Our lat­est model, Claude Opus 4.7, is now gen­er­ally avail­able. Opus 4.7 is a no­table im­prove­ment on Opus 4.6 in ad­vanced soft­ware en­gi­neer­ing, with par­tic­u­lar gains on the most dif­fi­cult tasks. Users re­port be­ing able to hand off their hard­est cod­ing work—the kind that pre­vi­ously needed close su­per­vi­sion—to Opus 4.7 with con­fi­dence. Opus 4.7 han­dles com­plex, long-run­ning tasks with rigor and con­sis­tency, pays pre­cise at­ten­tion to in­struc­tions, and de­vises ways to ver­ify its own out­puts be­fore re­port­ing back.The model also has sub­stan­tially bet­ter vi­sion: it can see im­ages in greater res­o­lu­tion. It’s more taste­ful and cre­ative when com­plet­ing pro­fes­sional tasks, pro­duc­ing higher-qual­ity in­ter­faces, slides, and docs. And—although it is less broadly ca­pa­ble than our most pow­er­ful model, Claude Mythos Preview—it shows bet­ter re­sults than Opus 4.6 across a range of bench­marks:Last week we an­nounced Project Glasswing, high­light­ing the risks—and ben­e­fits—of AI mod­els for cy­ber­se­cu­rity. We stated that we would keep Claude Mythos Preview’s re­lease lim­ited and test new cy­ber safe­guards on less ca­pa­ble mod­els first. Opus 4.7 is the first such model: its cy­ber ca­pa­bil­i­ties are not as ad­vanced as those of Mythos Preview (indeed, dur­ing its train­ing we ex­per­i­mented with ef­forts to dif­fer­en­tially re­duce these ca­pa­bil­i­ties). We are re­leas­ing Opus 4.7 with safe­guards that au­to­mat­i­cally de­tect and block re­quests that in­di­cate pro­hib­ited or high-risk cy­ber­se­cu­rity uses. What we learn from the real-world de­ploy­ment of these safe­guards will help us work to­wards our even­tual goal of a broad re­lease of Mythos-class mod­els.Se­cu­rity pro­fes­sion­als who wish to use Opus 4.7 for le­git­i­mate cy­ber­se­cu­rity pur­poses (such as vul­ner­a­bil­ity re­search, pen­e­tra­tion test­ing, and red-team­ing) are in­vited to join our new Cyber Verification Program.Opus 4.7 is avail­able to­day across all Claude prod­ucts and our API, Amazon Bedrock, Google Cloud’s Vertex AI, and Microsoft Foundry. Pricing re­mains the same as Opus 4.6: $5 per mil­lion in­put to­kens and $25 per mil­lion out­put to­kens. Developers can use claude-opus-4-7 via the Claude API.Claude Opus 4.7 has gar­nered strong feed­back from our early-ac­cess testers:In early test­ing, we’re see­ing the po­ten­tial for a sig­nif­i­cant leap for our de­vel­op­ers with Claude Opus 4.7. It catches its own log­i­cal faults dur­ing the plan­ning phase and ac­cel­er­ates ex­e­cu­tion, far be­yond pre­vi­ous Claude mod­els. As a fi­nan­cial tech­nol­ogy plat­form serv­ing mil­lions of con­sumers and busi­nesses at sig­nif­i­cant scale, this com­bi­na­tion of speed and pre­ci­sion could be game-chang­ing: ac­cel­er­at­ing de­vel­op­ment ve­loc­ity for faster de­liv­ery of the trusted fi­nan­cial so­lu­tions our cus­tomers rely on every day.An­thropic has al­ready set the stan­dard for cod­ing mod­els, and Claude Opus 4.7 pushes that fur­ther in a mean­ing­ful way as the state-of-the-art model on the mar­ket. In our in­ter­nal evals, it stands out not just for raw ca­pa­bil­ity, but for how well it han­dles real-world async work­flows—au­toma­tions, CI/CD, and long-run­ning tasks. It also thinks more deeply about prob­lems and brings a more opin­ion­ated per­spec­tive, rather than sim­ply agree­ing with the user.Claude Opus 4.7 is the strongest model Hex has eval­u­ated. It cor­rectly re­ports when data is miss­ing in­stead of pro­vid­ing plau­si­ble-but-in­cor­rect fall­backs, and it re­sists dis­so­nant-data traps that even Opus 4.6 falls for. It’s a more in­tel­li­gent, more ef­fi­cient Opus 4.6: low-ef­fort Opus 4.7 is roughly equiv­a­lent to medium-ef­fort Opus 4.6.On our 93-task cod­ing bench­mark, Claude Opus 4.7 lifted res­o­lu­tion by 13% over Opus 4.6, in­clud­ing four tasks nei­ther Opus 4.6 nor Sonnet 4.6 could solve. Combined with faster me­dian la­tency and strict in­struc­tion fol­low­ing, it’s par­tic­u­larly mean­ing­ful for com­plex, long-run­ning cod­ing work­flows. It cuts the fric­tion from those multi-step tasks so de­vel­op­ers can stay in the flow and fo­cus on build­ing.Based on our in­ter­nal re­search-agent bench­mark, Claude Opus 4.7 has the strongest ef­fi­ciency base­line we’ve seen for multi-step work. It tied for the top over­all score across our six mod­ules at 0.715 and de­liv­ered the most con­sis­tent long-con­text per­for­mance of any model we tested. On General Finance—our largest mod­ule—it im­proved mean­ing­fully on Opus 4.6, scor­ing 0.813 ver­sus 0.767, while also show­ing the best dis­clo­sure and data dis­ci­pline in the group. And on de­duc­tive logic, an area where Opus 4.6 strug­gled, Opus 4.7 is solid.Claude Opus 4.7 ex­tends the limit of what mod­els can do to in­ves­ti­gate and get tasks done. Anthropic has clearly op­ti­mized for sus­tained rea­son­ing over long runs, and it shows with mar­ket-lead­ing per­for­mance. As en­gi­neers shift from work­ing 1:1 with agents to man­ag­ing them in par­al­lel, this is ex­actly the kind of fron­tier ca­pa­bil­ity that un­locks new work­flows.We’re see­ing ma­jor im­prove­ments in Claude Opus 4.7’s mul­ti­modal un­der­stand­ing, from read­ing chem­i­cal struc­tures to in­ter­pret­ing com­plex tech­ni­cal di­a­grams. The higher res­o­lu­tion sup­port is help­ing Solve Intelligence build best-in-class tools for life sci­ences patent work­flows, from draft­ing and pros­e­cu­tion to in­fringe­ment de­tec­tion and in­va­lid­ity chart­ing.Claude Opus 4.7 takes long-hori­zon au­ton­omy to a new level in Devin. It works co­her­ently for hours, pushes through hard prob­lems rather than giv­ing up, and un­locks a class of deep in­ves­ti­ga­tion work we could­n’t re­li­ably run be­fore.For Replit, Claude Opus 4.7 was an easy up­grade de­ci­sion. For the work our users do every day, we ob­served it achiev­ing the same qual­ity at lower cost—more ef­fi­cient and pre­cise at tasks like an­a­lyz­ing logs and traces, find­ing bugs, and propos­ing fixes. Personally, I love how it pushes back dur­ing tech­ni­cal dis­cus­sions to help me make bet­ter de­ci­sions. It re­ally feels like a bet­ter coworker.Claude Opus 4.7 demon­strates strong sub­stan­tive ac­cu­racy on BigLaw Bench for Harvey, scor­ing 90.9% at high ef­fort with bet­ter rea­son­ing cal­i­bra­tion on re­view ta­bles and no­tice­ably smarter han­dling of am­bigu­ous doc­u­ment edit­ing tasks. It cor­rectly dis­tin­guishes as­sign­ment pro­vi­sions from change-of-con­trol pro­vi­sions, a task that has his­tor­i­cally chal­lenged fron­tier mod­els. Substance was con­sis­tently rated as a strength across our eval­u­a­tions: cor­rect, thor­ough, and well-cited.Claude Opus 4.7 is a very im­pres­sive cod­ing model, par­tic­u­larly for its au­ton­omy and more cre­ative rea­son­ing. On CursorBench, Opus 4.7 is a mean­ing­ful jump in ca­pa­bil­i­ties, clear­ing 70% ver­sus Opus 4.6 at 58%.For com­plex multi-step work­flows, Claude Opus 4.7 is a clear step up: plus 14% over Opus 4.6 at fewer to­kens and a third of the tool er­rors. It’s the first model to pass our im­plicit-need tests, and it keeps ex­e­cut­ing through tool fail­ures that used to stop Opus cold. This is the re­li­a­bil­ity jump that makes Notion Agent feel like a true team­mate.In our evals, we saw a dou­ble-digit jump in ac­cu­racy of tool calls and plan­ning in our core or­ches­tra­tor agents. As users lever­age Hebbia to plan and ex­e­cute on use cases like re­trieval, slide cre­ation, or doc­u­ment gen­er­a­tion, Claude Opus 4.7 shows the po­ten­tial to im­prove agent de­ci­sion-mak­ing in these work­flows.On Rakuten-SWE-Bench, Claude Opus 4.7 re­solves 3x more pro­duc­tion tasks than Opus 4.6, with dou­ble-digit gains in Code Quality and Test Quality. This is a mean­ing­ful lift and a clear up­grade for the en­gi­neer­ing work our teams are ship­ping every day.For CodeRabbit’s code re­view work­loads, Claude Opus 4.7 is the sharpest model we’ve tested. Recall im­proved by over 10%, sur­fac­ing some of the most dif­fi­cult-to-de­tect bugs in our most com­plex PRs, while pre­ci­sion re­mained sta­ble de­spite the in­creased cov­er­age. It’s a bit faster than GPT-5.4 xhigh on our har­ness, and we’re lin­ing it up for our heav­i­est re­view work at launch.For Genspark’s Super Agent, Claude Opus 4.7 nails the three pro­duc­tion dif­fer­en­tia­tors that mat­ter most: loop re­sis­tance, con­sis­tency, and grace­ful er­ror re­cov­ery. Loop re­sis­tance is the most crit­i­cal. A model that loops in­def­i­nitely on 1 in 18 queries wastes com­pute and blocks users. Lower vari­ance means fewer sur­prises in prod. And Opus 4.7 achieves the high­est qual­ity-per-tool-call ra­tio we’ve mea­sured.Claude Opus 4.7 is a mean­ing­ful step up for Warp. Opus 4.6 is one of the best mod­els out there for de­vel­op­ers, and this model is mea­sur­ably more thor­ough on top of that. It passed Terminal Bench tasks that prior Claude mod­els had failed, and worked through a tricky con­cur­rency bug Opus 4.6 could­n’t crack. For us, that’s the sig­nal.Claude Opus 4.7 is the best model in the world for build­ing dash­boards and data-rich in­ter­faces. The de­sign taste is gen­uinely sur­pris­ing—it makes choices I’d ac­tu­ally ship. It’s my de­fault daily dri­ver now.Claude Opus 4.7 is the most ca­pa­ble model we’ve tested at Quantium. Evaluated against lead­ing AI mod­els through our pro­pri­etary bench­mark­ing so­lu­tion, the biggest gains showed up where they mat­ter most: rea­son­ing depth, struc­tured prob­lem-fram­ing, and com­plex tech­ni­cal work. Fewer cor­rec­tions, faster it­er­a­tions, and stronger out­puts to solve the hard­est prob­lems our clients bring us.Claude Opus 4.7 feels like a real step up in in­tel­li­gence. Code qual­ity is no­tice­ably im­proved, it’s cut­ting out the mean­ing­less wrap­per func­tions and fall­back scaf­fold­ing that used to pile up, and fixes its own code as it goes. It’s the clean­est jump we’ve seen since the move from Sonnet 3.7 to the Claude 4 se­ries.For the com­puter-use work that sits at the heart of XBOW’s au­tonomous pen­e­tra­tion test­ing, the new Claude Opus 4.7 is a step change: 98.5% on our vi­sual-acu­ity bench­mark ver­sus 54.5% for Opus 4.6. Our sin­gle biggest Opus pain point ef­fec­tively dis­ap­peared, and that un­locks its use for a whole class of work where we could­n’t use it be­fore.Claude Opus 4.7 is a solid up­grade with no re­gres­sions for Vercel. It’s phe­nom­e­nal on one-shot cod­ing tasks, more cor­rect and com­plete than Opus 4.6, and no­tice­ably more hon­est about its own lim­its. It even does proofs on sys­tems code be­fore start­ing work, which is new be­hav­ior we haven’t seen from ear­lier Claude mod­els.Claude Opus 4.7 is very strong and out­per­forms Opus 4.6 with a 10% to 15% lift in task suc­cess for Factory Droids, with fewer tool er­rors and more re­li­able fol­low-through on val­i­da­tion steps. It car­ries work all the way through in­stead of stop­ping halfway, which is ex­actly what en­ter­prise en­gi­neer­ing teams need.Claude Opus 4.7 au­tonomously built a com­plete Rust text-to-speech en­gine from scratch—neural model, SIMD ker­nels, browser demo—then fed its own out­put through a speech rec­og­nizer to ver­ify it matched the Python ref­er­ence. Months of se­nior en­gi­neer­ing, de­liv­ered au­tonomously. The step up from Opus 4.6 is clear, and the code­base is pub­lic.Claude Opus 4.7 passed three TBench tasks that prior Claude mod­els could­n’t, and it’s land­ing fixes our pre­vi­ous best model missed, in­clud­ing a race con­di­tion. It demon­strates strong pre­ci­sion in iden­ti­fy­ing real is­sues, and sur­faces im­por­tant find­ings that other mod­els ei­ther gave up on or did­n’t re­solve. In Qodo’s real-world code re­view bench­mark, we ob­served top-tier pre­ci­sion.On Databricks’ OfficeQA Pro, Claude Opus 4.7 shows mean­ing­fully stronger doc­u­ment rea­son­ing, with 21% fewer er­rors than Opus 4.6 when work­ing with source in­for­ma­tion. Across our agen­tic rea­son­ing over data bench­marks, it is the best-per­form­ing Claude model for en­ter­prise doc­u­ment analy­sis.For Ramp, Claude Opus 4.7 stands out in agent-team work­flows. We’re see­ing stronger role fi­delity, in­struc­tion-fol­low­ing, co­or­di­na­tion, and com­plex rea­son­ing, es­pe­cially on en­gi­neer­ing tasks that span tools, code­bases, and de­bug­ging con­text. Compared with Opus 4.6, it needs much less step-by-step guid­ance, help­ing us scale the in­ter­nal agent work­flows our en­gi­neer­ing teams run.Claude Opus 4.7 is mea­sur­ably bet­ter than Opus 4.6 for Bolt’s longer-run­ning app-build­ing work, up to 10% bet­ter in the best cases, with­out the re­gres­sions we’ve come to ex­pect from very agen­tic mod­els. It pushes the ceil­ing on what our users can ship in a sin­gle ses­sion.Be­low are some high­lights and notes from our early test­ing of Opus 4.7:Instruction fol­low­ing. Opus 4.7 is sub­stan­tially bet­ter at fol­low­ing in­struc­tions. Interestingly, this means that prompts writ­ten for ear­lier mod­els can some­times now pro­duce un­ex­pected re­sults: where pre­vi­ous mod­els in­ter­preted in­struc­tions loosely or skipped parts en­tirely, Opus 4.7 takes the in­struc­tions lit­er­ally. Users should re-tune their prompts and har­nesses ac­cord­ingly.Im­proved mul­ti­modal sup­port. Opus 4.7 has bet­ter vi­sion for high-res­o­lu­tion im­ages: it can ac­cept im­ages up to 2,576 pix­els on the long edge (~3.75 megapix­els), more than three times as many as prior Claude mod­els. This opens up a wealth of mul­ti­modal uses that de­pend on fine vi­sual de­tail: com­puter-use agents read­ing dense screen­shots, data ex­trac­tions from com­plex di­a­grams, and work that needs pixel-per­fect ref­er­ences.1Real-world work. As well as its state-of-the-art score on the Finance Agent eval­u­a­tion (see table above), our in­ter­nal test­ing showed Opus 4.7 to be a more ef­fec­tive fi­nance an­a­lyst than Opus 4.6, pro­duc­ing rig­or­ous analy­ses and mod­els, more pro­fes­sional pre­sen­ta­tions, and tighter in­te­gra­tion across tasks. Opus 4.7 is also state-of-the-art on GDPval-AA, a third-party eval­u­a­tion of eco­nom­i­cally valu­able knowl­edge work across fi­nance, le­gal, and other do­mains.Mem­ory. Opus 4.7 is bet­ter at us­ing file sys­tem-based mem­ory. It re­mem­bers im­por­tant notes across long, multi-ses­sion work, and uses them to move on to new tasks that, as a re­sult, need less up-front con­text.The charts be­low dis­play more eval­u­a­tion re­sults from our pre-re­lease test­ing, across a range of dif­fer­ent do­mains:Over­all, Opus 4.7 shows a sim­i­lar safety pro­file to Opus 4.6: our eval­u­a­tions show low rates of con­cern­ing be­hav­ior such as de­cep­tion, syco­phancy, and co­op­er­a­tion with mis­use. On some mea­sures, such as hon­esty and re­sis­tance to ma­li­cious “prompt in­jec­tion” at­tacks, Opus 4.7 is an im­prove­ment on Opus 4.6; in oth­ers (such as its ten­dency to give overly de­tailed harm-re­duc­tion ad­vice on con­trolled sub­stances), Opus 4.7 is mod­estly weaker. Our align­ment as­sess­ment con­cluded that the model is “largely well-aligned and trust­wor­thy, though not fully ideal in its be­hav­ior”. Note that Mythos Preview re­mains the best-aligned model we’ve trained ac­cord­ing to our eval­u­a­tions. Our safety eval­u­a­tions are dis­cussed in full in the Claude Opus 4.7 System Card.Overall mis­aligned be­hav­ior score from our au­to­mated be­hav­ioral au­dit. On this eval­u­a­tion, Opus 4.7 is a mod­est im­prove­ment on Opus 4.6 and Sonnet 4.6, but Mythos Preview still shows the low­est rates of mis­aligned be­hav­ior.In ad­di­tion to Claude Opus 4.7 it­self, we’re launch­ing the fol­low­ing up­dates:More ef­fort con­trol: Opus 4.7 in­tro­duces a new xhigh (“extra high”) ef­fort level be­tween high and max, giv­ing users finer con­trol over the trade­off be­tween rea­son­ing and la­tency on hard prob­lems. In Claude Code, we’ve raised the de­fault ef­fort level to xhigh for all plans. When test­ing Opus 4.7 for cod­ing and agen­tic use cases, we rec­om­mend start­ing with high or xhigh ef­fort.On the Claude Platform (API): as well as sup­port for higher-res­o­lu­tion im­ages, we’re also launch­ing task bud­gets in pub­lic beta, giv­ing de­vel­op­ers a way to guide Claude’s to­ken spend so it can pri­or­i­tize work across longer runs.In Claude Code: The new /ultrareview slash com­mand pro­duces a ded­i­cated re­view ses­sion that reads through changes and flags bugs and de­sign is­sues that a care­ful re­viewer would catch. We’re giv­ing Pro and Max Claude Code users three free ul­tra­reviews to try it out. In ad­di­tion, we’ve ex­tended auto mode to Max users. Auto mode is a new per­mis­sions op­tion where Claude makes de­ci­sions on your be­half, mean­ing that you can run longer tasks with fewer in­ter­rup­tions—and with less risk than if you had cho­sen to skip all per­mis­sions.Opus 4.7 is a di­rect up­grade to Opus 4.6, but two changes are worth plan­ning for be­cause they af­fect to­ken us­age. First, Opus 4.7 uses an up­dated to­k­enizer that im­proves how the model processes text. The trade­off is that the same in­put can map to more to­kens—roughly 1.0–1.35× de­pend­ing on the con­tent type. Second, Opus 4.7 thinks more at higher ef­fort lev­els, par­tic­u­larly on later turns in agen­tic set­tings. This im­proves its re­li­a­bil­ity on hard prob­lems, but it does mean it pro­duces more out­put to­kens. Users can con­trol to­ken us­age in var­i­ous ways: by us­ing the ef­fort pa­ra­me­ter, ad­just­ing their task bud­gets, or prompt­ing the model to be more con­cise. In our own test­ing, the net ef­fect is fa­vor­able—to­ken us­age across all ef­fort lev­els is im­proved on an in­ter­nal cod­ing eval­u­a­tion, as shown be­low—but we rec­om­mend mea­sur­ing the dif­fer­ence on real traf­fic. We’ve writ­ten a mi­gra­tion guide that pro­vides fur­ther ad­vice on up­grad­ing from Opus 4.6 to Opus 4.7.Score on an in­ter­nal agen­tic cod­ing eval­u­a­tion as a func­tion of to­ken us­age at each ef­fort level. In this eval­u­a­tion, the model works au­tonomously from a sin­gle user prompt, and re­sults may not be rep­re­sen­ta­tive of to­ken us­age in in­ter­ac­tive cod­ing. See the mi­gra­tion guide for more on tun­ing ef­fort lev­els.

