📡 A Bug Behind the Boardroom TV, a Phone-Cracker Signed by a Minister, and a One-Man Plate-Reader Company

Or: When the Recorder Hides in a USB Port and Your Town’s New Camera Vendor Is One Guy

By Thomas Seest, Dunlap.Today · Saturday, November 7, 2026

This week’s surveillance news came with court dates. The former OpenAI engineer accused of tucking an audio recorder, wrapped in toilet paper, into a USB port behind a boardroom TV pleaded not guilty Friday in San Francisco. Prosecutors say AI tools helped him find the room and design the device. Halfway around the world, India’s Internet Freedom Foundation published a government letter showing the Home Minister personally approved the country’s most powerful Cellebrite phone-cracking purchase.

Closer to home, a Massachusetts city dropped Flock and then picked a plate-reader company the Boston Globe could tie to just one person. Another city canceled Flock even though its own audits found no misuse. And a contractor cleaning air ducts in a Canadian high school found what looked like a recorder in the girls’ change room.

Here’s the roundup for folks who buy bug sweeps and the private investigators who do the work: bugs in the walls, phones in police hands, plates and politics, faces in the crowd, and voices you can’t trust.

⏱️ What this means for you in 30 seconds

• A radio-only sweep can miss a recorder that doesn’t transmit. Physically check TV ports, chargers, and vents.
• If your phone was taken out of your hands, treat it as compromised until a forensic check says otherwise.
• When your town drops Flock, ask who the new vendor is and who can search the data.
• Ducts and ceiling voids are favorite hiding spots. One find means sweep the whole building.
• A familiar voice on the phone proves nothing. Use a family code word and call back.
• Get original video files with hashes. AI can now edit things out of footage cleanly.

🎙️ Bugs in the Boardroom, the Locker Room, and the Detective’s Office

Abdulrahman Alfozan pleaded not guilty to intercepting oral communications. Prosecutors say OpenAI found a recorder plugged into a TV’s USB port in an executive conference room, that security cameras later caught him checking behind that TV, and that a second recorder turned up in his bag. They also say he used a “productivity agent” to look up meeting rooms, and that a chatbot tied to his spouse held prompts on building a “continuous audio recorder.” He’s back in court Nov. 17 and presumed innocent.

In Fort Smith, Northwest Territories, a duct cleaner found a suspected recording device in a high school girls’ change room, and the RCMP is investigating. In Ukraine, the anti-corruption bureau NABU says someone tried again this summer to plant surveillance gear on its detectives. “Something went wrong for them,” its detective chief said.

What it means for you: The quiet devices are the dangerous ones. A recorder that never transmits needs a hands-on search: ports, power strips, vents, and anything new in the room. And when you find one, keep looking.

👉 Courthouse News · CNBC · CBC News · Censor.NET

📱 Phones in Police Hands and Insiders With Camera Access

India’s Internet Freedom Foundation says Home Minister Amit Shah approved a Make in India exemption so the National Investigation Agency could buy Cellebrite’s Premium tool, which the contract spec says can bypass iPhone passcodes and decrypt phones’ hidden private folders. IFF counts 15 Cellebrite listings by Indian agencies this year and notes there’s no law saying when a seized phone can be copied.

In Nebraska, an investigator testified that a former school resource officer took more than 5,000 covert photos of students, some with the school’s own camera system, and used AI to make nude images of more than 200 people. In Fishers, Indiana, a photo-hosting site’s tip led to 20 felony charges over AI-altered pictures of young people. Both men are presumed innocent.

What it means for you: Keep phones updated and fully powered off when seizure is likely. Schools and businesses should log who looks at camera footage, the way the bank counts the cash drawer.

👉 Internet Freedom Foundation · Nebraska Public Media · Central Indiana Herald

🚓 Plates, Politics, and the One-Man Vendor

Quincy, Mass. voted to cut ties with Flock. Four days later the mayor announced OdinEye, with no bid and no public input. The Globe could link it to one person, a Connecticut police detective. Haverhill is canceling Flock even though its own audits came back clean, saying the technology itself lacks enough privacy safeguards. Toledo’s council deadlocked, so the mayor breaks the tie Nov. 17, after four Flock cameras were tampered with over Halloween weekend.

In Los Angeles, the council fell one vote short of blocking an LAPD Axon plate-reader pilot, with a $235 million contract still ahead. In Congress, H.R. 10900 would dock federal grants from departments that don’t report officers misusing plate data. And in Sunland Park, N.M., Border Patrol AI towers watch neighborhoods that the state’s new privacy law can’t reach.

