A high profile hacking group claims it has breached multiple FBI-related services and stolen data “on all FBI employees and applicants.” A representative of the group, called ShinyHunters, told 404 Media the data includes FBI agents’ names, home addresses, phone number, and information on their spouse.

The data breach could be massively significant and may have all sorts of national security and counterintelligence implications. Criminals from the same ecosystem as ShinyHunters have previously used hacked data like phone records to track, intimidate, and harass the FBI agents investigating them. The highly sensitive data could also be a boon to foreign intelligence agencies who want to better understand how one of the most important law enforcement and intelligence agencies in the U.S. operates. And if the data fell into the hands of more criminals, FBI agents and their spouses could face serious threats to their safety.

“We hacked the FBI. We hold data on all FBI employees and applicants,” the representative of the group told 404 Media.

OpenAI has an army of contractors who read real ChatGPT users’ prompts and other data to help improve the chatbot’s responses. The idea is that the contractors provide an, obviously, human touch to OpenAI’s models. Well, not all of the contractors are doing that. 404 Media has found multiple contractors hired to improve OpenAI’s models have been fired for using AI to train the AI. That’s not great for the models themselves, but there is also obviously a great irony in AI training companies working for OpenAI firing people for using AI when OpenAI’s whole thing is to make people use AI at work.

Some AI models already exhibit signs of “model collapse,” which is where AI models further trained on AI-generated text can become worse and worse. In this case, some of the people hired to partially stop that happening are themselves using AI-generated responses to train OpenAI’s models.

One contractor said they see people using AI “all the time and people are let go for it all the time, it’s pretty much the one thing that will get you kicked off ASAP.” The person said, “in a group of thousands there are tons that have been caught.” 

Cities around the country are ditching Flock’s automatic license plate reader (ALPR) cameras, and replacing them with equivalent cameras from law enforcement contracting giant Axon. That move in large part comes in response to 404 Media’s coverage of how local cops performed lookups in Flock for Immigration and Customs Enforcement (ICE), and how a cop in Texas searched Flock cameras nationwide to look for a woman who self-administered an abortion.

That brings up questions: what are cities and law enforcement agencies using Axon ALPRs for? And who are they in turn sharing that data with? 404 Media has started to find out, but needs the help of local residents and community members to figure out what is happening across the country.

Over the last few weeks, 404 Media has filed requests with various cities and police departments for Axon “activity reports” and “sharing reports.” These show in granular detail when a police officer searched Axon’s ALPRs, the name of the officer, their badge number, the license plate they reached, and, most importantly, the stated reason why. These activity reports are essentially Axon’s version of Flock’s “network audits,” which has been the basis of much of 404 Media’s Flock reporting, and local and national media outlets’ around the country. You can see an example of one here:

So far, 404 Media has obtained activity reports from the Benton County Sheriff's Office, WA; Falmouth Police Department, ME; Johns Creek Police Department, GA; Ocean Shores Police Department, WA; Pleasanton Police Department, TX; and Red Wing Police Department, MN.

But we need your help. Has your local police department or city switched to Axon ALPR cameras? Were they already using Axon? And do you want to know what they’re using those cameras for?

We’re asking interested readers to file the below public records request. You can simply copy this language, tweak it a little if necessary to apply to your state, then file the request with the relevant agency. You can do this by finding their relevant public records request email address, or by filing it through Muckrock. This is the platform we use for sending and organizing our records requests.

The Internal ALPR Activity report is the one shown above. The Network ALPR Activity report shows what other agencies the police department or city shares their data with. The ALPR Data Sharing report provides a history of when other agencies were invited, or removed, to receive the data. And the ALPR Hostlist Management Audit report details changes made to alerts the agency may receive.

If you file a request and get data back, please feel free to email it to us at joseph@404media.co. We’ve seen with the nationwide conversation about Flock that local residents can do a lot to reveal how surveillance technology is being used in their own communities. We hope we can find out a bit more about how agencies are using Axon’s cameras too.

