Suzanne Smalley
@suzannesmalley.bsky.social
Reporter covering digital privacy and cybersecurity policy for The Record. Mom. Pub trivia queen. Crossword enthusiast. Literary fiction connoisseur. Idiosyncratic. Signal: Suzanne.236 Email: suzanne.smalley@therecord.media.
Spyware found on phone of European Parliament member probing it @suzannesmalley.bsky.social therecord.media/pegasus-spyw...
Spyware found on phone of European Parliament member probing it
Stelios Kouloglou, formerly a member of the European Parliament's committee investigation abuses of commercial spyware, was twice infected with Pegasus while serving, researchers said.
therecord.media
The SCOTUS decision in the Slaughter case could jeopardize the agreement allowing data to flow from the EU to the U.S. Meta and Google have already said they will pull out of Europe if the Data Privacy Framework collapses therecord.media/supreme-cour...
Supreme Court decision threatens EU-US data transfer agreement
In a Tuesday letter, Max Schrems, the founder of the Vienna-based privacy advocacy organization noyb, told European officials he plans to sue to invalidate the EU-U.S. Data Privacy Framework (DPF) tha...
therecord.media
Check out my story about how Cellebrite appears to have had a hard time pulling back its data extraction tech from regimes that abuse it and persecute dissidents
Ron Deibert@rondeibert.bsky.social · last mo.Russia used Cellebrite phone-hacking tool to crack down on dissident after firm cut off country therecord.media/russia-used-... @suzannesmalley.bsky.social
Maine has closed its breach portal to the public after a fraudster reported fake data breaches at Discord and VRChat. therecord.media/maine-turns-...
/maine-turns-off-breach-portal-fake-reports
Maine is still allowing companies to report breaches, but won’t make the portal easily available to the public until after it completes an audit of its procedures to stop such incidents, according to ...
therecord.media
CISA orders civilian government agencies to patch some cyber vulnerabilities within 3 days, in part in response to the increasing threats posed by AI therecord.media/cisa-to-requ...
CISA to require federal agencies to patch some cyber vulnerabilities within 3 days
CISA is giving agencies 180 days to adopt the new patching time frame, according to a directive released Wednesday.
therecord.media
CISA plans to transform how it assesses cyber risks and vulnerabilities and will release a binding operational directive outlining next steps tomorrow therecord.media/cisa-to-tran...
CISA to transform how it assesses cyber vulnerabilities and risks, Andersen says
A binding operational directive being released Wednesday will direct federal agencies to change the way they address vulnerabilities by elevating some while putting others to the side.
therecord.media
Criminal liability for tech execs are a possibility if major companies don't implement device controls to block nude images of kids within 3 months. therecord.media/uk-gives-big...
UK gives big tech 3 months to create device controls to block nude images of kids
The companies “must activate built-in features or implement technical solutions on smartphones and tablets to detect and block nude images for children,” according to a press release from the Home Off...
therecord.media
WhatsApp says it has found evidence that NSO has been targeting its users with spearphishing attacks. If true, NSO is violating a court order directing it to stop using WhatsApp infrastructure for spyware attacks. WhatsApp says it is filing a contempt complaint therecord.media/whatsapp-say...
WhatsApp says NSO targeted users with spearfishing attacks in violation of court order
WhatsApp said it is filing a federal court contempt order against NSO for violating a permanent injunction that bars it from mounting attacks against its users.
therecord.media
Big decision on closely watched Supreme Court case weighing whether FCC fines against major telecom companies were illegal finds that the penalties were constitutional and did not violate the firms' rights to a jury trial therecord.media/supreme-cour...
Supreme Court rules FCC fines punishing telecom giants for sharing location data were legal
The Trump administration had backed the FCC’s position and, apart from Justice Clarence Thomas, the high court agreed.
therecord.media
I interviewed Adam Unikowsky, who recently argued a Supreme Court case about the constitutionality of geofence warrants. He spoke w/ me abt why he believes geofence searches are problematic + why the ruling could have a dramatic impact on Americans’ right to privacy. therecord.media/why-supreme-...
