial innovation and the protection of personal information.

The scale of the lobbying campaign

According to LobbyControl’s investigation, non-European technology companies recorded 103 meetings with representatives of Germany’s federal government between May 2025 and September 2026.

Google accounted for 28 meetings, Microsoft 18, Amazon 16 and OpenAI 11.

Germany’s Digital Minister, Karsten Wildberger, participated in 18 meetings with representatives of major technology companies, the researchers reported.

In Ireland, the organisations identified extensive engagement involving Meta, Google and politicians ahead of the country’s assumption of the EU Council presidency in July.

Their findings indicate that Meta engaged with 41 Irish parliamentarians over the Digital Omnibus, while Google recorded 30 meetings.

The researchers also identified 655 lobbying meetings concerning the legislation involving members of the European Parliament.

According to their analysis, approximately 83 per cent represented business interests, compared with 11 per cent involving civil society organisations or trade unions.

These figures demonstrate the intensity of corporate engagement, although the existence of lobbying meetings does not, by itself, establish that particular legislative provisions were adopted because of that activity.

Why the Digital Omnibus matters

The legislative package forms part of a broader European Commission initiative to reduce administrative burdens and improve competitiveness.

Its provisions address several areas of digital regulation, including the General Data Protection Regulation, commonly known as GDPR.

The proposals seek to simplify compliance obligations, clarify the treatment of personal information and revise rules governing certain forms of data processing.

One particularly contentious issue concerns the use of personal data in developing and operating artificial intelligence systems.

AI developers require large quantities of information to train and improve their models. However, the collection and processing of personal information remain subject to European legal safeguards.

Technology companies have argued that regulatory complexity can discourage investment and make it more difficult for European businesses to compete internationally.

Privacy campaigners maintain that simplifying regulatory procedures must not become a mechanism for reducing substantive protections.

The disagreement concerns not merely administrative paperwork but the legal circumstances under which companies may process information relating to identifiable individuals.

Ireland rejects allegations of improper influence

Ireland occupies a particularly sensitive position in the debate.

The country hosts major European operations of several American technology companies, including Google and Meta, and has substantial economic interests in the digital sector.

At the same time, its presidency of the EU Council requires it to coordinate negotiations between member states.

According to RTÉ’s reporting on the investigation, the Irish government strongly rejected the allegation that it had weakened data safeguards in response to corporate pressure.

A presidency spokesperson emphasised that Ireland’s responsibility was to facilitate agreement between member states and that the negotiating mandate approved on 21 October enjoyed broad support.

The Council has presented the proposed changes as a means of reducing compliance costs while preserving established privacy protections.

In its official statement, the Council said its mandate retains the existing definition of personal data and introduces additional provisions governing pseudonymisation.

It also includes safeguards relating to sensitive information used for biometric verification and AI systems.

These details are significant because they demonstrate that the negotiating text contains protections alongside proposed simplifications.

Germany’s role in the negotiations

Germany has also emerged as an important participant in the controversy.

The investigation points to close contact between the German government and international technology companies during discussions about the future of European digital regulation.

Berlin has supported reducing administrative restrictions that it considers obstacles to innovation and the development of competitive AI technologies.

For Germany, the issue is connected to wider concerns about industrial competitiveness, investment and Europe’s dependence on foreign technology suppliers.

Yet an unresolved question remains.

Measures designed to assist European innovators may also benefit established American companies whose extensive computing infrastructure and data resources give them advantages over smaller competitors.

Consequently, easing restrictions does not necessarily guarantee a stronger European technology industry.

The European Parliament holds the next decision

The Council’s negotiating position does not make the Digital Omnibus law.

The European Parliament must establish its own position before negotiations between the institutions can determine the final legislation.

Parliamentarians will therefore have an opportunity to examine the treatment of personal data, the safeguards attached to AI development and the relationship between regulatory simplification and individual rights.

The lobbying investigation is likely to become part of that debate.

Its central political significance lies in the competing interpretations of European technological sovereignty.

For governments seeking investment, regulatory flexibility may provide an instrument for improving Europe’s international competitiveness.

For privacy organisations, the same flexibility could increase the influence of companies already dominant in global digital markets.

The outcome will help determine whether Europe’s future digital framework preserves the existing balance between commercial data use and individual protections, or establishes a different relationship between the two.

Meta Platforms, Alphabet’s YouTube, TikTok parent ByteDance and Snap are facing thousands of lawsuits brought by US states, school districts and individuals alleging the companies intentionally designed their platforms to keep young users hooked.

The companies have denied allegations that their products have contributed to depression, anxiety, body-image issues and a broader youth mental health crisis, saying they take action to protect the youngest users of their platforms.

The companies also have argued that Section 230 of a federal law called the Communications Decency Act shields them from claims based on the content their users post.

Here is a look at the current state of the litigation in US courts.

States seek billions over alleged harm

Nearly every US state filed claims against social media companies over the alleged impact on children of their platforms. The lawsuits seek damages or financial penalties, as well as court orders directing the companies to make significant changes to their platforms.

In August, Meta resolved nearly all of the state lawsuits against it with settlements worth up to $18 billion over the next decade. As part of the deal, Meta agreed to limit how teenagers can use Facebook and Instagram.

The deal made $5 billion of the payout contingent on YouTube, TikTok and Snap reaching similar agreements with the states.

New Mexico and Florida did not join the settlement.

Florida has an ongoing lawsuit against Meta in state court.

New Mexico has sued Meta twice. Earlier this year, jurors and a judge ordered the Facebook and Instagram parent company to pay more than $940 million to the state after finding that Meta failed to protect young users from sexual exploitation on its platforms.

In October, another New Mexico jury agreed with the state that Meta had misled consumers about how it handles data privacy. The judge overseeing the case ordered Meta to pay the state $25 billion in penalties. Meta has said it will appeal both verdicts.

TikTok, facing lawsuits by at least 27 states, settled with Alabama in September, days before that lawsuit was slated for trial. TikTok agreed to pay Alabama up to $300 million if the majority of states reach similar agreements with the company.

Schools seek compensation for social media harm

More than 1,000 US school districts have filed lawsuits over claims that social media companies designed their platforms to be addictive, contributing to ‌anxiety, depression ⁠and self-harm and leaving schools to deal with the fallout. The schools are seeking compensation for what they say they have spent dealing with social media’s effects on students, plus additional funding to limit its impact going forward.

