Citizen Lab: Discover-Tech ads delivered zero-click spyware to Al Jazeera devices

Citizen Lab links Discover-Tech ads to zero-click spyware infections

Citizen Lab, a digital investigations unit at the University of Toronto, says an Israeli advertising agency, Discover-Tech, has served millions of online ads enabling zero-click spyware. Its platform Controlium allegedly lets clients mass-profile and deanonymise users, then covertly hack targets with third-party spyware requiring no victim interaction. Citizen Lab believes dozens of devices at Qatari broadcaster Al Jazeera were compromised. Millions of users worldwide have received Discover-Tech ads since 2024, including in Yemen, Brazil, Mexico and Czechia. Researcher Wolfie Christl called it disastrous that major ad vendors failed to detect the malicious operations for years, urging regulators to investigate. Discover-Tech has been approached for comment.

Online ads weaponised to deliver ‘zero-click’ spyware, researchers say | Hacking | The Guardian →

Topics: SpywareOnline tracking

UK ICO reprimands Met Police over officers’ use of Auror platform

The UK Information Commissioner’s Office reprimanded the Metropolitan Police Service after officers and staff uploaded sensitive suspect data to Auror, an unapproved retail platform tracking shoplifters via facial recognition and AI. The ICO said the force failed to install technical restrictions against shadow IT, echoing a 2021 reprimand over Clearview AI. Officers created 500 accounts, 375 actively used, identifying 179 individuals, 59 of whom were arrested, charged, convicted or circulated as wanted. Data shared included names, birth dates, addresses and references to facial recognition, plus details on three under-18s. The ICO found high risks of misidentification and reputational damage, and missed opportunities to restrict the platform used since March 2023.

UK data watchdog warns Met Police over shadow IT data breach | Computer Weekly →

Topics: Facial recognitionPolice misuse of surveillance databases

EDPB sets first smart glasses guidance, requiring camera shutdown when LED covered

The European Data Protection Board adopted its first dedicated smart glasses guidance on October 13, 2026, classifying camera-equipped wearables as high-risk under the GDPR. The non-binding guidance, which typically becomes the minimum standard national regulators apply, requires recording indicators be physically impossible to defeat: covering the LED must trigger immediate camera shutdown at any point during recording. Hamburg’s data protection authority found Meta’s August 2026 Ray-Ban safeguard fires only when recording begins, not continuously, and that white LEDs can be indistinguishable from reflections. The board also demands layered warnings, on-device processing where possible, and opt-in footage storage, with manufacturers bearing primary compliance responsibility.

EU Requires Smart Glasses LED to Shut Camera Off When Covered: GDPR Now Falls on Makers →

Topics: Smart devices privacyGDPR

Meta Ray-Ban glasses recorded conversations without wake phrase

Meta’s Ray-Ban smart glasses recorded conversations without the Hey Meta wake phrase, leaving owners to find audio recordings and transcripts in the Meta AI app. The issue affected three pairs, including second- and third-generation models, after a firmware update. Meta says the problem has been resolved but has not explained the cause or how many users were affected. One Reddit user said recordings appeared even with the Respond without Hey Meta setting turned off, and that the white notification light sometimes activated during normal speech. Meta support advised disabling microphone and camera permissions and deleting voice history; the user said they consulted a lawyer about a possible class-action lawsuit.

Some Meta Smart Glasses Secretly Recorded Conversations: Owner… →

Topics: Smart devices privacyMeta

Patients struggle to opt out of MyChart and Care Everywhere data sharing

A physician and journalist spent hundreds of hours across 25 clinics in seven states testing whether patients can opt out of health data sharing, finding the process often impossible in practice. At University Hospitals in Ohio, opting out required 26 steps, a notary and a flight to Las Vegas. Epic Systems, whose MyChart holds over 305 million patient charts, confirmed checking in makes patients part of Care Everywhere by default unless they explicitly opt out, and only 112 patients have chosen full undiscoverability since August 2025. Epic’s Matt Doyle said there is no single place to revoke authorization; patients must contact each record custodian individually.

MyChart and a major hospital said I could opt out of sharing my health data. But they didn’t make it easy →

Topics: Healthcare data breaches