Security Newsletter | 7/23/26

If you take nothing else from this newsletter, just do these three things to protect yourself:

1. Share passwords using the Passwords app. Whenever you need to share a password (such as for a joint streaming account) with a friend or family member, create a password sharing group in the Passwords app.
2. Turn off location history in Apple Maps. If you use Apple Maps for navigation, it keeps a record of every place you visit and creates a searchable timeline. You can turn off Visited Places in Settings.
3. Take a few minutes to review who has access to your data. In the Settings app, you can review which apps and contacts you have granted access to certain data, and what data they have access to.

California residents can now take extra steps to protect their privacy through the Delete Request and Opt-out Platform (DROP). If you live in California, you can submit a DROP request, which requires any data broker registered in the state to delete any data they have about you. You'll also be opted out of having your data sold to those same brokers in the future. You can submit DROP requests now, and starting August 1, data brokers will have 45 days to comply with the request. Read more at the Electronic Frontier Foundation, or, if you live in California, check out the DROP website.

The Bottom Line: We think it's great that California has implemented this law, and hope that other states will take action to pass similar legislation. In the meantime, if you're a resident of California, we definitely recommend that you submit a DROP request.

Can Flock Watch You Wherever You Go?

Surveillance company Flock has introduced a new type of camera called the Condor. Normally, Flock's automated license plate readers (ALPRs) only capture the license plates of passing cars. The Condor camera, on the other hand, is designed to track people. It can lock onto specific people to follow their precise movements, identify them with facial recognition, and even zoom in on their phone screens to see what they're looking at.

The public has become increasingly antagonistic toward Flock and its cameras. The Los Angeles Police Department recently declined to renew its contract with Flock due to concerns related to privacy. Flock itself also decided against rolling out a new feature that would have placed microphones all over cities listening for audio that indicated distress (such as people screaming or calling for help).

The Bottom Line: Flock's Condor camera is a disturbing invasion of privacy. These cameras treat the entire general public like crime suspects. Thankfully, the LAPD's refusal to renew its contract shows that public scrutiny can affect policymaking decisions in some jurisdictions. However, as we've seen in the past, canceling contracts with Flock does not always mean that the cameras are deactivated.

Surveillance Toolkit for Defense Attorneys

With surveillance tech like ALPRs becoming so prevalent in the US, the American Civil Liberties Union (ACLU) has created a toolkit to help defense attorneys protect their clients. The toolkit contains resources for attorneys to use to find out what surveillance technology law enforcement may have used against their clients. Read more at the ACLU.

The Bottom Line: Attorneys can email the ACLU using the linked page above to request access to the toolkit. This is a good resource for defense attorneys to take advantage of amid the increase in police reliance on surveillance tech, which has been known to get the wrong person detained.

OpenAI "Accidentally" Hacks Rival AI Platform

Hugging Face, an AI development platform, was hacked this week. The hacker uploaded malicious code to the site, which allowed them to exploit a vulnerability and access Hugging Face's internal systems. The hacker was able to steal a set of credentials, which Hugging Face has since rotated. The hacker responsible for this data breach? OpenAI. According to OpenAI, the company was testing the cyber capabilities of its large language models when the LLM breached Hugging Face. Essentially, OpenAI is saying the AI model acted on its own and hacked Hugging Face without any instruction from the company.

The Bottom Line: It would appear that OpenAI is trying to dodge accountability by claiming that the AI acted of its own volition, but the fact is that it wouldn't have done so if it hadn't been designed to behave that way in the first place.

The correct answer is probably C. Restart your computer and run a malware scan. This is a common scam that hijacks your computer screen by locking the window in full screen and playing a siren to make you panic so that you're more likely to call the phone number on the screen without thinking. Usually, when you call the phone number, you'll be connected to a scammer who will provide you with instructions to install a screen-sharing tool that allows them to take over your computer.

If you ever encounter a pop-up like this, restart your computer by pressing and holding the power button until it shuts down. Once you have it powered back on, use a malware scanner, such as Malwarebytes, to double-check that your computer has not been infected with any viruses. It likely hasn't, but it's best to stay on the safe side. Looking up the real phone number for Apple Support and calling them is also an option for your peace of mind, though they will likely provide you with similar instructions.

Interested in learning more about the Passwords app? Check out:

• How To Sort Your Passwords in the Passwords App
• What Are Compromised Passwords on iPhone?