A small school district in rural eastern Kentucky was selected as the first school district case to go to trial. But the June trial was canceled after the companies reached settlements with the district. Public records revealed that the district was set to receive $27 million under the agreements.

Lawsuits brought by school districts in Charleston, South Carolina, and Tucson, Arizona, have been chosen for trial next.

Teenagers take tech giants to court

On Wednesday, two teenagers who have said Instagram and Snapchat caused them serious mental health problems will take Meta and Snap to trial in Los Angeles.

It is the second trial in more than 3,300 lawsuits brought in California state court by young people and their families alleging that Meta, Snap, TikTok and YouTube deliberately designed their platforms to be addictive. TikTok and YouTube settled with both plaintiffs before trial and Meta settled with one.

The lawsuits were selected as bellwethers, or test cases, for the state court cases. Attorneys often use bellwether verdicts to gauge how juries may view similar claims, helping them assess the potential value of remaining cases and guide settlement negotiations.

Jury verdicts test companies’ liability

In the first trial to test an individual’s claims that social media caused personal harm, a young woman alleged that her addiction to social media led to depression and anxiety.

In March, a Los Angeles jury found Meta and Google negligent and ordered Meta to pay $4.2 million in damages and Google $1.8 million. Both companies have appealed.

The second trial over an individual’s claims against the companies, scheduled for July in Los Angeles, was canceled after the plaintiff reached settlements with TikTok, Snap and YouTube and dropped his claims against Meta.

In August, a third teen whose case was chosen for trial dropped her case against Meta, Snap and YouTube after she settled with TikTok.

Customs and Border Protection (CBP) insists that it has the right to search Americans' private data without a warrant when entering the country. But ordered to explain one of these searches by a judge, the agency is now trying to wiggle out from under the microscope, invoking its own data privacy.

On Friday, Judge Leonie M. Brinkema in the Eastern District of Virginia ordered CBP to explain the seizure of a local psychiatric nurse's phone and laptop at Washington Dulles International Airport. CBP argued that the court should seal this information from both the public and the nurse himself in order to protect "privileged law enforcement information."

Brinkema initially agreed to let CBP file parts of its response "sealed and ex parte," meaning that neither the public nor the nurse would get to look at them. After reading the filings, the judge declared on Tuesday afternoon "that most of the redacted information is not privileged law enforcement information and should not be sealed." She gave CBP until Thursday at noon to object to unsealing the documents.

"Without knowing what happened, we cannot assess the extent of CBP's violation of our clients' rights. This raises serious concerns about government improperly invoking privilege to cover up wrongdoing," says Jenin Younes, a civil libertarian lawyer and president of the Arab-American Anti-Discrimination Committee, who is representing the nurse. "The court was right to unseal most of the redacted material so we can assess the extent to which the government behavior was improper."

Younes has stacked up a series of victories against CBP's electronic searches. Over the past few months, she sued on behalf of lawyer Jalal "Jay" Shehadeh and (non-Arab) journalist Max Blumenthal, both of whom had their phones seized at the airport by CBP without explanation. CBP tried to preempt a legal battle by giving their phones back almost immediately. Younes is still pressing to get information about what happened to their data.

Although CBP policy states that the agency will delete all data within 21 days unless there is "probable cause to believe the information contains digital contraband or evidence of a violation of law that CBP is authorized to enforce or administer," a 2018 lawsuit seemed to show that CBP was holding onto the data until someone bothered to demand its return.

Psychiatric nurse Muhammad Numaan Imam's case started similarly to Shehadeh's and Blumenthal's cases. CBP agents demanded to open his phone at the airport without explanation. He refused, arguing that patient emails and case-management software were protected by privacy laws. CBP then confiscated all of his and his wife Khadijah Mansoor's electronics. Almost immediately after Younes filed the suit on his behalf, CBP tried to argue that the case was moot because it was giving back the phone.

But Brinkema immediately agreed with Imam and Mansoor's "legitimate concerns about what was done with their electronic devices," ordering CBP to "explain why the devices of both plaintiffs were seized" and to provide sworn statements from "each person who handled any of the devices" describing exactly what was done to them.

On Monday night, the court published heavily redacted declarations from CBP Assistant Port Director Lauren Colgan, Department of Homeland Security (DHS) technician Caige McCabe, and CBP technician Ashlie Fisch.

"Mr. Imam and Ms. Mansoor presented valid, un-expired travel documents to CBP Officers in the primary inspection and were referred for secondary inspection," Colgan's declaration states. The next few sentences are blacked out. The declaration then recounts the couple explaining their early return from their anniversary vacation in Turkey and states that the CBP officer asked to open their electronics, without explaining why.

"Because of Mr. Imam's and Ms. Mansoor's refusal to provide access to their electronic devices, CBP informed Mr. Imam and Ms. Mansoor their devices would be detained to continue the border search," Colgan continues, noting that Port Director Christine Waugh signed off on holding the devices for more than five days, as CBP policy requires.

On October 17, a day after CBP seized the phones, it asked DHS headquarters for "technical assistance" with Imam's devices according to McCabe. "My examination of Mr. Imam's phone was limited to device specifications and high-level file-system structure," he states in the declaration. The next few sentences are blacked out. "I did not access or view the contents of Mr. Imam's laptop," McCabe continues. The next few sentences after that are also blacked out. "I did not access any medical information" on either the phone or laptop, McCabe concludes, stating that the devices were in his custody until he handed them back to CBP on October 21.

Fisch then received Imam's devices at CBP Laboratories and Scientific Services. Everything of substance in her declaration is redacted, beyond taking the devices on October 21 and sending them back to Washington Dulles Airport the next day. There is no unredacted explanation of what happened to Mansoor's devices.

Brinkema argued in her Tuesday order that only two sentences, both from Colgan's declaration, were legitimately blacked out. "Accordingly, the Court will unseal all other redacted information in the Declarations unless the defendants can show good cause why such information should not be unsealed," she wrote.

U.S. law gives border officers much wider authority to search for contraband in situations where normal police would need a warrant or probable cause under the Fourth Amendment. CBP argues that its powers extend to searching and seizing travelers' electronics without any explanation at all. Courts have given contradictory rulings on how far those searches can go, and the Supreme Court hasn't weighed in yet, leaving a gray area that CBP is happy to take advantage of.

Imam's case has resulted in "the most detailed explanation of what the government did with our clients' electronic devices—or it would be if so much wasn't redacted," Younes tells Reason. "I look forward to seeing the unredacted versions."

