eMudhra exits TLS business after 8 weak-key certificates

eMudhra quits global TLS business after defective certificate keys exposed

India-based certificate authority eMudhra is withdrawing from the global SSL/TLS business, two days after researchers revealed it had issued eight intermediate TLS certificates with private keys so weak they were trivial to crack. The NIST P-384 keys should carry roughly 384 bits of entropy; the compromised certificates had key sizes of 3 to 8 bits, with the strongest offering at most 256 possibilities. Anyone could use the cracked keys to mint certificates trusted by major browsers, email servers, IoT devices, Docker containers and Linux machines. Chairman V. Srinivasan cited compliance costs, the business accounting for just 1 percent of revenue, and free TLS providers reducing returns. He said social media scrutiny was out of proportion to the unit’s role, and the board concluded withdrawal was right for shareholders.

Disgraced eMudhra drops out of TLS business after using cert private key of 4 →

Proton hosts map of 300,000-plus Flock surveillance devices

Proton is hosting a free map of Flock surveillance devices on its Swiss servers, showing more than 300,000 cameras and other equipment based on a December 2025 snapshot. Flock makes automated license plate readers used by police, businesses, schools and homeowners associations, logging over 20 billion vehicle sightings monthly across 49 states, searchable by police and shareable across jurisdictions. A Washington Post investigation found at least 50 officers accused or charged with misusing plate readers, with Flock’s system involved in 46 cases. Researcher Joshua Michael found Flock servers exposing an access token, retrieved a device inventory and published the map. Flock fixed the flaw but sent a cease-and-desist letter calling him a malicious actor; Proton rejected a trademark complaint and republished the map. Flock says any abuse above zero is unacceptable.

This Flock Camera map shows more than 300,000 devices →

Topics: Flock SafetyLicense plate readers (ALPR)

US Park Police lease $343,000 in mobile cameras from LVT

The US Park Police are leasing mobile surveillance cameras for $343,000 from Utah-based LiveView Technologies, which also supplies Immigration and Customs Enforcement, federal contract records show. The Interior Department awarded the fully obligated lease on 14 September, running through the end of February; the records do not state how many camera trailers are covered. The deal follows Donald Trump’s claims that vandals damaged the reflecting pool in Washington DC, charges since dismissed, and his Truth Social warning that cameras had been installed there. The Washington Post reported LVT cameras at Memorial Circle and near statues by the Arlington Memorial Bridge. LVT’s towable trailers run AI software that can flag loitering and read license plates; the company says its systems do not actively apply facial recognition and that customers own their data.

US Park Police spend $343,000 on mobile surveillance cameras in Washington DC | Washington DC | The Guardian →

Malaysia requires government-only encryption keys for cloud data

Malaysia now bars confidential and restricted government data from overseas clouds and requires all government data, at every sensitivity level, to be encrypted with keys owned and controlled exclusively by the Malaysian government, Digital Minister Gobind Singh Deo said in a written parliamentary reply. The key-custody rule means a US court order under the CLOUD Act compelling Amazon, Microsoft or Google to hand over data on Malaysian servers yields nothing intelligible, because providers do not hold the keys. Keys must sit in hardware security modules outside provider administrative control, exceeding bring-your-own-key arrangements. The trade-off: no provider-side search, indexing, collaborative editing, Copilot-style AI tools or content threat detection. The mandate rests on MyKriptografi, the National Cryptography Policy approved by Cabinet on November 28, 2025.

Malaysia Takes Encryption Keys Away From Cloud Providers to Defeat US Court Orders →

Topics: Encryption

Toronto Crime Stoppers halts anonymous tips after breach of 176,859 reports

Toronto Crime Stoppers has temporarily suspended its anonymous tip service after 176,859 tips submitted between January 2022 and November 2025 were stolen in a data breach. Chair Sean Sportun said Wednesday the service was paused immediately and the Tip Submit feature removed from its website. The stolen data included 14,973 names; tipsters are not required to give names, but some include them to explain what they witnessed, and it is unclear whether those named are tipsters or people described in reports. Navigate360, the third-party vendor owning the P3 software, told the organization in March that tips had been stolen but insisted P3 remained secure, and did not confirm Toronto’s data was affected until June. Sportun said the service had still not seen the stolen tip text and apologized, saying for some people the promise of anonymity was broken. The Toronto Police Service also suspended its use of Crime Stoppers.

‘We are deeply sorry’: Toronto Crime Stoppers suspends anonymous tips after data breach →

Topics: Third-party and vendor breaches