📡 The Bug Was a $14 Board, the Planning Was Done by AI Tools, and a Human Found It

Or: When the Meeting Bot Joins Without Asking and the Cop Knows Where Your Car Has Been

By Thomas Seest, Dunlap.Today · Sunday, November 8, 2026

Here’s a story that sounds like a spy movie and cost about as much as a pizza. The recorder prosecutors say was hidden behind a boardroom TV at OpenAI was a thumb-sized $14 circuit board. New analysis this week says the planning used tools the company already owned, and the person who found the device was a human walking the floor, not an AI.

That’s the theme of this week’s roundup: cheap gear, smart software, and a lot of gaps between what the technology can do and what the rules say. The Attorney General said plate-reader privacy worries are “misinformation.” A Massachusetts city drafted a ban. Two AI meeting-notetaker companies are in court over bots that join calls quietly. And a rooftop drone might soon show up before the police do.

Here’s the plain-English roundup for folks who buy bug sweeps and the private investigators who do the work: bugs and insiders, plates and politics, faces and drones, bots in the room, and voices you can’t trust.

⏱️ What this means for you in 30 seconds

• A cheap recorder doesn’t transmit, so a radio-only sweep can miss it. Check ports and power strips by hand.
• Ask who can look up executive meeting rooms and calendars in your company’s software.
• Write a rule for AI meeting notetakers: who may turn one on, and who gets told.
• Be careful what client details you type into a personal chatbot account.
• A familiar voice on the phone proves nothing. Use a family code word and call back.
• When a town or sheriff adopts AI, ask what the written policy says.

🎙️ The $14 Bug and the Insider With a Plan

Abdulrahman Alfozan pleaded not guilty last week and is due back in court Nov. 17. He’s presumed innocent. This week brought a closer look at how prosecutors say it worked. A security research group points out that the device was a commodity board, and that the planning allegedly used an internal AI assistant and a chatbot account. The logs existed. Nobody was reading them until later.

One security executive pushes back on OpenAI’s claim that its own AI helped crack the case. In his view, a person doing a physical sweep found the recorder, and the AI only helped make sense of data afterward.

What it means for you: Think of it like the cash drawer at the hardware store. The lock matters, but so does asking why someone who doesn’t work the register keeps asking about it. A good sweep checks the room, and a good review checks who has been asking about the room.

👉 Saluca Labs · Security Magazine · WIRED · Courthouse News

🚓 Plates, Politics, and the Attorney General

Attorney General Todd Blanche told reporters license plate readers don’t affect Americans’ privacy and called the concerns misinformation, according to Politico. The same week, Springfield, Massachusetts, got a draft ordinance to ban Flock cameras for the police department. The police superintendent wants to keep them. A local news report, as summarized by an advocacy site, says the city’s camera data was searched millions of times, including for immigration cases. Two senators from different parties have asked the Justice Department for guardrails.

In Virginia, a woman told the ACLU an officer who said he was with the FBI stopped her for the left lane, then showed her a map of where her plate had been photographed and called her travel “suspicious.” The account doesn’t name the officer or the agency, so it’s one driver’s recollection.

What it means for you: Rules differ town by town right now. If you buy plate data or rely on it in a case, get the retention and search-log terms in writing.

👉 Politico · GovTech · DeFlock The USA · The Hill · Backfire News

👁️ Faces, Drones, and AI-Written Police Reports

Western Australia’s police scanned 1,380,882 faces in a five-month facial-recognition trial, got 292 alerts (nine of them wrong) and made 122 arrests. A trade publication estimates that’s about 45 percent of the state’s population, though repeat scans aren’t counted. Critics ask whether “it works” is the same as “it’s proportionate.”

In Oakland, police want six rooftop drones that launch on 911 calls and arrive before officers. The plan bars facial recognition and deletes ordinary footage after five days. Houston approved an application for federal counter-drone money, with the use rules still being written. In Oregon, a sheriff’s office cleared Axon’s AI to draft felony reports from body-camera audio. And Meta told Hong Kong’s privacy regulator about its AI glasses as they go on sale there.

What it means for you: The camera is no longer the whole story. The software behind it decides what gets flagged, so ask what the written policy says before you accept “the computer said so.”

👉 Biometric Update · The Oaklandside · DroneXL · Your Oregon News · South China Morning Post

🤖 The Bot in the Room and the Chatbot With a Memory

Two of the four best-known AI meeting notetakers, Otter and Granola, face federal privacy suits over bots that join calls without telling everyone. A judge let the core claims against Otter go forward in August, including a wiretap claim. Some tools warn every attendee by default and some leave it to the host.

