Advisories
U.S. Bills Target ALPR Networks, Implying New Compliance for Defenders
Two new U.S. bills—Stop Flock Abuse Act and Ban Flock Act—aim to regulate automated license plate reader networks, imposing audit, encryption, data‑retention, and data‑sharing restrictions. Defenders with ALPR deployments must review compliance and adjust systems accordingly.
What Happened
Two U.S. congressional bills were introduced in late September and early October to regulate automated license plate reader (ALPR) networks, largely targeting the major vendor Flock Safety.
Impact on Defenders
Defenders managing ALPR deployments or integrating with vendor APIs must review compliance with the proposed Stop Flock Abuse Act and Ban Flock Act. The legislation could impose new audit, encryption, data retention, and data‑sharing restrictions on all ALPR systems.
Key Requirements
- Written approval and audit trail for every ALPR search.
- Supervisor audits of ALPR usage.
- Encryption of stored vehicle‑location data.
- Automatic deletion of most data after 10 days.
- Prohibition on sharing or selling data to non‑government entities.
- No facial‑recognition integration.
- Data must remain stored within U.S. borders.
Recommended Actions
1. Inventory all ALPR devices and data flows. 2. Verify that your systems log each search with a timestamp and operator ID. 3. Enable encryption at rest and in transit. 4. Implement automated data‑retention policies to purge data after 10 days. 5. Restrict data export to internal use only and enforce U.S. data‑hosting. 6. Disable any facial‑recognition modules if present. 7. Prepare audit documentation for potential supervisory reviews.
Related articles
Automakers Share PII from Connected Cars with Advertisers and Data Brokers
A study shows that 19 of 21 major automakers routinely transmit personally identifiable data from connected vehicles to advertising and data‑broker networks. The data includes names, email addresses, VINs, and precise geolocations, and is shared with tech giants such as Google, Amazon, and Meta. Defenders should audit app integrations, enforce data‑minimization, and monitor outbound telemetry for compliance.
Read briefing
US Treasury Sanctions Tren de Aragua Members Over ATM Jackpotting Attacks
The U.S. Treasury Department has sanctioned eight members of the Venezuelan Tren de Aragua gang for orchestrating ATM jackpotting attacks that stole millions from U.S. banks. The sanctions target individuals who deployed malware such as Ploutus to force ATMs to dispense cash and erase evidence. Defenders should update ATM firmware, monitor for known malware, and enforce network segmentation.
Read briefing
Apple Unveils App Store Connect 2026 Update – New Features, Updated Guidelines, and Upcoming Compliance Requirements
On April 16, 2026 Apple rolled out a significant update to App Store Connect. The release introduces a revamped certificate management interface, tighter App Review criteria, and new security checks for visionOS apps. Developers will need to adjust to updated signing workflows and upcoming mandatory compliance rules that take effect later this year.
Read briefing
CrowdStrike Deploys On‑Device AI for Real‑Time Data Classification in Falcon Data Security
CrowdStrike, in partnership with Intel, has unveiled a next‑generation feature for Falcon Data Security that leverages on‑device language models running on dedicated AI hardware. The new capability instantly tags and classifies sensitive information—such as PII, PHI, and financial data—directly on endpoints, eliminating the need to ship raw data to the cloud. This reduces latency, preserves privacy, and tightens compliance controls while maintaining the same high detection accuracy that Falcon is known for. The move underscores CrowdStrike’s commitment to edge‑AI security and sets a new standa
Read briefing