u/V3R1F13D0NLY

We covered this on this week's Hide & Speak (our show). Texas and Florida both made moves on ALPR within four days of each other. Opposition to this technology now crosses party and ideological lines.

What it tells us is that public pushback works. Communities have been trying to end these contracts at the local level for a couple of years, and the companies have figured out they can't just dismiss the people documenting abuses.

Full recorded livestream: https://www.youtube.com/watch?v=Kppta1bWjFE

Read the full breakdown: https://s.vp.net/MdS5J

This Saturday at 2pm ET, we'll be joined live by Brian Hofer of Secure Justice,, discussing what to do AFTER you get Flock out, to make sure Axon or Motorola doesn't pop up the next week:
https://www.youtube.com/watch?v=DQqvM4n8GHA

Recently on Hide & Speak we got into what running your own AI infrastructure looks like when you skip Big Tech entirely.

The setup is an off-grid mini data center where every model is open source. It handles video creation, image creation, text, slides, prompts, and document cleaning. The output feeds a free research engine that's open to the public.

The reasoning is a straight trade: borrow from open source projects, then pay it forward by keeping everything you build open as well. The clip also takes a strong position on intellectual property, arguing knowledge should be shared freely rather than locked up.

Anyone here running any local models? I have been using GPT4ALL for about a year with different models for different tasks.

Watch full recorded stream: https://www.youtube.com/watch?v=B3u2RcUvxtU

Episode written summary: https://s.vp.net/5KGGn

The FBI confirmed Friday that its jobs portal was breached. ShinyHunters, the group claiming the attack, says it pulled personnel files on almost every agent through a flaw in Oracle's PeopleSoft software, and says that flaw is still unpatched. The FBI hasn't confirmed how the attackers got in. Sample files include home addresses, Social Security numbers and emergency contacts.

Blog write-up / our source list: https://s.vp.net/N0zLr

This week on Hide & Speak we got an update on a lawsuit filed two and a half years ago against Google, Meta, and the Department of Defense. It's still pending. At the most recent hearing, the platforms moved to dismiss, and the DOJ sided with them.

The argument, as described in the clip: there's no censorship on online platforms anymore, because an executive order said there shouldn't be.

The reaction in the clip would not be suitable for daytime TV.

The obvious problem is that an executive order is a statement of policy. It doesn't change how a moderation system works, and nobody outside the platform can check whether anything changed at all.

Full recorded livestream: https://www.youtube.com/watch?v=B3u2RcUvxtU

Full write-up here: https://s.vp.net/5KGGn

Judge David Barlow granted a preliminary injunction on September 24 against the VPN location rule in Utah's SB73, the Online Age Verification Amendments.

The rule meant adult sites had to treat anyone physically in Utah as a Utah user even if a VPN made them look like they were somewhere else, and they could be penalized for failing to age-check that person.

Utah was the first state to treat VPN use as a loophole in an age-verification law. Other states drafting similar bills will be reading this ruling closely.

Blog write-up / original sources: https://s.vp.net/4gIj8

We also did a longer Hide & Speak livestream on SB73 with Jacob from Rise To Liberty for anyone who wants the discussion version: https://www.youtube.com/watch?v=xlBsng6tsYY

Removal services like DeleteMe and Incogni charge for something you can do yourself in two or three hours. The hard part is knowing which forms are shortcuts and which are traps.

California residents can skip most of this. The state's DROP platform, live since January, sends one deletion request to over 500 registered brokers, and brokers have been required to check it every 45 days since August 1.

Use a throwaway email for the confirmations, and plan to redo it in three months. The listings come back.

Our link list is checked against Yael Grauer's Big Ass Data Broker Opt-Out List, which covers far more sites if you want to go deeper.

Full write-up + our list of sources: https://s.vp.net/X1dwO

On August 19, outside Atlanta, InvestigateTV reporter Brendan Keefe filmed a Flock technician upgrading a camera. He was on a public street in a press vest. The technician drove off, called 911, and told the dispatcher he was being harassed. Three police cars pulled Keefe over.

Flock's stated position on its own cameras is that a license plate on a public road is in plain view. Their actions in recent months makes it clear, that doesn't apply to them:

• June: a Flock employee called police on YouTubers filming outside the company's distribution center in Smyrna, Georgia.
• Sept 23: the Senate held a hearing on Flock titled Always Watching. The CEOs of Flock, Axon, Motorola Solutions and Verkada were invited. None showed.
• Sept 24: a firm acting for Flock filed a trademark complaint to take down researcher Joshua Michael's map of Flock devices, which he built from Flock's own location records. The map shows more than 170,000 cameras. Flock publicly says 120,000.

Full write-up / original sources: https://s.vp.net/aPUQA

404 Media got internal OpenAI documentation describing Project Lily. Contractors read a steady stream of real ChatGPT prompts, sometimes full conversations...

Complete write-up / source links: https://s.vp.net/atlhU

We spoke to Texas Libertarian candidate for Senate, Ted Brown on government-mandated encryption backdoors, and the position he landed on was a hard no.

This debate has been around for decades, and the same proposal keeps coming back with new branding every few years. The technical answer hasn't changed in that time: a door that's there for one party is there for anyone who finds it.

Watch the full interview: https://www.youtube.com/watch?v=PDgRbWQpvFc

Full write-up: https://s.vp.net/pi1qA

A hacker group called stegan0gram took a Flock camera down from above a road, copied almost everything on it, and gave the files to 404 Media and WIRED. Their joint analysis was published September 16.

