The Boston city government abandoned Flock Safety's license-plate reader cameras after the company shared data nationwide in violation of a contract provision, according to city officials.

"We have actually abandoned Flock," Boston Mayor Michelle Wu said in her monthly "Ask the Mayor" segment on GBH News last week. Wu made the comment a few days before the release of Boston's annual surveillance technology report, which said a Flock "vendor error" resulted in nationwide data sharing.

The report, which covers 2025, describes how the Boston Police Department deployed about 45 Automated License Plate Reader (ALPR) cameras in a trial with Flock from April to September last year. The unauthorized data sharing occurred during the first few days of the pilot, the report said:

Pursuant to the contract, the Flock ALPR Pilot Program was designed to restrict access to the data collected by BPD ALPR cameras exclusively to trained BPD personnel. The contract clearly noted that data sharing was to be disabled, and BPD confirmed with Flock that settings were “off” for sharing. Within three days of initiating the Pilot, BPD became aware that other law enforcement agencies were able to access license plate and vehicle information collected from BPD ALPR cameras using a nationwide lookup feature that was enabled by the vendor in error. Upon learning of the vendor error, BPD ensured that the function was immediately disabled and access to the Department’s data was no longer available without submitting a written request to BPD as described above. No further direct access was available for the duration of the Pilot.

The report didn't say how many law enforcement agencies accessed the data. The problem with Flock didn't stop Boston from seeking another vendor of license-plate reader technology. The police department started another license-plate reader trial with Motorola in February 2026 and a third trial with Axon in June 2026.

Boston's report comes amid a larger privacy debate over law enforcement access to license-plate camera data. An Electronic Frontier Foundation report yesterday described how the nationwide lookup tool lets police conduct searches with little or no justification.

"An EFF analysis of ALPR search logs from Flock Safety systems shows that officers across the country are spying on drivers for completely nonsensical 'reasons,'" the EFF wrote. "Police are routinely searching the Flock database without providing any legitimate justification, making a mockery of our civil liberties by logging reasons like 'LOL' (short for 'laugh out loud'), 'LMAO' (short for 'laughing my ass off'), 'sexy,' and 'idk' (short for 'I don't know') to access sensitive ALPR location data."

The EFF wrote that "Flock Safety claims it has improved its system by requiring officers to select from a dropdown list of crimes before running a search," but the new system in place since late 2025 "does not require proof that the dropdown reason actually matches the true purpose of the search."

Boston will keep using cameras, just not Flock's

When asked if the city will keep using license-plate cameras as long as there are appropriate constraints, Wu replied, "Yes, we need a publicly approved and authorized policy to guarantee all of those protections, privacy, civil liberties, and if that's in place, then we should deploy technology to be able to keep people safe and solve crimes faster."

Boston's annual report said the city requires vendors to agree not to share license-plate-reader data and to erase recordings after 30 days unless police request that video be retained for legal or investigative purposes.

"The police department has been piloting different versions [of the technology] to better understand where vehicles might be going," Wu said. City officials need to "know exactly who can access that data, how it will be retained, how long will it be saved for," she said.

"It can really help with safety in a lot of ways, but it has to be used responsibly," Wu said. "When the toggles or the access controls either are not able to be restricted in the ways that conform with that policy, or are set but then can be unset or reset in ways that violate that policy, we would not use that platform."

As we wrote last month, cities have been dropping Flock at an accelerating pace "over concerns regarding out-of-control surveillance, unwanted data sharing, high expenses, and reports of police abusing the tool." However, the company told Ars at the time that, “so far in 2026, new city partnerships have outpaced nonrenewals by approximately 10 to 1." We contacted Flock today about the Boston city report and will update this article if it provides a response.

Read full article

Comments

Microsoft’s patch for September is a doozy, with a record number of roughly 972 vulnerabilities fixed and 112 of them meeting the high critical-severity threshold.

It was only two months ago that Microsoft patched a then-record 570 vulnerabilities. Google and other companies have also published record numbers of vulnerabilities in recent months. Two weeks ago, OpenAI, Anthropic, Amazon Web Services, Google, Microsoft, and 100 companies and organizations published an open letter warning of a narrowing window for patching vulnerabilities ahead of an expected tsunami of AI-enabled attacks that actively exploit them first. The industry is taking the threat seriously by pumping out unprecedented numbers of bugs in their software.

Welcome to the new normal

Dustin Childs, a researcher at the Zero Day Initiative, calls the spikes the “new normal” and also cautions that despite them, the damage that’s likely to result from AI-assisted attacks could eventually be substantial.