To Whom It May Concern:

Pursuant to the [YOUR STATE’S PUBLIC RECORDS LAW], I hereby request the following records:

1. Internal ALPR Activity report in Axon.

The report should include data logged from the period of January 1, 2025, to the date this request is processed. Per Axon's documentation, the Internal ALPR Activity report is available within the LPR > ALPR Search > LPR Audit menu. You can find instructions to locate this here: https://www.axon.com/help/fusus/software/fusus/alpr/alpr-audit.htm

2. Network ALPR Activity report in Axon.

The report should include data logged from the period of January 1, 2025, to the date this request is processed. Per Axon's documentation, the Network ALPR Activity report is available within the LPR > ALPR Search > LPR Audit menu. You can find instructions to locate this here: https://www.axon.com/help/fusus/software/fusus/alpr/alpr-audit.htm

3. ALPR Data Sharing report in Axon.

The report should include data logged from the period of January 1, 2025, to the date this request is processed. Per Axon's documentation, the ALPR Data Sharing report is available within the LPR > ALPR Search > LPR Audit menu. You can find instructions to locate this here: https://www.axon.com/help/fusus/software/fusus/alpr/alpr-audit.htm

4. ALPR Hotlist Management Audit report in Axon.

The report should include data logged from the period of January 1, 2025, to the date this request is processed. Per Axon's documentation, the ALPR Hotlist Management Audit report is available within the LPR > ALPR Search > LPR Audit menu. You can find instructions to locate this here: https://www.axon.com/help/fusus/software/fusus/alpr/alpr-audit.htm

The requested documents will be made available to the general public, and this request is not being made for commercial purposes.

In the event that there are fees, I would be grateful if you would inform me of the total charges in advance of fulfilling my request. I would prefer the request filled electronically, by e-mail attachment if available or CD-ROM if not.

Thank you in advance for your anticipated cooperation in this matter. I look forward to receiving your response within the time period that the statute requires.

Sincerely,

[YOUR NAME]

Georgia State University has rescinded a job offer given to a high profile activist who is currently fighting a case in which he allegedly wiped a security-focused Android phone before Customs and Border Protection (CBP) could search it. The case, which 404 Media first covered and has now received widespread and national attention, has important ramifications for privacy and when someone can still be charged with an offense even if authorities don’t have suspicion of any specific crime.

Earlier this month, activist Samuel Tunick and a group of supporters delivered a “demand letter” to the university. That letter, which Tunick shared with 404 Media, says he explained to the university he was facing a pending charge, which he describes as “an instance of textbook political repression, and a high profile civil liberties case.”

While delivering the letter, supporters held signs saying, “GSU sides with Trump,” and “Digital Privacy Under Attack!”

Tunick told 404 Media he was supposed to start his Teaching Assistant job on August 25. Then six hours before his first lab, Tunick received an automated email saying he had not passed the required background check. The letter says Tunick’s head of department asked the university for more information about the relevant hiring policy, “and she was told that there actually aren’t any.” Instead, in Tunick’s telling, “this was a subjective, and essentially arbitrary decision made for reasons that have not been made clear to me or other faculty.”

Tunick was also planning to pursue a M.S. of Geosciences at Georgia State, and was going to receive a tuition waiver and wages for his work as a Teaching Assistant. “Now I have had both my tuition waiver and source of income pulled out from under me at the drop of a hat, my economic security and academic career threatened due to a single absurd charge, to which I have pleaded ‘not guilty,’” the letter continues. 

Tunick shared screenshots of emails between him and various faculty. One sent by the department head said, “I was told that the ‘Background Check Committee’ denied the approval for your hire, the Dean of Students denied the approval, and the legal department denied your approval.” That email reiterated there is no policy to be pointed to, and that each hire “undergoes a risk assessment on a case-by-case basis.” In another email, Tunick notes he had a misdemeanor in Fulton County, but these charges were dismissed.

Georgia State University did not respond to a request for comment.

404 Media first broke news of Tunick’s case in December and published an interview with Tunick and one of his lawyers, Matthew Dodge, in July. The airport encounter that led to the charge happened in January 2025, when Tunick was returning to the U.S. after a vacation in the Dominican Republic. Department of Homeland Security (DHS) officials called the airport ahead of time and asked agents there to stop Tunick, Dodge said.

The officers asked to search Tunick’s bags and pat him down, both of which he refused. Agents searched him and found nothing improper, Dodge said. Then, the agents said they wanted to search Tunick’s phone. Tunick provided them a code, which an officer then typed into the device. Rather than unlocking the phone, the device “went to a blank screen” and displayed the logo of GrapheneOS. In other words, the code wiped the device.

