Get tomorrow's brief in your inbox
Today: Louisiana asks the Supreme Court to keep the 5th Circuit's abortion pill mailing ban in place. European leaders finalize AI Act amendments that ban nudification tools and delay high-risk AI rules until December 2027. Polish intelligence confirms hackers accessed industrial control systems at five water treatment facilities in 2025, creating direct risk to water supply continuity.
Polish Water Treatment Control System Breaches
Poland's Internal Security Agency confirmed attackers breached water treatment facilities in Jabłonna Lacka, Szczytno, Małdyty, Tolkmicko, and Sierakowo during 2025. In some cases, attackers gained access to industrial control systems with the ability to alter technical parameters of devices, creating direct risk to continuity of water supply operations. The ABW linked the attacks to intensified hostile cyber activity from Russian Federation special services but did not formally attribute the incidents. CyberDefence24 previously linked several incidents to a pro-Russian hacktivist group that posted propaganda videos showing attackers altering settings linked to pumps and alarms after accessing administrator accounts.
North Carolina Man Pleads Guilty to Doxxing Supreme Court Justice
Kyle Edwards, 59, of North Carolina pleaded guilty to federal charges for posting a Supreme Court justice's home address on social media and threatening their life. Edwards admitted to saying the justice should "buy Kevlar robes" and encouraged others to turn multiple justices "into charcoal" according to DOJ. Edwards also posted the former home addresses and neighborhoods of two additional Supreme Court justices to the same publicly accessible social media site. The account drew other users who also suggested attacking the justice. Edwards faces a maximum sentence of five years in prison.
Law Enforcement Officers Abusing ALPR Cameras to Stalk Women
An Institute for Justice review of media reports identified at least 14 cases nationwide of police officers allegedly abusing ALPR camera networks to track romantic interests, current partners, exes, and strangers, with the bulk of incidents occurring since 2024. Nearly all officers were criminally charged and lost their jobs. Notable cases include Kechi, Kansas Lieutenant Victor Heiar (pleaded guilty to computer crime and stalking after using Flock cameras to track his estranged wife), Sedgwick, Kansas Police Chief Lee Nygaard (resigned after using Flock cameras to track his ex-girlfriend and her new boyfriend more than 200 times over several months), and Costa Mesa, California Officer Robert Josett (pleaded guilty to multiple criminal charges in April 2026 after using Flock cameras to track his mistress and her other romantic interests). Targets of abusive surveillance are almost exclusively women.
MuddyWater APT Group Deploying Chaos Ransomware as Cover for Espionage
Iranian government hackers from MuddyWater (linked to Iran's Ministry of Intelligence and Security) are deploying Chaos ransomware as cover for espionage and data theft operations according to Rapid7. The hackers used a social engineering campaign leveraging Microsoft Teams external chat requests to establish screen-sharing sessions with victims, access VPN configuration files, and obtain credentials. After deploying remote management tools, hackers sent extortion emails threatening to leak stolen data but never encrypted files, leading researchers to identify the operation as state-sponsored intrusion disguised as cybercrime. Technical evidence including malware, certificates, and infrastructure tied back to MuddyWater's toolkit and previous campaigns targeting Middle East and North Africa organizations in March.
ICE Developing Smart Glasses with Facial Recognition
U.S. Immigration and Customs Enforcement is developing smart glasses with facial recognition capabilities tied to multiple databases including ABIS and BEWL systems originally deployed in overseas counterterrorism operations. The devices enable non-cooperative biometrics, capturing facial features, gait, and other identifiers without consent, effectively eliminating anonymity in public spaces. Unlike the consumer market backlash that killed Google Glass ("glasshole"), federal deployments do not rely on public acceptance to operate.
$5M European Wax Center Privacy Class Action Settlement
Individuals who visited waxcenter.com between June 30, 2023, and April 2, 2026, may be eligible for compensation from a $5 million class action settlement. The settlement resolves claims that European Wax Center violated privacy laws.
$2M Bell Ambulance Data Breach Class Action Settlement
Individuals affected by the Bell Ambulance data breach may qualify for cash payment and credit monitoring under a $2 million class action settlement. The settlement compensates individuals whose personal information was compromised in the breach.
