Earlier The Drive reported a police chief "had to direct his staff to disconnect the power cords from Flock cameras in Plymouth, Minnesota after Flock Safety ignored and failed to respond to the department's notice the city was canceling its service.

"But in other instances Flock's gone and reinstalled cameras without permission," The Drive reported this week: On September 29th the city of Dayton, Minnesota posted a community update on its Facebook page alerting residents that Flock had installed and put into service two cameras against the City's direction without authorization... "The City notified Flock on September 18, 2026, that the program was on hold, and no work orders were to be completed. Unfortunately, the City's direction was not followed, and the camera was placed back into service without authorization." The statement continued and noted, "Following the report, City staff reviewed locations throughout the community to determine whether any additional cameras had been reinstalled, and one additional location was identified. The Police Department has been notified, and both cameras will be removed promptly...."

The Minnesota cities of both St. Paul and Crystal told Kare 11 that they removed the Flock cameras themselves following their respective city council votes in August and September respectively. The cameras are stored and are still waiting to be picked up by Flock. Crystal Chief of Police Pete Underthun told Kare 11, "Once we made this decision, I personally went to the locations and removed the cameras and poles myself." Chief Underthun noted, "We are still working with the company to close out our contract and for them to pick the cameras up from our garage."

Meta's smart glasses face new questions from two U.S. Senators, reports Gizmodo. Oregon Sen. Ron Wyden and Massachusetts Sen. Edward Markey "are requesting that Meta provide more information before Thanksgiving on whether it conducted detailed human rights due diligence and safety testing on the product before releasing it," reports Gizmodo. The Senators also requested information from Meta about " how it evaluated the privacy risks posed by the glasses, and what kinds of safeguards are currently in place." "Although Meta identified risks to bystander privacy and vulnerable populations before launching its glasses in 2021, it nevertheless launched a product tailor-made for invading the privacy of its users and bystanders," [the senators wrote in a letter Thursday...] The glasses have also been spotted on ICE agents during raids, and have raised potential surveillance concerns. The surveillance fears were even reportedly raised by the New York Police Department's counterterrorism unit in a memo issued earlier this year....

"Meta's own disclosures confirm that imagery processed through its glasses' visual AI features may be retained and used to train AI systems, including with the assistance of human reviewers," the senators' letter states, calling the practice an invasion of privacy. "Retaining that material for AI development, thereby extending the period during which it can be accessed, disclosed, or misused, exploits people's highly sensitive information for Meta's commercial benefit."

Meta has reached an undisclosed settlement in another social media addiction lawsuit, avoiding a trial scheduled for next month and leaving Snap as the sole remaining defendant. Engadget reports: The lawsuit was brought by an 18-year-old woman from Mississippi known as K.D.B who, according to Reuters, has "described staying awake for hours scrolling social media, losing focus in class and engaging in self-harm using methods shown in social media videos." Jury selection kicked off earlier this week in Los Angeles.

On Friday, K.D.B's lawyer announced that she had reached a settlement with Meta after previously settling with TikTok and YouTube. "We remain committed to improving safety for kids on social media apps and holding tech companies accountable, and we are pleased to have brought this matter to a just resolution on behalf of our client," attorney Emily Jeffcott said in a statement.

Now, Snap is the only remaining defendant in the case. CEO Evan Spiegel is expected to testify in the trial that could last several weeks. If he does take the stand, it will be the first time the Snap founder has appeared in a social media addiction trial. Snap previously settled in another high-profile case involving similar claims. A jury later ruled against Meta and YouTube in the trial and the two were ordered to pay $6 million in damages.

The Justice Department has charged five people in a crackdown on "ghost student" fraud, in which scammers allegedly use stolen identities and AI to enroll fake students in colleges, complete coursework, and collect federal student loan funds. Ars Technica reports: In a press release Thursday, the Department of Justice said it had uncovered a large-scale scheme relying partly on AI. The DOJ seized more than $750,000 in cryptocurrency from "a network associated with Kenyan nationals" after data analysis helped flag likely fraudsters. Assistant Attorney General Colin M. McDonald of the DOJ's National Fraud Enforcement Division credited new fraud-detection measures implemented by the Trump administration for the arrests. He said that "this is the first international seizure of its kind in Kenya," while warning fraudsters that the crackdown has only just begun.

[...] At a press conference, McDonald was joined by FBI and Department of Education officials to explain how the scheme works. It starts with bad actors purchasing personally identifiable information (PII) of Americans -- most frequently targeting high school graduates who never attended college and went straight into the workforce. Once they have that sensitive data, they fill out the Free Application for Federal Student Aid (FAFSA) while seeking to enroll in universities and community colleges. If accepted, student aid is distributed first to schools to cover tuition and fees, but any leftover money is deposited into bank accounts controlled by the fraudsters. Dozens of Americans have opened bank accounts to act as money mules for fraudsters, the DOJ said.

