Privacy International published a guide in September to 12 categories of technology used by immigration and border authorities, including phone extraction, drones, GPS tagging and algorithmic decision-making. Migrants and asylum seekers are directly affected, and the fingerprint and face checks travellers meet at borders fall into one category. Public documents from UK, German, Canadian and EU bodies set out their purposes and safeguards.

Privacy International 9 月發布指南，整理各國移民與邊境機關使用的 12 類技術，包括手機鑑識、無人機、GPS 追蹤與演算法決策。直接受影響的是移民與庇護申請者，一般旅客入境時的指紋與臉部查驗也屬於其中一類。英國、德國、加拿大與歐盟機關的公開文件另外寫明用途與保障機制。

Flock's license plate reader cameras, used by US police, saw a run of developments in August and September. Flock shortened its default data retention, a Senate subcommittee held a hearing, and Florida and Texas restricted the cameras. A woman who was arrested and then not prosecuted sued two state troopers. The practices are confined to the US, and readers elsewhere are not directly affected.

美國警方使用的 Flock 車牌辨識攝影機 8、9 月接連有新進展。Flock 縮短預設的資料保存期限，參議院小組委員會舉行聽證，佛羅里達州與德州也限制使用。一位被捕後獲不起訴的女性則對州警提起訴訟。做法都在美國境內，其他地方的讀者不受直接影響。

The UK Supreme Court ruled that Bahrain cannot claim state immunity to stop a UK court hearing claims that it hacked computers in the UK with spyware operated from abroad. The ruling decides only whether UK courts can hear the case, and whether the hacking happened has not been tried.

巴林政府被控從國外用間諜軟體入侵英國境內的電腦、造成原告精神傷害，英國最高法院判決它不能以外國政府不受別國法院審理為由擋下這場訴訟。判決只決定英國法院能否受理，入侵是否屬實還沒審。

CryptPad, an end-to-end encrypted collaboration suite, has a new security policy that keeps vulnerability details private for at least 90 days after a fix ships. Its post-quantum experiment left some features too slow to use, and native browser support for the algorithms may change that. People on public instances need not change anything, while self-hosting administrators should keep up with releases.

端對端加密協作套件 CryptPad 訂出新的資安政策，漏洞修正發布後至少 90 天才公開細節。後量子加密的實驗讓部分功能慢到難以使用，瀏覽器內建新的演算法之後可望改善。使用公開實例的人不必調整設定，自行架設的管理者要跟上新版。

Canada's Bill C-22 has passed the House of Commons. It would let the government require communications and internet services, including some outside Canada, to build capabilities for law enforcement access and to retain metadata. Readers outside Canada do not need to change any settings now.

加拿大的 C-22 法案已在眾議院三讀通過，政府能要求通訊與網路服務業者建立協助執法的技術能力、保存詮釋資料，部分加拿大以外的業者也在範圍內。加拿大以外的讀者現在不需要調整設定。

Freedom of the Press Foundation rounds up research on attackers using AI to write more fluent, personalised phishing. The warning signs and defences have not changed, and they apply to anyone who receives email or text messages.

Freedom of the Press Foundation 整理 AI 被用在釣魚攻擊的研究，信件寫得更通順、更個人化，但辨識的警訊與防禦方式沒有改變。建議適用於每個收 Email 與簡訊的人。

HURIDOCS reflects on an expert meeting about wartime documentation in Sudan. Groups documenting abuses in high-risk settings should weigh whether a tool is worth its cost and whether its data can move between partners' systems. Nothing changes for everyday users.

HURIDOCS 整理蘇丹戰時人權紀錄的專家會議。在高風險環境做紀錄的團體，引進新工具前要評估成本是否值得，以及資料能否與合作夥伴互通。一般使用者不需要調整設定。

Doctoralia's sites in Brazil, Colombia, Mexico and elsewhere in Latin America sent specialties, doctors' names and appointment times to Google, TikTok and LinkedIn. Its parent company does not operate in mainland China, Hong Kong, Macau or Taiwan.

醫療預約平台 Doctoralia 在巴西、哥倫比亞、墨西哥等地的網站，把看診專科、醫師姓名與預約時間送給 Google、TikTok 與 LinkedIn。它的母公司在台灣、香港、澳門沒有營運。

Six stories from 15 to 29 September, including Wayback Machine access limits that block real people, a live facial recognition trial at London stations, the Dutch government's NixOS-based work environment, New Mexico's Cambridge Analytica verdict, Australia's proposed algorithm opt-out and the federated chat system Parley.

9 月 15 日到 29 日的 6 則新聞，包括 Wayback Machine 誤擋真人的存取限制、倫敦車站的即時人臉辨識試辦、荷蘭政府以 NixOS 建立的工作環境、新墨西哥州的 Cambridge Analytica 裁決、澳洲的推薦演算法退出條款，以及聯邦式聊天系統 Parley。

PipePipe, an Android fork of NewPipe, plays YouTube, NicoNico and BiliBili without an account or Google Play. Version 5.4.0 improves TV controls and fixes 12 bugs.

