A Watchdog’s Warning

The UK’s data protection regulator has a blunt message for police forces embracing live facial recognition: your paperwork isn’t keeping up with your technology.

In an article published on August 18, Emily Keaney, deputy commissioner for regulatory policy at the Information Commissioner’s Office (ICO), noted that a growing number of forces are deploying the tech with zero prior experience of using it in public. Some are even experimenting with operator-initiated facial recognition — where officers stop someone on the street and instantly cross-check their face against a watchlist.

That’s a powerful tool, but it’s also a risky one. As Keaney put it: “A false match can have serious consequences for people, including wrongful intervention, accusation or arrest.”

What the Audits Found

To gauge how forces are handling these risks, the ICO audited five police forces across England and Wales. The results, published this week, paint an uneven picture.

“Our audits reveal inconsistencies in data protection compliance across the five forces audited,” Keaney said. “While there was some good practice, significant improvements are still needed.”

Compliance rates were actually higher for live facial recognition (LFR) than for retrospective facial recognition (RFR), which involves scanning stored images after the fact. But in both cases, the ICO flagged several recurring gaps:

• Insufficient senior oversight, accountability, and training for staff using the technology
• Poor record-keeping about what personal data is used, where it comes from, and who it’s shared with
• RFR images sometimes sourced from questionable places and kept longer than necessary
• Inadequate checks on system accuracy and bias

The last point stings, given a Home Office report on police facial recognition bias published in December 2025. That report found that, in certain situations, the algorithm was more likely to incorrectly include some demographic groups in its search results. Keaney said at the time that the ICO required “urgent clarity on this matter.”

Why Governance Matters

You might wonder: why is the ICO so focused on administrative details like record-keeping? Because, as the regulator argues, public trust is the foundation for any sustainable use of facial recognition in policing. If people believe the system is sloppy or biased, they won’t accept it — no matter how effective it is at catching criminals.

There’s also a legal dimension. The EU AI Act largely prohibits police use of live facial recognition in public spaces, and while the UK has its own path, the ICO’s guidance signals that British regulators expect similar caution.

Next Steps for Police

The ICO says forces have been “willing to engage and make changes” based on the audit findings. That’s encouraging, but the regulator is clear that more work is needed before LFR becomes a standard policing tool.

For forces looking to get ahead of the curve, the ICO’s recommendations boil down to a few practical actions:

1. Appoint a senior officer responsible for FRT oversight and ensure all staff are properly trained
2. Maintain clear, auditable records of every use of the technology
3. Source RFR images only from approved channels and delete them promptly
4. Regularly test systems for accuracy and bias, and document the results

These aren’t glamorous tasks, but they’re the difference between a tool that protects the public and one that undermines civil liberties. As the ICO’s Keaney put it, strong data protection governance is essential to fostering the trust that facial recognition needs to flourish as a policing tool.

For more context on how these issues are playing out elsewhere, read about the landmark court ruling on police facial recognition and the Home Office’s findings on racial bias in RFR systems.

Medusa Ransomware Expands Its Reach

The FBI, CISA, and the Department of Health and Human Services have issued a joint advisory revealing that Medusa ransomware has now impacted over 500 critical infrastructure organizations as of April 2026. That’s a significant jump from the 300 organizations reported in a March 2025 advisory, which covered activity through February 2025.

The updated warning, published August 18, singles out healthcare as a particularly frequent target. The advisory notes that Medusa actors have been opportunistic, going after victims with unpatched software rather than focusing on specific sectors. But the numbers suggest healthcare has borne the brunt.

Medusa first appeared in June 2021 as a closed operation, then shifted to an affiliate model by early 2023. Since then, it’s evolved into one of the more active ransomware-as-a-service (RaaS) groups around.

Exploiting Vulnerabilities at Breakneck Speed

Unpatched vulnerabilities remain Medusa’s primary entry point. What’s changed is the speed. The advisory says the group has been observed using exploits within 24 hours of public disclosure — often before victims even have a chance to patch.

In some cases, Medusa actors have leveraged exploits up to a week before the vulnerability is publicly announced. That’s a troubling timeline for defenders.

There’s no evidence Medusa develops its own zero-days. Instead, they’re fast followers, weaponizing known flaws quickly and moving on.