The post CBP Really Doesn't Want To Reveal What It Does to Americans' Phones appeared first on Reason Magazine.

Do you have a right to privacy on public roads? Hoover fellow and Stanford legal scholar Orin Kerr joins me in this episode to discuss Flock cameras, the networked license plate readers fueling debate over police surveillance. We discuss how the Fourth Amendment applies to tracking people's movements; whether police should need a warrant to search camera databases; how to balance investigative benefits with the potential for abuse; and what we still don't know about these tools' effectiveness in protecting public safety.

Jane Bambauer, my regular cohost, couldn't join us this episode, but will be back as usual in the next one. And also check out our past episodes:

Also check out our past episodes:

• Can the President Kick Reporters out of the White House?
• Spoiler Alert: Can You Get Sued For Revealing A Plot Point?
• The Process Is The Punishment: ABC v. FCC with Stuart Benjamin
• Can AI Libel You? The Robby Starbuck Case
• Shrexting: Free Speech or Criminal Harassment?
• The First Amendment and Privacy Rights
• 'Defamacast' and More: How American Defamation Law Works
• Speech, Not "Conduct": Supreme Court Rules on Conversion Talk Therapy
• Equal Time, Stephen Colbert, and the Future of Political Broadcasting
• Student Speech, Threats, and the First Amendment
• Can Journalists Be Charged for Involvement in Protests? The Don Lemon Dilemma
• 2025: The Year In Free Speech
• Does the First Amendment Protect Supposedly "Addictive" Algorithms?
• Defamation Law in the Age of AI with Lyrissa Lidsky
• Free Speech and the Future of Legal Education
• From Brandenburg to Britain: Rethinking Free Speech in the Digital Era with Eric Heinze
• Kimmel, the FCC, and the Government's Power Over Broadcast Speech
• A Conversation with FIRE's Greg Lukianoff
• A Burning First Amendment Issue: President Trump's Executive Order on Flag Desecration
• Free Speech and Doxing
• The Supreme Court Rules on Protecting Kids from Sexually Themed Speech Online
• Free Speech, Public School Students, and "There Are Only Two Genders"
• Can AI Companies Be Sued for What AI Says?
• Harvard v. Trump: Free Speech and Government Grants
• Trump's War on Big Law
• Can Non-Citizens Be Deported For Their Speech?
• Freedom of the Press, with Floyd Abrams
• Free Speech, Private Power, and Private Employees
• Court Upholds TikTok Divestiture Law
• Free Speech in European (and Other) Democracies, with Prof. Jacob Mchangama
• Protests, Public Pressure Campaigns, Tort Law, and the First Amendment
• Misinformation: Past, Present, and Future
• I Know It When I See It: Free Speech and Obscenity Laws
• Speech and Violence
• Emergency Podcast: The Supreme Court's Social Media Cases
• Internet Policy and Free Speech: A Conversation with Rep. Ro Khanna
• Free Speech, TikTok (and Bills of Attainder!), with Prof. Alan Rozenshtein
• The 1st Amendment on Campus with Berkeley Law Dean Erwin Chemerinsky
• Free Speech On Campus
• AI and Free Speech
• Free Speech, Government Persuasion, and Government Coercion
• Deplatformed: The Supreme Court Hears Social Media Oral Arguments
• Book Bans – or Are They?

The post Free Speech Unmuted: Flock Cameras and the Fourth Amendment, with Orin Kerr appeared first on Reason Magazine.

From today's opinion in Jackson v. Thomson Reuters Am. Corp., by Fourth Circuit Judge Paul Niemeyer, joined by Judges Steven Agee and Pamela Harris; the law covers :

West Virginia's Daniel's Law …, which is designed "to enhance the safety and security" of judicial and law enforcement officials, prohibits the disclosure by any person or entity of the home addresses or unpublished telephone numbers of … {"any active, formerly active, or retired judicial officer, prosecutor, … public defender, … or law-enforcement officer"} if a reasonable person would believe that such a disclosure would create a risk of harassment or harm. The law authorizes protected persons to bring a civil action for damages….

As distinct from the Daniel's Laws in other States, … West Virginia's version does not require that the Covered Person, upon discovering an improper disclosure, notify the person or entity that disseminated the information and request that the person or entity delete the information before liability arises. In addition, for liability to arise under West Virginia's version, the person or entity need not know that they have disclosed a Covered Person's information. The only limiting principle of § 5A-8-24(e) liability is that the information must have been disclosed "under circumstances in which a reasonable person would believe that providing such information would expose another to harassment or risk of harm to life or property." …

For generations now, home addresses and telephone numbers have been disseminated to the public, initially through Whitepages and Yellow Pages and now through "people search" services on the Internet. The public has thus long had the facility to look up the name of a person and obtain that person's address and telephone number. Sharing that information has been the gateway to communication and the exchange of ideas or messages that have long been protected by the First Amendment. In the digital age, such information may now be shared with greater efficiency, but the tradition continues with the understanding that it is protected speech.

In a similar vein, it has long been custom and practice to record for public examination the names and addresses of persons buying, selling, and financing real property. And it has been the tradition to share publicly information about taxes, appraisals, liens, and voting.

To be sure, while the dissemination of such information is protected speech necessary to the exchange of ideas, it can also contribute to abuse and the pursuit of harmful and, indeed, malicious ends, as exemplified by the murder of Daniel Anderl. To address such abuse, governments have enacted laws like Daniel's Law in an effort to restrict the dissemination of home addresses and unpublished telephone numbers of specified public officials who serve in roles important to society. And the parties here agree that those governments have a compelling interest in enhancing the safety and security of such officials. The task, therefore, is to draw an appropriate line between protecting the dissemination of such information while, at the same time, excepting from dissemination the same information when it creates a potential for harm of specified public officials.

Because of the high value that our Constitution and longstanding practices place on the free dissemination of information and the exercise of free speech, we draw the line with the greatest caution, requiring that governments regulate speech about the home addresses and telephone numbers of designated public officials in a manner that is the least restrictive of speech.

In this case, West Virginia was fully justified in attempting to regulate such speech in light of the compelling government interest in enhancing the safety and security of certain public officials, but its efforts reached more broadly then necessary to accomplish the task; it did not employ the least restrictive means of doing so. For that reason and only that reason, we agree with the district court that West Virginia could have regulated more narrowly to accomplish its purpose and thereby be less restrictive of what is otherwise protected speech. Thus, we agree that the provision of West Virginia's Daniel's Law at issue here … violates the First and Fourteenth Amendments.