Why the Supreme Court's Chatrie case could change the meaning of privacy in America
Lawyer Adam Unikowsky spoke with Recorded Future News about why he believes geofence searches are problematic and why the way the court rules could have a dramatic impact on Americans’ right to privac...
therecord.media
Why the Supreme Court's Chatrie case could change the meaning of privacy in America Really good interview from @suzannesmalley.bsky.social via @therecordmedia.bsky.social
Why the Supreme Court's Chatrie case could change the meaning of privacy in America
Lawyer Adam Unikowsky spoke with Recorded Future News about why he believes geofence searches are problematic and why the way the court rules could have a dramatic impact on Americans’ right to privac...
therecord.media
OpenAI is launching a new ChatGPT feature allowing users to connect all of their financial accounts to the chatbot for personal finance advice. Privacy and cyber experts say that's a problem therecord.media/experts-warn...
Experts warn of privacy risks as AI firms looks to connect to financial accounts
OpenAI announced Friday that it is rolling out a new ChatGPT feature allowing users to connect all of their financial accounts to the chatbot for personal finance advice.
therecord.media
GM agrees to pay California $12.8 million to resolve charges that it sold consumers' driving data for use by insurers who raised rates. Deal requires GM to begin deleting driving data w/i 180 days + stop selling it to consumer reporting agencies + brokers for 5 yrs therecord.media/gm-to-pay-12...
GM to pay over $12 million in California privacy settlement involving driver data
The settlement, announced by California officials Friday, is the largest fine issued under the California Consumer Privacy Act (CCPA) in its more than five-year history.
therecord.media
Access Now: In run up to Zambia cancelling RightsCon, a govt contact told organizers Chinese diplomats were pressuring officials about the fact that Taiwanese human rights defenders would be there. China bankrolled the event venue. RightsCon 2025 was held in Taiwan www.rightscon.org/rc26-stateme...
A statement to our community about why RightsCon 2026 will not take place in Zambia
Our official statement to the digital rights community about why RightsCon 2026 will not take place in Zambia
rightscon.org
The Senate Judiciary Committee has marked up a bill that requires AI companies to use age verification to keep children from accessing AI companions. Critics say the bill will potentially require age gating to access even search engines because it is broadly written therecord.media/senate-judic...
Senate Judiciary advances bill that would bar minors from interacting with AI companions
The bill, known as the GUARD Act, also requires that AI companions advise users of all ages that they are not human and lack professional credentials. It also makes it a crime for AI companions to kno...
therecord.media
Zambia announced it was cancelling the large digital freedoms conference RightsCon days before it was to be held in Lukasa even as thousands were en route. Officials cited concerns about the conference's themes. The Chinese govt reportedly bankrolled the event venue. therecord.media/zabia-cancel...
Zambia cancels global digital freedoms conference days before start
On Tuesday, Zambia’s Minister of Technology and Science offered the first hint that the conference would be cancelled, telling a Zambian news outlet that participants’ security clearances were incompl...
therecord.media
European Commission announces preliminary findings alleging that Meta violates DSA for allowing children under 13 to use its platform. Fines could be up to 6% of revenue from annual core business activity if findings are confirmed following Meta rebuttal therecord.media/european-com...
European Commission accuses Meta of breaching child safety rules
The platforms allegedly flouted the bloc’s Digital Services Act (DSA) by “failing to diligently identify, assess and mitigate the risks of minors under 13 years old accessing their services,” the comm...
therecord.media
SCOTUS signals it won't ban geofence searches, but disagrees with the government's contention that they don't require a warrant. Several justices seem to indicate they want to offer guidance on how to make the reverse search warrants as narrow and specific as possible therecord.media/supreme-cour...
Supreme Court signals location data searches should require a warrant
Privacy advocates had worried that the high court would rule that geofencing does not qualify as a constitutionally protected search, opening the door to much broader use of warrantless reverse search...
therecord.media
Norway considering social media ban for children under 16. therecord.media/norway-prime...
Norway's prime minister proposes ban on social media access for young teens
An upcoming proposed bill will include language that holds big tech accountable for using age verification tools to block young users.
therecord.media
New @citizenlab.ca report highlights how surveillance vendors are exploiting SS7 and other telecom infrastructure to track targets' locations. Cases found by Citizen Lab are just two concrete examples of a pervasive problem, researcher says. @rondeibert.bsky.social therecord.media/surveillance...