The camera runs Android. Two storage partitions weren't encrypted, and one of them, named "media," held the key to the encrypted footage area. With it: 27,321 video clips, plus logs showing about 1.6 million images of roughly 50,000 vehicles over about 21 days, from that single camera. The most sensitive storage stayed encrypted and the reporting doesn't indicate anyone accessed Flock's cloud.

Full write-up + our source list: https://s.vp.net/Wd5OH

404 Media obtained audit logs through public records requests showing Flock Safety accounts running FreeForm searches against live cameras in Dunwoody, Georgia and Bryan, Texas. FreeForm takes a plain English description and lets Flock's image recognition decide what comes back. The accounts were named Flock City PD, Flock Intelligence, and Flock Safety Commercial Sales Demo.

Searches included:

• COEXIST bumper sticker
• vehicle with Trump bumper sticker
• Don't Tread On Me flag
• religious cars
• man holding rifle
• person ins scrubs
• person wearing a mask
• crowd
• large group with signs

Full write-up + source links: https://s.vp.net/4Spnx

Harvest now, decrypt later is the reason the G7 Cybersecurity Working Group published a call to action earlier this month. It came out alongside CISA, with France chairing, and it tells governments and companies to start moving to post-quantum cryptography now rather than wait for a quantum computer to exist.

The attack doesn't need a quantum computer today:

• Encrypted traffic gets collected and stored
• It sits there until a machine exists that can break the public key cryptography protecting it
• At that point the whole archive opens, including everything collected years earlier

Article + original sources: https://s.vp.net/z5ccm

bmail.ag already uses a hybrid of X25519 and ML-KEM-768 so a hacker would need to break both types of encryption to get into your email. Try it for free today at https://bmail.ag

Recently on Hide & Speak, Sharon Polsky said she's glad her grandparents didn't live long enough to see the similarities between the Communist Russia they escaped and the modern day Canada they fled to.

Full episode here: https://www.youtube.com/watch?v=iQlbDNhamEs

Written breakdown here: https://s.vp.net/Wtrge

The revised Personal Information Protection Act and its enforcement decree took effect on September 11. The headline change is the penalty ceiling, which moves from 3% of relevant sales to 10% of a company's total revenue. For comparison, the GDPR tops out at 4%.

The ceiling does not apply to every incident. It takes one of three conditions:

• A repeat violation within three years involving intent or gross negligence
• A breach affecting more than 10 million people
• A breach occurring after the company ignored a corrective order
• Documented preventive spending, staffing and technical controls can cut a penalty by up to 40%

Complete write-up + our source list: https://s.vp.net/s4DcO

We spoke with Sharon Polsky, President of the Privacy and Access Council of Canada recently on Hide & Speak and what she had to say was somehow both shocking and unsurprising.

Lawmakers passing technology and surveillance laws regularly admit they don't understand the technology. And their research staff, brief writers and staff members drafting the text usually have no technical background either, so the only education on offer comes from the technology vendors themselves.

Full livestream here: https://www.youtube.com/watch?v=iQlbDNhamEs

Full breakdown on our blog: https://s.vp.net/Wtrge

Secure Justice, an Oakland advocacy group tracking every Flock cancellation since 2021, counted more than ninety in August. That's about three a day and four times the July number. Their running total is now 214 cities and counties, and their own chart went out of date twice inside forty-eight hours because confirmations kept arriving.

Complete write-up + source links: https://s.vp.net/aLy1z

Recently on Hide & Speak, Sharon Polsky discussed how UK claims GDPR is about about consent, but it's actually coercion.

Full episode: https://www.youtube.com/watch?v=iQlbDNhamEs

Episode written summary: https://s.vp.net/Wtrge

Our network just keeps on expanding! We are up to 38 locations in 22 countries now. All hardware enforced, all verifiably private.

Get the only verifiable zero-knowledge VPN today at:

https://vp.net/

Full list of server locations currently:

• United States
  • Atlanta, Georgia
  • Chicago, Illinois
  • Dallas, Texas
  • New York, New York
  • Houston, Texas
  • Warrenton, Virginia
  • Denver, Colorado
  • Seattle, Washington
  • Hillsboro, Oregon
• Canada
  • Montreal
  • Vancouver
• Queretaro, Mexico
• United Kingdom
  • London
  • Erith
• France
  • Roubaix
  • Paris
  • Gravelines
  • Strasbourg
  • Marseille
• Netherlands
  • Amsterdam
  • Roosendaal
• Germany
  • Limburg
  • Frankfurt
• Madrid, Spain
• Vienna, Austria
• Zurich, Switzerland
• Lison, Portugal
• Warsaw, Poland
• Copenhagen, Denmark
• Stockhold, Sweden
• Kyiv, Ukraine
• Sao Paulo, Brazil
• Bucharest, Romania
• Tokyo, Japan
• Athens, Greece
• Tel Aviv, Israel
• Hong Kong
• Melbourne, Australia

The bill passed the Assembly and Senate on August 31st. Newsom has until the end of September to sign or veto.

What it actually bars for users under 16 is broader than the "addictive features" label suggests:

• Recommendation algorithms, infinite scroll, autoplay, and notifications
• The inputs a service uses to decide what to show you, including who you follow and what you like
• Where a platform can't offer a version without those, the account has to be deleted, so for most 15-year-olds the outcome is no account
• Enforcing an under-16 cutoff means verifying every user's age through a government ID upload or a face scan run through an age estimation model, held by a third-party vendor

EFF sent a formal veto request the day the bill passed and argues the harm falls hardest on kids in unsupportive homes. The bill also overlaps with AB 1043 (app store age signaling, effective January 2027) and SB 976, which is already being litigated in the Ninth Circuit.

Blog write-up / original sources: https://s.vp.net/nfI8R