The court concluded that the law is a speech restriction, not just a restriction on "data":

[Jackson argues] that speech must be communicative such that it "convey a particularized message" with "the likelihood … that the message would be understood by those who" received it. Since Daniel's Law regulates disclosures of "pure facts" that lack a particularized message, he argues, the law is not subject to any First Amendment analysis….

[But] the Supreme Court has clearly held that the scope of "speech" regulated by the First Amendment is broader and includes data, reasoning that facts are "the beginning point for much of the speech that is most essential to advance human knowledge and to conduct human affairs." Sorrell v. IMS Health Inc (2011). Indeed, the Court has noted more specifically that statutes like West Virginia's Daniel's Law, which address only the disclosure of information, involve the regulation of speech protected by the First Amendment, observing, "If the acts of 'disclosing' and 'publishing' information do not constitute speech, it is hard to imagine what does fall within that category …." Bartnicki v. Vopper (2001).

The court then concluded that the law was content-based:

West Virginia's Daniel's Law …, on its face, distinguish[es] between different disclosures based on communicative content alone. It restricts disclosure of certain kinds of information (home addresses and unlisted telephone numbers), and it does so for certain individuals (judicial and law enforcement officers and their families)….

This means, for example, that a disclosure that a grocery store clerk lives at 100 Main Street is permitted, while a disclosure that a police officer lives at 100 Main Street is prohibited. The only difference between the two disclosures is the communicative content, or what the disclosures mean. In the hypothetical, the latter disclosure is prohibited because it identifies 100 Main Street as being the home address of the police officer, while the earlier disclosure is permitted because it identifies 100 Main Street as belonging to the grocery store clerk.

The court held that the law wasn't limited to "commercial speech" (which generally refers to commercial advertising), a category of speech that is entitled to lower protection:

While a speaker's economic motivation for speech may be a relevant factor in determining whether speech is commercial, economic motivation alone is insufficient to justify a categorization of that speech as commercial. Furthermore, because, even under Jackson's argument, only some of the regulated speech would be commercial, that fact does not render the law subject to the intermediate scrutiny of commercial speech. When a statute "applies with equal force to both commercial and noncommercial messages" with "no exception for noncommercial speech," the fact that some of the regulated speech is commercial does not justify an application of intermediate scrutiny….

And the court held that the law, as a content-based speech restriction, had to pass strict scrutiny, which is to say that (among other things) it had to be the "least restrictive means" of serving a "compelling government interest"; and the court held that the law failed such scrutiny:

[T]he parties agree, as do we, that the law's purpose of enhancing the safety of judicial and law enforcement officials is a compelling government interest …. [But] West Virginia's Daniel's Law does not employ the least restrictive means of serving the law's purpose.

Section 5A-8-24(e) imposes liability on a data broker immediately upon its disclosure of addresses and telephone numbers, regardless of whether the data broker had knowledge that the information related to Covered Persons. Whenever an entity such as a data broker collects names and addresses of all persons in a particular town using public land records and then publishes that information in some form of a directory, it undoubtedly violates the law because that directory includes, albeit unknowingly, information about, for instance, a police officer or public defender…. When a restriction on speech creates liability without a knowledge requirement, speakers are understandably incentivized to engage in self-censorship to avoid inadvertently incurring liability. See Counterman v. Colorado (2023) (noting that "prohibitions on speech have the potential to chill, or deter, speech outside their boundaries")….

Jackson argues, however, that the law is much more limited because it imposes liability only if "a reasonable person would believe that providing such information would expose another to harassment or risk of harm to life or property."

That provision, however, is hardly limiting, … because every disclosure of a person's name and address on the Internet exposes that person to harassment or a risk of harm…. [Indeed, in his complaints, Jackson] alleged that the mere disclosure of home addresses and unpublished telephone numbers "exposed [him] and his peers to harassment and/or risk of harm to life or property." And to support that unremarkable proposition, he quoted the FTC's report on "Data Brokers," which highlights the "potential risks to consumers from data brokers' collection and use of consumer data," including the fact that "people search products can be used to facilitate harassment, or even stalking, and may expose domestic violence victims, law enforcement officers, prosecutors, public officials, or other individuals to retaliation or other harm." Indeed, Jackson added that the FTC's report explains why the defendants' disclosures are "so dangerous." Thus, the argued "limitation" in § 5A-8-24(e) is actually not limiting but universal, as it is inevitable that every disclosure of personal information on the Internet poses an additional risk of harassment or harm to the person whose information is disclosed.

Additionally, States other than West Virginia that have enacted Daniel's Laws have uniformly required that, before liability attaches to a disclosure of home addresses and unpublished telephone numbers, Covered Persons give notice of their request that the data broker (or any other disclosing party) remove the information. Only on the failure to comply does liability attach. But West Virginia's Daniel's Law alone does not require notification as a precondition of liability. Thus, this aspect of the law fails to provide the least restrictive means of furthering the law's compelling interest.

While we hasten to note that requiring notice prior to imposing liability is one method for narrowing the law, it is not the only way. But it is the way that Congress and virtually every other State has chosen to narrow their laws and render them less speech-restrictive.

At bottom, we agree with the district court's conclusion:

[D]ue to its lack of a notice requirement, [§ 5A-8-24(e)] of West Virginia's Daniel's Law is far more restrictive then its comparators [in other States] and is definitively not the least restrictive means of achieving its compelling interest. Section [5A-8-24(e)] of West Virginia's Daniel's Law therefore fails strict scrutiny even as other more narrowly tailored federal and state statutes aiming at the same compelling interest pass constitutional muster….

The paragraph endorsing the district court's conclusion strongly suggests that the panel endorsed laws limited to situations where a covered person first demands that covered material be removed. But it's not clear whether the panel would endorse broad versions of such laws, which apply even when the address or phone number is relevant to a matter of public concern (see Kratovil v. City of New Brunswick (N.J. 2025), which upheld such a broad law), or whether it would insist that there be an exception for such public-concern situations (as there is in the federal version of Daniel's Law).

Samir I. Deger-Sen (Latham & Watkins LLP) argued on behalf of the defendants.

The post W. Va. Law Restricting Disclosing Home Addresses and Phone Numbers of Judges and Police Struck Down, but … appeared first on Reason Magazine.

