A Serbian prosecutor investigating alleged corruption surrounding a Trump real estate project in Belgrade was targeted with Israeli-made Pegasus spyware after speaking out about political interference and abuses of power, according to research made public Monday.

Rade Bajić, a member of Serbia’s Public Prosecutor’s Office for Organized Crime, is reported to be the latest target identified in a growing spyware scandal that has engulfed the country’s political opposition, civil society and institutions.

The research is the latest by Toronto University’s Citizen Lab in collaboration with Serbian digital rights organization, SHARE Foundation, including the discovery that Bajić received an Apple Threat Notification iMessage on Aug. 13.

The spyware revelation comes amid mounting controversy over plans to redevelop the former Yugoslav military headquarters in Belgrade into a luxury Trump Tower skyscraper. The project, associated with Jared Kushner, U.S. President Donald Trump’s son-in-law, has faced allegations of political interference and irregularities surrounding the removal of the site’s protected heritage status.

Bajić’s targeting follows revelations in September that at least 14 people in Serbia, including student activists and opposition figures, had received warnings indicating they may have been targeted with sophisticated spyware. Researchers at Toronto University’s Citizen Lab confirmed a Pegasus infection in at least one case. 

“In Serbia, spyware surveillance has steadily expanded from civil society and journalists to student activists, politicians and now university and judicial representatives,” said Andrijana Ristić, a policy advisor at SHARE Foundation. “This escalation is fueled by perceived impunity and state inaction, even in cases where criminal complaints have been filed.”

Another prominent figure caught up in the surveillance scandal is Vladan Đokić, rector of the University of Belgrade, whose phone was infected with Pegasus, according to the same report.

Đokić has emerged as a prominent figure in Serbia’s protest movement after refusing to facilitate a government crackdown on student demonstrators. He has faced sustained pressure from authorities, including a police raid on his university offices on March 31, during which computers and servers were reportedly seized.

Until September, Đokić was also frequently mentioned as a potential leader of the student-backed electoral list ahead of Serbia’s planned Oct. 25 parliamentary snap elections.

The identity of those responsible for deploying Pegasus against Bajić and Đokić has not been established.

“NSO has spent a decade claiming to turn over a new leaf each time an abuse surfaces. But there is no hiding the truth: Pegasus is a technology for repression,” said John Scott-Railton, a senior researcher at Citizen Lab. “It’s no accident that people standing up for freedom in the face of corruption keep getting hacked with NSO’s products.”

Today's links

• Israeli ad-tech company was a delivery system for "mercenary spyware": And they used Google, Facebook and every other major ad platform to do it.
• Hey look at this: Delights to delectate.
• Object permanence: Big Mouth Billy Bass x Linux; No-Fly lists v common sense; Lemony Snicket advises the 1%; "Aloha From Hell"; KSR v Elon Musk; "Everything Belongs to the Future"; Trump's mail-servers run Win2003; Copyfraud v covid.
• Upcoming appearances: Vancouver, Victoria, Ottawa, Vienna, Kilkenny, Oxford, Sheffield, Virtual, Oxford, Montreal.
• Recent appearances: Where I've been.
• Latest books: You keep readin' em, I'll keep writin' 'em.
• Upcoming books: Like I said, I'll keep writin' 'em.
• Colophon: All the rest.

---

Israeli ad-tech company was a delivery system for "mercenary spyware" (permalink)

More than half of all internet users have installed an ad-blocker; Doc Searls calls it the largest consumer boycott in history. As large as that boycott is, everyone – yes, everyone – should block every "programmatic" ad, because the entire system is so insecure that failing to do so could result in the total compromise of any or all of your digital devices.

That's the inescapable conclusion of Citizen Lab's latest blockbuster investigative report, "Exposing AdFection," which reveals how the largest ad-tech companies in the world, including Google and Facebook, allowed themselves to be hijacked by a "mercenary spyware" company that used the ad system to locate targeted individuals and serve "zero-click malware" that took over their computers and phones without them having to take any action:

https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/

These tech giants amassed detailed surveillance dossiers on virtually every internet user, and they've assigned each of us unique, persistent identifiers, like a Social Security Number for spying. These companies also allow advertisers – or anyone pretending to be an advertiser – to serve blobs of code (which is all an ad is) to anyone based on those identifiers.

This allowed an Israeli spyware company called Discover-Tech (which masquerades as an ad-tech company) to sell totalitarian governments and sleazy corporate mercenaries the ability to pluck individual internet users out of the billions who log in every day and then serve "malicious ads" (that is, blobs of arbitrary code) to those targeted users. These malicious ads contained "no-click, zero-day" attacks, which meant that they exploited previously unknown vulnerabilities to take over devices without any user interaction. The mere act of loading a web-page or opening an app that relied on one of these gigantic ad-tech companies to serve ads was enough to compromise your device. No clicks needed, and no warning.