Surveillance companies exploiting telecom system to spy on targets’ locations, research shows
The campaigns exploited a weakness in telecom infrastructure to allow the unnamed vendors to secretly pose as real cellular providers and pinpoint victims’ locations.
therecord.media
Privacy advocates are alarmed by a new data privacy bill introduced Wednesday by House Republicans. It includes several exemptions for what data is protected and is therefore toothless, they say. It also preempts at least 20 state laws, many of which are tougher therecord.media/house-republ...
House Republicans unveil data privacy law that would override state protections
The bill, known as the SECURE Data Act, is backed by top Republicans on the House Energy and Commerce and Financial Services committees.
therecord.media
Court ruling makes live facial recognition legal in the UK. London police captured 3 million faces last year and matched them to a suspect watchlist, yielding 2,100 arrests. therecord.media/facial-recog...
UK court determines police use of live facial recognition legal
Live facial recognition can be deployed nationwide, a U.K. court ruled, dismissing arguments from plaintiffs who said the technology is racially biased and is used arbitrarily.
therecord.media
Last night the gov of VA signed a law that bans sales of precise geolocation. Data brokers can't sell data showing where consumers are within a 1,750 foot radius. VA is 3rd state to enact such a ban. Four more state legislatures are now considering their own bans therecord.media/virginia-ena...
Virginia enacts ban on precise geolocation data sales as momentum for similar prohibitions builds
The legislation bars the sale of geolocation within a 1,750 foot radius, a buffer large enough to keep data brokers from pinpointing where consumers live, work, worship, shop and otherwise travel.
therecord.media
FCC proposes new rule to crack down on illegal robocalls. Rules would stiffen penalties for providers and require they collect a lot more information from customers, do more to verify it therecord.media/fcc-proposes...
FCC proposes new rule to further crackdown on illegal robocalls
The rule would force originating providers to gather more information from customers before they allow calls, verify the provided data more carefully and be assessed steeper penalties when they fail t...
therecord.media
Hack of LA City Attorney's Office data storage system exposes vast amount of LAPD files used in discovery. Files reportedly include witness names, medical information and unredacted criminal complaints therecord.media/breach-expos...
Breach exposes sensitive LAPD files stored in city attorney system
The LA Times reported that social media posts allegedly featuring information about the stolen material — some of which have since been taken down — revealed there were 7.7 terabytes of data available...
therecord.media
Two prominent Egyptian journalists, both of whom have been critical of the regime, were targeted with sophisticated spearphishing attacks says AccessNow therecord.media/two-egyptian...
Two prominent Egyptian journalists targeted with elaborate spearphishing campaign
Digital civil rights nonprofit Access Now released a report on the findings with the mobile security company Lookout on Wednesday, saying they saw evidence the hackers may “use the methods and infrast...
therecord.media
DC folks. This Sunday, April 12, I will be at Politics and Prose in conversation with the amazing Rachel Levinson-Waldman of the Brennan Center about my book — Your Data Will Be Used Agaisnt You. Stop by and support your local bookstore. politics-prose.com/andrew-guthr...
Bryan Fleming, owner of onetime stalkerware product pcTattletale, received no jail time + a $5K fine at sentencing Friday. Fleming is the first spyware maker to be convicted since 2014. He had marketed the product as a tool for catching cheating spouses and employees. therecord.media/stalkerware-...
First stalkerware maker prosecuted since 2014 receives no jail time
Bryan Fleming, founder of pcTattletale, was ordered to pay a $5,000 fine by a San Diego federal judge and will spend no time in prison beyond the one day he already served.
therecord.media
The EU's cyber agency blames hacking group TeamPCP for recent massive hack. The agency, CERT-EU, also says that Shiny Hunters posted the 92 GB of compressed data to its dark web leak site. therecord.media/european-com...
EU cyber agency attributes major data breach to TeamPCP hacking group
The European Union’s cybersecurity agency said the hacking group TeamPCP was behind a massive recent data breach at the European Commission.
therecord.media