A Connecticut law that took effect at the beginning of October imposes new restrictions on police use of automated license plate readers (ALPRs), which enable what a federal judge recently described as "a type of indiscriminate mass surveillance." The law reflects the bipartisan backlash against AI-assisted cameras that record images of passing cars billions of times a week, building databases that police can use to track drivers, identify other vehicles in their vicinity, predict itineraries, and conduct searches based on a wide range of vehicle characteristics.

Connecticut previously imposed no statutory limits on ALPRs, a fact that underlines how readily police can access license plate data, which they can search without any sort of judicial review and often without meaningful internal supervision. But the law's provisions, while promising in some ways, fall short of the reforms recommended by critics who warn that unconstrained use of ALPRs threatens the privacy of innocent motorists across the country.

As of today, DeFlock's mapping project has identified nearly 145,000 ALPR cameras in the United States, most of which were installed by Flock Safety, the leading vendor. That network includes more than 1,500 cameras deployed by Connecticut law enforcement agencies, three-quarters of which use the technology.

The concerns underlying the new law, which Gov. Ned Lamont signed last May, echo objections raised in other states. Last February, for example, CT Insider reported that out-of-state agencies had searched ALPR data from Connecticut thousands of times for immigration enforcement purposes. When police in Johnson City, Texas, searched Connecticut data for a missing woman, the log noted that she "had an abortion," which reinforced concerns that ALPR information might be used to enforce abortion bans.

As elsewhere, ALPR critics in Connecticut also have complained about a lack of transparency. In April 2025, for instance, South Windsor began using Flock cameras without any public notice. The resulting consternation prompted the city council to cancel the program early this month. CT Mirror reports that South Windsor is "at least the sixth Connecticut community to end or suspend the use of ALPRs this year, following Windsor, Killingworth, Ledyard, Milford and Newtown."

Compared to those moves, the new state restrictions are pretty weak tea. But they include some potentially meaningful changes, and they highlight how lax oversight of ALPRs has been.

The new law restricts the sharing of ALPR data, which henceforth will be limited to Connecticut, Massachusetts, New York, and Rhode Island unless an agency in another state obtains a judicial warrant. The law says the data may not be used for immigration enforcement, to target conduct protected by the First Amendment, or for investigations related to "reproductive" or "gender-affirming" health care services. It also bars the placement of ALPRs near facilities that provide such services or organizations that primarily serve immigrants.

The original bill specified that ALPR data could be retained for no more than seven days unless it is tied to an ongoing criminal investigation, subject to a warrant, or used for toll enforcement. The final version of the bill extended that limit to 21 days. Flock's original default was 30 days. But last August, in response to widespread criticism of ALPR surveillance, the company began recommending a seven-day limit. Connecticut's Police Officer Standards and Training Council, which last month sent Lamont a report that included suggested reforms, thinks the state should adopt the seven-day standard.

Under the new law, police may search ALPR data to "assist in the recovery of a stolen motor vehicle," "assist in locating a missing or endangered individual," or "assist in the apprehension of an individual with an outstanding warrant." They also may query the database for information "relevant and material to a specific active investigation of a criminal offense in which there is reasonable suspicion that the offense has been or is being committed." When they do that, their agency must record "the reason for the access and any associated case number for the complaint or incident that is being investigated and is the basis for the access."

It is remarkable that Connecticut lacked such basic safeguards until now, and it is not clear how effective the new rules will be. Since July 1, 2025, Virginia has required that cops state a "specific purpose" for ALPR searches, including "the offense type." Yet last April, WHRO reported that Norfolk police often give "incomplete and imprecise reasons" for ALPR queries, including "suspect," "suspicious," and "investigation" or "inv."

Connecticut's "reasonable suspicion" requirement is more lenient than the standard that the Institute for Justice favors. The organization's model statute would generally require a warrant based on probable cause for ALPR queries. The proposed law makes exceptions for "exigent circumstances," stolen vehicles, and toll, parking, or traffic enforcement.

Connecticut's law also addresses the sort of blatant abuses that have fueled opposition to license plate cameras, including cases in which cops have been caught using ALPR data to stalk personal nemeses, ex-girlfriends, possibly unfaithful spouses, and objects of romantic interest. The law says an officer "who is found to have knowingly accessed, used or disseminated automated license plate reader data with malicious intent for purposes outside of the provisions of this section shall be subject to disciplinary action including, but not limited to, suspension, cancellation or revocation of certification" for police work.

The law establishes two additional remedies that could deter ALPR abuses. It authorizes the attorney general to sue ALPR contractors for damages and injunctive relief when they violate the new restrictions. It also allows "any aggrieved individual" to sue "a public agency" that flouts the rules.

"The law, for a first bite at the apple, is not bad," Ken Barone, manager of the University of Connecticut's Racial Profiling Prohibition Project, told CT Insider. Given that "there was a benchmark of nothing," he said, the attempt to constrain and track ALPR use is "a big step forward."

The post Connecticut's New Restrictions on Flock Cameras Highlight the Dearth of Meaningful Privacy Protections appeared first on Reason Magazine.

Two US senators say the Trump administration is breaking the law by withholding the FISA court decision while it presses Congress to renew America’s most sweeping surveillance program.

West Des Moines, Iowa—Iowa voters may disagree on immigration, taxes, and the economy, but government surveillance is drawing opposition from across the political spectrum.

An Emerson College poll of 750 likely Iowa voters, conducted between late August and early September, found that 61 percent opposed police use of automated license plate reader (ALPR) cameras, compared with 26 percent in support.

The backlash comes as police departments across the state increasingly rely on surveillance technology supplied by private companies such as Flock Safety and Motorola Solutions. Their cameras record license plates and vehicle information, feeding searchable databases that allow law enforcement to piece together motorists' movements, including those of people suspected of no crime.

As Iowa's gubernatorial and congressional campaigns enter their final stretch, voters are increasingly pressing candidates on whether they intend to place limits on the technology. Jacqueline Thompson, an ordained elder in the Iowa Conference of the United Methodist Church and a self-described centrist Democrat, said she has been concerned about government surveillance for years.

"It's always been important to me [and] I've always thought that was a problem," she said before a campaign rally at a senior living community in Des Moines earlier this month. "So, when people started jumping on the bandwagon saying it, I was like, 'Hello, I've been here already!'"

Thompson pointed to two Democratic candidates, Nate Willems, who is running for Iowa attorney general, and Taylor Wettach, a candidate for state auditor, as having caught her attention with their emphasis on corporate oversight and access to government records.

For Thompson, the renewed attention to privacy is a welcome development in a political environment where Democrats and Republicans rarely find common ground. "It's kind of nice to hear the people come back to the middle [and discuss this]," she said.

