Get tomorrow's brief in your inbox
Today: Cash App's owner Block, Inc. will pay $45 million to 46 states over security failures that exposed users to scammers. Amazon settles for $2.25 million over Fair Credit Reporting Act violations related to identity theft victim record requests. The Supreme Court's recent decisions continue reshaping congressional power and voting rights enforcement, with Justices Kagan and Barrett set to testify to Congress on budget and security matters next week.
Cash App Settlement ($45 Million)
Block, Inc. agreed to pay $45 million to 46 state attorneys general to settle allegations that Cash App misled users about security protections and failed to protect them from fraud. The company falsely promised users that Cash App offered the same protections as a bank, maintained lax verification standards allowing bad actors to operate networks of scam accounts, had no phone support until 2021 (causing users to call fake numbers set up by scammers), and did not require Social Security numbers or dates of birth for signup with no limit on accounts per person. New York AG Letitia James stated the company "failed to help users when they were scammed, misled consumers about the safety of Cash App, and failed to provide the fraud protection and resolution that it promised and was required to provide by law." Texas AG Ken Paxton noted "lax verification standards, a years-long absence of phone support, and deceptive social media promotions left users exposed to scammers" while Block delayed internal fraud investigations and set unwarranted account lockouts leaving victims unable to recover stolen funds.
Amazon Fair Credit Reporting Act Settlement ($2.25 Million)
Amazon agreed to pay $2.25 million to resolve allegations that it violated the Fair Credit Reporting Act by refusing or delaying requests from identity theft victims seeking records related to fraudulent transactions. The settlement addresses systemic failures in Amazon's response procedures for victims attempting to obtain documentation of fraudulent purchases made in their names.
Nationstar Mortgage Florida Settlement ($1.5 Million)
Nationstar Mortgage agreed to a $1.5 million class action settlement resolving claims it charged illegal mortgage fees on Florida home loan accounts. The settlement addresses allegations that the company imposed fees prohibited under Florida mortgage lending statutes, providing compensation to affected Florida borrowers.
Credit Bureau Class Actions (TransUnion, Equifax, Experian)
Three new class action lawsuits accuse TransUnion, Equifax, and Experian of misreporting accounts on consumer reports that had been properly discharged in bankruptcy. The lawsuits allege the credit reporting agencies continued to report discharged debts as active obligations, damaging consumers' credit profiles in violation of the Fair Credit Reporting Act and bankruptcy discharge orders under 11 U.S.C. 524.
Trump Carroll Defamation Reconsideration Petition
President Donald Trump filed a petition asking the Supreme Court to reconsider its June 29 rejection of his appeal of the $5 million jury verdict in E. Jean Carroll's sexual abuse and defamation case. Trump's lawyers argue that statements he made while president constitute official acts for which he is immune under the court's 2024 presidential immunity ruling. Bloomberg noted the court almost never reconsiders decisions not to hear appeals, and rehearing petitions are appropriate only to address intervening circumstances of substantial controlling effect or other substantial grounds not previously presented.
Intellexa Predator Spyware Lawsuit (Greece)
Eight Greek victims filed a civil lawsuit against surveillance technology manufacturer Intellexa and 13 individuals tied to the company, seeking approximately €7.6 million ($8.7 million) in compensation for moral damages from illegal privacy violations. The plaintiffs, including a former Meta security manager, journalists, lawyers, a former Hellenic Police Forensic Laboratories director, and a former intelligence agency head, had Predator spyware confirmed on their devices during a 2022 scandal that led to the resignation of Greece's intelligence chief and the prime minister's chief of staff. Intellexa founder Tal Dilian and associates were sentenced to more than 126 years in prison in February (serving 8 years under Greek law) but remain free pending appeals. A trial is scheduled for April 2027.
Supreme Court Voting Rights Jurisprudence
The Supreme Court's recent Louisiana v. Callais decision attacking the Voting Rights Act represents the continuation of the Roberts Court's dismantling of congressional voting rights protections. The court explicitly rejected the legislatively crafted framework used to challenge racially discriminatory voting practices, overriding Congress's constitutionally delegated authority to enforce the 15th Amendment. This follows the 2013 Shelby County v. Holder decision that eliminated pre-clearance requirements for jurisdictions with histories of racial voter disenfranchisement, brushing aside Congress's extensive 2006 fact-finding record supporting the Voting Rights Act reauthorization. The court's approach reveals systematic disregard for legislative history and congressional intent, positioning the judiciary as the primary policymaking body rather than respecting the founders' vision of policy decisions being made by elected representatives.