Among the targets of this attack campaign were the computers of workers at Al Jazeera. They were attacked with malware from the mercenary spyware company Candiru (which now calls itself "Integrity Labs" because irony is not dead). Beyond Candiru, Discover-Tech also facilitates attacks by numerous criminal mercenary spyware companies, serving ads on hundreds of thousands of sites and apps.

Discover-Tech was "certified" as a safe supplier by Google, Yandex, Microsoft, Beeswax (a division of Comcast) and IAB, the ad-tech industry's leading professional association. Ironically, Discover-Tech even attacked users by serving them malicious GDPR notices that appeared to let users opt out of commercial surveillance.

Because Discover-Tech was certified by all these industry bodies and firms, it had access to more than four billion ad-auctions, meaning that on billions of occasions, it was able to collect the identities of users loading apps and visiting websites, check them against the list of targets, and attack any victims it discovered through this dragnet.

Discover-Tech is an Israeli company with ties to other Israeli spyware and hacking companies, including through its board, whose members included Eric Banoun ("One of the pioneers of offensive cyber in Israel" –Haaretz). They have overlaps, relationships and affiliations with a rogue's gallery of Israeli companies, including the notorious NSO Group, who routinely sell cyber-weapons to the world's worst governments and whose products have been used to attack journalists, embassy workers, and activists.

The whole incident highlights the monumental insecurity of the ad-tech industry, whose indiscriminate and voracious surveillance and manifestly insufficient vetting and security auditing now expose every internet user in the world to terrifying targeted attacks. These companies – including Google, a thrice-convicted monopolist whose surveillance tendrils are wrapped around the whole world – claim that they operate their networks with prudence and oversight. But the proof is in the pudding: for years, they've played host to a murderer's row of cyber-mercenaries who used their infrastructure to attack journalists and others.

The only way to avoid this is to block ads. This is easy enough to do in a browser (which is why the majority of internet users have installed an ad-blocker in their browsers), but it's illegal to reverse-engineer and modify an app so you can block the ads in it:

https://pluralistic.net/2026/07/21/dickovers/#block-element

Many websites run anti-ad-block scripts that push out nagging, guilt-tripping notices that call you a thief and a cheapskate for blocking ads. Ignore those notices: if a website is running "programmatic" ads that allow arbitrary third parties to spy on billions of people and target individuals for malicious device takeovers, they are charging too high a price to see their content.

Some sites go further: their notices demand that you either turn off your ad-blocker or pay for a subscription. This "pay or okay" scheme is illegal in Europe, California and other territories with strong privacy laws, and they are morally bankrupt besides. Privacy shouldn't be a luxury item and everyone deserves to be secure from cyber-attacks:

https://noyb.eu/en/noybs-pay-or-okay-report-how-companies-make-you-pay-privacy

This report also provides the most comprehensive rebuttal to a dangerous idea that refuses to die: that we should improve competition in the ad-tech sector by assigning every internet user a mandatory, government-issued advertising ID to "democratize" ad-targeting and followup (which the sector calls "attribution"):

https://pluralistic.net/2024/08/07/revealed-preferences/#extinguish-v-improve

Despite all this, none of it is an indictment of ads per se. The problem here isn't advertising, it's surveillance. The ad-tech sector has convinced advertisers that targeting ads to users rather than content will massively improve ad performance. The evidence for this is very poor: targeted ads improve clickthrough rates by less than 5% (relative to content-based ads that relate to the substance of the page you're looking at), and they're incredibly expensive (and very dangerous!) to serve.

On top of all that, surveillance-based ads shift power away from publishers (who know more about the materials they publish than any ad-tech company ever will) to spying ad-tech companies (who can spy on users in ways that no publisher could ever match). Whatever minor additional revenues surveillance advertising can wring out of the market are totally swamped by the cost of the ad-tech sector's own operations, which the ad-tech sector makes up for by grossly underinvesting in security and by colluding to cheat publishers and advertisers, charging more for ads and paying less to the websites that run them:

https://en.wikipedia.org/wiki/Jedi_Blue

If we want to improve competition in advertising services, the answer isn't to facilitate spying (which also allows the world's scummiest cyber-mercenaries to stage and serve targeted attacks). We should ban surveillance advertising altogether, restoring context-based ads to their role as the way that publishers make an honest living without selling out their audiences:

https://pluralistic.net/2023/05/31/context-ads/#class-formation

---

Hey look at this (permalink)

