The _really_ fun bucket squatting attacks are when the cloud providers themselves use deterministic names for "scratch space" buckets. There was a good DC talk about it at DC32 for AWS, although actual squatting was tough because there was a hash they researchers couldn't reverse (but was consistent for a given account?): https://www.youtube.com/watch?v=m9QVfYVJ7R8
Mountain View recently turned off their Flock installs after they discovered Flock had enabled data sharing without notice and other agencies were searching through MV data.
https://www.malwarebytes.com/blog/privacy/2026/02/flock-came...
> A separate “statewide lookup” feature had also been active on 29 of the city’s 30 cameras since the initial installation, running for 17 straight months until Mountain View found and disabled it on January 5. Through that tool, more than 250 agencies that had never signed any data agreement with Mountain View ran an estimated 600,000 searches over a single year, according to local paper the Mountain View Voice, which first uncovered the issue after filing a public records request.
A different town (Staunton, VA) also turned of their Flock installs after their CEO sent out an email claming:
https://www.aclu.org/news/privacy-technology/flock-ceo-goes-...
> The attacks aren't new. You've been dealing with this for forever, and we've been dealing with this since our founding, from the same activist groups who want to defund the police, weaken public safety, and normalize lawlessness. Now, they're producing YouTube videos with misleading headlines.
If you don't remember, Daniel Penny is the ex-Marine that killed a homeless man on the NYC subway then was found not guilty of criminally negligent homicide.