What it means for you: Getting rid of Flock doesn’t get rid of plate cameras. Ask who the next vendor is, whether anyone has audited its security, and who can search the data.

👉 Boston Globe · City of Haverhill · 13abc · The Auto Wire · H.R. 10900 brief · Sunland Park towers

👁️ Faces in the Crowd and the Classroom

Hong Kong police are turning on facial recognition across about 20,000 cameras, including feeds from shopping malls that the government says don’t have to tell shoppers they’re connected. Face captures are kept 180 days. Police Scotland put on a live facial recognition demo for officials as the country’s biometrics commissioner pushes for a real law. And Nanjing University pulled back an AI classroom system that scored students on how often they kept their heads up.

What it means for you: Ordinary security cameras can become face-matching or behavior-scoring systems with a software update. Ask your camera vendor what analytics are switched on, and whether your feeds go anywhere else.

👉 RTHK · Biometric Update · From Inside Asia

🎭 Voices, Scripts, and Snoops for Hire

A Kansas City TV test cloned a reporter’s voice from 32 minutes of public video with $11 software, and her cousin believed it was her. In the $129 million deepfake-CEO case, new coverage describes a handwritten “Lawyer Call” script and an alleged boast of laundering $400 million. On the defense side, Veriff launched checks that look for deepfaked selfie videos and for signs that someone is being coached through a verification. And in Britain, Reform UK figure Arron Banks is accused of hiring private investigators to dig into business rivals and journalists.

What it means for you: Voices are cheap to fake, so verify through a channel you start yourself. And if you hire a PI, put the limits in writing.

👉 WGAL/KMBC · Gizmodo · Biometric Update · InView

Cousin Billy could tell you the moral: the bug might be a recorder in a TV port, a camera in an air duct, or a cloned voice that sounds just like family. Check the ports, log who watches the cameras, call back on a number you already know, and call a pro when the coincidences start piling up.

— Dunlap.Today

📚 Plain-English AI Glossary

• TSCM: Technical surveillance countermeasures, the professional name for a bug sweep.
• Standalone recorder: A bug that records to a memory card and sends no signal, so radio scanners can’t hear it.
• Cellebrite: A company whose tools unlock and copy the contents of seized phones.
• ALPR: Automated license plate reader, a camera that logs passing plates.
• Hot list: The list of “wanted” plates a reader checks against. If it’s out of date, police can pull over the wrong car.
• Live facial recognition (LFR): Cameras that compare passing faces to a watchlist in real time.
• Voice cloning: AI that copies someone’s voice from recordings of them talking.
• Coercion detection: Software that looks for signs someone is being coached or pressured during an identity check.
• Hash: A digital fingerprint that proves a file hasn’t been changed.

❓ Frequently Asked Questions

Would a normal bug sweep have found the OpenAI recorder?

Not if the sweep only listened for radio signals. A recorder that saves to a card sends nothing out. You need a hands-on search of ports, chargers, and furniture, ideally by a team that knows to look there.

My town dropped Flock. Am I off the cameras?

Maybe not. Many towns switch to another vendor or software. Ask who replaced Flock, how long data is kept, and who can search it.

What should a school do after finding a hidden camera?

Call police, leave the device where it is, sweep the rest of the building, including vents and ducts, and check other public facilities nearby, the way Fort Smith did.

How cheap is it to clone a voice?

Cheap. One TV test did it with $11 software and public videos. Set up a family code word and always call back on a number you already know.

Can I trust surveillance video in a case?

Get the original file from the source system, with its hash and metadata. AI editing tools can now remove objects from video cleanly, so exported clips and screen recordings deserve extra scrutiny.

✅ This Week’s Counter-Surveillance Checklist

• ✅ Physically inspect TV ports, chargers, and power strips in meeting rooms
• ✅ Add vents, ducts, and ceiling voids to every sweep
• ✅ After one find, sweep the whole building and anywhere else the same person could reach
• ✅ Keep phones updated and power them fully off before a likely seizure
• ✅ Log and audit who views and exports security camera footage
• ✅ Ask what replaces Flock in your town and who can search the data
• ✅ Watch your own cameras for tampering and outages
• ✅ Set up a family or executive code word for urgent calls
• ✅ Put written limits on any private investigator engagement
• ✅ Collect original video with hashes, not screen recordings

Practical rule: If it plugs in, it could be listening. If it calls you, verify it. If it came out of a camera system, get the original file.