Surveillance Technology

The FCC announced on October 23, 2026 the first enforcement of new rules banning devices containing smart components from 'Covered List' entities, blocking a wireless video transmitter and a dashboard camera that used HiSilicon's HiVision Hi3516CV610 chip. HiSilicon, a Huawei subsidiary, marketed the chip for 'the surveillance market' with built-in facial detection algorithms. The rule closes a loophole that previously let banned companies' chips reach US consumers embedded inside other manufacturers' products. FCC Chairman Brendan Carr called the chips 'potential spyware' posing an 'unacceptable risk' to US consumers.

Citizen Lab's October 15, 2026 'Exposing AdFection' report found that Israeli ad-tech company Discover-Tech operates a platform called Controlium that de-anonymizes and fingerprints users via mobile advertising identifiers, browser identifiers, and IP addresses, then delivers 'controlled ads' capable of zero-click infection -- devices are compromised automatically when the ad is displayed, with no user interaction required. Citizen Lab traced a malware sample recovered from a compromised Al Jazeera device through a documented infection chain: contact with Discover-Tech ad infrastructure, then a Candiru validator server, then a Candiru command-and-control server, matching the attack signature of Candiru (rebranded as 'Integrity Labs' after its 2025 acquisition by Integrity Partners). At least 45 Al Jazeera devices were infected between 2024 and 2025. Discover-Tech-served ads carrying this capability also reached networks in Austria, Denmark, France, Mexico, Israel, Italy, Norway and Sweden, including government ministries, security agencies, NATO and the UN, though no client or government customer was publicly named as having ordered the specific attacks. Al Jazeera called the targeting 'an attack on press freedom and on the public's right to know'; neither Discover-Tech nor Candiru/Integrity Labs responded to requests for comment.

Documents unsealed in September 2026 and made public in redacted form around October 3, 2026 showed ICE has been feeding photographs of protesters into a Palantir-built database as part of its immigration enforcement casework system. Palantir's work for ICE includes a 2014 original contract, a roughly $96 million five-year Investigative Case Management (ICM) support contract from 2022, and an additional roughly $30 million in 2025 for the 'ImmigrationOS' platform. Civil liberties advocates say storing images of individuals engaged in First Amendment-protected protest activity in an immigration-enforcement database raises concerns about surveillance of lawful protest and potential chilling effects on civic participation.

An investigative report by Tibet Watch, with research support from C4ADS, analyzed Chinese government procurement tenders, contract awards, police bulletins, flight bans, and training records to document an extensive drone surveillance and counter-drone network built across the Tibet Autonomous Region. Security agencies from regional anti-terror units down to county police stations have acquired DJI equipment, with pilots trained for 'stability maintenance' (weiwen) - the CCP term for suppressing dissent - echoing DJI's 2017 training of police in Xinjiang for similar purposes. The report found authorities closed airspace over Lhasa and four other prefecture-level areas to unapproved flights and, since May 2026, require all newly manufactured drones in China to be registered to the owner's identity.

Euro-Med Human Rights Monitor published a report demanding suspension of the Stargate UAE AI campus -- a multi-gigawatt data center project involving G42 alongside OpenAI, Oracle, Nvidia and SoftBank -- pending an independent human rights impact assessment. The report and accompanying regional press coverage cited the absence of credible independent oversight of the facility under the UAE's broad 2021 cybercrimes law, G42's documented history of surveillance-linked ventures (ToTok, DarkMatter), and reliance on low-wage migrant labor without documented labor protections for construction and operations staff.

In July 2026, two UK parliamentary committees (Science and Technology; Health and Social Care) urged the Labour government to exercise a February 2027 break clause and terminate Palantir's seven-year, £330M contract to run the NHS Federated Data Platform, citing use of Palantir's software to support military strikes in Gaza and Iran, its role in US ICE immigration operations, and data-security concerns. In September 2026, Health Innovation Minister James Frith disclosed to the Commons Health Committee that roughly 60,000 additional patients withdrew their medical records from NHS research between mid-May and mid-July 2026, attributing at least part of the rise to public 'mistrust' of Palantir that moved in step with press attention on the company's NHS role, while describing the increase as 'modest' but requiring continued monitoring. DHSC and Frith gave conflicting public statements over whether NHS trusts are required to use the platform.