Flock Does Not Have Enough Guardrails

Police surveillance technology has spread across Iowa faster than the rules governing its use.

A recent study identified at least 62 Iowa law enforcement agencies that had accessed other agencies' Flock databases, including departments that did not operate cameras of their own. Police departments can therefore search information collected well beyond their jurisdictions without having to install a single camera themselves. The study (led by Megan Graham, a clinical associate professor and director of the Technology Law Clinic at the University of Iowa College of Law) found significant gaps in transparency surrounding ALPRs.

The constitutional implications are already being tested in court. On October 1, a federal judge in Oklahoma ruled that a sheriff's deputy violated the Fourth Amendment by searching a motorist's location history through automated license plate reader systems operated by Flock Safety and Motorola Solutions without a warrant.

The search turned up more than 50 records of the driver's whereabouts across multiple states over a month. In the 38-page ruling, the judge ordered the resulting evidence suppressed, describing the technology as a form of "indiscriminate mass surveillance." The decision is not binding in Iowa, and legal challenges to ALPR surveillance still face an uphill battle, but it adds to the legal scrutiny of police tracking motorists without warrants.

The University of Iowa study also raised concerns about unauthorized database access, erroneous alerts, and the potential use of locally collected information for federal immigration enforcement.

Flock Safety says it has not provided U.S. Immigration and Customs Enforcement or Border Patrol with direct access to its systems. But the researchers found that local law enforcement agencies elsewhere in the country had conducted searches on behalf of federal authorities, effectively allowing them to obtain information without direct access.

Taxpayers are also footing the bill. Cedar Rapids reported operating 76 cameras at a combined average cost of more than $20,000 a month, according to the study.

Researchers struggled to determine the full extent of surveillance across Iowa. Some agencies refused to disclose the number or locations of their cameras, while others withheld records concerning unauthorized access or erroneous alerts, citing confidentiality.

The cameras are not limited to Iowa's largest cities. Becca Eastwood, deputy policy director at the American Civil Liberties Union of Iowa, said they have spread across large, midsize, and smaller communities, prompting a surge in opposition over the past year.

The backlash "has just exploded, like no other issue that I have seen in my time at the ACLU," Eastwood told Reason in an interview. Candidates running for state and federal offices are increasingly getting asked if they support police departments using ALPR cameras, she said. 

Some local governments are already reconsidering their contracts. Indianola and Waukee suspended their Flock camera arrangements, Iowa Public Radio reported in August. Dallas County paused a planned rollout while awaiting guidance from state lawmakers. Ankeny, which operates 16 Flock cameras, is reportedly expected to reconsider a possible contract extension next year.

The backlash also cuts across the immigration debate. While concerns about federal immigration enforcement have helped draw attention to the cameras, critics argue the same surveillance infrastructure can be used against anyone, regardless of which party controls the government.

"This is a nonpartisan issue because people recognize that surveillance can be weaponized against anyone the government wants to weaponize it against," Eastwood said. "An increase in police surveillance impacts certain populations more, right now [but] nobody is immune."

Politicians Face Pressure To Cut Ties With Flock

The opposition is beginning to force Iowa's candidates to take positions on a technology that, until recently, attracted relatively little attention outside law enforcement and civil liberties circles.

Among the gubernatorial candidates, interviewed by Iowa Radio last month, Republican Zach Lahn has called for state-level regulation, arguing that the widespread collection of information about where people drive is unacceptable. Meanwhile, Democrat Rob Sand has expressed support for safeguards governing the collection and use of license plate data and said he would sign legislation if privacy concerns persisted. But he has also pointed to the cancellation of some Flock contracts as evidence that the market is responding to public concerns. 

For now, neither approach offers much clarity on whether police should be required to obtain warrants before searching motorists' location histories or how far restrictions on data collection should go.

Ryan Johnson, a libertarian-leaning Republican who works as a machinist near Waterloo, said he could accept cameras in certain locations, such as downtown areas or near traffic signals. But he objects to their spread into residential neighborhoods and public spaces.

"Just having Flock cameras everywhere, [in] residential [areas], putting them at parks and pools, we don't need that," Johnson said while attending a Lahn rally earlier this month.

So far, some of the most concrete changes to ALPR practices have come from Flock itself. In August, the company announced that it would reduce its default data-retention period from 30 days to seven and require officers to enter a criminal case number or code for each search. The changes would not, however, require police to obtain a warrant before accessing the records.

Gary and Nancy Guthrie, a Democratic couple attending a Des Moines rally supporting Chris Jones for secretary of agriculture, remain skeptical of the cameras.

"I don't have a good feel for that," Nancy Guthrie said. "Personally, I'm very much against Flock cameras."

For all the attention the issue is receiving on the campaign trail, Iowa voters have yet to hear much about what legal limits candidates would actually impose on police surveillance.

The post Iowa Voters Don't Want Police or Flock Tracking Their Cars. Politicians Are Still Catching Up. appeared first on Reason Magazine.

U.S. Customs and Border Protection (CBP) seized a psychiatric nurse practitioner's phone filled with confidential patient information at Washington Dulles International Airport last week, according to a new lawsuit. Muhammad Numaan Imam alleges that CBP agents told him that they could take his electronics the "easy way or the hard way" and refused to let him talk to his lawyer because "we are the authorities at the border."

The lawsuit by the American-Arab Anti-Discrimination Committee (ADC) may be the first time CBP is taken to court over seizing people's medical records. ADC is also helping Palestinian-American lawyer Jay Shehadeh and Jewish-American journalist Max Blumenthal sue over their devices being seized.

"We're seeing a pattern where officers use their border-search authority not to advance any legitimate border-related purpose, but to punish individuals for refusing to provide access to their personal electronic devices and for having expressed views the government didn't approve of," ADC president and legal director Jenin Younes wrote in a statement emailed to journalists.

While Shehadeh and Blumenthal claim that CBP is retaliating for their political views, Imam argues that he faced threats and retaliation with the simple act of asserting privacy rights. Both Imam and Shehadeh were considered "trusted travelers" under the Global Entry program, which allows American citizens who undergo a background check to pass through an automated fast track at airports and borders.

Asked by Reason, a CBP spokesperson did not address any specifics of the case, giving only a generic statement about how "CBP's ability to lawfully inspect electronic devices crossing the border is integral to keeping America safe in an increasingly digital world."