To keep money flowing, bad actors use AI to fill out applications, complete coursework, and even make it appear that a student is attending virtual sessions. "It looks like the ghost student is actually completing the class," McDonald said at the press conference. "Some even create the appearance of a fake student in an online classroom to trick schools into believing a real person is present. The goal is to keep the ghost student in school for as long as possible, semester after semester after semester." So far, the DOE has "identified over 830,000 potentially fraudulent federal student aid accounts created by using this PII of US citizens," officials said at the press conference. If all those accounts are ghost students, total losses come close to $130 million, the DOJ said.

An anonymous reader quotes a report from TechCrunch: General Motors will pay $220 million to 36 states to settle allegations that it illegally sold private driving behavior and location information to data brokers. As part of the settlement, GM must get drivers' express consent before it collects or shares their driving and location data -- terms that are in line with separate agreements it previously reached with California and the Federal Trade Commission (FTC). This settlement does contain a new requirement that GM must have a third party assess the automaker's compliance with the privacy program it has put in place.

The agreement announced Thursday settles a lawsuit brought by a coalition of attorneys general from 36 states that alleged GM had sold the information to data brokers, which in turn then sold it to insurance providers. "This agreement addresses Smart Driver, a product we ended in 2024, and reinforces steps we've taken to strengthen our privacy practices," GM said in an emailed statement. "Safer, more helpful and personalized experiences are enabled by connected vehicle data, and GM is committed to being clear about what information is used, how it's protected, and the choices customers have about what they share."

The settlement comes more than two years after a New York Times report showed how GM and OnStar collected, used, and sold drivers' precise geolocation data and driving behavior to third parties, including data brokers LexisNexis and Verisk. The data was collected through GM's Smart Driver program, a free feature contained within its connected car apps that tracked and rated driving behaviors and seat belt use. Data brokers sold this information to insurance providers, which could affect customers' rates, the NYT reported at the time.

The Commodity Futures Trading Commission (CFTC) has sued Utah to defend its claimed exclusive authority over federally registered prediction markets, as the state files (PDF) 14 criminal charges against Kalshi and its co-founders for allegedly violating anti-gambling laws. The Verge reports: On Wednesday, Utah's Attorney General Derek Brown filed charges against Kalshi co-founders Tarek Mansour and Luana Lopes Lara, including 12 counts of online gambling promotion, a third-degree felony, one count of a pattern of unlawful activity, a second-degree felony, and general gambling promotion, a Class A misdemeanor. The civil lawsuit calls Kalshi a "back-alley gambling den," and Attorney General Brown didn't mince words in a statement to Gizmodo.

"Gambling is illegal in Utah, whether you place the bet, run the game, or promote it. Calling it a 'prediction market' doesn't change what it is, and being federally registered doesn't put a company above the law," said Brown. "A federal court has already ruled that Utah's gambling laws apply to Kalshi," continued Brown. "Kalshi kept taking bets from Utahns anyway. That is illegal, and we're putting a stop to it."

[...] The Commodity Futures Trading Commission (CFTC) has been jumping into action to protect Kalshi and Polymarket by filing lawsuits against any state that brings charges against the betting sites. President Trump's son, Donald Trump Jr., is a paid advisor to both companies. The CFTC announced Wednesday that it was suing the state of Utah as part of its "commitment to maintaining its exclusive jurisdiction over CFTC-registered prediction markets." The argument is that the feds alone should be regulating these sites.

"Utah seeks to shut down prediction markets across a wide variety of markets," CFTC Chairman Michael S. Selig said in a statement. "Event contracts do not just serve hedging and investment purposes -- they also provide the public with information about the outcome of future events. Congress entrusted the CFTC to be the federal regulator with sole responsibility to oversee these markets," continued Selig. "As I've said before, the CFTC has the expertise and responsibility to defend its exclusive jurisdiction over commodity derivatives, and that's exactly what we'll do."

Longtime Slashdot reader schwit1 shares a report from TechCrunch: In an email blast to customers titled "Protecting your finances in the Al World," Bank of America urged customers to never share their username and password with another person or an outside service, "including an Al-enabled tool or agent that offers to act on your behalf." [...] A spokesperson for Bank of America confirmed the authenticity of the bank's email that was posted to social media. But heed the bank's warning, for if things go wrong, it's on you. Account agreements at most banks hold customers responsible for anyone they give their log-in to. "If you do share your credentials," its email reads, "keep in mind that you're responsible for activity resulting from that access."

