Pushback. The AI, Privacy, and Security Weekly Update.
EP 313.
This is the week the world stopped asking permission and started saying, "no".
A college in Illinois covered Flock surveillance cameras with black trash bags and zip ties because immigration agents were using the data to track and detain students.
Flock tried to remove the coverings.
The college left them on.
The standoff lasted until the contract expired and the cameras came down.
Over 15,000 Americans realized they'd been recruited into a money-laundering scheme; fake jobs, stolen money, personal bank accounts turned into criminal pipelines - and they fought back by reporting it. The mastermind pleaded guilty. He faces 50 years in prison.
A French supermarket chain got hacked, their freezers turned into ovens, thousands of products ruined, and instead of waiting for law enforcement, they deployed AI, restored their network, (finally patched their firmware), and exposed the attackers' infrastructure. The message was clear: we're done waiting for help.
A Texas city tried to charge $2.3 million for public records on its Flock surveillance system. A price so high it was obviously designed to prevent anyone from asking questions. The pushback was immediate: this is surveillance by secrecy, and we're not paying for our own silence.
FBI contractors were sitting on critical security patches that hackers already knew about, leaving federal systems vulnerable. The FBI removed the contractors and demanded patching become mandatory.
Your car is being tracked without your consent, your location turned into a searchable database, your movements logged and stored. The pushback: know who's using Flock cameras in your area. Check the map. Take a different route. Make tracking harder.
Ledger hardware wallets sold through a reseller were physically implanted with spy chips that stole crypto wallets worth millions. The pushback: demand proof of authenticity, buy only through official channels, verify everything.
Yandex's data centers in Russia got hit by drone attacks, and customers lost access to their files. Yandex is the Russian equivalent of Google, so Yandex pay, Yandex Maps, and even files on Yandex got knocked offline.
And the Chinese government has been running a sophisticated hacking operation targeting critical infrastructure worldwide, stealing files, passwords, and sensitive data from organizations that forgot to patch their software.
This is the week of pushback. This is the week people stopped accepting surveillance, corporate negligence, and state-sponsored hacking as the cost of modern life. This is the week they said: "No." We're going to make this harder. We're going to ask questions. We're going to verify. We're going to remove your cameras. We're going to patch our systems. We're going to know what's happening to our data.
Welcome to the Pushback.
US: The College Wanted Its Surveillance Cameras Gone. The Company Refused.
Elgin Community College in Illinois installed six Flock Safety cameras to improve campus security. But when reports surfaced that federal immigration authorities were accessing license plate data collected at other Illinois colleges, administrators began to worry that the technology could put their students at risk.
More than half of Elgin's students identify as Latino. After immigration agents detained a student in a campus parking lot, the college president said students were afraid to attend classes. The surveillance technology that was supposed to create safety had created fear instead.
The college asked Flock to remove its cameras in October 2025. The company refused, arguing it had not violated its contract. Administrators even offered to pay the remaining months of the agreement to buy their way out. Flock made no response.
So they resorted to pushback. Workers covered the cameras with black trash bags and zip ties. Workers believed to be from Flock repeatedly removed the coverings. The standoff continued in this surreal dance - cover, uncover, cover again - until the contract finally expired in April 2026 and the cameras came down.
The concern wasn't theoretical. Public records show immigration authorities searched data collected by Flock cameras at several Illinois public colleges, including Joliet Junior College, the University of Illinois Chicago and the University of Illinois Urbana-Champaign.
In some cases, federal agents directly accessed the data. Illinois officials also found that Customs and Border Protection had searched state Flock data in violation of state law. Elgin's own audit found no evidence that immigration agents had accessed its campus data, but administrators decided the risk wasn't worth taking.
Flock says federal agencies can no longer access local camera data unless law enforcement agencies grant permission. But surveillance researchers point out that companies benefit from maintaining large networks of cameras, even when a customer wants out. And other colleges still have these systems in place, with students still afraid to attend classes.
So what's the upshot for you?
A camera can be doing exactly what it was designed to do and still create a problem its owner never intended. License plate readers can turn an ordinary trip to school, work or a medical appointment into a searchable record of where you've been. Before your organization installs surveillance technology, ask who can access the data, how long it's retained, whether it can be shared with outside agencies, and whether you can actually terminate the contract and remove the equipment. The most important security feature may not be the camera. It may be your ability to turn it off.