The border exemption to the Fourth Amendment gives U.S. authorities the power to look for "contraband" crossing into the country without a warrant. There is a mess of contradictory court rulings on whether that power includes searching travelers' electronic data, but in practice, CBP can simply seize the physical devices that the data live on.

And the agency often lies outright to travelers whose data that it wants to search, as documents recently released in the case of Atlanta protester Samuel Tunick show. CBP agents gave Tunick a false reason for detaining him and falsely promised that he would be allowed to leave with his phone if he cooperated, even though they were under orders to seize his devices no matter what. Tunick is now on trial for allegedly tricking the CBP agents into deleting his data to avoid a search.

"It's happening to a lot of people, and it's being used in this coercive, inappropriate way," Younes tells Reason.

The problems for Imam, who lives in Virginia, actually began at another border. He was heading to Istanbul on Saturday for a family vacation with his Pakistani wife, Khadijah Mansoor, and their 1-year-old child. Turkish authorities demanded to see Mansoor's U.S. green card, which she had forgotten at home, and wouldn't let her enter on her Pakistani passport alone. The family had to board the next flight back to Washington. On their arrival, CBP naturally wanted to know why they had been turned away and why Mansoor didn't have her green card.

But things took a weirder turn after agents told Imam he had been "flagged" for undisclosed reasons, pulled him into a separate room, and began questioning him about his social media use and group chats, according to the lawsuit. (Imam tells Reason that they asked about group chats in general, not any specific group chat.) When agents asked for the password to Imam's phone, he told them that he uses the phone to communicate with and manage cases for patients at the rehab facility where he works. The Health Insurance Portability and Accountability Act (HIPAA) strictly prevents doctors and other medical staff from sharing patient data without consent, so Imam asked to speak to a lawyer.

"Your lawyer cannot do anything. We are the authorities at the border," Imam recalls one agent saying. A supervisor then told the couple that CBP could take all of their electronics the "easy way or the hard way," and that the devices could take months to get back, Imam and Mansoor claim.

CBP's own internal policy says that devices should "ordinarily" be held for less than five days. The same policy includes vague guidelines for dealing with medical information: "Possibly sensitive information, such as medical records and work-related information carried by journalists, shall be handled in accordance with any applicable federal law and CBP policy." Imam says that the CBP agents claimed to have software for filtering out HIPAA-protected data.

After four hours in detention, CBP took the family's phones and laptops and let them go. The next day, Imam got an email stating, "We regret to inform you that your membership in Global Entry has been revoked for the following reason(s): You do not meet the Trusted Traveler standard." In addition to both Imam and Mansoor losing valuable work data, the lawsuit argues, Imam is now unable to prescribe certain psychiatric medications to his patients, because of federal regulations that require phone verification.

The lawsuit demands the return of the devices and data under Rule 41(g) of federal criminal procedures, which requires the government to hand back property that is no longer necessary for a criminal investigation. ADC has also filed these motions in Shehadeh and Blumenthal's cases. (CBP gave back Blumenthal and Shehadeh's phones almost immediately afterward, but ADC is continuing to press for records of what they did to those phones in custody.) Younes filed a brief on Blumenthal's behalf in support of an upcoming Supreme Court case over whether CBP can continue these electronic searches.

"The devices are neither contraband nor subject to forfeiture, and, to Plaintiffs' knowledge, there is no pending criminal investigation, criminal prosecution, or warrant authorizing their continued seizure or search," Imam's lawsuit states. "The Fourth Amendment does not permit the border-search exception to become a means of coercing compliance through the threatened or actual confiscation of travelers' personal property."

The post Border Cops Seize Nurse's Phone Filled With Psychiatric Patient Information appeared first on Reason Magazine.

The verdict should be seen as a warning for tech companies that New Mexico will hold them accountable, state Attorney General Raúl Torrez said at a news conference.

The penalty, one of the largest levied against a tech giant, stemmed from a lawsuit by New Mexico claiming the social media company had misled users about their data privacy.

© Gabriela Bhaskar/The New York Times

One of the unfortunate quirks of the American system is that you can't lie to the government, but the government can lie to you. Samuel Tunick found himself on the receiving end of this setup last year at Atlanta International Airport. When agents from the Department of Homeland Security (DHS) asked for his phone password, he allegedly gave them a self-destruct code that wiped his data. Tunick now faces five years in prison for destroying evidence.

It turns out that the feds were lying to Tunick the entire time. A new court filing, first reported by 404 Media, shows that the DHS had sent out an order to seize Tunick's phone over his involvement in environmentalist protests in Atlanta. When he landed at the airport, however, agents told Tunick that they were looking for "kiddie porn" and he would be allowed to leave with his phone if he cooperated. They also repeatedly denied him access to his lawyer when he asked.

"There can be no real debate that if law enforcement had acted similarly elsewhere in Atlanta, their actions would be unconstitutional. But the government says it was entitled to act this way because Mr. Tunick was returning from an international vacation" in the Dominican Republic, his lawyers wrote in the filing, which includes internal DHS communications and excerpts from his interrogation video.

U.S. law recognizes a "border exception" to Fourth Amendment privacy rights, allowing federal agents to search incoming travelers for contraband. U.S. Customs and Border Protection (CBP) claims that this exemption also allows them to hold travelers for questioning and search their electronic data. Tunick's case reveals just how widely the agency stretches this loophole.

A few hours before Tunick landed, Homeland Security Investigations (HSI) agent Travis Mcghie emailed the CBP station in Atlanta with his photo and information, stating that he is under investigation for "suspected terrorist activities." (Tunick is involved in Save the Atlanta Forest, also known as Stop Cop City, a protest movement against a local police training center.) The email asked CBP to "conduct a 100% baggage exam, retain all electronics and collect passcodes," stating that the HSI will be at the airport to conduct an interrogation.

Pulled into the secondary screening room, Tunick "almost immediately" told CBP officers that "I don't really want to speak without a lawyer any more," according to the filing, which cites the interrogation tape. He would ask for a lawyer multiple times.

The agents asked Tunick if he had "kiddie porn" on his phone and stated that "because you're refusing to talk, we have the authority to go through your phone to see what we're looking for." One of them, Latoya Castro, told Tunick that "either you can give us your password so that we can go through it no problem, or you can refuse to do that, unfortunately, we will have to seize your phone."

Both of those statements were a lie, of course. The HSI's email had asked CBP to take Tunick's phone, whether or not he cooperated.