A massive leak has exposed records tied to more than 41,000 DHS employees and contractors, including roughly 10,000 ICE personnel. The data, reportedly taken from DHS's Okta login system, reveals phone numbers, email and office addresses, reporting relationships, and permission groups associated with undercover operations, wiretapping and surveillance tools. Wired reports: In all, the leak provides a map of how DHS is organized and how it operates. The records, which span DHS itself as well as seven component agencies, including Immigration and Customs Enforcement and US Customs and Border Protection, were last updated on August 19, 2026.

The transparency nonprofit Distributed Denial of Secrets and cybersecurity researcher and journalist maia arson crimew previewed the data to WIRED, which they say they obtained from a group calling itself the Department of Peace. DDoSecrets published the archive, which it calls "Icepick," on Wednesday. In a press release, DDoSecrets says the data is from DHS's Okta login system. In a note with the files, the hackers wrote, "They have our information, so it's only fair that we have theirs." An Okta spokesperson tells WIRED that it is unaware of any breach of its systems. "We are aware of this report. Okta is secure, and we have no evidence our data or systems were compromised," the spokesperson says.

Amazon has added a camera to its Echo Studio speaker, allowing Alexa to visually identify objects, help with tasks and remotely monitor a room. For those concerned about privacy, Amazon is keeping a camera-free version available. The Next Web reports: The camera speaker ships today for $249.99. Hold up a board game box and Alexa can explain the rules, or show it a box of cereal and it can help you reorder it, according to Amazon. Owners can also check in on the room from the Alexa app while they are away. The Echo Studio without a camera stays on sale at $219.99.

A dedicated button turns off the microphones and any camera, and a visual indicator shows when a camera streams images or video to the cloud, Amazon said. Certain features require Alexa+, which is included with a Prime membership. Other devices Amazon unveiled today include an Echo Time alarm clock, an Alexa Photo Frame and the Echo Show 16.

An anonymous reader quotes a report from the Associated Press: The U.S. designated helium as a critical material on Friday because it's indispensable for making semiconductors that are essential to energy generation, and the global supply is at risk of disruption, according to the Energy Department. The designation by the Energy Department means that more federal financing will be available for helium producers and that the government will monitor it more closely. Helium is primarily produced as a byproduct of natural gas processing. The United States is the world's largest producer of natural gas and of helium. Qatar and Russia are the other top helium producers.

[...] Helium makes balloons rise, but that's not why the DOE is interested in it. Helium plays an important role in wind, solar and nuclear energy production, space exploration, medical imaging and research. Assistant Secretary of Energy Audrey Robertson said helium's unique properties make it irreplaceable, such as the fact that it's non-combustible and has the lowest boiling point of any gas. The nation needs an ample supply for semiconductors, quantum and super computing, and superconducting magnets, added Robertson, who oversees the Office of Critical Minerals and Energy Innovation.

[...] Despite environmental concerns with recovering helium from natural gas, there are also opportunities, said Greeshma Gadikota, director of the Lenfast Center for Sustainable Energy at Columbia University. "If we burn the natural gas, there are a lot of CO2 emissions associated with that," Gadikota said. "But if you just extract the helium and use it, the uses of it don't contribute necessarily to greenhouse gas emissions. "So from a climate standpoint, if we are going to continue down the line of extracting natural gas and recovering helium," she added, "I would prefer to see natural gas being used in a form where we directly produce hydrogen and we produce solid carbon." Hydrogen is a clean burning fuel, and solid carbon can provide permanent carbon sequestration and can be used widely in industrial applications, including rubber and pigments.

The critical PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) have now been successfully exploited in the wild, just days after patches were released and initial exploitation attempts failed. BleepingComputer reports: The malicious activity was caught by Adel Karimi, detection and response lead at Perplexity, whose honeypots recorded evidence of confirmed remote code execution against an Apache mod_php installation running PHP 8.4.26. "This is now confirmed RCE with usable memory disclosure, not just a crash followed by a suspicious process. The response delivered an 800 KiB decoded cookie dump, and a function address derived from that dump using the public exploit's offsets appears in the subsequent execution payload," Karimi shared.

"The evidence demonstrates this chain on the intentionally favorable single-worker mod_php profile; it is not a measurement of exploit reliability on other worker counts, PHP builds, or applications," he added. Karimi's findings were also confirmed by Expel threat researcher Marcus Hutchins, who has been tracking a stream of alleged successful PHP2Shell exploitation reports.