TAKE ACTION: Map Your Own Surveillance
Today you are being tracked by any number of security cameras. As the data of these devices is aggregated, they become more invasive of that concept we used to know of as "privacy." If you haven't yet, browse over to deflock.org and check out the cameras in the area, or better yet, add the FlockHopper app to your phone and see how many Flock cameras log your trip. Then plan a route with no cameras and see what the difference is.
One of our staff found they were tracked by 5 different Flock cameras on a 2.7 mile (4.35 kilometers) journey to the supermarket. To do that with no Flock cameras made the trip 4.8 miles (7.7 kilometers).
That's what privacy costs now. It costs distance. It costs time. It costs effort.
But the point of checking is to know. Once you know where the cameras are, you have a choice. You can take the shorter route and accept being tracked. Or you can take the longer route and avoid the cameras. Or you can do something else entirely: you can know that your local police department has this infrastructure and you can ask them to justify it.
That's pushback. Knowledge first. Then choice. Then action.
A college covered Flock cameras with trash bags and refused to let the company remove the covers. That's pushback against surveillance. But pushback isn't just about cameras. It's about people who realized they'd been recruited into a scheme to launder stolen money, and they fought back by reporting it. Fifteen thousand Americans turned into witnesses against international cybercrime.
US: 15,000 Americans Recruited to Launder Stolen Money
An international cybercrime operation managed to recruit more than 15,000 Americans to help launder money stolen by hackers. Its alleged mastermind, Oleg Korniev, 42, pleaded guilty to running the operation, which moved millions of dollars through unsuspecting people's bank accounts.
The scheme worked by making victims believe they had landed legitimate jobs processing payments for businesses. It sounded like ordinary office work: receive money, transfer it, get paid. In reality, they were helping criminals move stolen money overseas.
The operation, known as Your Mule Cashout, helped launder at least $10 million stolen from more than 750 American bank accounts. Recruits were instructed to receive money into their personal accounts, withdraw it, and transfer it to supposed business partners abroad. The catch? The money came from cybercrime, and the promised compensation never arrived. What looked like an easy way to earn money was actually a criminal pipeline using ordinary people as the middlemen.
But here's where pushback enters: those 15,000 people realized something was wrong. They noticed the money wasn't coming. They noticed the transfers didn't make sense. They noticed they'd been used. And they reported it.
Korniev admitted responsibility for a scheme involving more than $14.7 million in actual and intended losses. He pleaded guilty to five offenses, including money laundering, computer fraud conspiracy, and aggravated identity theft. He faces up to 50 years in prison. Four associates have already been convicted and sentenced to prison terms ranging from 37 to 63 months.
So what's the upshot for you?
Never let a supposed employer turn your personal bank account into its payment-processing department. If a job asks you to receive money and forward it elsewhere, stop before you move a cent. Verify the company independently, and contact your bank if you've already transferred suspicious funds. You could otherwise end up with a frozen account, financial losses, or criminal charges. The job may be fake, but the money trail is real, and your name could be the one attached to it. Report what you find.
That's how 15,000 people took down an international crime ring.
Fifteen thousand Americans reported a money-laundering scheme and took down an international crime ring. That's pushback through reporting and refusal to participate. But pushback also looks like a French supermarket deciding to stop waiting for help and going after the hackers themselves. When a cyberattack turns freezers into ovens, you don't wait, you fight back.
FR: Hackers Turn French Supermarket Freezers Into Ovens
Hackers hit Intermarché, France's largest supermarket chain, targeting 150 stores across the country. They didn't steal data. They didn't hold systems ransom. They turned the refrigeration systems into ovens. Store freezers malfunctioned and heated up, destroying thousands of euros worth of frozen goods. The attack was deliberately designed for maximum disruption and maximum loss.
But Intermarché didn't wait. They deployed AI-powered analysis to understand what had happened. They finally applied the firmware patches they had been told for months to deploy. They restored their network in hours instead of days. And they did something unusual: they exposed the attackers' infrastructure. They shared the details publicly, helping other organizations defend against the same group.
The message was clear: you attacked us, but we're faster than you thought. We're already back online. And we're going to make sure you can't do this to anyone else.
That's pushback. Not just recovering from an attack, but fighting back by making the attacker's infrastructure visible to the world.
So what's the upshot for you?
When a major organization gets attacked, how quickly they recover matters. Speed of response doesn't just minimize damage, it shows the attackers they're not as clever as they think. And sharing details of the attack helps the entire sector defend itself. The hackers went after a supermarket chain. The supermarket fought back. Everyone else got smarter.