• Philips updates instructions for ultrasound system linked to 4 deaths https://www.medtechdive.com/news/philips-updates-instructions-for-ultrasound-system-linked-to-4-deaths/832692/

• Don’t be fooled—LLMs don’t reason https://www.technologyreview.com/2026/10/02/1145639/dont-be-fooled-llms-dont-reason/

• Beneath resilient financial markets, risks remain elevated and vulnerabilities persist https://www.imf.org/en/publications/gfsr/issues/2026/10/13/global-financial-stability-report-october-2026

• Ultimate gridfinity drawer configurator https://makerworld.com/en/models/2737065-ultimate-gridfinity-drawer-configurator

• Is Blockbuster Video the Answer to Our Digital Privacy Woes? https://www.thenation.com/article/society/digital-privacy-salazar-paramount/

• Trump Is Encouraging Airlines to Scam Passengers in Every Way Possible https://newrepublic.com/article/216435/trump-airline-fees-fines-passenger-rights-scam

---

Object permanence (permalink)

#25yrsago Linux on a Big Mouth Billy Bass https://web.archive.org/web/20010927153043/http://bigmouth.here-n-there.com/

#20yrsago No-Fly lists even stupider than suspected https://web.archive.org/web/20061019002553/http://rawstory.com/showoutarticle.php?src=http%3A%2F%2Fwww.cbsnews.com%2Fstories%2F2006%2F10%2F05%2F60minutes%2Fmain2066624.shtml

#20yrsago Canadian MP booted for his blog https://web.archive.org/web/20061026153747/http://www.cbc.ca/canada/story/2006/10/18/turner-caucus.html

#20yrsago Recording industry shuts out Brazilian legal scholars https://web.archive.org/web/20061103225020/http://www.a2kbrasil.org.br/ENG/SIGN-A-PETITION-FOR-AMENDING-THE

#20yrsago How pickpockets work https://web.archive.org/web/20070110023812/http://www.kiplinger.com/magazine/archives/2006/11/mystory.html

#15yrsago Why are more people opting for legal name-changes than ever before? https://web.archive.org/web/20111020163908/http://www.bbc.co.uk/news/magazine-15333140

#15yrsago Advice to the 1% from Lemony Snicket https://occupywriters.com/works/by-lemony-snicket/

#15yrsago Proposed Australian law makes it an offense to insult Gaming Minister Michael O’Brien https://web.archive.org/web/20120507161803/http://www.heraldsun.com.au/news/more-news/surely-this-is-a-joke/story-fn7x8me2-1226167552466

#15yrsago Aloha From Hell: Sandman Slim goes back to Hell and kicks more ass https://memex.craphound.com/2011/10/18/aloha-from-hell-sandman-slim-goes-back-to-hell-and-kicks-more-ass/

#10yrsago California DMV thinks “INFOS3C” is a dirty word https://www.techdirt.com/2016/10/17/california-dmv-rejects-1nfos3c-vanity-plate-because-sexual-connotation/

#10yrsago Howard Stern won’t release Trump tapes https://www.billboard.com/music/music-news/howard-stern-on-replaying-his-donald-trump-interviews-it-would-be-a-betrayal-7542079/

#10yrsago Kim Stanley Robinson says Elon Musk’s Mars plan is a “1920s science-fiction cliché” https://web.archive.org/web/20161018043554/http://www.bloomberg.com/news/articles/2016-10-17/why-elon-musk-s-mars-vision-needs-some-real-imagination

#10yrsago UK’s Investigatory Powers Tribunal says GHCQ illegally spied for 17 years https://www.theverge.com/2016/10/17/13305270/uk-illegal-surveillance-gchq-investigatory-powers-tribunal

#10yrsago Project Include cuts off Y Combinator because Peter Thiel is a part-time investor there https://web.archive.org/web/20161019043240/https://motherboard.vice.com/read/horrified-by-trump-silicon-valley-leaders-debate-cutting-ties-to-peter-thiel

#10yrsago Islamophobic terrorist cell planned a “bloodbath” in Kansas, wanted to kill Muslim babies https://web.archive.org/web/20161018144035/https://www.washingtonpost.com/news/post-nation/wp/2016/10/15/it-will-be-a-bloodbath-inside-the-kansas-militia-plot-to-ignite-a-religious-war/?utm_term=.a9d769256cf6

#10yrsago Everything Belongs to the Future: a tale of pharmadystopian, immortal gerontocrats https://memex.craphound.com/2016/10/18/everything-belongs-to-the-future-a-tale-of-pharmadystopian-immortal-gerontocrats/

