A US court lets EFF's social media surveillance lawsuit proceed, and TSA is mishandling facial recognition data. EU operators, take notes.
elcome to issue twenty-five. This week the US handed us two surveillance stories that read like a compliance horror film: a mass social media monitoring programme called 'Catch and Revoke' is heading to court, and a federal audit has found that TSA cannot properly protect the facial recognition data it collects from millions of passengers. Taken together, they are a live demonstration of what happens when biometric and speech data are harvested without the governance guardrails the EU AI Act is busy constructing. We also have AlgorithmWatch's sharp critique of a German draft law on AI in migration administration, which shows that even within the EU, getting high-risk AI rules right is harder than it looks.
Let’s go.
yours, Flux
Flux Weekly is a 6-minute briefing for people who have to actually make AI work in Europe. Sole traders to enterprise, one issue every Friday morning.
- New We have added a dedicated section to the Flux compliance scan covering biometric data handling requirements under the AI Act, prompted by this week's TSA facial recognition audit findings.
- Updated The Flux high-risk AI checklist now flags AI systems used in migration or visa-related decision-making as requiring enhanced human oversight documentation, reflecting the AlgorithmWatch KIMVG critique.
- ICYMI If you missed issue twenty-four's breakdown of the EFF's three-wave US federal data consolidation map, it is still the best single read for understanding why this week's surveillance stories are not isolated incidents.
A Federal Court Lets EFF's Challenge to Trump's Social Media Surveillance Programme Proceed, Putting Mass Monitoring of Noncitizens in the Dock
What 'Catch and Revoke' actually does. The Trump administration's programme scans the online speech of noncitizens living in the US, then uses those findings to revoke visas and immigration status. EFF sued on behalf of three major labour unions last autumn, arguing the programme forces noncitizens to choose between speaking freely and protecting their immigration status. This month, a federal district court declined to dismiss the case, meaning the legal challenge moves forward.
Why this matters for EU operators right now. Any EU business with US-based employees, contractors, or customers who are noncitizens is operating in an environment where online speech is being harvested and actioned at scale without a clear statutory limit. The EU AI Act explicitly classifies AI systems used for real-time remote biometric identification and social scoring as high-risk or prohibited. That distinction is not bureaucratic pedantry; this week shows exactly why the boundary exists.
Does your AI inform a decision that affects a person's job, credit, education, or essential service?
- ✓AlgorithmWatch published a policy paper on Germany's draft AI Migration Administration Act (KIMVG), identifying serious risks and four specific recommendations for protecting migrants' data from poorly governed AI systems.
- ✓The KIMVG critique highlights that even EU member-state legislation can fall short of the AI Act's intent, particularly where vulnerable groups and high-risk decisions intersect.
- ✓The AI Act's prohibition on certain real-time biometric surveillance and social scoring continues to stand as the clearest statutory line separating EU and US approaches this week.
- ~A US federal district court declined to dismiss EFF's lawsuit against the 'Catch and Revoke' social media surveillance programme, keeping the challenge to mass online monitoring of noncitizens alive.
- 1EU AI Act High-Risk Classification Guideofficial guidance
The European Commission's official guidance on which AI systems fall into the high-risk category, including biometric identification and systems affecting migration status.
Why we like it. This week's stories are textbook illustrations of the use cases the Act was written to govern; knowing exactly where the lines fall is non-negotiable.
- 2AlgorithmWatch KIMVG Policy Paperpolicy analysis
A detailed critique of Germany's draft AI Migration Administration Act, with four concrete recommendations for safer AI governance in high-stakes public-sector decisions.
Why we like it. Even within the EU, member-state implementation can leave dangerous gaps; this paper shows what good looks like and what to push back on.
- 3EFF Surveillance Self-Defence
Surveillance Without Guardrails Is Not a US Problem. It Is a Warning Label.
By John Ferguson
Every week I read these stories and think: this is what the AI Act is for. Not the paperwork. Not the conformity assessments. The actual reason behind all of it is sitting right here in this week's source items.
A government programme that reads your tweets to decide whether you get to stay in the country. A federal agency that collects your face at the airport and cannot adequately protect what it collects. A draft law in Germany that is supposed to protect migrants from bad AI but, according to experts, does not go nearly far enough. These are not edge cases. They are the centre of the problem.
What strikes me is that EU operators often treat compliance as a cost to be minimised. I get it. Forms are boring. Deadlines feel arbitrary. But this week is a reminder that the alternative is not a lighter regulatory touch; it is a world where the data governance decisions are made by whoever has the most servers and the least accountability.
Four hundred and five days to the high-risk AI deadline. That sounds like a long time. It is not. Start the biometric data audit now, document your human oversight process now, and check your supplier contracts now. Future you will be grateful.
John Ferguson · Founder, Agentic Fluxus
Short answer.Yes, indirectly but importantly. Under the AI Act, AI systems that infer personal characteristics from online behaviour in recruitment contexts are likely high-risk. Your supplier must provide a conformity assessment and you must log the use. More immediately, check whether the tool processes data about non-EU nationals, because this week's US rulings show that data can be swept into state surveillance programmes without warning.
Does your organisation have a documented policy on AI systems that process biometric or social-media data about individuals?
The DHS Inspector General audited TSA's facial recognition programme and found a 'significant weakness' in how passenger biometric data is protected. The full findings are classified, so the public cannot see exactly what went wrong.
On the same day, a California trial court dismissed EFF's challenge to warrantless licence plate reader searches in San Jose, while a separate federal court ruled that ALPRs constitute mass surveillance. Both rulings stand simultaneously.