Fifth Circuit Migrant Detention Decision (Due Process Timing)
The Fifth Circuit Court of Appeals partially walked back its February Buenrostro-Mendez decision that denied due process rights to immigration detainees, ruling that migrants held by the government are entitled to bond hearings but only after a 90-day waiting period. The court stated "the answer to those difficulties cannot include ignoring the Constitution," requiring the executive branch to provide bond hearings through its own procedures. The decision distinguishes Fifth Amendment due process protections from the earlier case's analysis of detention authority, acknowledging that thousands of immigration detainees are filing habeas corpus applications in federal district courts. The 90-day window allows rights-free detention before constitutional protections attach.
FCC Equal Time Enforcement (Selective Application)
FCC Commissioner Brendan Carr launched an investigation of ABC's The View in February, falsely claiming the daytime talk show violated the FCC's equal time rule by hosting Texas Democratic candidate James Talarico without offering equivalent airtime to opponents. The View has been exempt from equal time rules since 2002 as a bona fide news program. Despite the threat being legally baseless and likely to fail on First Amendment grounds, ABC subsequently stopped featuring political candidates in competitive midterm races. The case demonstrates how regulatory threats, even when unfounded, create chilling effects on media coverage. Carr previously threatened San Francisco station KCBS over ICE activity reporting, resulting in softened political coverage, and attempted to censor comedian Jimmy Kimmel.
UK Information Commissioner Resignation and Retaliation
John Edwards, the UK Information Commissioner who oversaw data protection and privacy regulations, formally resigned in June after an independent investigation found sexual harassment and bullying. Edwards initially characterized the conduct as "inappropriate humor" but accepted his position had become untenable. UK Secretary of State Liz Kendall told Parliament that Edwards is preparing to serve legal papers on a woman at the ICO who raised concerns about his behavior and supported the investigation that upheld multiple allegations against him. Kendall stated she was "absolutely appalled" at the findings and announced an independent review of the ICO's culture, accountability, and governance, plus recruitment of a new board of non-executive directors with a female majority.
Google Remote Attestation Scheme
Google launched "reCAPTCHA Mobile Verification," an experimental initiative allowing companies to block users running independent "de-googled" Android versions favored by privacy-conscious users who want to block trackers and ads. The scheme represents the latest in Google's efforts to prevent browser interoperability and user agent autonomy, departing from the open web ecosystem that enabled Google's founding in 1998. The Electronic Frontier Foundation notes this follows Google's pattern as a thrice-convicted monopolist of using technological measures to cement dominance by blocking interoperability, keeping out rival products and capturing markets. Google paid Apple more than $20 billion per year to stay out of the search market, cheated app vendors with sky-high junk fees, and rigged the ad market to gouge businesses while underinvesting in ad fraud prevention.
Taiwan Chinese Espionage Campaign (LINE Account Leasing)
Taiwan charged two businessmen with helping Chinese government-linked hackers by collecting and leasing LINE messaging app accounts to operators connected to China's cyber forces. The suspects' company collected LINE accounts registered with Taiwanese mobile numbers and rented them to Xiamen Empress Information Technology for about 1,100 yuan ($162) per account. Authorities allege the accounts were used to impersonate international journalists, including ICIJ reporters, to build trust with politicians, academics, journalists, and civil society targets before deploying malware disguised as encrypted communications software. The Ministry of Justice Investigation Bureau charged the executives with violations of Taiwan's Personal Data Protection Act under deferred prosecution orders. The case confirms earlier reporting by ICIJ and The Citizen Lab documenting a Beijing-linked phishing campaign using more than 100 malicious domains targeting democracy activists and Uyghur, Tibetan, Hong Kong, and Taiwanese communities.
Spain Arrest of Pro-Russian Hacktivist Supporter
Spanish police arrested a man in Palencia suspected of supporting pro-Russian hacktivist groups CyberArmy of Russia Reborn (CARR), Z-Pentest, and NoName057(16) following an FBI tip. Authorities allege the suspect provided logistical support to a Ukrainian hacker linked to CARR to help him escape to Russia through Poland and Belarus, communicated with group members via encrypted messaging apps, and coordinated activities supporting NoName057(16)'s distributed denial-of-service attacks against governments and organizations supporting Ukraine. Police seized computers, cryptocurrency storage devices, and froze a cryptocurrency wallet believed to contain proceeds from criminal information sales. The suspect faces investigation for alleged membership in and collaboration with a terrorist organization, glorification of terrorism, and computer-related damage. The arrest follows 2024 U.S. sanctions against two CARR members and a 2024 international law enforcement operation that disrupted much of NoName057(16)'s infrastructure.