#10yrsago UK government proposes issuing Britons with unique porn-viewing ID numbers https://www.openrightsgroup.org/blog/a-database-of-the-uks-porn-habits-what-could-possibly-go-wrong/

#10yrsago Donald Trump’s mail-servers are running Windows 2003 https://pluralistic.net/2021/10/18/labor-shortage-discourse-time/#core

#5yrsago Copyfraudster censors investigation of implausible covid gadget https://pluralistic.net/2021/10/18/labor-shortage-discourse-time/#copyfraud

#5yrsago Corporatism made John Deere ripe for a strike https://pluralistic.net/2021/10/18/labor-shortage-discourse-time/#deere-dash

---

Upcoming appearances (permalink)

• Vancouver: Read, Resist, Repair, Rejoice (Vancouver Writers Festival), Oct 19
  https://writersfest.bc.ca/festival-event-2026/01

• Victoria: Munro's Books, Oct 20
  https://www.munrobooks.com/events/6113620261020

• Vancouver: Life After AI (Vancouver Writers Festival), Oct 22
  https://writersfest.bc.ca/festival-event-2026/46

• Ottawa: Life After AI (Ottawa Writers Festival), Oct 24
  https://writersfestival.org/event/life-after-ai

• Vienna: TED AI, Oct 28-30
  https://tedai-vienna.ted.com/

• Kilkenny (Kilkenomics), Nov 6-8
  https://kilkenomics.com/

• Vancouver: Enshittification (Sid Williams Theatre Society), Nov 10
  https://www.sidwilliamstheatre.com/events/cory-doctorow-talks-enshittification/

• Vancouver: BC Policy Solutions Gala, Nov 12
  https://bcpolicy.ca/gala/

• Oxford: Ministry of the Future, Nov 23
  https://ministryforthefuture.co.uk/events.html

• Sheffield: Reverse Centaur at Juno Books, Nov 25
  https://www.outsavvy.com/event/40274/cory-doctorow-in-conversation

• Virtual: Enshittification, AI, and the Future of Technology (UBC Master of Educational Technology), Nov 28
  https://met.ubc.ca/2026/09/met-speaker-series-cory-doctorow-enshittification-ai-and-the-future-of-technology/

• Oxford: Bennett Oxford Symposium on Open Code in Science, Dec 9
  https://www.bennett.ox.ac.uk/events/2026-bennett-institute-symposium/

• Montreal: World Science Fiction Convention, Sep 2-6
  https://montreal2027.ca/en

---

Recent appearances (permalink)

• Life After AI (Brain Bar)
  https://www.youtube.com/watch?v=IPPa43-n0vI

• Terms of Service with Clare Duffy (CNN)
  https://www.cnn.com/audio/podcasts/terms-of-service-with-clare-duffy/episodes/458ce968-af5d-11f0-b539-13ed2afe25f8

• AI, Work, and Power (Software Engineering Daily)
  AI, Work, and Power https://softwareengineeringdaily.com/podcasts/cory-doctorow-on-ai-work-and-power/

• AI, Corporate Power, and the Fight for Worker Control (Plutopia)
  https://plutopia.io/cory-doctorow-ai-corporate-power-and-the-fight-for-worker-control/

• How to Think About AI—Before It’s Too Late (Daniel Solove)
  https://www.youtube.com/watch?v=_0xR3uEgGcc

---

Latest books (permalink)

• "The Reverse-Centaur's Guide to AI," a short book about being a better AI critic, Farrar, Straus and Giroux, June 2026
  https://us.macmillan.com/books/9780374621568/thereversecentaursguidetolifeafterai/

• "Canny Valley": A limited edition collection of the collages I create for Pluralistic, self-published, September 2025 https://pluralistic.net/2025/09/04/illustrious/#chairman-bruce

• "Enshittification: Why Everything Suddenly Got Worse and What to Do About It," Farrar, Straus, Giroux, October 7 2025
  https://us.macmillan.com/books/9780374619329/enshittification/

• "Picks and Shovels": a sequel to "Red Team Blues," about the heroic era of the PC, Tor Books (US), Head of Zeus (UK), February 2025 (https://us.macmillan.com/books/9781250865908/picksandshovels).

• "The Bezzle": a sequel to "Red Team Blues," about prison-tech and other grifts, Tor Books (US), Head of Zeus (UK), February 2024 (thebezzle.org).

• "The Lost Cause:" a solarpunk novel of hope in the climate emergency, Tor Books (US), Head of Zeus (UK), November 2023 (http://lost-cause.org).