In September 2024, Amandla Thomas-Johnson was a Ph. D. candidate study­ing in the U.S. on a stu­dent visa when he briefly at­tended a pro-Pales­tin­ian protest. In April 2025, Immigration and Customs Enforcement (ICE) sent Google an ad­min­is­tra­tive sub­poena re­quest­ing his data. The next month, Google gave Thomas-Johnson’s information to ICE with­out giv­ing him the chance to chal­lenge the sub­poena, break­ing a nearly decade-long promise to no­tify users be­fore hand­ing their data to law en­force­ment.

Google names a hand­ful of ex­cep­tions to this promise (such as if Google re­ceives a gag or­der from a court) that do not ap­ply to Thomas-Johnson’s case. While ICE “requested” that Google not no­tify Thomas-Johnson, the re­quest was not en­force­able or man­dated by a court. Today, the Electronic Frontier Foundation sent com­plaints to the California and New York Attorneys General ask­ing them to in­ves­ti­gate Google for de­cep­tive trade prac­tices for break­ing that promise. You can read about the com­plaints here. Below is Thomas-Johnson’s ac­count of his or­deal.

I thought my or­deal with U. S. immigration au­thor­i­ties was over a year ago, when I left the coun­try, cross­ing into Canada at Ni­a­gara Falls.

By that point, the Trump ad­min­is­tra­tion had ef­fec­tively turned fed­eral power against in­ter­na­tional stu­dents like me. After I attended a pro-Palestine protest at Cornell University—for all of five min­utes—the ad­min­is­tra­tion’s rhetoric about crack­ing down on stu­dents protest­ing what we saw as geno­cide forced me into hid­ing for three months. Federal agents came to my home look­ing for me. A friend was de­tained at an air­port in Tampa and in­ter­ro­gated about my where­abouts.

I’m currently a Ph. D. stu­dent. Before that, I was a re­porter. I’m a dual British and Trinadad and Tobago cit­i­zen. I have not been ac­cused of any crime.

I be­lieved that once I left U. S. territory, I had also left the reach of its au­thor­i­ties. I was wrong.

Weeks later, in Geneva, Switzerland, I re­ceived what looked like a rou­tine email from Google. It in­formed me that the com­pany had al­ready handed over my ac­count data to the Department of Homeland Security.

At first, I wasn’t alarmed. I had seen some­thing sim­i­lar be­fore. An as­so­ci­ate of mine, Momodou Taal, had re­ceived ad­vance no­tice from Google and Facebook that his data had been re­quested. He was given ad­vanced no­tice of the sub­poe­nas, and law en­force­ment even­tu­ally with­drew them be­fore the com­pa­nies turned over his data.

Google had al­ready dis­closed my data with­out telling me.

I as­sumed I would be given the same op­por­tu­nity. But the lan­guage in my email was dif­fer­ent. It was fi­nal: “Google has re­ceived and re­sponded to le­gal process from a law en­force­ment au­thor­ity com­pelling the re­lease of in­for­ma­tion re­lated to your Google Account.”

Google had al­ready dis­closed my data with­out telling me. There was no op­por­tu­nity to con­test it.

To be clear, this should not have hap­pened this way. Google promises that it will no­tify users be­fore their data is handed over in re­sponse to le­gal processes, in­clud­ing ad­min­is­tra­tive sub­poe­nas. That no­tice is meant to pro­vide a chance to chal­lenge the re­quest. In my case, that safe­guard was by­passed. My data was handed over with­out warn­ing—at the re­quest of an ad­min­is­tra­tion tar­get­ing stu­dents en­gaged in pro­tected po­lit­i­cal speech.

Months later, my lawyer at the Electronic Frontier Foundation obtained the sub­poena it­self. On pa­per, the re­quest fo­cused largely on sub­scriber in­for­ma­tion: IP ad­dresses, phys­i­cal ad­dress, other iden­ti­fiers, and ses­sion times and du­ra­tions.

But taken to­gether, these frag­ments form some­thing far more pow­er­ful—a de­tailed sur­veil­lance pro­file. IP logs can be used to ap­prox­i­mate lo­ca­tion. Phys­i­cal ad­dresses show where you sleep. Ses­sion times would show when you were com­mu­ni­cat­ing with friends or fam­ily. Even with­out mes­sage con­tent, the pic­ture that emerges is in­ti­mate and in­va­sive.

What this ex­pe­ri­ence has made clear is that any­one can be tar­geted by law en­force­ment. And with their mas­sive stores of data, tech­nol­ogy com­pa­nies can fa­cil­i­tate those ar­bi­trary in­ves­ti­ga­tions. Together, they can com­bine state power, cor­po­rate data, and al­go­rith­mic in­fer­ence in ways that are dif­fi­cult to see—and even harder to chal­lenge.

The con­se­quences of what hap­pened to me are not ab­stract. I left the United States. But I do not feel that I have left its reach. Being in­ves­ti­gated by the fed­eral gov­ern­ment is in­tim­i­dat­ing. Questions run through your head. Am I now a marked in­di­vid­ual? Will I face height­ened scrutiny if I con­tinue my re­port­ing? Can I travel safely to see fam­ily in the Caribbean?

