Internet Freedom Weekly: News Recap, November 2nd–6th, 2026
Apple Warns of Spyware Attacks Across 99 Countries
Apple sent threat notifications to German politicians, including members of the Bundestag, warning of suspected mercenary spyware attacks. The latest round of alerts reached iPhone users in 99 countries. Germany's cybersecurity agency warned recipients that their devices may have been compromised.
The suspected attacks reportedly involved zero-click spyware, which can infiltrate a phone without the user opening a link or downloading anything. Messages, calls, and location data could be exposed. Apple hasn't identified the attackers or named the spyware, leaving the scale and source of the surveillance unclear.
Hong Kong Is Connecting Shopping Mall Cameras to Police Facial Recognition
Hong Kong police plan to activate AI facial recognition across their SmartView CCTV network this month. The network already has more than 10,000 cameras, with plans to reach around 60,000 by 2028. At least four shopping malls are expected to connect their cameras by the end of the year.
Police say the technology will help locate suspects and missing people. Facial recognition data could be retained for up to 180 days, compared with the usual 30 days for CCTV footage. Malls won't have to display separate notices explaining that their cameras are connected to the police network. A shopping trip could become part of a much larger surveillance system without visitors knowing.
Utah Enforces Age Checks, but Its VPN Restrictions Remain Blocked
Utah began enforcing age verification for adult websites on November 2. Covered platforms must verify that visitors are at least 18 or risk fines of up to $2,500 per violation. A federal court injunction still blocks the provision requiring websites to determine users' physical locations even when they use VPNs.
The problem is that websites cannot reliably establish someone's real location from a VPN connection. Forcing them to try could lead to legitimate privacy tools being blocked altogether. The age verification requirement is now enforceable, but the dispute over VPN users' location privacy is still in court.
The UK Plans to Use Facial Recognition to Find Visa Overstayers
The UK Home Office is preparing to deploy live facial recognition at transport hubs and major public events to identify visa overstayers and people subject to immigration enforcement. The project has entered a formal delivery phase following trials at Holyhead port between November 2025 and February 2026.
On November 4, the government proposed new safeguards for police facial recognition, including bias testing and independent oversight. But the UK's biometrics commissioner says immigration enforcement falls outside his remit and that he wasn't consulted. The government is expanding facial recognition into new settings while questions about who oversees its use remain unresolved.
What Biometric Data Is and Why It Matters
Biometric data identifies people through physical or behavioral characteristics, including fingerprints, facial geometry, iris patterns, and typing rhythms. Unlike passwords, these identifiers cannot easily be changed. A 2015 breach of the US Office of Personnel Management exposed fingerprints belonging to 5.6 million people.
Biometric systems also work through confidence scores rather than exact matches, creating the possibility of false identification. And unlike passwords, some biometric information can be collected without active participation, including through public cameras. As biometric identification spreads, so does the risk of collecting sensitive information people cannot replace.
Websites Can Track You Even Without Cookies
Websites collect personal data through cookies, tracking pixels, advertising identifiers, and browser fingerprinting. The last method combines details such as screen size, fonts, and browser settings to recognize visitors without storing a traditional tracking cookie.
Companies use this information to build advertising profiles, while data brokers can combine information from multiple sources. Rejecting cookies reduces some tracking, but doesn't prevent every method. A VPN can hide your original IP address, although it won't stop websites from identifying you through logged-in accounts or browser fingerprints.
Online Attacks on Journalists Often Go Unpunished
November 2 marked the International Day to End Impunity for Crimes against Journalists. Beyond physical attacks, journalists face digital tactics that can remove their reporting without the perpetrators being identified. In Kazakhstan and Uzbekistan, fraudulent copyright complaints were used to take down news content and block journalists' pages.
In September, Turkish authorities also blocked 419 social media accounts in three days, including accounts belonging to journalists, newspapers, and civil society organizations. Some digital attacks rely on anonymous complaints and automated platform decisions; others use court orders. Either way, reporting can disappear while those responsible face little accountability.
Be part of the resistance, quietly.
Ina is an occasional contributor covering the overlooked corners of the internet – from surveillance and data collection to the systems quietly shaping what we see, share and give away.
