Cellebrite phone cracking tied to refugee, activist and journalist cases across Europe

Cellebrite tools underpinned prosecutions of refugees, activists and journalists in Europe

A Statewatch investigation details how Cellebrite and Magnet Forensics extraction shaped cases across Europe. In Italy, Ahmed Salem, a 24-year-old Palestinian from Lebanon, was sentenced to four years after data from two phones was extracted; his lawyer says prosecutors withheld the precise dates and portions of files relied on. Cellebrite data also featured in the case against Anan Yaeesh, sentenced in January 2026 to five years and six months, with extracted messages transferred to Israeli authorities via a mutual legal assistance request. In Turin, three No CPR activists had phones extracted with UFED Premium despite refusing passcodes, with a first hearing set for January 2027. German journalist Hendrik Torner’s phone was held over 11 months while prosecutors accessed Signal, Instagram and Telegram messages; his case is pending at the Federal Constitutional Court. Cellebrite says it supports millions of lawful investigations and investigates all misuse allegations.

Israeli phone cracking tools targeted refugees, activists, journalists in Europe - Statewatch →

Topics: Spyware

Muse maker Interaxon trained an AI model on about 50,000 hours of EEG data

An investigation by Science, conducted with the Pulitzer Center’s AI Accountability Network, found consumer neurology companies have accumulated tens of millions of hours of EEG recordings and that several are using the data to develop brain foundation models despite initially failing to spell out that use in privacy policies. Interaxon, the Canadian firm behind the Muse sleep and meditation headband, monitors brain activity during sleep and turns recordings into rest-tracking reports. It has trained an AI model using about 50,000 hours of EEG recordings and says it strips identifying information such as names, emails and addresses before use. Chief Marketing Officer Nadia Kumentas said the company aims to use as much of that eligible corpus as possible.

Wearable sleep trackers are using your brainwaves to train AI models without explicit user consent — tens of millions of hours of EEG data harvested | Tom’s Hardware →

Google ad tags will receive full visitor IPs by default from January 11, 2027

From January 11, 2027, Google advertising tags in server-side Google Tag Manager containers will receive visitors’ full IP addresses by default, covering Google Ads, Display & Video 360, Search Ads 360 and Campaign Manager 360 tags on advertiser- and agency-run tagging servers. Containers holding only Google Analytics tags keep redacting IPs, and browser-only tagging is unaffected. Google’s help page describes no on/off switch: container owners must build a custom variable on getAnonymizedIpAddress() and an Augment event transformation overriding ip_override. The function zeroes the last IPv4 octet and the last 80 bits of IPv6. TRKKN’s Nikel Schubert said there is no simple switch and the transformation must be published before the date, suggesting December testing. Google has not said whether unconsented requests will carry full IPs.

Google ad tags gain full IPs on January 11 unless sGTM owners build a fix →

Topics: GoogleOnline tracking

EDPB picks automated candidate screening for 2027 GDPR enforcement sweep

The European Data Protection Board has selected automated candidate screening as the topic of its sixth coordinated enforcement action, covering AI-driven screening tools and launching during 2027. The sweep will focus on the right not to be subject to a decision based solely on automated processing and the related right of access. Under the Coordinated Enforcement Framework, the Board picks a topic, national authorities join voluntarily, and the Board aggregates their national results; it has not said which authorities will sign up. The current action covers GDPR transparency obligations with 25 authorities, while the 2025 right-to-erasure action drew 32 authorities and 764 controllers, reporting on February 18, 2026. Breaches of data subject rights sit in the GDPR’s higher fine tier, reaching 4% of worldwide annual turnover.

EU Regulators Set 2027 GDPR Sweep to Test Human Review in Automated Candidate Screening →

Topics: GDPR

Colorado lawsuit targets Flock license plate readers after wrongful porch-theft charge

Chrisanna Elser filed a federal civil rights lawsuit in October 2026 against Flock Safety, the towns of Columbine Valley and Bow Mar, and two police officials, alleging surveillance and a wrongful accusation violated her constitutional rights. Police used Flock license plate readers to identify her green Rivian after a September 2025 porch theft, but her vehicle’s own cameras proved she was not the thief and the charge was dropped. The suit joins proposed class actions in Georgia, California and Colorado challenging Flock’s network of about 120,000 cameras across 49 states. Courts have split: a Virginia federal judge upheld warrantless Flock use, while an Oklahoma judge ruled in October that a warrantless search of Flock data violated the Fourth Amendment. A Pew analysis found only half of 1,517 agencies with public Flock portals disclosed individual search information.

How Everyday Life Feeds Government Surveillance Databases →

Topics: Flock SafetyLicense plate readers (ALPR)