Russia’s Interior Ministry, for its part, warned that ChatGPT’s memory can pile up personal details into a profile and that hidden instructions inside documents could tamper with that memory. That’s a government warning, not a lab test, but the advice is sensible: review memory settings and keep work documents out.

What it means for you: A notetaker is like inviting Cousin Billy to a family meeting and finding out he’s been taping it. Decide ahead of time who gets to bring a recorder, and say so.

👉 AI Lately · RIA Novosti (Russian) · Vedomosti (Russian) · TAFS

🕵️ Tools of the Trade for Investigators

Nexus, a Slovenian company, sells an “agentic” research platform that takes a plain-language goal and returns findings tied to saved evidence, for about €59 a month. SockPuppet launched Scout, which gives investigative teams managed, logged access to online platforms. Cyberette and bizTops are adding deepfake detection to a tool child-safety investigators use. These are company descriptions, and we haven’t tested any of them.

Meanwhile, a case published by China’s top prosecutors shows the other side of the trade: nine fake “private detectives” were sentenced after they bought personal data and put GPS trackers on people’s cars. The ringleader got four years.

What it means for you: Software can speed up the search, but it doesn’t make a source lawful. Ask any investigator how the information was gathered, and who checked.

👉 Nexus · SockPuppet · Biometric Update · Jimu News via Tencent (Chinese)

📞 Voices You Can’t Trust

The $129 million deepfake-CEO case drew defense advice this week. A security vendor says a 20 to 30 second voice sample is enough to clone someone, that people tell real from fake at about coin-flip odds, and that a callback or quick video check can be faked too. Its advice is to treat secrecy, urgency, a new bank account and an outside “lawyer” as red flags and to verify through contact details you already have. The defendants are presumed innocent.

In South Carolina, Greenville police warn about “virtual kidnapping” calls that use AI voices and spoofed numbers. A Pindrop survey from late September, which is older and from a vendor, found only 10 percent of big companies have purpose-built tools for deepfakes.

What it means for you: Pick a family code word today. If a call asks for money in a hurry, hang up and call back on a number you already know.

👉 PCMag Middle East · GetReal Security · WSPA · Pindrop

🔍 One Research Item Worth Knowing

Researchers at KAIST in Korea, with two Singapore universities, built a hidden-camera detector that uses a phone and a sub-$7 LED case. It reached about 94 percent accuracy on 30 everyday objects. It’s a research prototype from August, not something you can buy, but it hints at where consumer detection is heading.

What it means for you: A phone scan can add a clue, but it can’t prove a room is clean. A professional sweep still looks for things a lens detector won’t see.

👉 EurekAlert

— Dunlap.Today

📚 Plain-English AI Glossary

• TSCM: Technical surveillance countermeasures, the professional name for a bug sweep.
• Insider threat: Someone with legitimate access who misuses it.
• ALPR: Automated license plate reader, a camera that logs passing plates.
• Live facial recognition: Cameras that compare passing faces to a watchlist as people walk by.
• AI notetaker: A bot that joins a call, records it and writes a summary.
• OSINT: Open-source intelligence, research using publicly available information.
• Voice cloning: AI that copies someone’s voice from a short recording.
• Counter-drone: Gear that detects, tracks or stops drones.
• Chain of custody: The record of who handled a piece of evidence and when.

❓ Frequently Asked Questions

Can a bug sweep find a recorder that doesn’t send a signal?

Not with radio gear alone. A recorder that saves to a memory card needs a hands-on search of ports, power strips, vents and anything new in the room.

Is it legal for an AI notetaker to join my call?

It depends on where you and the other people are. Some laws require everyone’s consent, and two notetaker companies are being sued over how they notify people. Tell attendees ahead of time.

Should I type client details into a personal chatbot?

Best not to. Consumer chatbots may store what you enter, and Russia’s police are warning that memory features can build a profile. Use a work account with clear confidentiality terms.

Does a facial-recognition “match” mean it’s the right person?

No. It’s an alert for a human to check. Even a very low error rate means some people get stopped by mistake.

How do I know a call from a relative is real?

Agree on a code word in advance. If someone asks for money in a hurry, hang up and call the person back on a number you already have.

✅ This Week’s Counter-Surveillance Checklist

• ✅ Physically inspect TV ports, chargers and power strips in meeting rooms
• ✅ Limit who can look up executive calendars and meeting rooms in company software
• ✅ Write a rule for AI notetakers on sensitive calls
• ✅ Keep client names and case facts out of personal AI accounts
• ✅ Ask any vendor or town for the written policy and the audit log
• ✅ Set a family or executive code word for urgent calls
• ✅ Check where an investigator’s data came from before you rely on it
• ✅ Add vents, ducts and ceiling voids to every sweep

The rule of thumb: if someone is in a hurry, wants secrecy, and wants money, stop and verify through a channel you already trust.