Nick Tausek, lead security automation architect at Swimlane, says this speed is creating real problems for security teams. “Shrinking windows put far more pressure on defenders to identify and remediate exposed systems before Medusa can take advantage. Dangerous levels of speed can turn a newly disclosed flaw into an active intrusion before many security teams have even finished assessing their exposure,” he commented.

Interactsh and Verification Tactics

The group has also adopted Interactsh dynamic URLs to verify successful exploitation. This lets them identify compromised hosts and confirm their foothold before moving deeper.

Stealthier Post-Exploitation and Lateral Movement

Medusa’s post-exploitation game has improved significantly. The advisory describes multiple PowerShell stealth techniques of increasing complexity, used to obfuscate payloads. They even delete PowerShell command history to cover their tracks.

New tools are in play for command and control (C2) and stealth. Publicly available tools like Nezha, an operations and maintenance server monitoring tool, give them backdoor visibility into compromised hosts. GSocket allows workstations on different private networks to connect and bypass firewalls.

The group also deploys legitimate remote monitoring and management (RMM) software, often selecting tools already present in the victim’s environment to avoid detection. These are used to move laterally and identify files for exfiltration.

Credential theft has gotten more aggressive. The advisory notes the use of Windows Task Manager Mimikatz to harvest credentials directly from the LSA authentication mechanism, recording plaintext passwords to a log file.

Andrew Costis, engineering manager at AttackIQ, highlighted the implications. “The group is blending legitimate remote management tools into its operations while using new credential theft methods and overriding security policies to maintain access,” he said.

“Stolen Active Directory files are especially concerning because they can be used to forge Kerberos tickets. At that point, Medusa isn’t just encrypting systems. It can potentially impersonate trusted users and move through an entire domain with far fewer obstacles.”

Exfiltration and the Double-Extortion Model

Medusa’s exfiltration playbook is well-established. They use Bandizip to create archives of stolen files and Rclone to move data to their C2 servers, obfuscating rclone.exe and related .conf files by renaming them.

Secure file transfer protocol (SFTP) is used to deliver the encryptor to victim machines. Encrypted files get a .medusa extension. The malware terminates all services, deletes shadow copies, and drops a ransom note.

This enables a double-extortion model: victims pay to restore systems and data, and to prevent stolen data from being published online. The ransom note demands contact within 48 hours. If victims don’t respond, Medusa actors often reach out directly via phone or email.

Ransom demands are posted on Medusa’s leak site, complete with direct hyperlinks to Medusa-affiliated cryptocurrency wallets.

FBI Urges Incident Response Readiness

Beyond prevention, the advisory stresses the need for effective incident response. Security teams should be ready to act when an intrusion occurs, not just before.

Recommended actions include:

• Use threat hunting to scope the intrusion, including logs left behind by threat actor tooling
• Remove C2 software like Nezha or any other remote access method used by the organization
• Remove local administrator accounts and rotate credentials for service accounts and domain administrator accounts
• Ensure the initial intrusion CVE is patched
• Use CISA’s Eviction Strategies Tool to assemble countermeasures for a systematic eviction plan

For organizations worried about their exposure, the advisory is a reminder that patch management alone isn’t enough. Speed matters, but so does having a plan for when defenses fail. The FBI’s latest Medusa ransomware advisory offers concrete steps, and security teams should review it closely.

If you’re in healthcare, the stakes are especially high. The sector’s reliance on legacy systems and connected medical devices makes it a prime target. Reviewing healthcare ransomware defense strategies could help close gaps before attackers find them.

And for those tracking broader trends, the rise of ransomware-as-a-service operations shows no signs of slowing. Medusa is just one example of how these groups evolve, adapt, and keep pressure on defenders.

A landmark ruling with a long shadow

The Supreme Court’s decision last month in Chatrie v. United States — the first major Fourth Amendment case to reach the high court in eight years — may have been about cell phone location data. But its ripple effects could reach far beyond Google’s servers.

Legal scholars and privacy advocates are now asking a pointed question: if police need a warrant to see where your phone was, why shouldn’t they need one to see where your car was?

The ruling, which found that so-called geofence searches of location history require a warrant, has thrown a spotlight on license plate cameras — the networks of automated license plate readers (ALPRs) that have quietly become a cornerstone of modern policing.