The lie about child porn may not only have been meant to intimidate Tunick. While there are contradictory lower court rulings about the border search exemption, some courts have ruled that the CBP can only search electronics for "digital contraband," or files that are themselves illegal. A search for child sex abuse material would be on stronger legal ground than a search for mere evidence of other crimes.

Tunick was using GrapheneOS, a secure phone system that allows users to set both a real password and a "duress password" that wipes out all data when entered. The interrogation tape shows his phone appearing to reset after he gave the officers a passcode. HSI agent Nathan Burnham and FBI agent Andrea Coble then entered the room.

"You are not under arrest. Once these gentlemen are done with you, pursuant to your entry into the country, you're free to leave," Burnham said, referring to the CBP officers.

Tunick's lawyers argue that the judge should throw out the phone password Tunick provided and everything that resulted from entering it as an "involuntary" response made under "unlawful interrogation," because the CBP agents did not read Tunick his Fifth Amendment rights and ignored his multiple requests to consult with his lawyer before answering their questions.

The CBP claims that secondary screening at the border doesn't count as a criminal investigation, so detainees don't have the same rights as criminal suspects. "Since the international arrivals inspection is an administrative function, CBP policy and federal regs do not permit the presence of lawyers during secondary examinations," a spokesman told Reason earlier this year.

But Tunick's lawyers insist that his experience was "far outside" a normal border crossing: He was accused of a serious crime to his face, faced an investigation for a different serious crime he didn't know about, and clearly could not leave the situation until he gave information to government agents.

"I hope people understand that the charges against me are meant to intimidate people against protecting their data and their privacy, and the government hopes to set a precedent that no one has the right to privacy," Tunick told 404 Media. 

Defend the Atlanta Forest, the movement that Tunick is involved with, has been a major nuisance for authorities in Georgia. Protesters attacked and burned construction equipment throughout 2022, and police shot a protester in 2023 under unclear circumstances, claiming that they were fired at during a raid.

The Trump administration has brought down the federal government against the movement. In June 2026, the Department of Justice brought federal charges against two alleged arsonists, citing National Security Presidential Memo 7, which directs the feds to go after left-wing domestic terrorism.

But beyond the email line about "suspected terrorist activities," there is no indication of what specific crimes the feds suspected Tunick of, or why they suspected him. And the whole setup of the interrogation was designed to hide those answers. In fact, instead of charging Tunick under typical obstruction or evidence-destruction laws, federal prosecutors chose a rarely-used statute that doesn't require them to disclose what the underlying investigation was about.

"Many times the government wants to highlight what it was trying to investigate because that ups the stakes on what the defendant was doing," former prosecutor Daniel Richman told The New York Times. "This is a case where I think they're trying to avoid exactly that by focusing only on the destruction, and not what the investigation was about." 

The post Homeland Security Lied About Child Porn To Search Activist's Phone appeared first on Reason Magazine.

Around 80 pages on WhatsApp’s website exposed instructions that were designed for its chatbot, including “WHAT NOT TO SAY.” Meta says a bug caused the issue.

Canada’s planned surveillance law is the latest grim step in a series of threats to encryption that are spreading around the world.

Ghana has rejected a proposed health compact with the United States that would have provided an estimated $109 million in US health funding over five years, with President John Dramani Mahama saying the agreement raised serious concerns over health data, financing obligations, and Ghana’s regulatory authority.

The decision places Ghana among a few African countries that have pushed back against new US health agreements introduced as Washington restructures its foreign assistance following the dismantling of USAID. Zimbabwe has also rejected a similar agreement, while Zambia has raised concerns over provisions in its negotiations with the United States.

Ghana raises concerns over health data

Speaking at the Council on Foreign Relations in New York on September 25, Mahama said the proposed compact was presented to Ghana as a replacement for health funding previously provided through USAID.

He said Ghana’s Ministry of Health reviewed the document before preparing a Cabinet Information Paper.

“Ghana is a sovereign nation, and we have our own processes. We are a democratic country,” Mahama said.

According to the President, the Cabinet identified several provisions that raised concerns, particularly those relating to Ghana’s health information.

“One, it says that we shall give the United States our pathogen profile,” he said, adding that the agreement also required Ghana to provide medical records.

“It also says we should give our medical records. I mean, who takes another country’s medical records? And so that was strange.”

Concerns over health-data sharing have been central to resistance to the new US health agreements in several African countries. 

No FDA inspection

Mahama also raised concerns about the treatment of medicines and other medical products supplied under the proposed arrangement.

He said Ghana would have been required to contribute funding to the program while, according to his account of the compact, the country’s Food and Drugs Authority would not have been able to inspect medicines or other medical products entering Ghana under the program.

“And then it also says that any medications or any medical products that shall be brought into our country, our Food and Drugs Administration has absolutely no right to inspect,” Mahama said.

“I mean, it was humiliating.”

Ghanaian officials had previously cited concerns about the proposed handling of sensitive health information as a reason for rejecting the agreement. Reporting on the negotiations also indicated that the proposed arrangement would have required additional investment from Ghana alongside the US contribution.

Cabinet rejected the agreement

Mahama said the proposal was rejected after the Health Ministry presented its assessment to the Cabinet.

He described the decision as unusually swift.

“It was the compact that was thrown out in record time in our Cabinet. I’ve never seen anything thrown out as fast as that.”

He said the government subsequently instructed the Health Minister to communicate Ghana’s position to the US ambassador.

“And so, of course, we rejected it. And we asked the health minister to inform the US ambassador that we didn’t need it. We’ll manage ourselves.”

The proposed agreement would have provided Ghana with about $109 million in US health assistance over five years. The negotiations had begun in late 2025.

A wider concern over health sovereignty

Ghana’s decision comes as the United States seeks to shift its approach to global health cooperation. The new US strategy places greater emphasis on recipient countries taking responsibility for financing and delivering health programs, while Washington reduces its traditional aid commitments.

Kenya became the first African country to sign the agreement which was challenged in court, followed by similar arrangements with Rwanda, Liberia, Uganda, Lesotho and Eswatini, among other countries. Ravi Ram from the People’s Health Movement (PHM) East and South Africa, told BreakThrough News in December 2025, that  “Bilateral agreements between the US and Kenya and other African countries are meant to limit the ability of any one ‘partner’ country to challenge the terms of implementing the agreement, due to the unequal power relations.”

The concerns among health activists and concerned Africans is the ability of African states to determine their own health priorities, regulate medicines, control sensitive health information, and collectively negotiate the terms of international health cooperation.