Who, ex­actly, can I hold ac­count­able?

Update: This post has been up­dated to in­clude more in­for­ma­tion about Google’s ex­cep­tions to their no­ti­fi­ca­tion pol­icy, none of which ap­plied to the sub­poena tar­get­ing Thomas-Johnson.

Tim Cook to be­come :br(s): :br(m): :br(l): :br(xl):Apple Executive Chairman

John Ternus

to be­come Apple CEO

CUPERTINO, CALIFORNIA Apple an­nounced that Tim Cook will be­come ex­ec­u­tive chair­man of Apple’s board of di­rec­tors and John Ternus, se­nior vice pres­i­dent of Hardware Engineering, will be­come Apple’s next chief ex­ec­u­tive of­fi­cer ef­fec­tive on September 1, 2026. The tran­si­tion, which was ap­proved unan­i­mously by the Board of Directors, fol­lows a thought­ful, long-term suc­ces­sion plan­ning process.

Cook will con­tinue in his role as CEO through the sum­mer as he works closely with Ternus on a smooth tran­si­tion. As ex­ec­u­tive chair­man, Cook will as­sist with cer­tain as­pects of the com­pany, in­clud­ing en­gag­ing with pol­i­cy­mak­ers around the world.

“It has been the great­est priv­i­lege of my life to be the CEO of Apple and to have been trusted to lead such an ex­tra­or­di­nary com­pany. I love Apple with all of my be­ing, and I am so grate­ful to have had the op­por­tu­nity to work with a team of such in­ge­nious, in­no­v­a­tive, cre­ative, and deeply car­ing peo­ple who have been un­wa­ver­ing in their ded­i­ca­tion to en­rich­ing the lives of our cus­tomers and cre­at­ing the best prod­ucts and ser­vices in the world,” said Cook. “John Ternus has the mind of an en­gi­neer, the soul of an in­no­va­tor, and the heart to lead with in­tegrity and with honor. He is a vi­sion­ary whose con­tri­bu­tions to Apple over 25 years are al­ready too nu­mer­ous to count, and he is with­out ques­tion the right per­son to lead Apple into the fu­ture. I could not be more con­fi­dent in his abil­i­ties and his char­ac­ter, and I look for­ward to work­ing closely with him on this tran­si­tion and in my new role as ex­ec­u­tive chair­man.”

“I am pro­foundly grate­ful for this op­por­tu­nity to carry Apple’s mis­sion for­ward,” said Ternus. “Having spent al­most my en­tire ca­reer at Apple, I have been lucky to have worked un­der Steve Jobs and to have had Tim Cook as my men­tor. It has been a priv­i­lege to help shape the prod­ucts and ex­pe­ri­ences that have changed so much of how we in­ter­act with the world and with one an­other. I am filled with op­ti­mism about what we can achieve in the years to come, and I am so happy to know that the most tal­ented peo­ple on earth are here at Apple, de­ter­mined to be part of some­thing big­ger than any one of us. I am hum­bled to step into this role, and I promise to lead with the val­ues and vi­sion that have come to de­fine this spe­cial place for half a cen­tury.”

Arthur Levinson, who has been Apple’s non-ex­ec­u­tive chair­man for the past 15 years, will be­come its lead in­de­pen­dent di­rec­tor on September 1, 2026. Ternus will join the board of di­rec­tors, also ef­fec­tive September 1, 2026.

“Tim’s un­prece­dented and out­stand­ing lead­er­ship has trans­formed Apple into the world’s best com­pany. He’s in­tro­duced ground­break­ing prod­ucts and ser­vices time and again, and his in­tegrity and val­ues are in­fused into every­thing Apple does,” said Levinson. “On be­half of the en­tire board of di­rec­tors, we are in­cred­i­bly grate­ful for his count­less con­tri­bu­tions to Apple and the world, and we are thrilled he will now be ex­ec­u­tive chair­man. We be­lieve John is the best pos­si­ble leader to suc­ceed Tim and as he tran­si­tions to CEO we know his love of Apple, his lead­er­ship, deep tech­ni­cal knowl­edge, and re­lent­less fo­cus on cre­at­ing great prod­ucts will help lead Apple to an ex­tra­or­di­nary fu­ture.”

“I want to thank Art for the in­cred­i­ble work he has done lead­ing the board of di­rec­tors for the past 15 years,” said Cook. “I have al­ways found his ad­vice to be in­valu­able and I ap­pre­ci­ate his thought­ful­ness and his un­wa­ver­ing ded­i­ca­tion to the com­pany. I am grate­ful he will serve as our lead in­de­pen­dent di­rec­tor, and I look for­ward to work­ing with him in my new role.”

Tim Cook joined Apple in 1998. He be­came CEO in 2011 and has over­seen the in­tro­duc­tion of nu­mer­ous prod­ucts and ser­vices, in­clud­ing new cat­e­gories like Apple Watch, AirPods, and Apple Vision Pro, and ser­vices rang­ing from iCloud and Apple Pay to Apple TV and Apple Music. He was also in­stru­men­tal in ex­pand­ing ex­ist­ing prod­uct lines. Under Cook’s lead­er­ship Apple has grown from a mar­ket cap­i­tal­iza­tion of ap­prox­i­mately $350 bil­lion to $4 tril­lion, rep­re­sent­ing a more than 1,000% in­crease, and yearly rev­enue has nearly quadru­pled, from $108 bil­lion in fis­cal year 2011 to more than $416 bil­lion in fis­cal year 2025. The com­pany has ex­panded its global foot­print sub­stan­tially, par­tic­u­larly in emerg­ing mar­kets; it is now in more than 200 coun­tries and ter­ri­to­ries. Apple op­er­ates over 500 re­tail stores and has more than dou­bled the num­ber of coun­tries in which its cus­tomers can visit an Apple Store. During his tenure, Apple has grown by more than 100,000 team mem­bers and in­creased its ac­tive in­stalled base to more than 2.5 bil­lion de­vices.

Apple Services has been a ma­jor fo­cus area of Cook’s, and dur­ing his tenure the cat­e­gory has grown to be­come a more than $100 bil­lion busi­ness, the equiv­a­lent of a Fortune 40 com­pany. Cook was also in­stru­men­tal in cre­at­ing the wear­ables cat­e­gory at Apple, which now in­cludes the world’s most pop­u­lar watch and head­phones, and which has served as the foun­da­tion for Apple’s re­mark­able im­pact on the health and safety of its users. Under Cook’s lead­er­ship, Apple also tran­si­tioned to Apple-designed sil­i­con, en­abling the com­pany to own more of its pri­mary tech­nol­ogy and de­liver in­dus­try-lead­ing gains in power ef­fi­ciency and per­for­mance that di­rectly ben­e­fit users across its prod­ucts.

Cook has made Apple’s core val­ues even more cen­tral to the com­pa­ny’s de­ci­sion mak­ing and prod­uct de­vel­op­ment. Under his lead­er­ship, the com­pany re­duced its car­bon foot­print by more than 60 per­cent be­low 2015 lev­els dur­ing a pe­riod in which rev­enue nearly dou­bled. Cook, who has long ad­vo­cated for pri­vacy as a fun­da­men­tal hu­man right, has made pri­vacy and se­cu­rity im­per­a­tive at Apple, set­ting a stan­dard for user pro­tec­tion that con­tin­ues to set the com­pany apart from the rest of the tech­nol­ogy in­dus­try. He has also pushed for con­tin­ued in­no­va­tion in the ac­ces­si­bil­ity space, be­liev­ing that Apple prod­ucts should be made for every­one. And he has made cen­tral to his lead­er­ship the no­tion that Apple should be a place where every­one can feel they be­long and where every­one is treated with dig­nity and re­spect.

Ternus joined Apple’s prod­uct de­sign team in 2001 and be­came a vice pres­i­dent of Hardware Engineering in 2013. He joined the ex­ec­u­tive team in 2021 as se­nior vice pres­i­dent of Hardware Engineering. Throughout his tenure at Apple, Ternus has over­seen hard­ware en­gi­neer­ing work on a va­ri­ety of ground­break­ing prod­ucts across every cat­e­gory. He was in­stru­men­tal in the in­tro­duc­tion of mul­ti­ple new prod­uct lines, in­clud­ing iPad and AirPods, as well as many gen­er­a­tions of prod­ucts across iPhone, Mac, and Apple Watch.

Ternus’s work on Mac has helped the cat­e­gory be­come more pow­er­ful and more pop­u­lar glob­ally than at any time in its 40-year his­tory. That in­cludes the re­cent in­tro­duc­tion of MacBook Neo, an all-new lap­top that makes the Mac ex­pe­ri­ence even more ac­ces­si­ble to more peo­ple around the world. This past fall, his team’s ef­forts were on full dis­play with the in­tro­duc­tion of a re­de­fined iPhone lineup, in­clud­ing the in­cred­i­bly pow­er­ful iPhone 17 Pro and Pro Max, the rad­i­cally thin and durable iPhone Air, and the iPhone 17, which has been an in­cred­i­ble up­grade for users. Under his lead­er­ship, his team also drove ad­vance­ments in AirPods to make them the world’s best in-ear head­phones, with un­prece­dented ac­tive noise can­cel­la­tion, as well as the ca­pa­bil­ity to be­come an all-in-one hear­ing health sys­tem that can serve as over-the-counter hear­ing aids.

Ternus led much of the com­pa­ny’s fo­cus in ar­eas like re­li­a­bil­ity and dura­bil­ity, in­tro­duc­ing new tech­niques that have made Apple prod­ucts re­mark­ably re­silient. He has also dri­ven much of Apple’s in­no­va­tion in ma­te­ri­als and hard­ware de­sign that have re­duced the car­bon foot­print of its prod­ucts, in­clud­ing the cre­ation of a new, re­cy­cled alu­minum com­pound that has been in­tro­duced across mul­ti­ple prod­uct lines, the use of 3-D printed ti­ta­nium in Apple Watch Ultra 3, and in­no­va­tions in re­pairabil­ity that have in­creased the lifes­pans of sev­eral Apple prod­ucts.

Prior to Apple, Ternus worked as a me­chan­i­cal en­gi­neer at Virtual Research Systems. He holds a bach­e­lor’s de­gree in Mechanical Engineering from the University of Pennsylvania.

This press re­lease con­tains for­ward-look­ing state­ments, within the mean­ing of the Private Securities Litigation Reform Act of 1995. These for­ward-look­ing state­ments in­clude with­out lim­i­ta­tion those about Apple’s ex­ec­u­tive suc­ces­sion plans. These state­ments in­volve risks and un­cer­tain­ties, and ac­tual re­sults may dif­fer ma­te­ri­ally from any fu­ture re­sults ex­pressed or im­plied by the for­ward-look­ing state­ments. More in­for­ma­tion re­gard­ing po­ten­tial risks and other fac­tors that could af­fect the com­pany are in­cluded in Apple’s fil­ings with the SEC, in­clud­ing in the “Risk Factors” and “Management’s Discussion and Analysis of Financial Condition and Results of Operations” sec­tions of Apple’s most re­cently filed pe­ri­odic re­ports on Form 10-K and Form 10-Q and sub­se­quent fil­ings. Apple as­sumes no oblig­a­tion to up­date any for­ward-look­ing state­ments or in­for­ma­tion, which speak only as of the date they are made.

About Apple

Apple rev­o­lu­tion­ized per­sonal tech­nol­ogy with the in­tro­duc­tion of the Macintosh in 1984. Today, Apple leads the world in in­no­va­tion with iPhone, iPad, Mac, AirPods, Apple Watch, and Apple Vision Pro. Apple’s six soft­ware plat­forms — iOS, iPa­dOS, ma­cOS, watchOS, vi­sionOS, and tvOS — pro­vide seam­less ex­pe­ri­ences across all Apple de­vices and em­power peo­ple with break­through ser­vices in­clud­ing the App Store, Apple Music, Apple Pay, iCloud, and Apple TV+. Apple’s more than 150,000 em­ploy­ees are ded­i­cated to mak­ing the best prod­ucts on earth and to leav­ing the world bet­ter than we found it.

© 2026 Apple Inc. All rights re­served. Apple, the Apple logo, Apple Watch, AirPods, Apple Vision Pro, iCloud, Apple Pay, Apple TV, Apple Music, Apple Store, iPad, iPhone, Mac, MacBook Neo, and iPhone Air are trade­marks of Apple. Other com­pany and prod­uct names may be trade­marks of their re­spec­tive own­ers.

Today, we’re launch­ing Claude Design, a new Anthropic Labs prod­uct that lets you col­lab­o­rate with Claude to cre­ate pol­ished vi­sual work like de­signs, pro­to­types, slides, one-pagers, and more.

Claude Design is pow­ered by our most ca­pa­ble vi­sion model, Claude Opus 4.7, and is avail­able in re­search pre­view for Claude Pro, Max, Team, and Enterprise sub­scribers. We’re rolling out to users grad­u­ally through­out the day.

Even ex­pe­ri­enced de­sign­ers have to ra­tion ex­plo­ration—there’s rarely time to pro­to­type a dozen di­rec­tions, so you limit your­self to a few. And for founders, prod­uct man­agers, and mar­keters with an idea but not a de­sign back­ground, cre­at­ing and shar­ing those ideas can be daunt­ing.

