We start this week with Joseph’s article about Samuel Tunick, the man charged with allegedly wiping his phone before DHS officials could search it. It’s a wild case with a lot to unpack. After the break, Jason tells us all about a TikTok Shop scheme powered by AI. In the subscribers-only section, we talk about possibly the dumbest AI tool ever made.

Listen to the weekly podcast on Apple Podcasts, Spotify, or YouTube. Become a paid subscriber for access to this episode's bonus content and to power our journalism. If you become a paid subscriber, check your inbox for an email from our podcast host Transistor for a link to the subscribers-only version! You can also add that subscribers feed to your podcast app of choice and never miss an episode that way. The email should also contain the subscribers-only unlisted YouTube link for the extended video version too. It will also be in the show notes in your podcast player.

• ⁠You're Invited: 404 Media's Third Anniversary Live Podcast and Party!⁠
• ⁠‘The Government Hopes To Set a Precedent’: An Interview With the Man Charged for Allegedly Wiping His GrapheneOS Phone⁠
• ⁠Inside an AI TikTok Shop Slop Factory That Shills Supplements Recalled By the FDA⁠
• ⁠Google Earth’s New AI Lets Anyone Fabricate Completely Bullshit Satellite Images⁠

A series of issues in Apple’s web browser engine — the tech underlying all browsers on iOS — means that Apple’s iCloud Private Relay tool, which is supposed to hide a user’s IP address, in many cases doesn’t actually work. Instead, the issues mean a malicious attacker can set up a website to learn a Private Relay user’s real IP address, or that many websites have also already collected this information incidentally. The issues also impact OnionBrowser, an iOS app for browsing the web through the Tor anonymity network, the researchers who discovered the issues say.

The Private Relay leak is the second issue to recently impact Apple’s paid-for privacy products. Last month 404 Media reported a bug in Apple’s Hide My Email feature was actually revealing peoples’ real email addresses. Apple knew about that issue for more than a year before fixing it.

The Securities and Exchange Commission (SEC) bought access to what it described as more than a billion airline ticketing records, related to not just U.S. domestic flights or those landing in the country, but also flights between foreign countries, according to SEC documents obtained by 404 Media. A group of the world’s airlines, including Delta, United, and American, previously sold the data under the company name ARC; that is where the SEC bought the data from.

ARC, or the Airlines Reporting Corporation, stopped selling airline ticketing records after repeated coverage from 404 Media and pressure from lawmakers last year. But the newly obtained records provide additional insight into the breadth of data that airlines were selling without their customers' knowledge, and that law enforcement agencies were tapping into, likely without a warrant.

This is an adaption of a podcast interview 404 Media recorded with Jonathan Paz, a former Flock employee who is now running running for Congress in Massachusetts’ 5th District. Check out the whole thing here on YouTube.

Jonathan Paz was initially nervous when he started working at the surveillance company Flock. It was his first tech job. But he was interested in the company’s mission. Flock’s cameras, which constantly scan the license plate of every vehicle driving past, were for finding missing people. Staff at the company were able to solve real issues.

In his job as a government affairs manager a couple of years ago, Paz represented Flock in public hearings, with the goal of getting a city to purchase Flock cameras. These sorts of hearings are happening on a near constant basis all across the country, as cities and towns participate in a national conversation about whether they want Flock cameras in their community or not.

On Thursday, Google introduced a new AI feature into Google Earth which lets anyone fabricate all sorts of misleading or straight up inaccurate satellite imagery, from making it look like a specific place has suffered a drone strike to manifesting a nuclear plant in Iran.

Usually, Google Earth is an exceptionally useful tool for open source intelligence (OSINT) analysts to digitally monitor areas of interest and see how they change over time, say, during a conflict or disaster. Now, Google Earth can easily be used as a tool for disinformation. 

LinkedIn, a social network awash with long AI-generated posts from executives and other corporate workers, has introduced a new button that users can click to flag if a post “seems like AI slop,” according to 404 Media’s own tests.

If you have been anywhere near LinkedIn in the past couple of years, you have undoubtedly seen users posting blatantly AI-generated missives. Often these posts take some sort of news event, and opine on how this relates to thought leadership, or some other LinkedIn brainrot term. It’s also pretty wild the button specifically uses the term “AI slop” and not, say, “It seems this was generated with AI.”