Military Deployment at Elections (Lawfare Analysis)
Lawfare published a two-part analysis of statutory and constitutional limits on deploying military forces during U.S. elections. Part I traced the legal wall from Civil War-era restrictions through Reconstruction to modern limitations, noting that Congress moved to keep troops out of polling places as early as 1865, expanded military election roles during Reconstruction, then reasserted and tightened restrictions that remain codified beyond standard domestic deployment limitations. Part II examined alternative interpretations claiming the president is not barred from deploying military during elections under certain circumstances, including the Justice Department's 1968 Insurrection Act reading and untested "protective power" constitutional theories. The authors warn that legal ambiguity could enable a determined executive to deploy military during elections before courts intervene, and recommend Congress legislatively restore powers the Roberts Court says were only implied rather than explicit.
Great American AI Act Discussion Draft
The bipartisan Great American AI Act discussion draft crafted by Representatives Obernolte and Trahan proposes federal frontier AI safety regulations granting the Department of Commerce broad rulemaking authority to establish auditing and transparency regimes. Lawfare analysis argues the bill offers the best federal AI safety framework proposed to date by leveraging agencies' sophisticated rulemaking capacity that no state can match, but warns that limited whistleblower protections and sweeping state law preemptions mean the bill does more harm than good in current form. The analysis emphasizes that federal rulemaking capacity built over decades represents a significant institutional advantage for implementing complex AI safety requirements that states cannot realistically replicate.
Mexico Gender-Based Political Violence Law Misuse
Mexico's law prohibiting gender-based political violence, passed to protect marginalized groups, is being weaponized by powerful politicians to silence journalists. In April 2025, a federal court found five reporters guilty of gender-based political violence against politician Mara Chama Villa for a satirical radio spot and articles that "minimized" her "by subordinating her to a male figure with political power" (her father, the former mayor). Penalties included fines exceeding a month's salary, mandatory public apologies, deletion of the radio spot and articles, and placement on a national gender-violence offenders registry. When journalists and organizations criticized the ruling, approximately 70 additional people were added to follow-on legal proceedings. In another case, a court sanctioned anti-corruption activist Miguel Alfonso Meza for calling a judicial candidate (who represented drug lord El Chapo) a "narco lawyer." The pattern demonstrates how speech-restricting laws intended to protect the powerless are inevitably used by the powerful to suppress critics.
Implement live customer support for payment apps. Cash App's $45 million settlement establishes that payment app providers must maintain 24-hour live support with at least 13.5 hours covered by real persons, verify user identities with government ID at signup, and limit accounts per person to prevent fraud networks. Review your fintech onboarding flows for SSN and DOB collection if not currently required.
Establish FCRA response procedures for identity theft victims. Amazon's $2.25 million settlement confirms that organizations maintaining consumer transaction records must respond promptly to identity theft victim requests under 15 U.S.C. 1681g. Document your process for handling these requests and train customer service teams on statutory response timelines.
Verify bankruptcy discharge status before credit reporting. The TransUnion, Equifax, and Experian class actions demonstrate that continuing to report discharged debts violates both FCRA accuracy requirements (15 U.S.C. 1681e(b)) and bankruptcy discharge injunctions. If you furnish credit data, implement automated controls to identify accounts subject to bankruptcy discharge and suppress them from reports.
Train employees to verify journalist contacts through official channels. The Taiwan espionage case shows sophisticated attackers lease legitimate messaging app accounts to impersonate international journalists and deliver malware disguised as encrypted communication tools. Security awareness training should specifically address unsolicited journalist interview requests and pressure to download "secure" software from unknown parties.
Monitor Fifth Circuit immigration detention procedures. Organizations providing legal services or operating detention facilities in the Fifth Circuit must implement bond hearing procedures for detainees held more than 90 days following the court's new due process framework. The 90-day rights-free window represents a partial rollback of the circuit's earlier blanket denial of constitutional protections.