Claude Design gives de­sign­ers room to ex­plore widely and every­one else a way to pro­duce vi­sual work. Describe what you need and Claude builds a first ver­sion. From there, you re­fine through con­ver­sa­tion, in­line com­ments, di­rect ed­its, or cus­tom slid­ers (made by Claude) un­til it’s right. When given ac­cess, Claude can also ap­ply your team’s de­sign sys­tem to every pro­ject au­to­mat­i­cally, so the out­put is con­sis­tent with the rest of your com­pa­ny’s de­signs.

Teams have been us­ing Claude Design for:

* Realistic pro­to­types: Designers can turn sta­tic mock­ups into eas­ily-share­able in­ter­ac­tive pro­to­types to gather feed­back and user-test, with­out code re­view or PRs.

* Product wire­frames and mock­ups: Product Managers can sketch out fea­ture flows and hand them off to Claude Code for im­ple­men­ta­tion, or share them with de­sign­ers to re­fine fur­ther.

* Design ex­plo­rations: Designers can quickly cre­ate a wide range of di­rec­tions to ex­plore.

* Pitch decks and pre­sen­ta­tions: Founders and Account Executives can go from a rough out­line to a com­plete, on-brand deck in min­utes, and then ex­port as a PPTX or send to Canva.

* Marketing col­lat­eral: Marketers can cre­ate land­ing pages, so­cial me­dia as­sets, and cam­paign vi­su­als, then loop in de­sign­ers to pol­ish.

* Frontier de­sign: Anyone can build code-pow­ered pro­to­types with voice, video, shaders, 3D and built-in AI.

Your brand, built in. During on­board­ing, Claude builds a de­sign sys­tem for your team by read­ing your code­base and de­sign files. Every pro­ject af­ter that uses your col­ors, ty­pog­ra­phy, and com­po­nents au­to­mat­i­cally. You can re­fine the sys­tem over time, and teams can main­tain more than one.

Import from any­where. Start from a text prompt, up­load im­ages and doc­u­ments (DOCX, PPTX, XLSX), or point Claude at your code­base. You can also use the web cap­ture tool to grab el­e­ments di­rectly from your web­site so pro­to­types look like the real prod­uct.

Refine with fine-grained con­trols. Comment in­line on spe­cific el­e­ments, edit text di­rectly, or use ad­just­ment knobs to tweak spac­ing, color, and lay­out live. Then ask Claude to ap­ply your changes across the full de­sign.

Collaborate. Designs have or­ga­ni­za­tion-scoped shar­ing. You can keep a doc­u­ment pri­vate, share it so any­one in your or­ga­ni­za­tion with the link can view it, or grant edit ac­cess so col­leagues can mod­ify the de­sign and chat with Claude to­gether in a group con­ver­sa­tion.

Export any­where. Share de­signs as an in­ter­nal URL within your or­ga­ni­za­tion, save as a folder, or ex­port to Canva, PDF, PPTX, or stand­alone HTML files.

Handoff to Claude Code. When a de­sign is ready to build, Claude pack­ages every­thing into a hand­off bun­dle that you can pass to Claude Code with a sin­gle in­struc­tion.

Over the com­ing weeks, we’ll make it eas­ier to build in­te­gra­tions with Claude Design, so you can con­nect it to more of the tools your team al­ready uses.

Claude Design is avail­able for Claude Pro, Max, Team, and Enterprise sub­scribers. Access is in­cluded with your plan and uses your sub­scrip­tion lim­its, with the op­tion to con­tinue be­yond those lim­its by en­abling ex­tra us­age.

For Enterprise or­ga­ni­za­tions, Claude Design is off by de­fault. Admins can en­able it in Organization set­tings.

TLDR: Despite claim­ing to backup all your data, Backblaze qui­etly stopped back­ing up OneDrive and Dropbox fold­ers - along with po­ten­tially many other things.

For ten years I have been us­ing Backblaze for my per­sonal com­puter backup. Before 2015 I would backup files to one of two large ex­ter­nal hard discs. I then ro­tated these dri­ves be­tween, first my fa­ther’s house, and af­ter I moved to the UK, my of­fice draw­ers.

In 2015 Backblaze seemed like a good bet. Unlike Crashplan their soft­ware was­n’t a bloated Java app, but they did have un­lim­ited stor­age. If you could cram it into your PC they would back it up. With their yearly Hard Drive re­views mak­ing good press, a lot of per­sonal rec­om­men­da­tions from my friends and col­leagues, their ser­vice sounded great. I in­stalled the soft­ware, ran it for sev­eral weeks, and sure enough my data was safely stored in their cloud.

I had fur­ther rea­son to be im­pressed when sev­eral years later one of my hard dri­ves failed. I made use of their “send me a hard drive with my stuff on it ser­vice”. A drive turned up filled with my pre­cious data. That for me was proof that this sys­tem worked, and that it worked well.

And so I rec­om­mended Backblaze for years. What do you do for backup? I would ex­toll the virtues of Backblaze, and they made many sales from such rec­om­men­da­tions.

There were a few things I did­n’t like. The app, could use a lot of mem­ory, es­pe­cially af­ter do­ing a large im­port of pho­tographs. The web­site, which I of­ten used to re­store sin­gle files or fold­ers, was slow and clunky to use. The win­dows app in par­tic­u­lar was clunky with an early 2000s aes­thetic and cramped lists. There was the time they leaked all your file­names to Facebook, but they prob­a­bly fixed that.

But no mat­ter, small prob­lems for the peace of mind of hav­ing all my files backed up.

Backup soft­ware is meant to back up your files. Which files? Well the files you need. Given every­one is dif­fer­ent, with dif­fer­ent work­flows and file­types, the ideal thing is to back up all your files. No backup provider knows what I will need in the fu­ture. The provider must plan ac­cord­ingly.

My first trou­bling dis­cov­ery was in 2025, when I made sev­eral er­rors then did a push -f to GitHub and blew away the git his­tory for a half decade old repo. No data was lost, but the log of changes was. No prob­lem I thought, I’ll just re­store this from Backblaze. Sadly it was not to be. At some point Backblaze had started to ig­nore .git fold­ers.

This an­noyed me. Firstly I needed that folder and Backblaze had let me down. Secondly within the Backblaze pref­er­ences I could find no way to re-en­able this. In fact look­ing at the list of ex­clu­sions I could find no men­tion of .git what­so­ever.

This made me won­der - I had checked the ex­clu­sions list when I in­stalled Backblaze 9 years be­fore, had I missed it? Had I missed any­thing else?

Well les­son learned I guess, but then a week ago I came across this thread on red­dit: “Doesn’t back up Dropbox folder??”. A user was sur­prised to find their Dropbox folder no longer be­ing backed up. Alarmed I logged into Backblaze, and lo and be­hold, my OneDrive folder was miss­ing.

Backblaze has one job, and ap­par­ently they are un­able to do that job. Back up my stuff. But they have de­cided not to.

Lets take an aside.

A rea­son­able per­son might point out those files on OneDrive are al­ready be­ing backed up - by OneDrive! No. Dropbox and OneDrive are for file sync­ing - sync­ing your files to the cloud. They of­fer lim­ited pro­tec­tion. OneDrive and Dropbox only re­tain deleted files for one month. Backblaze has one year file re­ten­tion, or if you pay per GB, un­lim­ited re­ten­tion. While OneDrive re­tains ver­sion changes for longer, Dropbox only re­tains ver­sion changes for a month - again un­less you pay for more. Your files are less se­cure and less backed up when you stick them in a cloud stor­age provider folder com­pared to just be­ing on your desk­top.

And that’s as­sum­ing your cloud provider is play­ing ball. If Microsoft or Dropbox bans your ac­count you may find your­self with no backup what­so­ever.

For me the larger is­sue is they never told us. My OneDrive folder sits at 383GB. You would think that hav­ing de­cided to no longer back this up I might get an email, and alert or some other no­ti­fi­ca­tion. Of course not.

Nestled into their re­lease notes un­der “Improvements” we see:

The Backup Client now ex­cludes pop­u­lar cloud stor­age providers from backup, in­clud­ing both mount points and cache di­rec­to­ries. This pre­vents per­for­mance is­sues, ex­ces­sive data us­age, and un­in­tended up­loads from ser­vices like OneDrive, Google Drive, Dropbox, Box, iDrive, and oth­ers. This change aligns with Backblaze’s pol­icy to back up only lo­cal and di­rectly con­nected stor­age.

First, I would hardly call this change in pol­icy an im­prove­ment, its hard to imag­ine any­one read­ing this as any­thing other than a down­grade in ser­vice. Secondly does Backblaze be­lieve most of its users are read­ing their re­lease notes?

And if you joined to­day and looked at their list of file ex­clu­sions you would find no ref­er­ence to Dropbox or OneDrive. No men­tion of Git ei­ther.

Here’s the thing, to­day they don’t back up Git or OneDrive. Who’s to say to­mor­row they wont add to the list. Maybe some ob­scure file for­mat that’s crit­i­cal to your work flow. Or they will ig­nore a file ex­ten­sion that just hap­pens be the same as one used by your DAW or 3D Modelling soft­ware. And they won’t tell you this. They wont even list it on their site.

By de­cid­ing not to back up every­thing, Backblaze has made it as if they are back­ing up noth­ing.

But re­ally this feels like a promise bro­ken. Back in 2015 their web­site proudly pro­claimed:

All user data in­cluded by de­fault No re­stric­tions on file type or size

Protect the dig­i­tal mem­o­ries and files that mat­ter most to you.

File backup is a mat­ter of trust. You are pay­ing a monthly fee so that if and when things go wrong you can get your data back. By silently chang­ing the rules, Backblaze has not sim­ply eroded my trust, but swept it away.

I wrote this to warn you - Backblaze is no longer do­ing their part, they are no longer back­ing up your data. Some of your data sure, but not all of it.

Finally let me leave you with Backblaze’s own words from 2015:

They promised to sim­plify backup. They suc­ceeded - they don’t even do the backup part any­more.

The Photo page brings Hollywood’s most ad­vanced color tools to still pho­tog­ra­phy for the first time! Whether you’re a pro­fes­sional col­orist look­ing to ap­ply your skills to fash­ion shoots and wed­dings, or a pho­tog­ra­pher who wants to work be­yond the lim­its of tra­di­tional photo ap­pli­ca­tions, the Photo page un­locks the tools you need. Start with fa­mil­iar photo tools in­clud­ing white bal­ance, ex­po­sure and pri­mary color ad­just­ments, then switch to the Color page for ac­cess to the full DaVinci color grad­ing toolset trusted by Hollywood’s best col­orists! You can use DaVinci’s AI toolset as well as Resolve FX and Fusion FX. GPU acceleration lets you ex­port faster than ever be­fore!

For pho­tog­ra­phers, the Photo page of­fers a fa­mil­iar set of tools along­side DaVinci’s pow­er­ful color grad­ing ca­pa­bil­i­ties. It includes na­tive RAW sup­port for Canon, Fujifilm, Nikon, Sony and even iPhone ProRAW. All image pro­cess­ing takes place at source res­o­lu­tion up to 32K, or over 400 megapix­els, so you’re never lim­ited to pro­ject res­o­lu­tion. Familiar ba­sic ad­just­ments in­clud­ing white bal­ance, ex­po­sure, color and sat­u­ra­tion give you a com­fort­able start­ing point. With non-de­struc­tive pro­cess­ing you can re­frame, crop and re-in­ter­pret your orig­i­nal sen­sor data at any time. And with GPU ac­cel­er­a­tion, en­tire al­bums can be processed dra­mat­i­cally faster than con­ven­tional photo ap­pli­ca­tions!

The Photo page Inspector gives you pre­cise con­trol over the trans­form and crop­ping pa­ra­me­ters of your im­ages. Reframe and crop non-de­struc­tively at the orig­i­nal source res­o­lu­tion and as­pect ra­tio, so you’re never re­stricted to a fixed time­line size! Zoom, po­si­tion, ro­tate and flip im­ages with full trans­form con­trols and use the crop­ping pa­ra­me­ters to trim the edges of any im­age with pre­ci­sion. Reframe a shot to im­prove com­po­si­tion, ad­just for a spe­cific ra­tio for print or so­cial me­dia use, or sim­ply re­move un­wanted el­e­ments from the edges of a frame. All adjustments can be re­fined or re­set at any time with­out ever af­fect­ing the orig­i­nal source file!

DaVinci Resolve is the world’s only post pro­duc­tion soft­ware that lets every­one work to­gether on the same pro­ject at the same time! Built on a pow­er­ful cloud based work­flow, you can share al­bums, all as­so­ci­ated meta­data and tags, as well as grades and ef­fects with col­orists, pho­tog­ra­phers and re­touch­ers any­where in the world. Blackmagic Cloud sync­ing keeps every col­lab­o­ra­tor with the lat­est ver­sion of your im­age li­brary in real time, and re­mote re­view­ers can ap­prove grades off­site with­out need­ing to be in the same room. Hollywood col­orists can even grade live fash­ion shoots re­motely, all while the pho­tog­ra­pher is still on set!