Louisiana Mifepristone Appeal (Danco Laboratories v. Louisiana, GenBioPro v. Louisiana)
Louisiana urged the Supreme Court to leave in place the 5th Circuit order prohibiting mailing of mifepristone (abortion pill). Justice Samuel Alito temporarily paused the 5th Circuit's order to give the Supreme Court time to consider requests from drug manufacturers Danco Laboratories and GenBioPro. Alito's order means mifepristone will remain widely available nationwide at least until Monday, May 11. Louisiana's 58-page filing argued the Biden administration's decision to make mifepristone available by mail was part of an effort to undermine Dobbs v. Jackson Women's Health Organization and is causing approximately 1,000 illegal abortions in Louisiana each month. The case follows the Supreme Court's June 2024 ruling in FDA v. Alliance for Hippocratic Medicine, where Justice Kavanaugh held that doctors and medical groups opposed to abortion lacked standing to challenge FDA's expansion of mifepristone access. Louisiana filed its own lawsuit last fall asking to reinstate in-person dispensing requirements. The 5th Circuit ruled Louisiana has standing because the FDA opened the door for mifepristone to be remotely prescribed to Louisiana women.
TPS Cases (Trump v. Miot, Mullin v. Doe)
The Trump administration claims Congress gave the Secretary of Homeland Security unreviewable discretion to grant or terminate Temporary Protected Status for foreign nationals from countries in turmoil. The cases involve Secretary Kristi Noem's attempt to terminate TPS for Haiti and Syria. The government points to TPS statute language stating "There is no judicial review of any determination of the Attorney General with respect to the designation, or termination or extension of a designation, of a foreign state under this subsection." Haitian and Syrian TPS beneficiaries argue Congress enacted the statute to limit executive power, not unleash it. During oral argument, Justices Ketanji Brown Jackson, Sonia Sotomayor, and Elena Kagan signaled disagreement with the government's position that courts cannot review TPS termination decisions. Justice Amy Coney Barrett also revealed skepticism that courts cannot review the decisions.
Nintendo Class Action Over Tariff Windfall Profits
A new class action lawsuit alleges Nintendo unlawfully retained windfall profits generated by tariffs that were later deemed unlawful. Plaintiffs claim Nintendo profited twice from the tariffs by passing costs to consumers and then retaining those profits after the tariffs were invalidated.
Capital One Class Action Over Canceled Credit Card Rewards
Capital One unlawfully canceled credit card rewards that were promised to and earned by customers according to a new class action lawsuit. The lawsuit alleges customers relied on reward promises when selecting cards and using them for purchases.
Louisiana v. Callais Supreme Court Opinion Finalized
The Supreme Court denied a motion to recall its opinion in Louisiana v. Callais after agreeing to immediately finalize the opinion, which gives Louisiana more time to draw a new congressional map before the 2026 elections. The decision allows Louisiana to redraw election maps in May even though voting had already started in the same election, continuing a pattern where the Court's conservatives allow map changes when expected to help Republicans but invoke the Purcell principle (too close to an election) when changes would help Democrats.
DOJ Plans Intervention in Trump Supreme Court Carroll Appeal
The Justice Department will ask the Supreme Court to let it intervene in President Trump's appeal of the $83.3 million jury verdict against him in the defamation suit brought by E. Jean Carroll. The government will ask justices to substitute the U.S. for Trump because the president was acting as a government employee when he denied Carroll's sexual-assault claims in 2019. Substituting the U.S. for Trump under the Westfall Act of 1988 would result in the suit being dismissed because the U.S. cannot be sued for defamation. A panel of appeals court judges previously denied the government's request to invoke the Westfall Act in the case.
European AI Act Amendments Ban Nudification Tools, Delay High-Risk AI Rules
European lawmakers forged a tentative agreement that will ban artificial intelligence nudification tools while delaying implementation of key provisions of the EU's AI Act. The agreement requires formal approval from EU countries and the European Parliament by August. The deal postpones enforcement of rules governing high-risk AI tools involving biometrics and those used in employment, law enforcement, and critical infrastructure to December 2027 (initially slated for August 2026). The legislation allows personal data to be processed where necessary to detect and correct biases and narrows the number of businesses the AI Act applies to by granting exemptions to mid-cap enterprises. The nudification tool ban was first proposed after Elon Musk's Grok chatbot began publishing millions of nudified images in December and takes effect December 2, 2026.
