It Takes 2 Minutes to Hack the EU’s New Age-Verification App

The intersection of private corporate interests, national security mandates, and rapid technological advancement has created a complex and often perilous landscape for digital privacy and safety. In a series of investigative reports and unfolding events this week, the mechanisms of the modern surveillance state—both public and private—have been laid bare. From the implementation of high-tech monitoring in iconic entertainment venues to the systemic failure of age-verification software in Europe, the boundaries of personal data protection are being tested at an unprecedented scale. As artificial intelligence moves from the realm of generative text to the front lines of cybersecurity warfare, and as global platforms struggle to police multi-billion-dollar criminal markets, the necessity for robust oversight and technical integrity has never been more apparent.

The Private Surveillance State at Madison Square Garden

A comprehensive investigation into the security protocols of Madison Square Garden (MSG) has revealed the extent of the private surveillance infrastructure instituted by owner Jim Dolan and his head of security, John Eversole. According to court records and internal sources, visitors to the Garden and other Dolan-owned properties are now subject to a "private surveillance state" that utilizes a sophisticated array of tracking tools. This infrastructure includes advanced facial recognition technology, social media monitoring, and active in-person surveillance.

The use of facial recognition at MSG has previously drawn criticism for its application in identifying and barring attorneys from law firms engaged in litigation against the company. However, the new details suggest a broader scope of monitoring that extends beyond legal adversaries. The system is designed to track "persons of interest" in real-time, often without the knowledge of the patrons. Security experts warn that the normalization of such technologies in public-facing private venues creates a precedent for "surveillance-as-a-service," where private entities possess more granular data on citizens than local law enforcement, often with significantly less oversight.

Legislative Impasse: The Roadblock of Section 702

In Washington, D.C., the United States government’s warrantless wiretap powers faced a significant legislative hurdle this week. Section 702 of the Foreign Intelligence Surveillance Act (FISA), a controversial program that allows intelligence agencies to collect communications of non-U.S. citizens abroad without a warrant, was slated for a long-term reauthorization. Despite a strong push from President Donald Trump for a comprehensive extension, the effort was thwarted by a "Republican mutiny" in the House of Representatives.

Twenty Republican lawmakers joined Democrats to vote against the full reauthorization, citing concerns over the "incidental" collection of American citizens’ data and the potential for federal overreach. This internal party conflict forced Speaker Mike Johnson to implement a temporary 10-day extension to avoid a total expiration of the program. This short-term fix sets the stage for a high-stakes debate over the balance between national security and the Fourth Amendment, with privacy advocates demanding a warrant requirement for any queries involving American data.

The Privacy Crisis of AI-Enabled Wearables

The consumer technology sector is facing its own privacy reckoning as Meta’s Ray-Ban and Oakley AI smartglasses come under intense scrutiny. A coalition of more than 70 civil society groups, including the American Civil Liberties Union (ACLU) and the National Organization for Women (NOW), issued a formal demand this week for Meta to abandon plans to integrate facial recognition features into its wearable devices.

The groups argue that the current capability of these glasses—the ability to surreptitiously record video and audio—is already a significant threat to privacy. The addition of facial recognition would, according to the letter, "facilitate stalkers, domestic abusers, and federal agents," essentially turning every wearer into a mobile surveillance node. Meta has marketed the glasses as a tool for seamless digital interaction, but the backlash highlights a growing public fear that wearable AI will permanently erode the "expectation of anonymity" in public spaces.

Global Analysis: The Scourge of Nonconsensual Deepfakes

The rise of generative AI has facilitated a global crisis in schools, where "nudify" technology is being used to create nonconsensual deepfake nudes of students. An analysis conducted by WIRED and Indicator tracked publicly reported incidents, identifying more than 600 victims across 28 countries. The majority of these victims are middle- and high-school-aged girls.

The data reveals a disturbing trend: the accessibility of these AI tools allows students to target peers with devastating psychological consequences. Law enforcement agencies in several countries have reported being overwhelmed by the volume of cases, as the digital nature of the content makes it difficult to fully erase once it has been shared across social media platforms. Educators and child safety advocates are calling for stricter regulation of AI image generators and increased criminal penalties for those who create or distribute such harmful content.

Telegram and the Xinbi Guarantee Shadow Market

A WIRED investigation has exposed the continued operation of Xinbi Guarantee on the messaging app Telegram, despite the platform’s awareness of the group’s criminal activities. Xinbi Guarantee, which the United Kingdom government has designated as a facilitator of human trafficking and the "largest-ever online marketplace of its kind," reportedly operates a $21 billion black market for scammers.

Following the UK’s sanctions against the group, crypto-tracing firm Elliptic reported that Xinbi carried out an additional $505 million in transactions in just 19 days. The persistence of such a high-volume criminal enterprise on Telegram raises serious questions about the platform’s moderation policies and its compliance with international sanctions. While Telegram has long championed user privacy and resistance to government interference, critics argue that this stance has effectively turned the app into a safe haven for global organized crime.