“On the one hand, congrats to the security gnomes at Microsoft for being able to patch bugs at this rate,” Childs wrote Tuesday. “On the other hand, AI-assisted vulnerability discovery shows no signs of slowing down. However, we have not seen a correlating spike in active exploits—yet.”

Counting the precise number of vulnerabilities fixed in a monthly patch release for Microsoft is never an exact science. In some cases, the bugs were previously addressed or affected non-Microsoft products. By Childs’s count, Tuesday’s release patches 972 vulnerabilities, and 997 when counting the porting of fixes for the Chromium browser incorporated into Edge. Of the new vulnerabilities, 112 of them are rated critical, with the remainder carrying the important designation. Already this year, Microsoft has fixed 2,760 vulnerabilities, more than double the number from last year. At this rate, Microsoft will complete the year having fixed more bugs than all of 2023, 2024, and 2025 combined.

Credit: Microsoft

Notable vulnerabilities in this month’s release include two zero-days, CVE-2026-81963 and CVE-2026-85880 in the Windows update service and the Windows Advanced Local Procedure, respectively. There’s no public information about who is exploiting them or how broadly. Other notable vulnerabilities Childs called out are:

• CVE-2026-55007 in Exchange Server. A remote, unauthenticated attacker could get code execution on an affected Exchange server by doing nothing more than sending an email with a malicious Visio attachment.
• CVE-2026-80097: A local privilege escalation in Microsoft Authenticator. “This is the worst type of privilege escalation as it uses a bug in the authentication system itself,” Childs said.
• CVE-2026-69465: Roughly 17 distinct vulnerabilities in Microsoft Office SharePoint allowing remote code execution.
• CVE-2026-65669: One of 60 SQL Server privilege escalation vulnerabilities this month. This particular one is exploited when a user submits instructions through SQL Copilot.
• CVE-2026-69525: A remote code execution flaw in Remote Desktop Services with a 9.8 severity rating.

The researcher said he found so many of Tuesday’s vulnerabilities that were wormable that he stopped counting at 20. These vulnerabilities don’t require any user interaction to be exploited and hence can spread from machine to machine on their own, triggering a possible chain reaction that’s difficult to stop.

The effectiveness of AI-assisted vulnerability hunting is filled with controversy. Critics question the expense and number of false positives when using LLMs. They also question the motives of companies trying to recoup the billions of dollars they’re pouring into developing the very AI engines being used to find and patch the flaws.

The counterargument is that the results—AI-assisted hunting finding record numbers of severe bugs across the industry—speak for themselves. Mozilla, for instance, said in May that its researchers using Mythos found a record 271 vulnerabilities, with almost none of them being false positives.

The true, long-term effectiveness of AI-assisted bug hunting won’t be known for a time that will likely be measured in a year or more. What’s clear now is that critics should maintain curiosity and remain open to the possibility that vulnerability discovery has entered a new and unprecedented phase. Skeptics who discount the possibility do so at their own peril.

Read full article

Comments

New data compiled by a Bay Area anti-surveillance advocacy group shows that not only are American localities dropping cameras from Flock Safety, but they are doing it at an accelerating rate.

Communities from Lansing, Michigan, to Pflugerville, Texas, are ending their relationship with Flock, largely over concerns regarding out-of-control surveillance, unwanted data sharing, high expenses, and reports of police abusing the tool.

Secure Justice, an Oakland-based advocacy group, has recorded 214 cities and counties that have dropped Flock since 2021. Of those, 90 ended their relationship with Flock in August 2026 alone, a fourfold increase compared to the previous month.

Put another way: During the last 30 days, an average of three localities per day have halted contracts with Flock.

“Looking at that image, it’s gone parabolic!” Brian Hofer, the executive director of Secure Justice, told Ars.

Hofer, who until 2025 served as chair of the Oakland Privacy Advisory Commission for 10 years, recognized that while 210 remains relatively small, the momentum is growing rapidly.

“When you see that now 165 [cancellations] are just in the first almost eight months of this year... At that speed, if it goes another year, we’re talking serious money,” he said. “That number is going to get huge, fast.”

When presented with this data, Flock Safety did not express concern. “So far in 2026, new city partnerships have outpaced nonrenewals by approximately 10 to one,” emailed Courtney Terlecki, a company spokesperson. “That does not mean every community will make the same decision, and we understand that public safety technology deserves thoughtful public discussion and community engagement.”

She declined to say precisely how many new customers Flock has taken on this year, but the company has repeatedly said that its products are “trusted by over 5,000 communities.”

Criticism

After extensive criticism, Flock CEO Garrett Langley wrote in a recent blog post that Flock would reduce data retention defaults from 30 days to seven, among other privacy-minded changes.