A French supermarket got hacked and fought back by exposing the attackers' infrastructure. But fighting back requires information, and information should be public. In Texas, a city was charging $2.3 million just to answer questions about how its surveillance system works. The pushback was: we're not paying for our own silence.
US: Your Car Is Being Tracked. Want to Know Who's Watching? That'll be $2.3 million. Please.
Your car's movements are being tracked, logged, and stored in police databases.
Want to know who's looking at your data and why?
In North Richland Hills, Texas, the answer comes with a $2.3 million price tag.
The city says that's what it would cost to fulfill a public records request about its Flock surveillance system. The request sought information about errors, misuse, and effectiveness. That's a lot of money to answer some pretty reasonable questions about what the police department is doing with your location data.
The request came from the Texas Privacy Coalition, which has asked nearly 200 law enforcement agencies for similar records. The responses range from free access to six-figure bills.
Houston's television station was quoted $121,000. North Richland Hills says the enormous estimate reflects the labor required to review roughly a terabyte of communications.
Maybe the workload is real. But when the price of transparency becomes prohibitive, the public is left wondering whether the goal is to disclose what's happening or discourage anyone from finding out. That's not transparency. That's surveillance by secrecy.
But here's where pushback enters: public records requests aren't going away because they're expensive. Police officers have abused Flock databases, including using them to stalk people for personal reasons. In Texas, public records requests helped expose one officer's misuse of the system, leading to a guilty plea on 100 felony counts.
The revelations helped fuel investigations and contributed to Governor Greg Abbott's decision to halt state funding for Flock cameras. Asking questions produced answers that some people would rather keep buried.
So what's the upshot for you?
Your car can become a tracking device you never agreed to carry. The database may reveal where you work, which doctor you visit, where you worship, and whom you see. You may never know who's searched for you, whether the search was justified, or how long the records survive. Ask your local police department whether it uses Flock, how searches are authorized, how long data is retained, and whether usage records are public.
If the answers are evasive, contact your local representatives. If they charge you millions to answer, contact the media. Surveillance works best when nobody asks questions, and a $2.3 million bill is one expensive way to encourage your silence. Don't pay it. Ask anyway.
Texas tried to hide the truth about surveillance by making questions too expensive to answer. But hiding goes deeper than money. The FBI had patched security vulnerabilities available for months, but contractors managing federal systems ignored them, leaving the bureau vulnerable to attack. The pushback: mandatory patching and removal of contractors who refused to do the work.
US: FBI Contractor Fails to Patch Critical Security Vulnerability
There has been an inquest at the FBI over how such a critical security lapse happened. The FBI determined that a contractor managing the bureau's jobs portal failed to update software "explicitly issued to secure the platform," according to Brett Leatherman, a senior FBI cyber official. The FBI has "removed the contractor," he said.
The software in question is a human-resources platform made by Oracle. ShinyHunters has said that the same vulnerability was previously used to attack targets in the education sector in May and June, according to Google's Threat Intelligence Group. But months later, the FBI contractor apparently still had not applied a security patch that was available for the software.
The breach exposed 2-3 terabytes of information from the FBI's job website, including sensitive personal information about FBI employees and applicants.
The pushback here is direct: when a contractor fails to patch known vulnerabilities, they're removed. When federal systems are breached, accountability follows. It's not perfect, but it's better than pretending it didn't happen.
So what's the upshot for you?
Want to make home and work life easier and safer when working with software and computers? Keep them patched. Patch your phone. Patch your computer. Patch your router. Patch your car's software if it connects to the internet. Security patches aren't optional. They're the difference between a system that's defended and a system that's already been breached. If the FBI can't stay on top of patching, neither can you, unless you make it a routine.
The FBI removed a contractor who refused to patch critical vulnerabilities. But responsibility doesn't stop with individual contractors. Hardware gets compromised too. Ledger hardware wallets sold through Southeast Asian resellers were physically implanted with spy chips designed to steal crypto wallets. The pushback: demand authenticity, verify your supply chain, and only buy through official channels.
Global: Ledger Confirms Spy Chip Implant Behind Wallet Crypto Thefts
Ledger confirmed that some of its hardware wallets sold by a Southeast Asian reseller were physically tampered with using a spy chip implant, leading to crypto thefts. Ledger investigated reports of users losing funds from devices bought through CryptoBilis, a major Malaysia-based retailer. It confirmed that at least one device contained an unauthorized hardware implant and that all known theft cases were linked to wallets from this reseller.