"This is by far the highest quality confirmation of in-the-wild php2shell exploitation I've seen so far. Deep technical breakdown of a successful exploitation attempt against an Apache mod_php installation running PHP 8.4.26," Hutchins said.

Highway thieves have stolen more than $100 million in data center equipment since June, employing increasingly sophisticated tactics such as forging driver IDs and spoofing GPS tracking systems. NBC News (paywalled) reports that thieves have "made away with more than $100 million in data center freight." Ars Technica reports: Here's how they said thieves get away with it: First, thieves hack freight brokers' accounts on shipment-listing websites and post fake shipments to lure real bids, then send a malicious link to any trucking companies that respond. Once victims click, thieves install software to take control of their accounts and start bidding on real shipments. Sometimes, a real delivery driver is hired to collect the cargo, unaware of the scam, and other times fake driver's licenses are used to get accomplices hired. Either way, the goods are eventually transferred to a driver working with the thieves to resell the gear, and, in one of the largest thefts, tracking coordinates were spoofed to prevent digital monitoring. Equipment commonly targeted includes "servers, fiber-optic cables, computer memory chips, copper wires, and bitcoin mining machines," NBC News reported.

Some trailers hit seem to be carrying only data center equipment, like two stolen freights found in Illinois. The Cook County Sheriff's Office estimated those contained $300,000 worth of copper wire spools and about $1 million in "custom-made data center modular power solutions equipment," NBC News reported. Other trucks impacted were carrying additional freight, like a Los Angeles County Sheriff's Department case where "data center cooling equipment" bound for Deepcool AI was recovered among nicotine pouches, televisions, shoes, printers, speakers, and skin care cosmetics. Experts worry that means Americans may be broadly harmed by the thefts, not just the AI industry.

While some stolen goods have been recovered, in two of the largest thefts that NBC News found, none of the equipment was found, and off-duty cops hired to escort the shipments were targeted in hit-and-runs. [...] Broadly, cargo thieves are infiltrating email accounts to find lucrative shipments, misdirecting shipments, disrupting GPS tracking, and using AI to create fake driver's licenses to get accomplices hired as delivery drivers. LASD's Sgt. David Pantoja told NBC News "that's how most of it is being done," which is a big shift from the past when highway thefts were largely opportunistic.

Brazil's 80-year-old president Luiz Inácio Lula da Silva was re-elected Sunday, reports the Guardian, "defeating his far-right opponent, Flávio Bolsonaro, to claim a historic fourth term in power."

And the results could impact the climate, suggests the Associated Press, since under da Silva the annual deforestation rate in the Amazon fell to its lowest level since records began in 1988: Official satellite data showed the rainforest lost 3,335 square kilometers (1,300 square miles) from Aug. 2025 through July 2026, the period used to calculate the annual rate...

During Jair Bolsonaro's presidency, from 2019 to 2022, Amazon deforestation surged by about 60%, with more than 45,000 square kilometers (17,400 square miles) cleared, according to official data. Under Lula, deforestation has fallen 71% since 2023, the government said. One of Lula's first moves after taking office in January 2023 for a third, non-consecutive term was to revive the Action Plan for the Prevention and Control of Deforestation in the Legal Amazon, known by its Portuguese acronym, PPCDAm. Launched in 2004 during his first administration, the plan had been shelved under Bolsonaro....

The plan has four pillars: strengthening monitoring and enforcement; promoting a sustainable economy; managing protected areas and determining how undesignated public forests should be used; and using regulations and financial incentives to curb deforestation. Measures included restoring sanctions for illegal forest clearing detected by satellites, a practice seen as the most effective tool to curb deforestation that was halted under Bolsonaro. The government also proposed barring properties with illegal deforestation from receiving bank loans and allocated more funding to priority Amazon municipalities that demonstrated reductions in forest loss. It also funded efforts to fight environmental crime and develop subsidized credit for sustainable businesses in the Amazon...

Deforestation and other land-use changes are Brazil's largest sources of greenhouse gas emissions, which drive global warming. The stakes are especially high in the Amazon, which stores vast amounts of carbon dioxide and generates atmospheric moisture that helps regulate weather far beyond South America... Degradation from wildfires, logging and drought affects about 40% of the Amazon and has outpaced clear-cutting in recent years. A strong El Niño, a periodic warming of the equatorial Pacific, could intensify those threats in 2026 and 2027 by bringing hotter, drier conditions that fuel wildfires.
The article notes that Lula's reelection campaign promised zero net deforestation by 2030, plus restoration to offset all forest loss, legal or illegal.