Last Friday, Flock’s top lawyer wrote in another blog post that its newly modified terms of use “expressly prohibit customers and their users from using Flock Services to mislead, harass, stalk, or otherwise impose upon or violate the legal rights of another person.”

Those efforts have done little to quell political scrutiny.

This week, Sen. Josh Hawley (R-Mo.) announced that he was “investigating Flock Safety’s collection, retention, and dissemination of the data generated by its artificial intelligence surveillance cameras.”

Additionally, on Wednesday, after two Florida police officers were arrested for misusing Flock, Republican Gov. Ron DeSantis gave a speech in which he said that Flock cameras were “out of control” in his state.

“When I see, like, a police officer using this to track, like, an ex-girlfriend, I’m like, you know what the hell’s going on?” DeSantis said.

Even advocates who have followed the pervasive expansion of automated license plate reader (ALPR) technology—which predated Flock—are surprised.

“Maybe in the past it didn't feel like every red light cam really meant a pair of eyes was watching you, but with AI, that's increasingly becoming the reality,” Jake Laperruque, deputy director of the Center of Democracy and Technology’s Security and Surveillance Project, emailed Ars.

“And we're already seeing how AI can morph ALPRs into a mass surveillance dragnet," he added. "Flock lets its cameras be searched for keywords and people, cities are incorporating real-time facial recognition into camera networks, Border Patrol is using AI to scan ALPR data for driving patterns [and] pulling people over whenever the AI deems their driving ‘suspicious.’”

The scrutiny has become bipartisan after numerous widely reported incidents. “A Texas Sheriff’s Office used it to search for a woman who had had an abortion, and federal agents proposed using it outside gun shows,” Catherine Crump, a UC Berkeley law professor, emailed Ars.

“It definitely does not help that this is yet another Silicon Valley product that no one asked for that threatens to reshape people’s lives.”

Update, August 28: Secure Justice has updated its data and now says that 93 jurisdictions (up from 90) have ended Flock contracts this month alone.

Read full article

Comments

Apple increased the price for a monthly subscription to Apple TV by $2, to $15, today.

Annual prices increased by 20 percent from $99 to $119. Current subscribers will receive one month’s notice before paying the new prices, Apple said, per Variety.

Apple’s most recent price hike was in August 2025, when monthly prices went from $10 to $13. Monthly prices also increased in October 2023 and October 2022. Apple TV (then called Apple TV+) started in 2019 for (a seemingly financially unsustainable) $5/month.

Apple TV doesn’t have commercials and is still cheaper than many of its biggest rivals, like Netflix (ad-free plans start at $20/month) and Disney+ (ad-free plans start at $19/month). However, Apple TV has a much smaller library than many subscription-based streaming services.

Apple also increased the cost of a monthly individual subscription to Apple One—which bundles the Apple TV streaming service with Apple Arcade, Apple Fitness+, Apple Music, Apple News+, and iCloud+—from $20 to $22 today. The price bump tracks somewhat logically, considering new higher fees for Apple TV, as well as Apple Music, whose monthly price increased from $11 to $13 last month.

Last month, Apple also increased the prices of Apple One’s Family (from $26 to $28) and Premier (from $38 to $40) plans.

The higher prices come as Apple continues relying heavily on services revenue. In the quarter ending on June 27, services represented 28.1 percent of Apple's revenue compared to 71.9 percent from hardware. Apple’s services business also had a disproportionately lower cost of sales compared to its hardware business (13.7 percent for services versus 86.3 percent for hardware), adding to its appeal.

After years of spending massive amounts of money on content for its streaming service, Apple may be keen on bringing Apple TV closer to profitability. Although Apple originally framed the streaming service as a pathway to other Apple offerings, it would be reasonable for Apple to want more from the service now.

In 2025, The Information reported that Apple TV was Apple's only service offering that wasn't profitable, and, per an anonymous employee, it wasn’t expected to be so for at least its first 10 years. Notably, Apple has never disclosed profitability figures for its streaming service, but The Information’s report, citing two anonymous sources, claimed at the time that Apple TV was “losing more than $1 billion annually.”

Without the addition of ads, small price hikes could be the simplest way for Apple TV to drive revenue. However, this also risks harming another obvious avenue: getting more subscribers.

Read full article

Comments

Florida's attorney general got a fiery rebuke and some ecclesiastical schooling from the state's Catholic bishops after he boldly threatened to block funding to Catholic schools unless the church bends to the state's ant-vaccine policies—policies allegedly intended to uphold religious freedom.

On July 31, Attorney General James Uthmeier sent a questionable letter to the bishops regarding exemptions to school vaccination requirements. Florida law requires public and private schools to allow vaccination exemptions based on religious grounds. But Catholic schools in the state do not accept religious exemptions; Florida's Catholic dioceses support vaccination and recognize no theological argument against it. The schools only accept exemptions based on medical conditions that are verified by a healthcare provider.