Digital rights group SHARE Foundation, corroborated by Amnesty International and Citizen Lab, found at least 14 Serbians infected with mercenary spyware between December 2025 and August 2026, including student pro-democracy activists, an opposition member of parliament, and a local government official. At least one confirmed Pegasus infection (zero-click) was documented alongside at least two infections with a domestic NoviSpy spyware variant, one occurring after police confiscated a student's phone during questioning. Apple sent threat notifications to affected users in 110 countries on August 13, 2026. The targeting coincided with Serbia's March 2026 local elections and ongoing student protests following the 2024 Novi Sad railway station collapse, with additional targeting anticipated around October 2026 parliamentary elections. Citizen Lab researcher John Scott-Railton said Pegasus 'is still being used to hack people campaigning for democracy' despite a decade of NSO reform promises.

In August 2026, Huawei courted Egypt with a proposal to build AI data centers powered by its Ascend chips, explicitly including military and surveillance applications and integration with national population databases; reporting noted the presence of China's Ministry of Public Security insignia in proposal materials, suggesting direct involvement of Chinese state surveillance infrastructure. The bid put Huawei in direct competition with a US-backed consortium for the same government tender, marking one of the first instances of head-to-head US-China competition for a national AI data center contract. The US government raised concerns, warning of extraterritorial legal consequences for unauthorized use of restricted Huawei accelerators; Egypt is one of roughly 40 countries requiring US permission for AI chip shipments. A similar Huawei-powered national AI proposal in Malaysia was scaled back after US pressure, and Malaysian customs seized a $13 million chip shipment bound for re-export in June 2026.

A cross-border investigation by Forbidden Stories, the Guardian and Middle East Eye, based on a decade-long DGST insider (pseudonym 'Safir') corroborated by security sources in Morocco and Europe, detailed how Morocco's intelligence agency DGST acquired and used NSO Group's Pegasus spyware from 2017 onward against domestic political opponents, journalists and foreign officials, including French President Emmanuel Macron and 15 French government members. The investigation described a three-party arrangement in which a UAE-linked company (Al Fahad Smart Systems, later acquired by UAE state-owned defense group Edge) acted as financial intermediary or payer for Morocco's access to Pegasus. Morocco has consistently denied purchasing Pegasus despite the documentary and testimonial evidence; NSO Group declined to confirm Morocco as a customer, citing Israeli law.

On July 13, 2026, the European Union imposed sanctions on VK Company for developing MAX, a messaging app mandatorily preinstalled on all smartphones, tablets, computers, and smart TVs sold in Russia since September 2025. MAX's terms of service explicitly permit sharing user data with Russian government institutions, and human rights lawyers say law enforcement has access to VK-administered platforms including VKontakte, Odnoklassniki, and MAX. The EU action, part of a package that also sanctioned developers of the FSB's SORM surveillance system, followed a Russian government crackdown on independent apps such as Telegram and WhatsApp. MAX had over 45 million registered accounts and 18 million daily active users as of late 2025.

On June 5, 2026 Microsoft published the conclusion of its internal investigation into the Israeli military's use of Azure cloud and other Microsoft products. The review acknowledged prior gaps and committed to strengthening human rights governance procedures, expanding internal escalation paths for misuse allegations, and tightening contract language. Human-rights advocates and Microsoft employees criticized the review as insufficient because it did not commit to terminating identified contracts or publish the underlying findings. The review followed sustained internal organizing and external reporting on mass surveillance of Palestinians via Azure.

Middle East Eye reported in June 2026 that Israeli spyware firm NSO Group continued to target WhatsApp users with Pegasus despite a binding US court order arising from the Meta v. NSO Group litigation. The reporting cited evidence of continued infections after the judgment, raising the prospect of contempt proceedings and renewed pressure on US sanctions enforcement against the company.