Utah Age Verification Law Takes Effect with VPN Detection Requirement
Utah's Online Age Verification Amendments (Senate Bill 73) took effect May 7, establishing that users are considered to be accessing websites from Utah if they are physically located there, regardless of whether they use VPNs or proxies to mask IP addresses. The law states "An individual is considered to be accessing the website from this state if the individual is actually located in the state, regardless of whether the individual is using a virtual private network, proxy server, or other means to disguise or misrepresent the individual's geographic location." The law prohibits covered websites from facilitating or encouraging use of VPNs to circumvent age verification requirements, including by providing instructions on how to use VPNs or proxy servers to access the website or means for individuals to circumvent geofencing or blocking. Fight for the Future noted the law's logic is technically impossible by design, as reputable VPNs totally hide where a person is browsing from, meaning websites definitionally cannot tell whether users are in Utah.
FCC Commissioner Gomez Calls for Review of Paramount-Warner Merger Foreign Financing
FCC Commissioner Anna Gomez called for rigorous review of the $111 billion Paramount-Warner Brothers merger after Paramount revealed 49.5 percent of funding comes from Middle East and Chinese government-linked sources. The Communications Act restricts foreign entities from holding more than 25% indirect equity or voting interest in U.S. companies holding broadcast licenses. FCC Chairman Brendan Carr and the Ellison family insist the law does not apply because foreign countries will not have meaningful management and board presence. Gomez stated "The American public deserves to know who owns the airwaves that carry their news. I am alarmed by what appears to be an effort to rubber stamp a financial structure that places nearly half of one of America's largest broadcast and media companies into the hands of foreign governments with documented records of press suppression and a troubling willingness to silence journalists." With Gomez in the minority, there is virtually no chance of meaningful FCC review. State attorneys general coalition lawsuits remain the best path for blocking the deal.
Chief Justice Roberts Says Public Wrongly Views Justices as Political Actors
Chief Justice John Roberts spoke at a conference for lawyers and judges in Hershey, Pennsylvania, defending the Supreme Court from what he characterized as misconceptions that justices are making policy decisions rather than applying law. Roberts said "I think at a very basic level, people think we're making policy decisions, [that] we're saying we think this is what things should be as opposed to this is what the law provides." He noted the court must issue unpopular decisions and said "We're not simply part of the political process, and there's a reason for that, and I'm not sure people grasp that as much as is appropriate." The comments came one week after the partisan ruling in Callais, which stripped away Section 2 of the Voting Rights Act. Roberts had pointed to Section 2's existence in 2013 as the reason the court could kill Section 4 of the Voting Rights Act. In the 15 precedent-overturning cases with partisan implications, Roberts voted for a conservative outcome 14 times (93%). Roberts is one of only two justices since 1946 to support 100% of decisions overturning precedent that led to conservative outcomes. His 84% conservative votes in precedent-overturning cases is the second-most conservative among 37 justices who have ruled in at least 5 such cases since 1946, trailing only Justice Alito's 88%.
Water utilities: Implement multi-factor authentication for all industrial control system administrator accounts immediately. Conduct access log audits for unauthorized parameter changes. Review incident response plans for control system compromise scenarios.
EU AI operators: Inventory all AI systems for high-risk categories (biometrics, employment, law enforcement, critical infrastructure) by Q3 2026 to prepare for December 2027 compliance deadline. Immediately discontinue any AI systems capable of creating non-consensual sexually explicit images before the December 2, 2026 nudification ban takes effect.
Organizations with Utah users: Consult counsel before implementing VPN detection or blocking for age verification compliance. The law's requirement to determine physical location of VPN users is technically impossible. Document decisions for anticipated First Amendment litigation.
Employers and government agencies using surveillance tech: Implement access logging, regular database query audits, and immediate termination protocols for personnel accessing ALPR, facial recognition, or location data for non-legitimate purposes. The Institute for Justice identified 14 cases since 2024 of law enforcement personnel abusing ALPR networks to stalk women.
Organizations using Microsoft Teams: Restrict external access by default. Train employees to recognize social engineering through collaboration platforms, including external chat requests, screen-sharing requests to view credentials or VPN configs, and requests to install remote management tools. Iranian state actors used this exact technique in Chaos ransomware cover operations.