Uthmeier, himself a Catholic, wrote to the bishops in an open letter that, based on his own understanding of Catholicism, he saw "no legitimate religious reason to refuse granting religious exemptions." He reviewed select theological positions regarding the use of "abortion-derived vaccines," and suggested to the bishops that it was "morally reprehensible" that they not grant religious exemptions.

Beyond sharing his personal interpretations with the bishops, Uthmeier threatened to withhold state scholarships and vouchers from Catholic school if they don't change their position.

"Far from hallow"

The bishops responded with their own letter, which they made public last week. With a firm crack, they smack down Uthmeier's legal and theological arguments, while also noting that they're being unnecessarily nice in explaining to him why he's wrong. "[T]he Catholic bishops in Florida do not have to justify to your office their position on Catholic teaching and their reasons for the current vaccine policies," the write.

But "out of respect," they go on to demolish Uthmeier's points, citing the hierarchical nature of the Catholic church, the Religion clauses of the First Amendment, state laws, and previous court rulings. In all, "It is beyond cavil that the bishops, not the state, decide how to interpret and apply Catholic principles and theology."

They write:

The constitutional defect in your office’s inquiry is, therefore, not merely the conclusion it posits, but the inquiry itself. Whether Catholic doctrine requires, permits, or disfavors a particular exemption is a religious question entrusted to Catholic authorities, not state officials. The government may not decide that Church teaching is insufficiently religious, insufficiently consistent with Catholic doctrine, or insufficiently compelling to justify an ecclesiastical policy. Nor may it require Church leaders to defend their interpretation of Catholic doctrine before civil authorities as a condition of operating religious schools.

To the threat of withholding educational scholarships and other funding, the bishops call it "far from hallow and legally incorrect."

"The state cannot disqualify Catholic schools from the scholarship program merely because a state official’s views differ from the bishops' views."

Vaccine and the common good

As to their position on vaccines, the bishops explain their policy by first addressing a common religion-tinged criticism of vaccines: that the production of some of them involves using cell cultures that were originally developed from fetuses aborted in the 1960s. With the cell lines still in use, no new fetal cells or abortions are involved, and vaccines are purified so that no fetal tissue is in immunizations.

Some, like Uthmeier, claim that use of such vaccines goes against the church's belief in the sanctity of life. But, in fact, the church has repeatedly made clear that this is not the case. The Florida bishops reference a 2017 document from the Pontifical Academy for Life and the Italian Bishops’ Conference that getting vaccinated "does not signify some sort of cooperation with voluntary abortion" and can be done "with a clear conscience." The Florida bishops further clarify that it is "morally permissible" for parents to have their children vaccinated for the same reason.

The bishops say that some parents may still disagree, and for those parents, they "are free to choose a different educational path for their children. Catholic virtual schooling and home schooling are among them," the bishops write.

Their vaccine policy is "rooted in the desire to protect the common good and to encourage the proportional benefits of utilizing vaccines," the bishops write. "This position is rooted in our Catechism: 'Life and physical health are precious gifts entrusted to us by God. We must take reasonable care of them, taking into account the needs of others and the common good.'"

The bishops note the vaccines not only protect healthy children, but also vulnerable groups in their schools, including children who cannot be vaccinated due to medical conditions, expectant teachers, and elderly parents and grandparents.

State context

The bishops' stand against Uthmeier comes as Florida's Republican leaders continue to attack life-saving vaccines and vaccination requirements. Last year, Florida Surgeon General Joseph Ladapo announced that the state planned to end all vaccination requirements, including those for school children. He dramatically claimed that every vaccine requirement "drips with disdain and slavery."

On Monday, the state proposed a rule to remove requirements that children get vaccinated against chickenpox, hepatitis B, Haemophilus influenzae type B, and pneumococcal to enter school. The rule would also expand religious exemptions.

The bishops' letter highlights a fallacy often used by anti-vaccine advocates: that undermining vaccines and dismantling vaccination requirements upholds religious freedom, when in fact it can be an attack on that freedom. Just on Monday, anti-vaccine Health Secretary Robert F. Kennedy Jr. proposed weakening the wording of federal vaccine recommendations "in favor of individual autonomy and religious freedom." Yet, no major religion in the world forbids vaccinations, and most encourage and embrace them as a common good, like the Catholic bishops.

The bishops ended their letter noting that they periodically review their vaccine policy. But, they wrote, they stand firm in their rejection of religious exemptions and "will not succumb to affronts to religious freedom."

Read full article

Comments