The Photo page gives you every­thing you need to man­age your en­tire im­age li­brary from im­port to com­ple­tion. You can im­port pho­tos di­rectly, from your Apple Photos li­brary or Lightroom, and or­ga­nize them with tags, rat­ings, fa­vorites and key­words for fast, flex­i­ble man­age­ment of even the largest li­braries. It supports all stan­dard RAW files and im­age types. AI IntelliSearch lets you in­stantly search across your en­tire pro­ject to find ex­actly what you’re look­ing for, from ob­jects to peo­ple to an­i­mals! Albums al­low you to build and man­age col­lec­tions for any pro­ject and with a sin­gle click you can switch be­tween your photo li­brary and your color grad­ing work­flow!

Albums are a pow­er­ful way to build and man­age photo col­lec­tions di­rectly in DaVinci Resolve. You can add im­ages man­u­ally to each al­bum or or­ga­nize by date, cam­era, star rat­ing, EXIF data and more. Powerful fil­ter and sort tools give you to­tal con­trol over how your col­lec­tion is arranged. The thumbnail view dis­plays each im­age’s graded ver­sion along­side its file name and source clip for­mat so you can see your grades at a glance. Create mul­ti­ple grade ver­sions of any im­age, all ref­er­enc­ing the orig­i­nal source file, so you can ex­plore dif­fer­ent looks with­out ever du­pli­cat­ing a file. Plus, grades ap­plied to one photo can be in­stantly copied across oth­ers in the al­bum for a fast, con­sis­tent look!

Connect Sony or Canon cam­eras di­rectly to DaVinci Resolve for teth­ered shoot­ing with full live view! Adjust cam­era set­tings in­clud­ing ISO, ex­po­sure and white bal­ance with­out leav­ing the page and save im­age cap­ture pre­sets to es­tab­lish a con­sis­tent look be­fore you shoot. Images can be cap­tured di­rectly into an al­bum, with al­bums cre­ated au­to­mat­i­cally dur­ing cap­ture so your li­brary is per­fectly or­ga­nized from the mo­ment you start shoot­ing. Grade im­ages as they ar­rive us­ing DaVinci Resolve’s ex­ten­sive color toolset and use a hard­ware panel for hands-on cre­ative con­trol in a col­lab­o­ra­tive shoot. That means you can cap­ture, grade and or­ga­nize an en­tire shoot with­out leav­ing DaVinci Resolve!

The Photo page gives you ac­cess to over 100 GPU and CPU ac­cel­er­ated Resolve FX and spe­cialty AI tools for still im­age work. They’re or­ga­nized by cat­e­gory in the Open FX li­brary and cover every­thing from color ef­fects, blurs and glows to im­age re­pair, skin re­fine­ment and cin­e­matic light­ing tools. These are the same tools used by Hollywood col­orists and VFX artists on the world’s biggest pro­duc­tions, now avail­able for still im­ages. To add an ef­fect, drag it to any node. Whether you’re mak­ing sub­tle beauty re­fine­ments for a fash­ion shoot or ap­ply­ing dra­matic film looks and at­mos­pheric light­ing ef­fects em­u­lat­ing the looks of a Hol­ly­wood fea­ture, the Photo page has the tools you need!

Magic Mask makes pre­cise se­lec­tions of sub­jects or back­grounds, while Depth Map gen­er­ates a 3D map of your scene to sep­a­rate fore­ground and back­ground with­out man­ual mask­ing. Use together to grade dif­fer­ent depths of an im­age in­de­pen­dently for re­sults that have never be­fore been pos­si­ble for stills!

Add a re­al­is­tic light source to any photo af­ter cap­ture with Relight FX. Relight an­a­lyzes the sur­faces of faces and ob­jects to re­flect light nat­u­rally across the im­age. Combine with Magic Mask to light a sub­ject in­de­pen­dently from the back­ground, turn­ing flat por­traits into stun­ning fash­ion im­ages!

Face re­fine­ment au­to­mat­i­cally masks dif­fer­ent parts of a face, sav­ing count­less hours of man­ual work. Sharpen eyes, re­move dark cir­cles, smooth skin, and color lips. Ultra Beauty sep­a­rates skin tex­ture from color for nat­ural, high end re­sults, while AI Blemish Removal han­dles fast skin re­pair!

The Film Look Creator lets you add cin­e­matic looks that repli­cate film prop­er­ties like ha­la­tion, bloom, grain and vi­gnetting. Adjust ex­po­sure in stops and use sub­trac­tive sat­u­ra­tion, rich­ness and split tone con­trols to achieve looks usu­ally found on the big screen, now for your still im­ages!

AI SuperScale uses the DaVinci AI Neural Engine to up­scale low res­o­lu­tion im­ages with ex­cep­tional qual­ity. The enhanced mode is specif­i­cally de­signed to re­move com­pres­sion ar­ti­facts, mak­ing it the per­fect tool for rescal­ing low qual­ity pho­tos or frame grabs up to 4x their orig­i­nal res­o­lu­tion!

UltraNR is a DaVinci AI Neural Engine dri­ven de­noise mode in the Color page’s spa­tial noise re­duc­tion palette. Use it to dra­mat­i­cally re­duce dig­i­tal noise from an im­age while main­tain­ing im­age clar­ity. Use with spa­tial noise re­duc­tion to smooth out dig­i­tal grain or scan­ner noise while keep­ing fine hair and eye edges sharp.

Sample an area of a scene to quickly cover up un­wanted el­e­ments, like ob­jects or even blem­ishes on a face. The patch re­placer has a fan­tas­tic auto grad­ing fea­ture that will seam­lessly blend the cov­ered area with the sur­round­ing color data. Perfect for re­mov­ing sen­sor dust.

The Quick Export op­tion makes it fast and easy to de­liver fin­ished im­ages in a wide range of com­mon for­mats in­clud­ing JPEG, PNG, HEIF and TIFF. Export ei­ther an en­tire al­bum or just se­lected pho­tos pro­vid­ing flex­i­bil­ity to meet your spe­cific de­liv­ery needs. You can set the res­o­lu­tion, bit depth, qual­ity and com­pres­sion to en­sure your im­ages are op­ti­mized for their in­tended use. Whether you’re ex­port­ing stand­alone im­ages for print, shar­ing on so­cial me­dia plat­forms or de­liv­er­ing graded files to a client, Quick Export has you cov­ered. All exports pre­serve your orig­i­nal photo EXIF meta­data, so cam­era set­tings, lo­ca­tion data and other im­por­tant in­for­ma­tion al­ways trav­els with your files.

The Photo page uses GPU ac­cel­er­ated pro­cess­ing to de­liver fast, ac­cu­rate re­sults across your en­tire work­flow. Process hun­dreds of RAW files in sec­onds with GPU ac­cel­er­ated de­cod­ing and ap­ply Resolve FX to your im­ages in real time. GPU acceleration also means batch ex­ports and con­ver­sions are dra­mat­i­cally faster than con­ven­tional photo ap­pli­ca­tions. On Mac, DaVinci Resolve is op­ti­mized for Metal and Apple Silicon, tak­ing full ad­van­tage of the lat­est hard­ware. On Windows and Linux, you get CUDA sup­port for NVIDIA GPUs, while the Windows ver­sion also fea­tures full OpenCL sup­port for AMD, Intel and Qualcomm GPUs. All this en­sures you get high per­for­mance re­sults on any sys­tem!

Hollywood col­orists have al­ways re­lied on hard­ware pan­els to work faster and more cre­atively and now pho­tog­ra­phers can too! The DaVinci Resolve Micro Color Panel is the per­fect com­pan­ion for photo grad­ing as it is com­pact enough to sit next to a lap­top and portable enough to take on lo­ca­tion for shoots. It features three high qual­ity track­balls for lift, gamma and gain ad­just­ments, 12 pri­mary cor­rec­tion knobs for con­trast, sat­u­ra­tion, hue, tem­per­a­ture and more. It even has a built in recharge­able bat­tery! DaVinci Resolve color pan­els let you ad­just mul­ti­ple pa­ra­me­ters at once, so you can cre­ate looks that are sim­ply im­pos­si­ble with a mouse and key­board.

Hollywood’s most pop­u­lar so­lu­tion for edit­ing, vi­sual ef­fects, mo­tion graph­ics, color cor­rec­tion and au­dio post pro­duc­tion, for Mac, Windows and Linux. Now supports Blackmagic Cloud for col­lab­o­ra­tion!

The most pow­er­ful DaVinci Resolve adds DaVinci Neural Engine for au­to­matic AI re­gion track­ing, stereo­scopic tools, more Resolve FX fil­ters, more Fairlight FX au­dio plu­g­ins and ad­vanced HDR grading.

Includes large search dial in a de­sign that in­cludes only the spe­cific keys needed for edit­ing. Includes Bluetooth with bat­tery for wire­less use so it’s more portable than a full sized key­board!

Editor panel specif­i­cally de­signed for multi-cam edit­ing for news cut­ting and live sports re­play. Includes but­tons to make cam­era se­lec­tion and edit­ing ex­tremely fast! Connects via Bluetooth or USB‑C.

Full sized tra­di­tional QWERTY ed­i­tor key­board in a pre­mium metal de­sign. Featuring a metal search dial with clutch, plus ex­tra edit, trim and time­code keys. Can be in­stalled in­set for flush mount­ing.

Powerful color panel gives you all the con­trol you need to cre­ate cin­e­matic im­ages. Includes con­trols for re­fined color grad­ing in­clud­ing adding win­dows. Connects via Bluetooth or USB‑C.

Portable DaVinci color panel with 3 high res­o­lu­tion track­balls, 12 pri­mary cor­rec­tor knobs and LCDs with menus and but­tons for switch­ing tools, adding color nodes, HDR and sec­ondary grad­ing and more!

Designed in col­lab­o­ra­tion with pro­fes­sional Hollywood col­orists, the DaVinci Resolve Advanced Panel fea­tures a mas­sive num­ber of con­trols for di­rect ac­cess to every DaVinci color cor­rec­tion fea­ture.

Portable au­dio con­trol sur­face in­cludes 12 pre­mium touch sen­si­tive fly­ing faders, chan­nel LCDs for ad­vanced pro­cess­ing, au­toma­tion and trans­port con­trols plus HDMI for an ex­ter­nal graph­ics dis­play.

Get in­cred­i­bly fast au­dio edit­ing for sound en­gi­neers work­ing on tight dead­lines! Includes LCD screen, touch sen­si­tive con­trol knobs, built in search dial and full key­board with multi func­tion keys.

Used by Hollywood and broad­cast­ers, these large con­soles make it easy to mix large pro­jects with a mas­sive num­ber of chan­nels and tracks. Modular de­sign al­lows cus­tomiz­ing 2, 3, 4, or 5 bay consoles!

Fairlight stu­dio con­sole legs at 0º an­gle for when you re­quire a flat work­ing sur­face. Required for all Fairlight Studio Consoles.

Fairlight stu­dio con­sole legs at 8º angle for when you re­quire a slightly an­gled work­ing sur­face. Required for all Fairlight Studio Consoles.

Features 12 mo­tor­ized faders, ro­tary con­trol knobs il­lu­mi­nated but­tons for pan, solo, mute and call, plus bank se­lect but­tons.

12 groups of touch sen­si­tive ro­tary con­trol knobs and il­lu­mi­nated but­tons, as­sign­a­ble to fader strips, sin­gle chan­nel or mas­ter bus.

Get quick ac­cess to vir­tu­ally every Fairlight fea­ture! Includes a 12” LCD, graph­i­cal key­board, macro keys, trans­port con­trols and more.

Features HDMI, SDI in­puts for video and com­puter mon­i­tor­ing and Ethernet for graph­ics dis­play of chan­nel sta­tus and me­ters.

Empty 2 bay Fairlight stu­dio con­sole chas­sis that can be pop­u­lated with var­i­ous faders, chan­nel con­trols, edit and LCD monitors.

Empty 3 bay Fairlight stu­dio con­sole chas­sis that can be pop­u­lated with var­i­ous faders, chan­nel con­trols, edit and LCD monitors.

Empty 4 bay Fairlight stu­dio con­sole chas­sis that can be pop­u­lated with var­i­ous faders, chan­nel con­trols, edit and LCD monitors.

Empty 5 bay Fairlight stu­dio con­sole chas­sis that can be pop­u­lated with var­i­ous faders, chan­nel con­trols, edit and LCD monitors.

Use al­ter­na­tive HDMI or SDI tele­vi­sions and mon­i­tors when build­ing a Fairlight stu­dio con­sole.

Mounting bar with lo­cat­ing pins to al­low cor­rect align­ment of bay mod­ules when build­ing a cus­tom 2 bay Fairlight console.

Mounting bar with lo­cat­ing pins to al­low cor­rect align­ment of bay mod­ules when build­ing a cus­tom 3 bay Fairlight console.

Mounting bar with lo­cat­ing pins to al­low cor­rect align­ment of bay mod­ules when build­ing a cus­tom 4 bay Fairlight console.

Mounting bar with lo­cat­ing pins to al­low cor­rect align­ment of bay mod­ules when build­ing a cus­tom 5 bay Fairlight console.