What Chatrie actually changed

For years, police have leaned on tech companies to hand over location data, letting them pinpoint which phones were near a crime scene at a specific time. The government argued these geofence searches were too brief to trigger Fourth Amendment protections.

The justices disagreed. Even a few hours of location history, they wrote, can reveal whether someone visited an “indisputably private” place — a psychiatrist’s office, an abortion clinic, an AIDS treatment center, a strip club, or a by-the-hour motel.

“Location History enables police officers to focus on precisely those sites — to see, in a given time block, who shows up,” the opinion read.

That language matters, says Michael Soyfer, an attorney at the Institute for Justice. The court zeroed in on the “retrospective and indiscriminate” nature of the surveillance — adjectives that fit ALPR data just as well.

“The justices drilled down on what was in the database and not just what police happened to access at a point in time,” Soyfer said at a recent briefing. “The court’s really emphasizing that it’s looking at the capabilities of the technology overall rather than just what police did with it.”

The Flock Safety factor

Here’s where the rubber meets the road. Flock Safety, the country’s dominant ALPR vendor, says it has between 90,000 and 100,000 cameras on public roadways. It collects data on roughly 20 billion license plates every month.

That’s not a typo. Twenty billion.

Police increasingly use this data to identify suspects — running plates through databases that can reveal where someone lives, works, and drives on a regular basis. The question is whether that kind of sweeping surveillance should require judicial oversight.

Flock Safety insists the Chatrie decision doesn’t apply to its technology. In a statement, a company spokesperson argued that the ruling addresses “geofence warrants for Google location history, which is categorically different from license plate recognition technology.”

“Google location history involves data from a person’s own mobile device and reveals continuous movements across both public and private places,” the statement said. “Flock’s ALPR technology, by contrast, captures point-in-time images of vehicles in public view.”

The company also pointed to a side note in the Supreme Court opinion that appears to differentiate the standard for what counts as a Fourth Amendment search based on whether the tracking occurs on “public roads.” Courts have “repeatedly and uniformly” treated ALPRs differently from cell-site location data, the spokesperson added.

Why ALPRs aren’t just about plates

Andrew Guthrie Ferguson, a law professor at George Washington University and author of Your Data Will Be Used Against You, isn’t convinced. He argues that modern ALPRs are just the tip of a much larger iceberg.

“Modern ALPRs are just the connecting point to a much larger system of personally revealing information stored in police and connected public databases,” Ferguson said in an interview.

Those databases often hold far more than plate reads. Ferguson points to social media activity, surveillance video from thousands of public and private cameras, body camera footage, drone video, gunshot detection sensor data, and police dashboard cameras — all linked together in ways that let officers build extraordinarily detailed dossiers on individuals.

“There are some differences with the nature of license plates that are after all designed for identification, but I think it is a mistake to think about ALPRs standing alone,” he said. “Chatrie certainly strengthens the Fourth Amendment case against the warrantless collection of ALPR data.”

What a warrant requirement would mean

If courts ultimately decide that ALPR searches require a warrant, the impact on policing would be hard to overstate. Here’s what could change:

• Police would need to show probable cause before searching historical plate data — a significant hurdle for investigations that currently rely on quick database queries.
• Retrospective searches — going back days or weeks to see which cars were at a scene — would likely face the toughest scrutiny.
• Real-time alerts, like Flock’s ability to flag a stolen car the moment it passes a camera, might survive, since those are more like traditional surveillance.
• Data retention policies would probably shrink. Why keep 30 days of data if you can’t search it without a warrant?

The Chatrie decision could also have implications beyond ALPRs. Soyfer notes it may affect reverse keyword searches, cell tower dumps, and law enforcement’s purchase of commercial location data from brokers — all practices that have grown rapidly in recent years.

A debate that’s just beginning

Flock Safety may be right that the Supreme Court didn’t have license plates in mind when it wrote the Chatrie opinion. But the logic of the ruling — that the government can’t build a massive, searchable database of where people have been without judicial oversight — is hard to square with the company’s business model.

The court’s emphasis on the capabilities of technology, rather than how police happened to use it in a particular case, is a direct challenge to the way ALPR networks operate. They collect everything, store everything, and search everything.

For now, the legal landscape remains unsettled. But one thing is clear: the debate over license plate cameras and the Fourth Amendment is only getting started. And after Chatrie, the burden of proof may be shifting.