The implants were sophisticated, found mainly in Ledger Nano X models. They captured the screen output and button presses to steal the recovery seed phrase - the master key that unlocks your entire wallet. They transmitted the data wirelessly via an LTE connection using a tiny eSIM hidden inside the device. Some implants were hidden by swapping the battery. Others were fitted under the display where they'd never be noticed.
This isn't theoretical. This is someone opening your wallet, installing hardware you can't see, and stealing your crypto the moment you try to use it.
Ledger is contacting affected users and working with authorities. The company advises anyone who bought from this reseller not to set up the device - or to move funds to a new wallet with a fresh seed if already set up.
The company also stresses buying only through official channels, noting that its "Genuine Check" cannot detect these implants if the original secure chip is untouched.
So what's the upshot for you?
Your supply chain is your security. If you buy from a reseller instead of an official channel, you're trusting that reseller more than the manufacturer. When that trust is violated, the damage is permanent. A spy chip can steal your recovery seed. Once stolen, your wallet is gone. Buy hardware wallets only through official channels. Verify authenticity before using. And if you buy from a reseller and the price seems too good to be true, it probably is because someone's already installed hardware inside it.
Ledger hardware wallets got physically implanted with spy chips by resellers. But you can defend against that by being careful about where you buy. But what happens when your cloud provider's entire data center gets hit, and all your files disappear? You can't patch your way out of that. You can't verify authenticity. You just lose everything. That's what happened at Yandex when drone attacks took down Russian data centers.
RU: Your Cloud Files Could Disappear When the Data Center Gets Hit
Three drone attacks have damaged Russian tech giant Yandex's data centers, leaving customers unable to access some cloud files and services. Two facilities have shut down completely, while a third is operating with reduced capacity. The outages began after attacks on October 8, 9, and 11. Yandex has no reliable recovery timeline, and it remains unclear whether any stored data has been permanently lost.
Yandex, often called Russia's Google, provides cloud storage and computing services used by businesses and millions of consumers. The disruption has affected everything from file access to databases, computing resources, and AI services. Some customers have reported missing file thumbnails and failed downloads. Yandex itself is warning customers that its remaining infrastructure is unstable.
The bigger story isn't just about drone warfare or Russia. It's about how much we trust cloud providers to keep our digital lives available. A provider can have sophisticated technology and still suffer a major outage when physical infrastructure is damaged. And even if your files haven't been deleted, being unable to reach them when you need them can be just as damaging. And that is a critical infrastructure hit for Ukraine.
The pushback here is simple: Ukraine may be under Trump's thumb not to destroy oil refineries, but if their second option is data centers, it could be just as meaningful in this work to repel Russia from within its borders.
So what's the upshot for you?
If you depend on a single cloud provider, you're one attack, one outage, one natural disaster away from losing everything. The cloud is convenient. But convenience and redundancy aren't the same thing. When your data center goes dark, being convenient doesn't matter. Being backed up does. Just ask a Russian.
Yandex lost access to customer files when its data centers got hit. But that's a geopolitical attack that's easy to dismiss as "not my problem." The real pushback is defending against the hacking that's happening right now, everywhere. Chinese government hackers are inside networks worldwide, stealing sensitive data, and they're only able to do it because organizations aren't patching their software. The pushback: patch everything, authenticate everything, and close the doors that are already open.
CN: China's Hackers May Already Be Inside Your Network
The FBI has seized internet domains linked to a Chinese technology company accused of helping Beijing-backed hackers spy on organizations worldwide.
At the same time, seven governments warn that Chinese cyber operatives are stealing sensitive data and targeting critical infrastructure, including energy providers, airports, and universities.
This isn't some distant cyberwar. The same weaknesses attackers exploit in major organizations can exist in your home network or workplace.
Investigators say the operation used tools to hunt for vulnerable systems, steal files and passwords, and install malware. Outdated software, weak passwords, and unpatched Microsoft Exchange servers opened doors that should have been closed. Once inside, attackers could quietly collect information while organizations carried on as usual, unaware they were compromised.
Even your router could be part of the attack. Hackers have hijacked thousands of internet-connected devices to build botnets, hiding their activity behind traffic from ordinary equipment. The FBI disrupted a related network of roughly 260,000 devices in 2024. Now, the latest operation shows why these threats are far from over.
But the pushback is straightforward: close the doors that are already open. The Chinese hackers aren't breaking into locked systems. They're walking through doors left unlocked by negligence: unpatched software, default passwords, and remote access that was never disabled.
So what's the upshot for you?