Side arm kit mounts into Fairlight con­sole mount­ing bar and holds each fader, chan­nel con­trol and LCD mon­i­tor mod­ule.

Blank 1/3rd wide bay for build­ing a cus­tom con­sole with the ex­tra 1/3rd sec­tion. Includes blank in­fill pan­els.

Allows mount­ing stan­dard 19 inch rack mount equip­ment in the chan­nel con­trol area of the Fairlight stu­dio con­sole.

Blank panel to fill in the chan­nel con­trol area of the Fairlight stu­dio con­sole.

Blank panel to fill in the LCD mon­i­tor area of the Fairlight stu­dio con­sole when you’re not us­ing the stan­dard Fairlight LCD monitor.

Blank panel to fill in the fader con­trol area of the Fairlight stu­dio con­sole.

Adds 3 MADI I/O con­nec­tions to the sin­gle MADI on the ac­cel­er­a­tor card, for a to­tal of 256 inputs and out­puts at 24 bit and 48kHz.

Add up to 2,000 tracks with real time pro­cess­ing of EQ, dy­nam­ics, 6 plug‑ins per track, plus MADI for ex­tra 64 inputs and out­puts.

Adds ana­log and dig­i­tal con­nec­tions, pre­amps for mics and in­stru­ments, sam­ple rate con­ver­sion and sync at any stan­dard frame rate.

Flock Safety mar­kets AI sur­veil­lance that goes far be­yond read­ing li­cense plates; color, bumper stick­ers, dents, and other fea­tures are used to build data­bases and iden­tify move­ment pat­terns. These sys­tems are spread­ing rapidly, of­ten with­out over­sight, and are ac­ces­si­ble to po­lice with­out a war­rant. They raise se­ri­ous pri­vacy and le­gal con­cerns, and con­tribute to a na­tion­wide trend to­ward mass sur­veil­lance.

While this and other sys­tems like it claim to re­duce crime, there is lit­tle ev­i­dence to sup­port that claim - and sig­nif­i­cant risk of abuse. Real pub­lic safety comes from in­vest­ing in com­mu­ni­ties, not stalk­ing them.

Flock Safety mar­kets AI sur­veil­lance that goes far be­yond read­ing li­cense plates; color, bumper stick­ers, dents, and other fea­tures are used to build data­bases and iden­tify move­ment pat­terns. These sys­tems are spread­ing rapidly, of­ten with­out over­sight, and are ac­ces­si­ble to po­lice with­out a war­rant. They raise se­ri­ous pri­vacy and le­gal con­cerns, and con­tribute to a na­tion­wide trend to­ward mass sur­veil­lance.

While this and other sys­tems like it claim to re­duce crime, there is lit­tle ev­i­dence to sup­port that claim - and sig­nif­i­cant risk of abuse. Real pub­lic safety comes from in­vest­ing in com­mu­ni­ties, not stalk­ing them.

Flock Safety mar­kets its de­vices as “AI-powered pre­ci­sion polic­ing tech­nol­ogy” - far be­yond ba­sic li­cense plate read­ers (ALPRs) (Flock Safety). The sys­tem uses AI to cre­ate a “Vehicle Fingerprint” - iden­ti­fy­ing cars not only by li­cense plate, but also by color, make and model, roof racks, dents/​dam­age, wheel type, and more. Even bumper sticker place­ment is an­a­lyzed. This lets law en­force­ment search for a “blue sedan with dam­age on the left side” even with­out a li­cense plate.

But the sur­veil­lance goes deeper. Using a fea­ture called “Convoy Analysis”, the sys­tem can de­tect ve­hi­cles that fre­quently ap­pear near each other - sug­gest­ing as­so­ci­a­tions be­tween dri­vers or ac­com­plices. The plat­form can also flag ve­hi­cles that rou­tinely travel to the same lo­ca­tions across time. Flock de­scribes this as a way to “identify sus­pect ve­hi­cles trav­el­ing to­gether” or “pinpoint as­so­ci­ates” - func­tion­al­ity con­firmed in both their mar­ket­ing and po­lice tes­ti­mo­ni­als (GovTech, ACLU).

The data is logged and made search­able across a na­tion­wide law en­force­ment net­work - which of­fi­cers in sub­scrib­ing agen­cies can ac­cess with­out a war­rant. According to Flock, the sys­tem can au­to­mat­i­cally flag a ve­hi­cle based on its his­tory, route, or pres­ence in mul­ti­ple lo­ca­tions linked to a crime (Flock HOA Marketing).

While these tools may aid in lo­cat­ing stolen cars or miss­ing per­sons, they also cre­ate a de­tailed record of every­one’s move­ments, as­so­ci­a­tions, and rou­tines. That data has al­ready been mis­used - like when a Kansas po­lice chief used Flock cam­eras 228 times to stalk an ex-girl­friend and her new part­ner with­out cause (Local12).

The scope of this track­ing be­comes clear when you see real-world ex­am­ples. In 2025, a jour­nal­ist drove 300 miles across rural Virginia and was cap­tured by nearly 50 sur­veil­lance cam­eras op­er­ated by 15 dif­fer­ent law en­force­ment agen­cies. When he re­quested his own sur­veil­lance footage, he dis­cov­ered the cam­eras had doc­u­mented pat­terns that made his be­hav­ior “predictable to any­one look­ing at it.” Most trou­bling: while the jour­nal­ist could­n’t re­mem­ber spe­cific dates he’d made cer­tain trips, po­lice would know in­stantly - with­out any war­rant or sus­pi­cion of wrong­do­ing (Cardinal News).

See also:

EFF: How ALPRs Work,

The Secure Dad on Flock Cameras,

Compass IT: “Privacy Concerns with Flock”,

ACLU: Flock is build­ing a new AI-driven mass sur­veil­lance sys­tem,

Wikipedia: Flock Safety

How Widespread Are These Cameras?

Understanding what Flock cam­eras are leads to a nat­ural ques­tion: how com­mon are they in our com­mu­ni­ties?

The crowd­sourced map made avail­able on DeFlock.me cur­rently shows roughly half of the >100,000 Flock AI cam­eras na­tion­wide. Here are ex­am­ples from three ma­jor cities show­ing how per­va­sive this sur­veil­lance has be­come:

These sys­tems are ex­pand­ing rapidly, of­ten with lit­tle pub­lic de­bate or over­sight. The Atlas of Surveillance, main­tained by the Electronic Frontier Foundation, has doc­u­mented over 3,000 law en­force­ment and gov­ern­ment agen­cies us­ing Flock prod­ucts as of 2025 - a num­ber grow­ing monthly.

The Fourth Amendment was writ­ten in re­sponse to the British Crown’s “general war­rants” - broad au­tho­riza­tions to search any­one, any­where, any­time. Mass sur­veil­lance re­vives that threat in dig­i­tal form. Simply mov­ing freely in pub­lic should not re­quire that you be pro­filed and scru­ti­nized.

It is im­por­tant to point out that the courts have re­peat­edly ruled so-called “dragnet war­rants,” of­ten us­ing cell phone GPS lo­ca­tions, un­con­sti­tu­tional un­der the Fourth Amendment. But Flock’s sta­tus as a pri­vate com­pany means it can col­lect and sell data with fewer re­stric­tions, ex­ploit­ing a le­gal gray zone which courts have yet to fully ad­dress.

“If you’ve got noth­ing to hide, you’ve got noth­ing to fear” is a tempt­ing thought - un­til some­one mis­uses your in­for­ma­tion. Privacy is­n’t about hid­ing wrong­do­ing. It’s about au­ton­omy, dig­nity, and the abil­ity to live free from un­just scrutiny. “Saying you don’t care about pri­vacy be­cause you have noth­ing to hide is like say­ing you don’t care about free speech be­cause you have noth­ing to say.” - Edward Snowden

As one ob­server put it: “While to­day they are no threat to me…cir­cum­stances change, lead­er­ship changes, laws change. When you re­ally boil this down, what is this na­tion­wide sys­tem? What did Flock re­ally make? It’s a weapon. A silent weapon. Right now it tar­gets what many would agree are crim­i­nals. But with the flip of a switch this sys­tem can be used to tar­get or op­press any­body the peo­ple in power de­cide is a threat.”

We are fast ap­proach­ing a world in which go­ing about one’s busi­ness in pub­lic means be­ing en­tered into a law en­force­ment data­base. Automated li­cense plate read­ers col­lect lo­ca­tion data on mil­lions of peo­ple with no sus­pi­cion of wrong­do­ing, cre­at­ing vast data­bases of where we go and when.

Flock cam­eras and sim­i­lar sur­veil­lance tools raise se­ri­ous Fourth Amendment con­cerns by en­abling broad, war­rant­less track­ing of peo­ple’s move­ments. In 2024, a trial court held that the Flock net­work func­tioned as a “dragnet over the en­tire city.” The judge in the case equated it to plac­ing GPS track­ers on every ve­hi­cle - a prac­tice that the U. S. Supreme Court has ruled re­quires a war­rant (Virginia Mercury, The Virginian Pilot).

The American Civil Liberties Union (ACLU) warns that au­to­matic li­cense plate read­ers (ALPRs) are be­com­ing tools for rou­tine mass lo­ca­tion track­ing and sur­veil­lance, with too few rules gov­ern­ing their use. These sys­tems can col­lect and store data on mil­lions of in­no­cent dri­vers, cre­at­ing de­tailed records of peo­ple’s move­ments with­out their knowl­edge or con­sent. (ACLU)

Legal schol­ars have high­lighted the broader im­pli­ca­tions of such sur­veil­lance. Neil Richards, writ­ing in the Harvard Law Review, em­pha­sizes that sur­veil­lance can chill the ex­er­cise of civil lib­er­ties, par­tic­u­larly in­tel­lec­tual pri­vacy, and in­crease the risk of black­mail, co­er­cion, and dis­crim­i­na­tion. (Harvard Law Review)

Flock’s data fur­ther en­ables al­ready bi­ased en­force­ment. In Oak Park, Illinois, 84% of dri­vers stopped us­ing Flock cam­era alerts were Black - de­spite the town be­ing only 21% Black. (Freedom to Thrive).

See also:

ACLU on Unaccountable Surveillance Tech

Mass sur­veil­lance is­n’t just about polic­ing; there are ma­jor busi­ness in­ter­ests in­volved.

Flock Safety col­lab­o­rates with law en­force­ment agen­cies to pro­mote the adop­tion of its li­cense plate recog­ni­tion cam­eras by en­cour­ag­ing pri­vate en­ti­ties such as busi­nesses and HOAs to share their footage. This prac­tice broad­ens the sur­veil­lance net by grant­ing ac­cess to what would oth­er­wise have been pri­vate data (Flock Safety FAQ).

Instances have been re­ported where HOAs in­stalled Flock cam­eras on pub­lic roads, lead­ing to de­bates over the ex­tent of sur­veil­lance and the pri­vacy rights of res­i­dents and vis­i­tors (Oaklandside), (Forest Brooke HOA).

The ACLU has high­lighted that the ex­pan­sive reach of these sur­veil­lance net­works could en­able law en­force­ment to con­struct de­tailed pro­files of in­di­vid­u­als’ move­ments and as­so­ci­a­tions, un­der­scor­ing the need for trans­parency and over­sight (ACLU).

Additionally, Flock mar­kets its sur­veil­lance tech­nol­ogy to em­ploy­ers and re­tail es­tab­lish­ments, fur­ther blur­ring the lines be­tween pub­lic safety ini­tia­tives and profit-dri­ven sur­veil­lance. For ex­am­ple, ma­jor re­tail prop­erty own­ers have en­tered into agree­ments to share AI-powered sur­veil­lance feeds di­rectly with law en­force­ment, ex­pand­ing the scope of mon­i­tor­ing be­yond pub­lic spaces. (Forbes) [Mirror]

Lowe’s is a sig­nif­i­cant pri­vate client of Flock Safety, hav­ing im­ple­mented their sys­tems in nu­mer­ous lo­ca­tions to en­hance se­cu­rity and de­ter theft.

While Flock specif­i­cally does not of­fer fa­cial recog­ni­tion (today), Lowe’s has faced le­gal trou­bles over its use of fa­cial recog­ni­tion sys­tems from other ven­dors. In 2019, a class ac­tion law­suit was filed in Cook County Circuit Court, al­leg­ing that Lowe’s used fa­cial recog­ni­tion soft­ware to track cus­tomers’ move­ments with­out their con­sent, vi­o­lat­ing Illinois’ Biometric Information Privacy Act (BIPA). The law­suit claimed that Lowe’s col­lected and stored bio­met­ric data from cus­tomers and shared it with other re­tail­ers. (Security InfoWatch)

Some jus­tify these sys­tems as mak­ing us safer, but the re­al­ity is more com­pli­cated.

Flock ad­ver­tises a drop in crime, but the true cost is a cul­ture of mis­trust and pre­emp­tive sus­pi­cion. As the EFF warns, com­mu­ni­ties are be­ing sold a false promise of safety - at the ex­pense of civil rights*

(EFF).