• "The Internet Con": A nonfiction book about interoperability and Big Tech (Verso) September 2023 (http://seizethemeansofcomputation.org). Signed copies at Book Soup (https://www.booksoup.com/book/9781804291245).

• "Red Team Blues": "A grabby, compulsive thriller that will leave you knowing more about how the world works than you did before." Tor Books http://redteamblues.com.

• "Chokepoint Capitalism: How to Beat Big Tech, Tame Big Content, and Get Artists Paid, with Rebecca Giblin", on how to unrig the markets for creative labor, Beacon Press/Scribe 2022 https://chokepointcapitalism.com

---

Upcoming books (permalink)

• "The Post-American Internet," a geopolitical sequel of sorts to Enshittification, Farrar, Straus and Giroux, 2027

• "Unauthorized Bread": a middle-grades graphic novel adapted from my novella about refugees, toasters and DRM, FirstSecond, April 20, 2027

• "Enshittification, Why Everything Suddenly Got Worse and What to Do About It" (the graphic novel), Firstsecond, 2027

• "The Memex Method," Farrar, Straus, Giroux, 2027

---

Colophon (permalink)

Today's top sources:

Currently writing:

• “Once Is Enemy Action,” a science fiction novel about the origins of modern technofascism. Today's words: 563 (26602 total).

• "The Post-American Internet," a sequel to "Enshittification," about the better world the rest of us get to have now that Trump has torched America. Fourth draft completed. Submitted to editor.

• A Little Brother short story about DIY insulin PLANNING

---

This work – excluding any serialized fiction – is licensed under a Creative Commons Attribution 4.0 license. That means you can use it any way you like, including commercially, provided that you attribute it to me, Cory Doctorow, and include a link to pluralistic.net.

https://creativecommons.org/licenses/by/4.0/

Quotations and images are not included in this license; they are included either under a limitation or exception to copyright, or on the basis of a separate license. Please exercise caution.

---

How to get Pluralistic:

Blog (no ads, tracking, or data-collection):

Pluralistic.net

Newsletter (no ads, tracking, or data-collection):

https://pluralistic.net/plura-list

Mastodon (no ads, tracking, or data-collection):

https://mamot.fr/@pluralistic

Bluesky (no ads, possible tracking and data-collection):

https://bsky.app/profile/doctorow.pluralistic.net

Medium (no ads, paywalled):

https://doctorow.medium.com/

Tumblr (mass-scale, unrestricted, third-party surveillance and advertising):

https://mostlysignssomeportents.tumblr.com/tagged/pluralistic

"When life gives you SARS, you make sarsaparilla" -Joey "Accordion Guy" DeVilla

READ CAREFULLY: By reading this, you agree, on behalf of your employer, to release me from all obligations and waivers arising from any and all NON-NEGOTIATED agreements, licenses, terms-of-service, shrinkwrap, clickwrap, browsewrap, confidentiality, non-disclosure, non-compete and acceptable use policies ("BOGUS AGREEMENTS") that I have entered into with your employer, its partners, licensors, agents and assigns, in perpetuity, without prejudice to my ongoing rights and privileges. You further represent that you have the authority to release me from any BOGUS AGREEMENTS on behalf of your employer.

ISSN: 3066-764X

Canada’s planned surveillance law is the latest grim step in a series of threats to encryption that are spreading around the world.

There's a growing trend in the consumer tech world: gadgets designed to spy on everything and everyone around you, regardless of whether or not anyone else actually consented to it. Now, with the advent of "AI personal assistants" like Meta's Muse, you're being cheerfully asked not just to give up your own data, but also the information of your friends, family, the person you went on a Hinge date with five years ago - and virtually anyone else you've ever come in contact with.

Since Muse was released last month, the agent has already been downloaded millions of times and hit No. 1 on Apple's App Store. With the help of its creepy virtual av …

Read the full story at The Verge.

An Israeli surveillance technology firm has run a large-scale operation to infect mobile phones with spyware using online advertisements to hack the devices, researchers said on Thursday.

An investigation by the University of Toronto’s Citizen Lab and cybersecurity firm Confiant Threat Intelligence laid bare an ad-based infection technique developed by an Israeli company that researchers named “AdFection.” The hacks weaponized legitimate online ad systems for espionage purposes, allowing spyware manufacturers to connect to millions of devices and identify, track and target victims.

“Plugging into the online ads ecosystem provides the mercenary spyware industry a stealthy delivery system,” said Bill Marczak, senior researcher at The Citizen Lab. He said the findings were “surely just the tip of the iceberg” of how online ads are abused for espionage.

Researchers discovered critical details of the hacking tools by analyzing devices belonging to journalists and staff at the Al Jazeera media network, finding that 45 devices of journalists and staff were targeted and some infected with Israeli-made spyware known as Candiru.