Your best defense is to close the doors hackers are already looking for. Update your router and other connected devices. Replace anything no longer receiving security patches. Enable multifactor authentication. Disable remote access you don't need. If you run IT, verify that critical patches are installed, not merely scheduled. You don't need to outsmart a nation-state hacker. You need to stop making their job easy.
PROTECTIVE GUIDANCE
After a week of stories about surveillance, hacking, theft, and compromise, we want to give you something actionable: a guide to help you protect yourself and your family.
We've released an "Updated Family Identity Theft Protection Guide" that walks you through the practical steps to take before or after a data breach, how to freeze credit for yourself and your children, how to set up strong authentication, and how to create a recovery plan if identity theft does happen.
The guide covers:
• Updating and securing your everyday devices (phone, computer, TV, router, smartwatch, car)
• Temporarily disabling AI agents on your computer (Muse, OpenClaw, Hermes) until you've verified your system is clean
• Freezing credit for adults and minors at all four bureaus (Equifax, Experian, TransUnion, Innovis)
• Getting an IRS Identity Protection PIN to prevent fraudulent tax refunds
• Setting up a family password manager and multi-factor authentication
• Photocopying and securing important documents
• Establishing a family security word to verify identity during emergencies
• Following the official FTC protocol if identity theft does occur
Print it. Keep it in a safe place. Read it together as a family. Because the best protection isn't technology. It's preparation, awareness, and knowing exactly what to do when something goes wrong.This is what pushback looks like. It's not just refusing surveillance cameras or asking for public records. It's taking control of your own security. It's knowing your systems. It's verifying your supply chain. It's updating your software. It's backing up your data. It's asking questions and demanding answers.
Pushback is practical. Pushback is persistent. And pushback is how you fight back against a world that assumes you'll just accept whatever happens to your data, your privacy, and your security.
so, in summary...
Eight stories showed what happens when people stop accepting the status quo and start saying, "no".
A college covered Flock cameras with trash bags because immigration agents were using the data to track students. Flock tried to remove the coverings. The college left them on for six months until the contract expired. That's institutional pushback.
Fifteen thousand Americans realized they'd been recruited into a money-laundering scheme and reported it. The operation was dismantled. The mastermind pleaded guilty and faces 50 years in prison. That's community pushback.
A French supermarket got hacked and instead of waiting for law enforcement, deployed AI, patched their freezer firmware, fixed their network, all in just hours, and then exposed the attackers' infrastructure publicly so others could defend themselves. That's organizational pushback.
A Texas city tried to charge $2.3 million for public records on its surveillance system. Public records requests, journalists, and activists refused to pay for silence. Governor Abbott halted state funding for Flock cameras based on the information that did come out. That's partisan pushback.
The FBI removed a contractor who hadn't patched critical vulnerabilities and conducted an inquest into how such a lapse happened. That's institutional accountability.
Ledger confirmed spy chips were implanted in hardware wallets and repeated their "buy only through official channels and verify authenticity" message. That's supply-chain awareness.
Yandex's data centers got hit. Russians learned the hard way that cloud is convenient, and that their war can bring inconvenience.
Chinese government hackers have been penetrating networks worldwide for months, but they're only successful because organizations didn't patch software that patches were available for. The FBI seized domains and seven governments issued warnings... and that's only the beginning of pushback against nation-state hacking.
Pushback isn't fighting with weapons. It's fighting with information. It's fighting with refusal. It's fighting with verification. It's fighting with backups. It's fighting with questions.
So print our excitingly titled family guide. Know what to do. Patch your software. Freeze your credit. Verify your supply chain. Back up your data. Ask the questions the powerful don't want answered. Report what you see. Refuse what you won't accept.
Because pushback isn't a moment. It's a practice. And the more people who practice it, the harder it becomes for anyone; government, company, or criminal, to exploit the silence.
And that brings us to our quote of the week, from cryptographer and security expert Bruce Schneier:
"The surest defense against terrorism is to refuse to be terrorized. Our job is to recognize that terrorism is just one of the risks we face, and not a particularly common one at that. And our job is to fight those politicians who use fear as an excuse to take away our liberties and promote security theater that wastes money and doesn't make us any safer."
This quote comes from Schneier's 2006 essay "Refuse to Be Terrorized" in Wired magazine, but it applies perfectly to this week's theme of pushback.
Because that's what pushback is: the refusal to accept fear as an excuse for surveillance, negligence, or control.
Pushback is the refusal to accept the unacceptable.
And that refusal is how things change.
That's it for this week; stay safe, stay secure, push it good, and we'll see you in se7en.
Comments
Post a Comment