A 2019 re­port by the NAACP Legal Defense Fund warned that pre­dic­tive polic­ing tools premised on bi­ased data will re­flect that bias, re­in­forc­ing ex­ist­ing dis­crim­i­na­tion in the crim­i­nal jus­tice sys­tem. These tools may ap­pear ob­jec­tive, but in­stead of­ten am­plify his­toric in­jus­tice un­der a ve­neer of sci­en­tific cred­i­bil­ity (NAACP LDF).

True safety comes from healthy, em­pow­ered com­mu­ni­ties; not au­to­mated sus­pi­cion. Community-led safety ini­tia­tives have demon­strated sig­nif­i­cant re­sults: North Lawndale saw a 58% de­crease in gun vi­o­lence af­ter READI Chicago be­gan im­ple­ment­ing their pro­gram there. In cities na­tion­wide, the pres­ence of lo­cal non­prof­its has been sta­tis­ti­cally linked to re­duc­tions in homi­cide, vi­o­lent crime, and prop­erty crime (Brennan Center, The DePaulia, American Sociological Association).

Zooming out, Flock is just one part of a larger move­ment to­ward ubiq­ui­tous sur­veil­lance.

Flock’s ex­pan­sion is part of a broader move­ment to­ward ubiq­ui­tous mass sur­veil­lance - where your as­so­ci­a­tions, on­line com­ments, pur­chases, move­ments, and more may be logged, in­dexed, an­a­lyzed by AI, and made eas­ily search­able by al­most any gov­ern­ment agency at any time.

This pro­gres­sion from data col­lec­tion to sur­veil­lance fol­lows a fa­mil­iar pat­tern in tech: tools sold for con­ve­nience of­ten evolve into tools of con­trol.

Bruce Schneier, a promi­nent cryp­tog­ra­pher and pri­vacy ad­vo­cate, put it sim­ply: “Surveillance is the busi­ness model of the Internet.” What be­gins as data col­lec­tion for con­ve­nience or se­cu­rity of­ten evolves into per­sis­tent mon­i­tor­ing, nor­mal­iza­tion of track­ing, and the loss of au­ton­omy.

As Edward Snowden warned: “A child born to­day will grow up with no con­cep­tion of pri­vacy at all. They’ll never know what it means to have a pri­vate mo­ment to them­selves - an un­recorded, un­an­a­lyzed thought.”

In Dunwoody, Georgia, drones are now dis­patched from Flock Safety “nests” to re­spond to 911 calls au­tonomously, of­ten ar­riv­ing in un­der 90 sec­onds (Axios).

In California, 480 high-tech cam­eras were re­cently in­stalled to sur­veil Oakland’s high­ways - track­ing li­cense plates, bumper stick­ers, and ve­hi­cle types - with alerts sent to law en­force­ment in real-time (AP News).

This sur­veil­lance in­fra­struc­ture ex­tends far be­yond law en­force­ment. The U. S. mil­i­tary has spent at least $3.5 mil­lion on a tool called “Augury” that mon­i­tors “93% of in­ter­net traf­fic,” cap­tur­ing brows­ing his­tory, email data, and sen­si­tive cook­ies from Americans - all “without in­formed con­sent.” Senator Ron Wyden has re­ceived whistle­blower com­plaints about this war­rant­less sur­veil­lance pro­gram (VICE).

Meanwhile, the cur­rent ad­min­is­tra­tion is work­ing with Palantir Technologies to cre­ate what Ron Paul calls a “big ugly data­base” - a com­pre­hen­sive col­lec­tion of all in­for­ma­tion held by fed­eral agen­cies on all U.S. cit­i­zens. This would in­clude health records, ed­u­ca­tion records, tax re­turns, firearm pur­chases, and as­so­ci­a­tions with any groups la­beled “extremist.” Palantir, funded by the CIA’s In-Q-Tel ven­ture cap­i­tal firm, is “literally the cre­ation of the sur­veil­lance state” (OC Register).

Even ba­sic tools we use daily are be­ing trans­formed into sur­veil­lance in­stru­ments. Recent court rul­ings now al­low the gov­ern­ment to or­der com­pa­nies like OpenAI to in­def­i­nitely pre­serve all ChatGPT con­ver­sa­tions. Users who thought they were hav­ing pri­vate con­ver­sa­tions - like “talking to a friend who can keep a se­cret” - dis­cov­ered this only through web fo­rums, not com­pany dis­clo­sure. The judge’s or­der en­ables what one user called a “nationwide mass sur­veil­lance pro­gram” dis­guised as a civil dis­cov­ery process (TechRadar).

This pat­tern re­peats through­out his­tory: peo­ple aban­don lib­erty for promises of safety. After 9/11, many sup­ported the PATRIOT Act. During COVID, many em­braced mask and vac­cine man­dates. After the 2008 fi­nan­cial cri­sis, many sup­ported bailouts be­cause lead­ers said they had to “abandon free-mar­ket prin­ci­ples to save the free-mar­ket sys­tem.” Today, some sup­port mass sur­veil­lance be­cause they be­lieve it will tar­get only “the right peo­ple” - but cir­cum­stances change, lead­er­ship changes, laws change.

See also:

Ars Technica: “AI Cameras to Ensure Good Behavior”,

Video: Predictive Surveillance Trends

So where is all of this head­ing? The tra­jec­tory is trou­bling.

Flock’s cam­eras cap­ture de­tailed in­for­ma­tion about the daily lives of any­one pass­ing by, with­out of­fer­ing a gen­uine opt-out mech­a­nism. Concurrently, Palantir Technologies has se­cured a $30 mil­lion con­tract with ICE, aim­ing to de­velop a sys­tem that con­sol­i­dates sen­si­tive per­sonal data such as bio­met­rics, ge­olo­ca­tion, and other per­sonal iden­ti­fiers from var­i­ous fed­eral agen­cies, fa­cil­i­tat­ing near real-time track­ing and cat­e­go­riza­tion of in­di­vid­u­als for im­mi­gra­tion en­force­ment pur­poses (Wired). It should be no sur­prise that this will also not of­fer any mean­ing­ful opt-out mech­a­nism.

The in­te­gra­tion of sur­veil­lance tech­nolo­gies such as Flock Safety’s li­cense plate read­ers and Palantir’s ImmigrationOS plat­form sig­ni­fies a shift to­ward com­pre­hen­sive mon­i­tor­ing of in­di­vid­u­als’ move­ments and be­hav­iors. It is not dif­fi­cult to imag­ine the scope of such sys­tems’ us­age grow­ing with time.

These de­vel­op­ments raise con­cerns about the ero­sion of pri­vacy and the po­ten­tial for mis­use of ag­gre­gated data. The per­va­sive na­ture of such sur­veil­lance sys­tems means that in­di­vid­u­als are mon­i­tored with­out ex­plicit con­sent, and the data col­lected can be re­pur­posed be­yond its orig­i­nal in­tent. As these tech­nolo­gies be­come more en­trenched, the line be­tween pub­lic safety and in­va­sive over­sight blurs, prompt­ing crit­i­cal dis­cus­sions about the bal­ance be­tween se­cu­rity and in­di­vid­ual free­doms.

Some of the most chill­ing val­i­da­tions of mass sur­veil­lance come not from crit­ics - but from the very peo­ple pro­mot­ing it. These aren’t out-of-con­text slips; they are open en­dorse­ments of a world where pri­vacy is side­lined in fa­vor of con­trol, com­pli­ance, and con­ve­nient en­force­ment.

“Anything tech­nol­ogy they think, ‘Oh it’s a boogey­man. It’s Big Brother watch­ing you,’ … No, Big Brother is pro­tect­ing you.”

- Eric Adams, NYC Mayor (Politico, 2022)

New York’s mayor ca­su­ally re­brands Orwell’s au­thor­i­tar­ian icon as a guardian fig­ure. It’s a star­tling re­ver­sal - not a warn­ing about over­reach, but a de­fense of it.

“Instead of be­ing re­ac­tive, we are go­ing to be proac­tive… [we] use data to pre­dict where fu­ture crimes are likely to take place and who is likely to com­mit them… then deputies would find those peo­ple and take them out.”

- Chris Nocco, Pasco County Sheriff (Tampa Bay Times, 2020)

This “Minority Report”-style pro­gram led to ha­rass­ment of in­no­cent peo­ple - and was ul­ti­mately found un­con­sti­tu­tional in court (Institute for Justice). A rare win, but a stark ex­am­ple of where unchecked sur­veil­lance can go.

“The use of net flow data by NCIS does not re­quire a war­rant.”

- Charles E. Spirtos, Navy Office of Information (VICE, 2024)

The mil­i­tary’s po­si­tion on mon­i­tor­ing Americans’ in­ter­net traf­fic with­out ju­di­cial over­sight. This state­ment came af­ter a whistle­blower com­plained about war­rant­less sur­veil­lance ac­tiv­i­ties to Senator Ron Wyden’s of­fice.

“Tech firms should not de­velop their sys­tems and ser­vices, in­clud­ing end-to-end en­cryp­tion, in ways that em­power crim­i­nals or put vul­ner­a­ble peo­ple at risk.”

- Priti Patel, UK Home Secretary UK Govt, 2019, (Infosecurity Magazine)

The logic: pro­tect­ing every­one’s pri­vacy is dan­ger­ous. This kind of fram­ing jus­ti­fies back­doors into se­cure sys­tems - which in­evitably get abused.

“The risk [of built-in weak­nesses]… is ac­cept­able be­cause we are talk­ing about con­sumer prod­ucts… and not nu­clear launch codes.”

- William Barr, U. S. Attorney General (TechCrunch, 2019)

A clear “rules for thee but not for me” men­tal­ity. Your data, mes­sages, and de­vices don’t de­serve the same pro­tec­tions as the gov­ern­men­t’s - be­cause you’re just a civil­ian.

China ex­ploited a covert sur­veil­lance in­ter­face - orig­i­nally built for law­ful ac­cess by U.S. law en­force­ment - to tap into Americans’ pri­vate phone records, mes­sages, and ge­olo­ca­tion data. (CISA)

Telecom providers are re­quired by law to build these back­doors for law en­force­ment. The “Salt Typhoon” in­ci­dent shows the risk: once a back­door ex­ists, it can be dis­cov­ered and abused - and not just by “the good guys.” (EFF, Reason)

Today, we are ex­pand­ing our spam poli­cies

to ad­dress a de­cep­tive prac­tice known as “back but­ton hi­jack­ing”, which will be­come an ex­plicit vi­o­la­tion of the “malicious prac­tices” of spam poli­cies, lead­ing to po­ten­tial spam ac­tions.

When a user clicks the “back” but­ton in the browser, they have a clear ex­pec­ta­tion: they want to re­turn to the pre­vi­ous page. Back but­ton hi­jack­ing breaks this fun­da­men­tal ex­pec­ta­tion. It oc­curs when a site in­ter­feres with a user’s browser nav­i­ga­tion and pre­vents them from us­ing their back but­ton to im­me­di­ately get back to the page they came from. Instead, users might be sent to pages they never vis­ited be­fore, be pre­sented with un­so­licited rec­om­men­da­tions or ads, or are oth­er­wise just pre­vented from nor­mally brows­ing the web.

Why are we tak­ing ac­tion?

We be­lieve that the user ex­pe­ri­ence comes first. Back but­ton hi­jack­ing in­ter­feres with the browser’s func­tion­al­ity, breaks the ex­pected user jour­ney, and re­sults in user frus­tra­tion. People re­port feel­ing ma­nip­u­lated and even­tu­ally less will­ing to visit un­fa­mil­iar sites. As we’ve stated be­fore, in­sert­ing de­cep­tive or ma­nip­u­la­tive pages into a user’s browser his­tory has al­ways been against our Google Search Essentials.

We’ve seen a rise of this type of be­hav­ior, which is why we’re des­ig­nat­ing this an ex­plicit vi­o­la­tion of our ma­li­cious prac­tices

pol­icy, which says:

Malicious prac­tices cre­ate a mis­match be­tween user ex­pec­ta­tions and the ac­tual out­come,

lead­ing to a neg­a­tive and de­cep­tive user ex­pe­ri­ence, or com­pro­mised user se­cu­rity or pri­vacy.

Pages that are en­gag­ing in back but­ton hi­jack­ing may be sub­ject to man­ual spam ac­tions

or au­to­mated de­mo­tions, which can im­pact the site’s per­for­mance in Google Search re­sults. To give site own­ers time to make any needed changes, we’re pub­lish­ing this pol­icy two months in ad­vance of en­force­ment on June 15, 2026.

What should site own­ers do?

Ensure you are not do­ing any­thing to in­ter­fere with a user’s abil­ity to nav­i­gate their browser his­tory.

If you’re cur­rently us­ing any script or tech­nique that in­serts or re­places de­cep­tive or ma­nip­u­la­tive pages into a user’s browser his­tory that pre­vents them from us­ing their back but­ton to im­me­di­ately get back to the page they came from, you are ex­pected to re­move or dis­able it.

Notably, some in­stances of back but­ton hi­jack­ing may orig­i­nate from the site’s in­cluded li­braries or ad­ver­tis­ing plat­form. We en­cour­age site own­ers to thor­oughly re­view their tech­ni­cal im­ple­men­ta­tion and re­move or dis­able any code, im­ports or any con­fig­u­ra­tions that are re­spon­si­ble for back but­ton hi­jack­ing, to en­sure a help­ful and non-de­cep­tive ex­pe­ri­ence for users.