At the heart of the hacking campaign is the Israeli company Discover-Tech that describes itself as an advertising business. Citizen Lab researchers said the company facilitated surveillance for commercial spyware operators. Its platform, called Controlium, allegedly allowed spyware makers like Candiru — which in 2025 was acquired by Integrity Labs — to identify, track and target devices by loading advertisements on websites and apps.

Discover-Tech and Integrity Labs did not immediately respond to a request for comment.

The scale is striking: An analysis of four billion advertising records found that Discover-Tech’s ads appeared across nearly 200,000 websites and mobile apps in dozens of countries over four months. Among the websites that featured the ads were institutional sites of NATO, the United Nations, the European Parliament, European Commission and Council of the EU.

The technique exploits real-time bidding — the automated system used by platforms such as Google to sell advertising space and target users. Rather than persuading victims to click a malicious link, attackers can exploit advertisements to identify and potentially infect devices without any interaction from the user — a technique known as “zero-click” infections.

Discover-Tech’s advertisements directed millions of devices to servers associated with Candiru, potentially enabling large-scale surveillance and reconnaissance, researchers said. That does not mean all those devices were infected.

Citizen Lab, based in Toronto, is a globally recognized research group that previously uncovered spyware scandals targeting Catalan political figures, a member of the European Parliament and the inner circle of murdered Saudi journalist Jamal Khashoggi.

The findings triggered calls for further investigation on Thursday. “The possibility that EU institutions have been exposed should set off alarm bells across Brussels,” said Hannah Neumann, a German European Parliament lawmaker of the Greens group. Neumann herself was the victim of a cyber-espionage operation by an Iranian hacking group.

“Europe cannot claim to defend democracy while leaving its own democratic institutions vulnerable to spyware,” Neumann said.

At TechCrunch Disrupt, Flock CEO Garrett Langley defended his company's surveillance technology despite growing privacy concerns, arguing that its crime-fighting benefits outweigh the risks of abuse.

Flock CEO Garrett Langley said that the surveillance company has not canceled contracts of any police department or law enforcement agency, despite reports of abuse.

BRUSSELS — Privacy regulators want people wearing smart glasses in public to look and sound like a truck backing down a road.

Europe’s powerful data regulators have made stringent new recommendations on how smart glasses should alert people that the wearable devices are filming, including a combination of flashing lights, audio alerts and notifications sent to the phones of people nearby.

The European Data Protection Board (EDPB), made up of national privacy regulators across Europe, issued a statement about smart glasses on Tuesday, following a meeting in Brussels.

Privacy regulators are putting forward a united front on smart glasses, as privacy concerns about the wearable technology have multiplied since videos made with them have begun spreading online without the knowledge or consent of those being filmed.

The statement is not legally binding but will guide how privacy regulators in Europe assess whether smart glasses users and manufacturers are complying with EU privacy rules like the General Data Protection Regulation (GDPR).

The regulators said smart glasses manufacturers should implement a combination of transparency measures to make other people aware that they are being recorded.

The measures may include lights or sounds when users are recording, requiring smart glasses users to activate them with an audible voice command, sending notifications to the smartphones of people nearby and other design “clues” to help people spot smart glasses.

The group of privacy regulators said that not only should users of smart glasses respect other people’s privacy but that the devices’ manufacturers and people providing connected apps or services may also be responsible for making sure they comply with privacy rules.

The GDPR applies to companies and organizations, and doesn’t apply when people process personal data in a household context. The regulators said this household exemption should be “narrowly interpreted” when it comes to smart glasses, and would not apply when someone shares photos or videos of others “to an indefinite number of persons on a public social media account.”

Tech firms like Meta have pitched their smart glasses to consumers on the basis that they are sleek and discreet. Meta has included an LED light in its smart glasses, which activates while recording, which it has said is a key privacy safeguard.

Samsung and Google have also recently announced that they’re collaborating on a new line of “intelligent eyewear” set to launch later this year, and Apple is reportedly aiming to hit the market with its own smart glasses by the end of 2027. 

The regulators’ statement could now force smart glasses manufacturers to reassess whether and how they sell smart glasses to European consumers. The EDPB called for industry-wide standards to be developed to make sure people are able to spot smart glasses and understand how they process data.

The European group of privacy regulators also commissioned a study into the social acceptability of smart glasses, published today.

Investigators also sought permission to use an invasive surveillance tool called a cell-site simulators against journalist Georgia Fort and a Minnesota state Senate candidate.