GrapheneOS is a security- and privacy-focused operating system, which includes all sorts of additional features. One of those is the duress password feature that “will irreversibly wipe the device,” according to GrapheneOS’s website. 

Tunick participated in the Stop Cop City movement in Atlanta, and in a previous interview with 404 Media, Tunick put his prosecution for wiping his phone squarely in the context of other cases against the movement. Before the airport encounter, Tunick found out from his lawyer a tracker had been placed on his car. He also learned authorities subpoenaed his cellphone records and Gmail data. Tunick previously failed a background check for a job on a Christmas tree lot which involved going onto the property of a school, he previously said. When he asked the Atlanta Public Schools office about it, he was directed to the FBI.

The authorities “really just tried to dig up anything they could on me and they didn’t find anything,” Tunick previously told 404 Media. “At this point, it almost seems like it’s just intended to make my life miserable and discourage participation in any sort of advocacy or activism.”

The letter demands that Georgia State reinstate Tunick’s employment and/or the tuition waiver; provide more information about the hiring and background review process; and apply an “innocent until proven guilty” principle on hiring decisions.

We start this week with Joseph’s story about the people who are reading real ChatGPT users’ prompts and conversations. He got a bunch of documents all about these contractors and saw real prompts himself. After the break, Sam tells us all about the Automattic CEO getting kicked out. Then coming back again. In the subscribers-only section, Emanuel tells us why a16z thinks enshittification is not real.

Listen to the weekly podcast on Apple Podcasts, Spotify, or YouTube. Become a paid subscriber for access to this episode's bonus content and to power our journalism. If you become a paid subscriber, check your inbox for an email from our podcast host Transistor for a link to the subscribers-only version! You can also add that subscribers feed to your podcast app of choice and never miss an episode that way. The email should also contain the subscribers-only unlisted YouTube link for the extended video version too. It will also be in the show notes in your podcast player.

• Inside ‘Project Lily’: The Humans Reading Your ChatGPT Chats⁠
• ⁠Automattic CEO Matt Mullenweg Put on 'Leave of Absence'⁠
• ⁠Automattic’s Matt Mullenweg Claims He’s Back 'In Control'⁠
• ⁠Sources say Automattic’s board is out after failed attempt to oust CEO Matt Mullenweg⁠
• ⁠A16z Says You Actually Love Social Media, Enshittification Isn’t Real⁠

This article was produced in collaboration with WIRED. You can read their version of the article here.

Hackers ripped down a Flock camera above a roadway, made a near-complete copy of the data stored inside it, and shared the files with 404 Media and WIRED, revealing in new detail how exactly Flock Safety’s cameras track the movements of both vehicles and people. The hackers say they are also publishing details on how they managed to obtain the software, in the hopes that other people may copy them.

OpenAI is hiring hundreds of contractors who read a massive stream of real users’ ChatGPT prompts, with the prompts sometimes including sensitive personal information, 404 Media has learned. The prompts these people review can include whole conversations between users and the chatbot, conversations that most of ChatGPT’s more than 900 million users probably don’t realize may be read by actual people.

The goal of these prompt review teams is to improve the responses ChatGPT gives to its users, with the contractors rating and critiquing the chatbot’s generated replies. Internal documents seen by 404 Media show contractors training ChatGPT to not anthropomorphize itself, and to be less sycophantic, a key problem for OpenAI whose over-sycophantic 4o model led in part to multiple peoples’ suicides, according to various lawsuits.

The news presents a major privacy risk for ChatGPT’s users, with people often using ChatGPT as a therapist, professional assistant, or digital friend, and providing it with all sorts of intimate details about their lives. The contractors don’t see ChatGPT usernames, and OpenAI says it tries to remove personal information before prompts reach the reviewers, but the company acknowledged sensitive details can still get through. 

The news also dispels the misconception that these models are improving only because of OpenAI’s mass scraping of the internet, the talent of its well-paid engineering and AI teams, or the power of its newer models. An important and overlooked part are the outside contractors paid to read and review ChatGPT responses to real prompts over and over again. Anthropic confirmed to 404 Media it is also using human review to improve its models.

“No,” someone who works with the prompts said when asked if they think ChatGPT users know that humans are reading their chats. “I don’t think they would imagine some contractor somewhere [...] is analyzing the conversations.”