If your site has been im­pacted by a man­ual ac­tion and you have fixed the is­sue, you can al­ways let us know by sub­mit­ting a re­con­sid­er­a­tion re­quest

in Search Console. For ques­tions or feed­back, feel free to reach out on so­cial me­dia or dis­cuss in our help com­mu­nity.

A real-world pro­duc­tion mi­gra­tion from DigitalOcean to Hetzner ded­i­cated, han­dling 248 GB of MySQL data across 30 data­bases, 34 Nginx sites, GitLab EE, Neo4j, and live mo­bile app traf­fic — with zero down­time.

Running a soft­ware com­pany in Turkey has be­come in­creas­ingly ex­pen­sive over the last few years. Skyrocketing in­fla­tion and a dra­mat­i­cally weak­en­ing Turkish Lira against the US dol­lar have turned dol­lar-de­nom­i­nated in­fra­struc­ture costs into a se­ri­ous bur­den. A bill that felt man­age­able two years ago now hits very dif­fer­ently when the ex­change rate has mul­ti­plied sev­eral times over.

Every month, we were pay­ing $1,432 to DigitalOcean for a droplet with 192GB RAM, 32 vC­PUs, 600GB SSD, two block vol­umes (1TB each), and back­ups en­abled. The server was fine — but the price-to-per­for­mance ra­tio had stopped mak­ing sense.

Then we dis­cov­ered the Hetzner AX162-R.

That’s $14,388 saved per year — for a server that’s ob­jec­tively more pow­er­ful in every di­men­sion. The de­ci­sion was easy.

I’ve been a DigitalOcean cus­tomer for nearly 8 years. They have a great prod­uct and I have no com­plaints about re­li­a­bil­ity or de­vel­oper ex­pe­ri­ence. But look­ing at those num­bers now, I can­not help feel­ing a bit sad about all the ex­tra money I left on the table over the years. If you are run­ning steady-state work­loads and not ac­tively us­ing DO’s ecosys­tem fea­tures, do your­self a fa­vor and check ded­i­cated server pric­ing be­fore your next re­newal.

* Several live mo­bile apps serv­ing hun­dreds of thou­sands of users

Old server: CentOS 7 — long past its end-of-life, but still run­ning in pro­duc­tion. New server: AlmaLinux 9.7 — a RHEL 9 com­pat­i­ble dis­tri­b­u­tion and the nat­ural suc­ces­sor to CentOS. This mi­gra­tion was also an op­por­tu­nity to fi­nally es­cape an OS that had­n’t re­ceived se­cu­rity up­dates in years.

The naive ap­proach — change DNS, restart every­thing, hope for the best — was­n’t ac­cept­able. Instead, we de­signed a proper mi­gra­tion path with six phases:

Phase 1 — Full stack in­stal­la­tion on the new server

Nginx (compiled from source with iden­ti­cal flags), PHP (via Remi repo, with the same .ini con­fig files from the old server), MySQL 8.0, Neo4J Graph DB, GitLab EE, Node.js, Supervisor, and Gearman. Every ser­vice had to be con­fig­ured to match the old server’s be­hav­ior be­fore we touched a sin­gle DNS record.

SSL cer­tifi­cates were han­dled by rsync­ing the en­tire /etc/letsencrypt/ di­rec­tory from the old server to the new one. After the mi­gra­tion was com­plete and all traf­fic was flow­ing through the new server, we force-re­newed all cer­tifi­cates in one shot:

Phase 2 — Web files cloned with rsync

The en­tire /var/www/html di­rec­tory (~65 GB, 1.5 mil­lion files) was cloned to the new server us­ing rsync over SSH with the –checksum flag for in­tegrity ver­i­fi­ca­tion. We ran a fi­nal in­cre­men­tal sync right be­fore cu­tover to catch any files changed af­ter the ini­tial clone.

Phase 3 — MySQL mas­ter to slave repli­ca­tion

Rather than tak­ing the data­base of­fline for a dump-and-re­store, we set up live repli­ca­tion. The old server be­came mas­ter, the new server a read-only slave. We used my­dumper for the ini­tial bulk load, then started repli­ca­tion from the ex­act bin­log po­si­tion recorded in the dump meta­data. This kept both data­bases in real-time sync un­til the mo­ment of cu­tover.

Phase 4 — DNS TTL re­duc­tion

We scripted the DigitalOcean DNS API to lower all A and AAAA record TTLs from 3600 to 300 sec­onds — with­out touch­ing MX or TXT records (changing mail record TTLs can cause de­liv­er­abil­ity is­sues). After wait­ing one hour for old TTLs to ex­pire glob­ally, we were ready to cut over in un­der 5 min­utes.

Phase 5 — Old server ng­inx con­verted to re­verse proxy

We wrote a Python script that parsed every server {} block across all 34 Nginx site con­figs, backed up the orig­i­nals, and re­placed them with proxy con­fig­u­ra­tions point­ing to the new server. This meant that dur­ing DNS prop­a­ga­tion, any re­quest still hit­ting the old IP was silently for­warded. No user would see a dis­rup­tion.

Phase 6 — DNS cu­tover and de­com­mis­sion

A sin­gle Python script hit the DigitalOcean API and flipped all A records to the new server IP in sec­onds. The old server re­mained as a cold standby for one week, then was shut down.

The key in­sight: at no point did we have a win­dow where the ser­vice was un­avail­able. Traffic was al­ways be­ing served — ei­ther di­rectly or through the proxy.

This was the most com­plex part of the en­tire op­er­a­tion.

We used my­dumper in­stead of the stan­dard mysql­dump — and it made an enor­mous dif­fer­ence. By lever­ag­ing the new server’s 48 CPU cores for par­al­lel ex­port and im­port, what would have taken days with a tra­di­tional sin­gle-threaded mysql­dump was com­pleted in hours. If you’re mi­grat­ing a large MySQL data­base and you’re not us­ing my­dumper/​my­loader, you’re do­ing it the hard way.

The main dump’s meta­data file recorded the bin­log po­si­tion at the time of the snap­shot:

File: mysql-bin.000004

Position: 21834307

This would be our repli­ca­tion start­ing point.

Once the dump was com­plete, we trans­ferred it to the new server us­ing rsync over SSH. With 248 GB of com­pressed chunks, this was sig­nif­i­cantly faster than any other trans­fer method:

The –compress flag in my­dumper paid off here — com­pressed chunks trans­ferred much faster over the wire.

Being stuck on CentOS 7 meant we were also stuck on MySQL 5.7 — an out­dated ver­sion that had been run­ning in pro­duc­tion for years. Before the mi­gra­tion, we ran mysqlcheck –check-upgrade to ver­ify that our data was com­pat­i­ble with MySQL 8.0. It came back clean, so we in­stalled the lat­est MySQL 8.0 Community on the new server. The per­for­mance im­prove­ment across all our pro­jects was im­me­di­ately no­tice­able — query ex­e­cu­tion times dropped sig­nif­i­cantly thanks to MySQL 8.0’s im­proved op­ti­mizer and InnoDB en­hance­ments.

That said, the ver­sion jump did in­tro­duce one tricky prob­lem.

After im­port, the mysql.user table had the wrong col­umn struc­ture — 45 columns in­stead of the ex­pected 51. This caused mysql.in­fos­chema to be miss­ing, break­ing user au­then­ti­ca­tion.

But this failed the first time with:

ERROR: ‘sys.innodb_buffer_stats_by_schema’ is not VIEW

The sys schema had been im­ported as reg­u­lar ta­bles in­stead of views. Solution:

With both dumps im­ported, we con­fig­ured the new server as a replica of the old one:

Almost im­me­di­ately, repli­ca­tion stopped with er­ror 1062 (Duplicate Key). This hap­pened be­cause our dump was taken in two passes — dur­ing the gap be­tween them, rows were writ­ten to cer­tain ta­bles, and now both the im­ported dump and the bin­log re­play were try­ing to in­sert the same rows.

IDEMPOTENT mode silently skips du­pli­cate key and miss­ing row er­rors. All crit­i­cal data­bases synced with­out a sin­gle er­ror. Within a few min­utes, Seconds_Behind_Master dropped to 0.

Before touch­ing a sin­gle DNS record, we needed to ver­ify that all ser­vices were work­ing cor­rectly on the new server. The trick: we tem­porar­ily edited the /etc/hosts file on our lo­cal ma­chine to point our do­main names to the new server’s IP.

# /etc/hosts (local ma­chine)

NEW_SERVER_IP your­do­main1.com

NEW_SERVER_IP your­do­main2.com

# … and so on for all your do­mains

With this in place, our browsers and Postman would hit the new server while the rest of the world was still go­ing to the old one. We ran through our API end­points, checked ad­min pan­els, and ver­i­fied that every ser­vice was re­spond­ing cor­rectly. Only af­ter this con­fir­ma­tion did we pro­ceed with the cu­tover.

Once mas­ter-slave repli­ca­tion was fully syn­chro­nized, we no­ticed that INSERT state­ments were suc­ceed­ing on the new server when they should­n’t have been — read­_only = 1 was set, but writes were go­ing through.

The rea­son: all PHP ap­pli­ca­tion users had been granted SUPER priv­i­lege. In MySQL, SUPER by­passes read­_only.

We re­voked it from all 24 ap­pli­ca­tion users:

After this, read­_only = 1 cor­rectly blocked all writes from ap­pli­ca­tion users while al­low­ing repli­ca­tion to con­tinue.

All do­mains were man­aged through DigitalOcean DNS (with name­servers pointed from GoDaddy). We scripted the TTL re­duc­tion against the DigitalOcean API, only touch­ing A and AAAA records — not MX or TXT records, since chang­ing mail record TTLs can cause de­liv­er­abil­ity is­sues with Google Workspace.

After wait­ing one hour for old TTLs to ex­pire, we were ready.

Rather than edit­ing 34 con­fig files by hand, we wrote a Python script that parsed every server {} block in every con­fig file, iden­ti­fied the main con­tent blocks, re­placed them with proxy con­figs, and backed up orig­i­nals as .backup files.

The key: prox­y_ss­l_ver­ify off — the new server’s SSL cert is valid for the do­main, not for the IP ad­dress. Disabling ver­i­fi­ca­tion here is fine be­cause we con­trol both ends.

With repli­ca­tion at Seconds_Behind_Master: 0 and the re­verse proxy ready, we ex­e­cuted the cu­tover in or­der:

1. New server: STOP SLAVE;

2. New server: SET GLOBAL read­_only = 0;

3. New server: RESET SLAVE ALL;

4. New server: su­per­vi­sor­ctl start all

5. Old server: ng­inx -t && sys­tem­ctl re­load ng­inx (proxy goes live)

6. Old server: su­per­vi­sor­ctl stop all

7. Mac: python3 do_­cu­tover.py (DNS: all A records to new server IP)

8. Wait: ~5 min­utes for prop­a­ga­tion

9. Old server: com­ment out all crontab en­tries

The DNS cu­tover script hit the DigitalOcean API and changed every A record to the new server IP — in about 10 sec­onds.

After mi­gra­tion, we dis­cov­ered many GitLab pro­ject web­hooks were still point­ing to the old server IP. We wrote a script to scan all pro­jects via the GitLab API and up­date them in bulk.

We went from $1,432/month down to $233/month — sav­ing $14,388 per year. And we ended up with a more pow­er­ful ma­chine:

The en­tire mi­gra­tion took roughly 24 hours. No users were af­fected.

MySQL repli­ca­tion is your best friend for zero-down­time mi­gra­tions. Set it up early, let it catch up, then cut over with con­fi­dence.

Check your MySQL user priv­i­leges be­fore mi­gra­tion. SUPER priv­i­lege by­passes read­_only — if your app users have it, your slave en­vi­ron­ment is­n’t ac­tu­ally read-only.

Script every­thing. DNS up­dates, ng­inx con­fig rewrites, web­hook up­dates — do­ing these by hand across 34+ sites would have taken hours and in­tro­duced er­rors.

my­dumper + my­loader dra­mat­i­cally out­per­forms mysql­dump for large datasets. Parallel dump/​re­store with 32 threads cut what would have been days of work down to hours.

Cloud providers are ex­pen­sive for steady-state work­loads. If you’re not us­ing au­toscal­ing or ephemeral in­fra­struc­ture, a ded­i­cated server of­ten de­liv­ers bet­ter per­for­mance at a frac­tion of the cost.

All Python scripts used in this mi­gra­tion are open-sourced and avail­able on GitHub:

* do_list_­do­main­s_ttl.py — List all DigitalOcean do­mains with their A records, IPs, and TTLs

* do_­to_het­zn­er_bulk_dns_record­s_im­port.py — Migrate all DNS zones from DigitalOcean to Hetzner DNS

* do_­cu­tover_­to_new_ip.py — Flip all A records from old server IP to new server IP

* mysql_­com­pare.py — Compare row counts across all ta­bles on two MySQL servers

* fi­nal_git­lab_web­hook_up­date.py — Update all GitLab pro­ject web­hooks to the new server IP

All scripts sup­port a DRY_RUN = True mode so you can safely pre­view changes be­fore ap­ply­ing them.