In April of 2025, Elgin Community College had six Flock safety cameras installed to "enhance the safety and security of students." But by September of that year, the school's administration grew concerned that Flock was sharing data with Customs and Border Patrol, that camera feeds were not properly secured, and that both law enforcement and the company's employees were abusing access to the data.

So in October of 2025, Elgin Community College requested Flock to remove its cameras. According to Elgin's President Peggy Heinrich, Flock rejected the request, saying it had not violated its contract. According to the Chicago Sun-Times, school o …

Read the full story at The Verge.

At this year's OpenAI DevDay, CEO Sam Altman unveiled the company's new AI agent Dots - and told the crowd that the company wants to "set a new standard for privacy in frontier AI." OpenAI would spend the day taking veiled shots at Meta's Muse, its primary competitor, for failing to keep users' data safe. Yet Muse itself, a couple of months earlier, had launched as a supposedly safer alternative to predecessor OpenClaw - with CEO Mark Zuckerberg promising it was "built from the ground up for privacy and security."

In an age when companies hoard customers' personal data and cyberattacks are a dime a dozen, AI labs are trying to convince user …

Read the full story at The Verge.

August Hanning spent seven years at the top of Germany’s foreign intelligence service, the BND, with access to some of the country’s most closely guarded secrets. Then came a second act: private consulting, corporate intelligence and business stretching across Europe, into Russia and Asia.

Now, the 80-year-old former spymaster is himself at the center of an espionage investigation, after German federal prosecutors arrested him Tuesday on suspicion of treasonous espionage, attempted treason and other espionage offenses. They allege he obtained a stream of secret intelligence from his former chief of staff and used the material to benefit his private consulting business.

“It’s catastrophic for Germany and for Western intelligence services. Everyone is in shock. The scale of it is enormous, especially at a moment like this,” said one EU intelligence official, who — like others in this report — was granted anonymity to discuss a clandestine arena. “And given that investigators stumbled across this while working on an entirely separate case, we’re likely to learn much more.”

For the BND, the case comes at an uncomfortable moment. Just last week, German parliamentarians began debating a new law proposed by Chancellor Friedrich Merz’s government to grant the agency sweeping new authority, as part of an effort to return Berlin’s foreign intelligence service to the top ranks of global espionage. The timing is equally awkward for European intelligence more broadly. With Russian hybrid attacks continuously targeting Europe, governments across the bloc are rewriting decades-old security laws to give their spy agencies greater powers and be taken more seriously.

Prosecutors say Hanning’s former chief of staff, identified under German privacy rules as Manfred D., supplied him with roughly 2,000 BND documents between 2010 and June 2022. Many contained classified information intended exclusively for internal intelligence work, including material used to brief senior German officials.

In comments to German newspaper WELT, a lawyer representing Hanning said some of the allegations against the ex-spymaster were true but that he did not harm Germany.

“He was in possession of confidential documents. Incorrect, however, is the accusation that he had passed on information contained therein to the detriment of the Federal Republic of Germany — let alone [for] payment. Further investigations will show that,” he said.

In one case, prosecutors suspect Hanning used classified material to prepare an analysis for an employee of foreign intelligence service. They also allege he maintained a relationship with a representative of another foreign intelligence service for several years, passing along political information that was partly based on material obtained from Manfred D.

Prosecutors have not publicly identified either foreign service but German media has named Azerbaijan and Kazakhstan. Azerbaijan has denied any connection.

“In intelligence services, everything is logged — who accesses which documents and when. If an analyst working on right-wing extremism suddenly started looking at intelligence on China, that would raise red flags. But the position of chief of staff has access to virtually everything, so it wouldn’t look suspicious because of the seniority of the position,” said a second EU intelligence official.

Chiefs of staff often stay on when directors change, unless they don’t get along with the incoming boss, the official added.

“Every intelligence service will now be looking at what information it shared with the BND and assessing what damage may have been done,” he said.

Revolving door

Hanning led the BND from 1998 to 2005, before serving as state secretary at Germany’s interior ministry until 2009. Once out of government, he wasted little time entering the private sector.

In July 2010, Hanning and his wife established Hanning Consult. It was in the spring of that same year that Manfred D. agreed to provide him with intelligence from inside the BND in exchange for payment, according to the prosecutor’s statement. Hanning then used that information in his private consulting activities, they added.

Roderich Kiesewetter, a Christian Democrat lawmaker on the Foreign Affairs Committee in the German parliament, said that within Germany there is a “very widespread network” of people who use the contacts and knowledge acquired while they were in service to influence Berlin’s policy on behalf of foreign governments like Russia and China.