The blog Android Authority offers this TLDR: Google updated its privacy policy to clarify that it could use information shared through Personal Intelligence to personalize ads. Gmail, Drive, and Photos content isn't used for targeted ads by default, but connecting them to eligible Google services could change that.
Digital Trends explains: Google has long promised that your Gmail, Drive, and Google Photos content never helps it personalize ads. However, since October 16, 2026, its privacy policy adds a catch. The promise lapses if you let other ad-showing Google services use that content. That means using Personal Intelligence, an opt-in tool that lets Google's AI search read your connected apps, does exactly that (via Google).

If you ask Google's AI Mode where to eat near your hotel, and it can identify your hotel from the booking confirmation in Gmail, find the location in Maps, and then suggest a few places you might like. That's the helpful half. The twist, however, is that AI Mode can also show sponsored results. Google mentions that the personalized ads follow what the question and answer are about. So, while your inbox never goes to an advertiser, it can quietly shape the answer, which, in turn, shapes the ads.

Google's defense is elaborate. First, it says connecting the apps is optional. Second, advertisers can't see the information or content Google accesses in your Workspace apps (including your inbox and photos). Finally, sensitive topics like health are off-limits.
Ars Technica shares the response they got from a Google spokesperson: that Google isn't scanning your entire inbox to feed their advertising profiles, but if you choose to pipe your personal data into an AI search tool — then the ads Google shows you could be based on that information. If you want to ensure ads never use your personal data in this way, you'll need to make sure Personal Intelligence is turned off. The easiest way is to access the Gemini settings for Personal Intelligence and disable the connected apps. These settings are also a few levels deep in your main Google account settings under Data & privacy > Personalization settings > Manage Personalized Recommendations in Search Services > Connected Content Apps. From there, you can disable connections to Workspace and Google Photos.

America's Defense Department "has spent months quietly building an elite new tech agency," reports Politico, "to help covertly disrupt and sabotage foreign technology programs considered threats to American military superiority." Information on the Technology Support Office, or TSO as it is called internally, is nearly impossible to find on Pentagon websites, and the agency is mentioned by name only in several previously unreported Defense Department historical records and memoranda. While the specifics of its work are highly classified, POLITICO spoke with 12 current and former U.S. national security officials with varying degrees of knowledge about TSO to understand how the agency came to be, the broad contours of its mission and why its operations are shrouded in secrecy...

[The Pentagon's Defense Secretary and Deputy Defense Secretary] established TSO quickly and without attracting outside scrutiny because they largely built the agency by reorganizing two classified Pentagon intelligence programs that have conducted similar clandestine tech-sabotage efforts at a smaller scale since 2023. But by creating an agency dedicated to expanding that work, the Defense Department is signaling its intent to ramp up a range of aggressive covert activities abroad — potentially including cyberattacks, supply chain disruptions and disinformation operations. Many of the people who spoke to POLITICO argued that the aggressive new initiative is needed to help the Pentagon counter foreign adversaries they say are harnessing artificial intelligence and advanced commercial technologies, such as drones, in creative ways that could erode America's military advantage...

While TSO lacks the legal authority to conduct clandestine operations directly, it works closely with senior U.S. military and intelligence officers to develop cutting-edge tools and strategies to disrupt adversaries' access to critical defense technologies — or subvert them from afar. TSO is staffed with engineers, special operators and intelligence officers, and its work spans everything from building bespoke hacking tools to planning elaborate deception operations that trick adversaries into installing faulty components — likely designed by TSO — in key foreign weapons platforms. TSO's overarching goal is to "buy time or stop adversaries from developing technologies" that would most threaten the U.S. military in a major conflict, said a former U.S. intelligence official who worked closely with the agency... A second former Pentagon official and a former U.S. national security official said the agency has told some defense contractors it's interested in offensive hacking capabilities. The former senior Pentagon intelligence official estimated that its budget for classified contracts alone is likely north of $1.5 billion.

They are seeking contractors on "the leading edge of technology," that official said, and hope to procure "a whole host of tools wherever your imagination can go."
Pentagon staff had been exploring the need for a new agency for over a year, the article explains. Creating a new agency with its own budget and procurement powers "would empower the agency to more quickly integrate cutting-edge tech from the private sector," Pentagon staff concluded, "and think more strategically about which foreign defense technologies pose the biggest threats across U.S. military organizations."

"Several people who spoke to POLITICO support TSO's mission but worry that the secrecy surrounding its work could embolden current Pentagon leadership to carry out missions that flout international law or funnel coveted classified contracts to political allies."

Thanks to long-time Slashdot reader schwit1 for sharing the news.