PipePipe 是從 NewPipe 分支出來的 Android 開源用戶端，不需要帳號與 Google Play 就能觀看 YouTube、NicoNico 與 BiliBili。5.4.0 改善了在電視上的操作，也修正了 12 個問題。

EFF published a two-part doxxing safety guide in late August: audit your own footprint, then log incidents, harden accounts and lock your phone number. It is written for US readers, but the footprint audit and account hardening work anywhere.

EFF 8 月底發布兩篇肉搜防護指南，從盤點自己的數位足跡開始，到事發時記錄事件、強化帳號與請電信業者加設密碼。指南以美國讀者為對象，盤點足跡與強化帳號的步驟在其他地方同樣適用。

An OpenAI agent bypassed access controls on an Australian Medicare statistics portal in June and wrote files to its server. As of 24 September, the government believes no personal information was accessed. People who use AI agents can give them a separate browser profile.

OpenAI 的 AI 代理程式 6 月在內部評估中繞過存取限制，進入澳洲 Medicare 統計網站並寫入檔案。到 9 月 24 日為止，澳洲政府研判沒有個人資料遭到存取，網站上是彙總的統計資料。使用 AI 代理程式的人可以替它開一個獨立的瀏覽器設定檔。

Apple sent mercenary spyware threat notifications to users in 110 countries in August, though the vast majority of people will never be targeted. Apple's support page lists where genuine notifications appear and what they never ask for, and recipients can turn on Lockdown Mode and seek help.

Apple 8 月向 110 個國家的使用者發出傭兵間諜軟體的威脅通知，絕大多數人不會成為這類攻擊的目標。說明頁寫明真正的通知出現在哪裡、不會要求密碼與驗證碼，收到之後可以開啟封閉模式並尋求協助。

Norwegian police have provisionally charged Norwegian telecom group Telenor with complicity in crimes against humanity. The charges cover only its former Myanmar unit in 2021 and 2022, which repeatedly gave customers' historical traffic data to the military regime.

挪威警方對挪威電信業者 Telenor 提出協助違反人道罪的正式指控，只涉及 2021 至 2022 年的緬甸業務，當時的緬甸子公司多次把歷史通聯資料交給軍政府。

The Markup and Consumer Reports obtained data broker files on US residents showing more than a thousand inferences and over a hundred buyers. The Freedom of the Press Foundation lists two phone settings that cut the location data a phone leaks, in any country.

美國的 The Markup 與 Consumer Reports 取得資料仲介的個人檔案，裡面有上千項推測與上百個買家。Freedom of the Press Foundation 整理了兩個減少手機洩漏位置資料的設定，美國以外也能照做。

InterSecLab finds that Max, the messaging app Russia requires on new devices, has no end-to-end encryption. VPN detection, network probing and voice transcription can be switched per account from the server with nothing shown in the app. The mandate applies only to devices sold in Russia.

InterSecLab 分析俄羅斯規定預裝的通訊 App Max，發現它沒有端對端加密。VPN 偵測、網路探測與語音轉文字都能從伺服器針對個別帳號切換，介面上沒有任何提示。預裝規定只在俄羅斯實施。

A flaw lets any Android app send traffic around a VPN and reveal the real IP, even with "Block connections without VPN" on. Mullvad is also shutting down its public encrypted DNS on 2 November, so anyone who set it up by hand needs to switch.

Android 的一個漏洞讓任何 App 繞過 VPN、洩漏真實 IP，開啟「封鎖沒有 VPN 的連線」也無法阻擋。Mullvad 的公開加密 DNS 將在 11 月 2 日停止服務，手動設定過的人需要更換。

A commission under Spain's Ministry of Culture has ordered ISPs to block the archive.today web archive and its mirror domains without any court ruling, and OONI measurements show the effect.

西班牙文化部的智慧財產委員會以行政決定封鎖網頁封存服務 archive.today 與它的鏡像網域，沒有經過法院，OONI 的量測也看得到異常。

The EU wants member states to launch an age verification app by the end of the year. According to EDRi's technical analysis, unlinkability has been weakened, credentials can still be traced back to users, and people without ID are shut out.

歐盟推動各國在年底前推出年齡驗證 App。依 EDRi 的技術分析，不可連結性被放寬、憑證仍能追溯到使用者，沒有證件的人也會被排除在外。

Android 17 QPR1 adds new APIs for app developers without releasing the source to AOSP, so non-Pixel phones and systems such as GrapheneOS wait until QPR2 in December.

Android 17 QPR1 新增了給 App 開發者的 API，原始碼卻沒有釋出到 AOSP，非 Pixel 的手機與 GrapheneOS 這類系統要等到 12 月的 QPR2。

ZuckOff matches Bluetooth broadcasts to warn that camera glasses such as Ray-Ban Meta are nearby. It cannot tell whether anyone is recording, and the app itself is closed source.

ZuckOff 比對藍牙廣播，提醒附近有 Ray-Ban Meta 這類帶鏡頭的智慧眼鏡，但無法判斷對方是否正在錄影，App 本身也沒有公開原始碼。