“It’s not only sad, it’s damaging the reputation of Germany,” Kiesewetter told POLITICO. “You could also say if you want to talk to Russia, take former members of the government or former members of the secret services.”

Hanning also became involved with Samuel Danilowitsch, a German businessman, who led the Swiss corporate intelligence consultancy, Pluteos. There, Hanning eventually became chairman and the two were listed as attending a 2019 Moscow gathering focused on Europe-Russia relations, attended by Russian political and business figures, where the annexation of Crimea was brought up as a “necessity” rather than a choice. Pluteos did not respond to a request for comment.

From around 2014, Hanning joined British consultancy G3 as a senior adviser, according to archived web pages seen by POLITICO. He later oversaw its work involving Russia and the former Soviet republics, according to German media outlet Correctiv. G3 did not respond to a request for comment.

In 2019, Hanning was invited as a “guest of honor” to a gathering organized by Russia’s Security Council of officials and experts from Arctic Council countries. It was chaired by former secretary of the Security Council of Russia, Nikolai Patrushev, one of the most powerful figures in President Vladimir Putin’s security orbit. As part of the cultural program, the group visited the remote Valaam Island monastery where Hanning was pictured next to Patrushev.

Hanning has also publicly ventured into some of the more politically explosive questions surrounding Russia’s war on Ukraine.

In 2024, he told WELT TV that he considered it “very likely” that Ukrainian President Volodymyr Zelenskyy knew about the 2022 operation that destroyed the Nord Stream pipelines. Days later, Hanning went further, suggesting an agreement between senior Ukrainian and Polish figures was behind the attack. Germany has since charged a Ukrainian national it identified only as Serhii K., with his trial due to begin in Hamburg in October.

None of those business relationships, contacts or statements establishes a connection to the espionage case now facing Hanning, though they paint a picture of the influence he continued to amass after leaving the German government. Prosecutors have not accused him of spying for Russia.

The steakhouse heiress

Investigators got onto Hanning’s trail starting with an extraordinary custody dispute involving Christina Block, an heiress to a German steakhouse empire.

Block is accused by the Hamburg Public Prosecutor’s Office of orchestrating the abduction of her two youngest children from their father in Denmark. Prosecutors in that case say Block and two men commissioned an Israeli security team to seize her children, then aged 10 and 13, from their father, Stephan Hensel.

According to the indictment, masked men beat Hensel and took the children across the Danish-German border, to southern Germany. The children were reunited with their father in Denmark four days later, under a court order. Block denies knowing about the abduction.

In September 2025, Hamburg investigators searched Hanning’s home and business premises in connection with the Block case, according to local media. Prosecutors suspected Hanning and a retired police officer had accepted a contract worth more than €100,000 to intercept the children on their way to school in November 2022. The plan ultimately failed as their father noticed suspicious figures and alerted Danish police. 

German broadcaster Taggeschau reported that the investigators, in the search of Hanning’s premises, discovered around 2,000 digital BND documents that ultimately triggered scrutiny of his handling of sensitive government information. Federal prosecutors took over the resulting investigation in May 2026.

Manfred D. had been Hanning’s chief of staff at the intelligence service and subsequently served several of Hanning’s successors, remaining in a senior position until March this year. 

Both men are now in custody.

“He’s reflecting the Germany between 1998 and 2011, so he has not the feeling of having done something evil,” said Kiesewetter. “He was just mirroring [the] state policy of the center-right Christian Democratic and conservative political alliance.”

Hans von der Burchard contributed to this report. 

The maker of the open source document editor says it has no plans to add AI to its software's default configuration, citing user privacy.

A federal judge ruled that a sheriff’s deputy violated a woman’s Fourth Amendment rights when using Flock to search for her license plate without a warrant. 

Millions have downloaded Meta’s AI agent Muse. But getting it to do your bidding comes with privacy costs.

The proposed legislation would extend to all automotica license plate readers.

The California state bill would have penalized people who secretly recorded people in public with wearables equipped with cameras and microphones.

In an exclusive interview with WIRED, Paragon Solutions CEO Andrew Boyd reveals the limits of the company’s promise to keep bad actors from abusing its powerful espionage tool.

Meta says its Muse AI agent cannot access a user’s Messages without explicit permission, disputing a journalist’s account that the agent read his private messages while the required Mac setting was turned off.

More than 500,000 faces were scanned by the live facial recognition systems set up in London's railway stations by the British Transport Police. At a cost of £320,786 (about $423,000) the numbers are in: the system scored "one false match against a watchlist of suspects" and notched up zero arrests over the course of a six-month trial. — Read the rest

The post London's live facial recognition trial ends in one false positive, no arrests, and a £320k bill appeared first on Boing Boing.