The Cybersecurity Arms Race: Anthropic vs. OpenAI

The competition between leading AI laboratories has entered a new phase focused on cybersecurity. After Anthropic revealed its new model, "Mythos," which was characterized as a unique risk to the existing security status quo, OpenAI responded with its own strategic shift. OpenAI announced a new cybersecurity strategy alongside the release of "GPT-5.4-Cyber."

This development marks a transition from general-purpose AI to specialized models designed to both identify vulnerabilities and defend against sophisticated cyberattacks. Anthropic’s Mythos model prompted concerns that AI could be used to automate the discovery of "zero-day" exploits, potentially giving attackers an insurmountable advantage. OpenAI’s GPT-5.4-Cyber aims to provide defensive teams with similar levels of automation to patch systems and respond to threats in real-time. This "arms race" suggests that the future of digital security will be increasingly defined by AI-versus-AI interactions.

Technical Failure: The European Age Verification App

The European Commission’s attempt to regulate access to sensitive online content suffered a major setback this week. Upon the release of a free, open-source app designed to verify the ages of visitors to social networks and pornography websites, European Commission President Ursula von der Leyen claimed there were "no more excuses" for platforms to fail age checks.

However, within hours of the launch, security experts identified the app as a "security disaster." Security consultant Paul Moore claimed on X (formerly Twitter) to have breached the app in less than two minutes. The vulnerability lies in the way the app stores user-created PINs, which could allow an attacker to take over a user’s entire profile and access their identity data. Whitehat hacker Baptiste Robert confirmed the vulnerability, leading to widespread calls for the app’s immediate withdrawal. The incident underscores the difficulty of creating secure, centralized identity verification systems at a continental scale.

Major Data Breaches: Basic-Fit and Booking.com

The vulnerability of personal data was further highlighted by two major breaches involving European giants. Basic-Fit, the largest gym chain in Europe, confirmed that the bank details of approximately one million customers were compromised. The breach originated from a single system used to record member visits across Belgium, France, Germany, Luxembourg, the Netherlands, and Spain. While passwords were not stored, the theft of names, addresses, and bank details leaves members highly vulnerable to financial fraud.

Simultaneously, the travel giant Booking.com confirmed a breach where hackers accessed customer names, emails, and booking details. While the company stated that no financial information was lost, customers reported on platforms like Reddit that "anything shared with the accommodation" may have been exposed. These concurrent breaches emphasize the systemic risk inherent in centralized databases that manage sensitive consumer information.

Infrastructure Under Fire: Bluesky and ICE Hiring

The decentralized social media platform Bluesky experienced significant service disruptions this week following a sophisticated distributed denial-of-service (DDoS) attack. Chief Operations Officer Rose Wang confirmed the attack began on April 15, causing intermittent failures across search and notification feeds. Interestingly, the attack spared communities like "Blacksky" that operate their own instances on the underlying AT Protocol, demonstrating the potential resilience of decentralized architectures.

In a separate administrative failure, an investigation into the U.S. Immigration and Customs Enforcement (ICE) hiring practices revealed significant lapses in background checks. During a hiring spree that saw 12,000 officers added in less than a year, the Associated Press found that several applicants with histories of unpaid debt or alleged misconduct in previous law enforcement roles were given "temporary selection letters." These offers allowed individuals to begin working before their full background checks were completed, raising concerns about the integrity and professional standards of the agency’s new workforce.

Geopolitics and Crypto: The Grinex Suspension

In Russia, the cryptocurrency exchange Grinex abruptly suspended operations after reporting a breach that resulted in the theft of over $13 million (one billion rubles). Grinex, which has been sanctioned by U.S. authorities for aiding in sanctions evasion, blamed the "special services" of an "unfriendly state" for the attack. The exchange claimed the "digital traces" indicated a level of sophistication available only to state-sponsored actors.

Grinex is widely considered the successor to Garantex, another sanctioned Russian exchange. Crypto-tracing firm Elliptic noted that Grinex likely inherited the customer base and funds of its predecessor to circumvent international restrictions. The exchange’s claim that the hack was an attempt to damage "Russia’s financial sovereignty" highlights the growing role of cryptocurrency in geopolitical conflict and the use of cyberattacks as a tool of statecraft.

Implications for the Global Digital Order

The events of this week illustrate a world where the traditional safeguards of privacy and security are being outpaced by technological innovation and administrative expediency. The proliferation of facial recognition in the private sector, the weaponization of AI in schools, and the failure of government-mandated security apps all point to a fundamental instability in the current digital order. As AI models become more specialized for offensive cyber operations and as criminal markets find refuge in encrypted messaging apps, the burden of protection is increasingly shifting toward the individual. Without significant legislative reform and a commitment to technical transparency, the "surveillance state"—both public and private—is likely to expand, further complicating the global effort to secure the digital frontier.