In May 2026, London Mayor Sadiq Khan's Office for Policing and Crime (MOPAC) blocked a proposed two-year, up to £50M Metropolitan Police contract with Palantir for AI-driven criminal-investigation data analysis, finding the Met had seriously considered only one supplier and failed to present a procurement strategy for approval - a 'clear and serious breach' of procurement rules. Palantir filed a High Court challenge in June 2026, alleging MOPAC acted unlawfully and irrationally by treating the company's 'values and ethics' as grounds for rejection and imposing an unlawful veto; MOPAC denies ethics were the basis and says the Met's process itself was unlawful and gave 'misleading and/or inconsistent information.' As of September 2026, Khan agreed to have his texts and emails searched as part of discovery, with 12+ MOPAC/GLA officials also designated document custodians; a full High Court hearing is scheduled for January 2027.

In April 2026, the EFF published analysis showing Palantir's ELITE tool is used by ICE for mass deportation sweeps, contrary to Palantir's claims of 'prioritized enforcement.' Sworn testimony revealed ICE agents use ELITE to determine where to conduct deportation sweeps using data from 'all kinds of sources' including Medicaid. Nearly 1 in 5 ICE arrests were of Latine persons with neither criminal history nor removal order. Reports link Palantir systems to facial recognition used to identify people recording law enforcement. The tool has been connected to deaths of Renee Good and Alex Pretti. Palantir publicly embraces UN Guiding Principles on Business and Human Rights.

On February 23-24, 2026, xAI reached agreement with the Pentagon to deploy Grok on classified military systems at Impact Level 5 (IL5) - the highest military AI security classification. Unlike Anthropic, xAI accepted the Pentagon's 'all lawful use' standard without restrictions on autonomous weapons or mass surveillance. The deal positions Grok to replace Claude across up to 3 million DoD personnel, with potential applications in intelligence analysis, weapons development, and battlefield operations.

In January 2026, reporting revealed that ICE was using a Palantir-built tool called ELITE that taps Medicaid data to identify and arrest people for deportation. The tool maps potential targets and provides 'confidence scores' for individuals' current addresses. A data-sharing agreement between ICE and the Centers for Medicare and Medicaid Services gave ICE access to personal data of nearly 80 million Medicaid patients. The Electronic Frontier Foundation challenged the use of healthcare data for immigration enforcement, arguing patients never consented to their health-related information being repurposed for deportation.

On December 30, 2025, the Treasury Department's Office of Foreign Assets Control removed three executives linked to the Intellexa commercial spyware consortium from its sanctions list. The individuals had been sanctioned by the Biden administration in 2024 for enabling spyware (including Predator, capable of one-click and zero-click device compromise) used to target U.S. government officials, journalists, policy experts, opposition politicians, and activists worldwide, as part of a broader effort under Executive Order 14093 to curb commercial spyware. Treasury and State Department officials offered only a vague characterization of the removal as a 'normal administrative process,' without publicly explaining what changed in the underlying conduct that had justified the original designations.

The US Federal Communications Commission designated DJI as a national security threat and banned its communications equipment from use in the United States in December 2025.

Ghana and the UAE signed a roughly $1 billion agreement for what was billed as Africa's largest AI and innovation hub, with G42 affiliate AI71 responsible for a $180 million AI compute hub and a further $100 million national digital-identity system built on Falcon large language models. Investigative reporting (The Labari Journal) found the underlying MoU had not been published, that the authority of Ghana's planned Responsible AI Office over the foreign-operated hub was undefined, and that Ghana's Emerging Technologies Bill governing data protection standards remained in draft form when the deal was signed. The report also noted an Emirati signatory to related deals had past ties to the DarkMatter surveillance venture. G42 has separately taken steps to reduce China-linked technology exposure and deepened US ties (Microsoft $1.5B investment, board seat).

Following the Guardian's investigation revealing mass Palestinian surveillance via Azure, Microsoft ceased and disabled specified Israel Ministry of Defense subscriptions including cloud storage and AI services. Microsoft President Brad Smith stated 'We do not provide technology to facilitate mass surveillance of civilians.' This was the first known case of a US tech company withdrawing services from the Israeli military since the Gaza war began. However, Microsoft's wider relationship with the IDF remained intact, and Unit 8200 reportedly migrated the surveillance data to Amazon Web Services.