FBI Eyes Nationwide License Plate Tracking, While Google Exposes Unpatched Chromium Flaw
This week's security roundup includes concerns over the FBI's potential nationwide license plate tracking and **Google's** accidental release of exploit code for an unpatched Chromium vulnerability. Additionally, law enforcement is cracking down on deepfake sexual abuse, and a new law aims to protect individuals from non-consensual nude images.
A recent **WIRED** investigation uncovered that a former Phoenix police officer, now a firearms trainer for Immigration and Customs Enforcement, was involved in six shootings, four of which were fatal. Separately, a New York police officerβs lawyer has been banned from **Madison Square Garden** amidst a lawsuit over injuries sustained at a boxing match.
### Take It Down Act and Data Broker Opt-Outs
The **Take It Down Act** went into effect this week in the US, empowering individuals to demand the removal of nonconsensual nude images from websites. However, opting out of data collection by data brokers remains challenging, with research suggesting that many companies employ manipulative tactics to hinder the process.
### FTC Settlement Over Non-Functional "Active Listening" Technology
The **Federal Trade Commission (FTC)** announced a settlement with three marketing firms, not for selling "Active Listening" technology for targeted advertising, but because the technology allegedly did not work.
### Bipartisan Effort to Curb Automatic License Plate Readers (ALPRs)
A bipartisan group of US lawmakers is attempting to regulate automatic license plate readers (ALPRs). Their proposed legislation aims to prevent state and local governments from using this surveillance technology for police tracking. However...
### FBI Plans Nationwide Access to License Plate Readers
While US lawmakers stealthily proposed to prohibit the use of automated license plate readers across the country this week, it has also been revealed that the **Federal Bureau of Investigation (FBI)** is planning to buy nationwide access to the cameras and access βnear real timeβ data about vehicle movements.
First reported by **404 Media**, recently published procurement records for the FBI Directorate of Intelligence show the agency gearing up to pay millions for access to data captured by roadside ALPR data. These cameras take images of every passing vehicle, adding their license plate, location, time and data, into searchable databases that are often accessed by local law enforcement agencies and some federal agencies.
βThe FBI has a crucial need for accessible LPRs to provide a diverse and reliable range of collections across the United States,β a statement of work says. βThis data should be available across major highways and in an array of locations for maximum usefulness to law enforcement.β Further documents said the access to data must be provided in βnear real time.β
### Google Publishes Live Exploit Code for Unpatched Chromium Flaw
**Google** this week made public a working proof-of-concept for an unfixed vulnerability in **Chromium**, the open source codebase underpinning Chrome, **Microsoft Edge**, Brave, Opera, Vivaldi, and Arc, reported Ars Technica. The flaw was originally reported to the company 42 months ago by independent researcher **Lyra Rebane**, who initially assumed Wednesday's posting to the project's bug tracker meant a patch had finally shipped. It hadn't. Google pulled the disclosure after the error became apparent, but the exploit code is already mirrored on archival sites.
The bug abuses the Browser Fetch API, a feature meant to handle large background downloads, allowing any website a target visits to spin up a persistent service worker on the device. The resulting connection can be used to monitor browsing activity, route traffic through the victim's machine, or pull the device into a proxied DDoS networkβconnections that survive browser restarts and, in some cases, reboots. On Edge, telltale signs are minimal. Chrome users may see an unexplained downloads dropdown.
Google's own engineers flagged the bug as serious in the original disclosure thread, assigning it a multiple high-severity tiers in the company's internal ranking system. Firefox and Safari are unaffected, as neither implements the relevant feature. Google said it is working on a fix. Users seeing unprompted download windows should treat them as suspect.
### Feds Arrest Men Allegedly Behind Deepfake Sexual Abuse Watched Millions of Times
Ever so slowly, a crackdown on people creating deepfake sexual abuse images may be starting. In recent months, the UK and the EU have announced plans to ban so-called nudifying websites that create fake nude images of women and girls using artificial intelligence. With the increasing enforcement of the Take It Down Act since May 19, similar pressure is being applied in the US.
This week, the Federal Trade Commission sent a letter to 12 companies offering nudifying services, warning them they may be in violation of the Act saying they should have a process βthrough which victims can request the removal of nonconsensual intimate images.β While not limiting the servicesβ content, the move increases scrutiny on the harmful sites.
The Department of Justice also arrested two men for allegedly sharing βthousandsβ of AI-created photos and videos showing real women nude or involved in sex acts. The men, **Cornelius Shannon**, 51, and **Arturo Hernandez**, 20, are alleged to have uploaded the AI creations to pornography websites and video sharing platforms. The images and videos, which prosecutors say were viewed millions of times, included celebrities and politicians, but also women known to the accused. The arrests follow the first conviction of an Ohio man last month under the Take It Down Act.