The U.S. Postal Service used social media surveillance to monitor and report on protests across the political spectrum, government records show.

The records, disclosed to EFF and other requesters suing the postal service under the Freedom of Information Act, show that the agency’s internet Covert Operations Program, or iCOP, routinely sifted through social media posts organizing and discussing protests with little records of any oversight or legal justification.

EFF filed suit in 2021 after Yahoo News disclosed the program’s existence and how the agency used it to monitor First Amendment protected activities. After years of delays and technical failures that led the agency to lose access to a trove of emails discussing the program, the postal service disclosed records to EFF and several other requesters this year.

The Postal Service used iCOP to surveil First Amendment activities

The disclosures include a series of bulletins created from iCOP, which show that the postal service used the program in 2020 and 2021 to monitor and circulate information about a wide range of planned protests. They included a planned “Million MAGA March,” a guns rights advocacy event and counter-protest in Virginia, a nationwide Save the Post Office Saturday protest, and planned protests in front of then-Postmaster General Louis DeJoy’s home in Washington, D.C.

Many of the bulletins provide dry descriptions of the events being planned and reference public discussions or events on major social media services. Others seem to imply or anticipate that the protests would turn violent.

For example, in discussing planned national and international protests scheduled for March 20, 2021, the bulletin references potential violence in light of “online inflammatory material.” Yet the bulletin acknowledges that the agency has “no intelligence to suggest specific threats.” This bulletin was described by Yahoo News when it disclosed iCOP’s existence.

Another bulletin discussing an ongoing Black Lives Matter protests in response to police shooting and killing people styles itself as a “National Civil Unrest Update.” The bulletins also recount and monitor threats sent to then-Postmaster DeJoy.

The Postal Service also disclosed three email chains to EFF that, while heavily redacted, show how the agency queried iCOP and disseminated what it found (Read the emails here, here, and here). The government agreed to release the email messages as part of settling EFF’s FOIA suit this fall. To EFF’s knowledge, they are the only existing materials that reflect how the agency queried iCOP.

Postal Service renames iCOP and loses access to records about it

According to the agency, after Yahoo News disclosed the program in 2021, the postal service renamed it and publicly said that it had stopped issuing bulletins. But the documents do not say that the agency’s social media surveillance stopped.

At the same time, EFF and several other FOIA requesters sought records detailing how the agency used iCOP and what rules the postal service had for using the program and distributing information it gained from surveilling social media. EFF spent years pushing the agency to disclose email communications about the program, which the agency had stored on an external hard drive. Amid these negotiations, someone dropped the hard drive, rendering it inoperable, agency officials said. By the time that happened, the agency had already deleted the underlying email messages pursuant to the agency’s retention schedule.

Minimal records disclosed about internal limits on surveillance programs

EFF’s FOIA request sought internal rules, guidance, and training that would show what safeguard the Postal Service imposed to protect First Amendment rights. The agency disclosed very few documents in response to this part of EFF’s request.

For example, a series of slides give an overview of the program, but do not explain how officials used iCOP. The closest thing to internal guideline that the agency disclosed were talking points the Chief Postal Inspector authored in response to questions about iCOP.

The inspector wrote that, “In reviewing social media postings to gather information we did not single out any particular group and did not base what was reviewed on race, religion, gender, sexual orientation, immigration status, or a person’s exercise of First Amendment freedoms.” The statement echoes language in the bulletin stating that its purpose is not to infringe on First Amendment rights; Other parts of the talking points characterize the surveillance as providing officials with situational awareness.

The postal inspector’s talking points go on to say that “the recent attention on iCOP has highlighted opportunities for improvement, including enhanced executive oversight. We have stopped the distribution of the bulletins like the one you have seen in the media reports.”

Setting aside that it’s unclear whether internal oversight occurred or resulted in any changes, the claim that iCOP did not infringe on First Amendment rights rings hollow. As the records disclosed show, surveilling and reporting on social media users’ efforts to organize rallies and protests was a feature of iCOP.

But more fundamentally, the claims by Postal Service officials fail to recognize that surveillance directly chills First Amendment rights. Further, the government can misuse the information it obtained as part of its social media surveillance to harass or retaliate against those exercising their constitutional rights.

Although EFF’s case seeking records about iCOP has ended, we will continue to bring more transparency to the government’s use of social media surveillance and look for ways to challenge the practice, especially when people are caught in the dragnet for exercising the First Amendment rights.

Related Cases: EFF v. USPS - Social media monitoring (iCOP)

The government’s surveillance powers grew rapidly after Sept. 11, 2001, some in public view and some in secret. EFF suspected but couldn’t prove that the National Security Agency was spying on Americans' communications. The New York Times sat on a story about it for over a year, finally publishing it in December 2005. Then, in January 2006, a retired AT&T technician named Mark Klein walked into EFF's office with a manila folder of documents that blew the story wide open. 

Welcome to the third episode of “Privacy’s Defenders,” a podcast about the people – lawyers, journalists, hackers, and others – who’ve fought to secure your digital liberties since before most people even knew what the internet was.

%3Ciframe%20height%3D%2252px%22%20width%3D%22100%25%22%20frameborder%3D%22no%22%20scrolling%3D%22no%22%20seamless%3D%22%22%20src%3D%22https%3A%2F%2Fplayer.simplecast.com%2Fe7dd937c-3319-4a9a-9245-f9ed34b9419d%3Fdark%3Dtrue%26amp%3Bcolor%3D000000%22%20allow%3D%22autoplay%22%3E%3C%2Fiframe%3E Privacy info. This embed will serve content from simplecast.com

   

(You can also find this episode on YouTube.)

In this episode, former EFF Executive Director Cindy Cohn talks with former EFF lawyer Kevin Bankston, who was at his desk drafting a lawsuit against AT&T when Klein showed up. Less than two weeks later, EFF sued the phone company on behalf of its own customers in Hepting v. AT&T. Cindy speaks again with now-retired Justice Department lawyer Tony Coppolino, who asked for the opportunity to defend the case. He called EFF with a warning after Klein’s documents were filed in court: If they were classified, EFF would be in big trouble. You’ll also hear from Klein himself, and from Carolyn Jewel, a romance novelist and AT&T customer who became the lead plaintiff in EFF's related case against the NSA. 

It's the story of a secret room in a San Francisco phone company building, a heroic whistleblower, and the people who refused to let mass surveillance stay hidden. 

The “Privacy’s Defenders” podcast is a follow-up to Cindy’s book, “Privacy’s Defender: My Thirty-Year Fight Against Digital Surveillance,” bringing to life pivotal moments in the voices of those who fought for your rights. Sales of “Privacy’s Defender” benefit EFF, so pick up your copy today!  

Joanne Elgart Jennings co-produced and created this podcast.   

Jarrod Sport co-produced, mixed, and mastered it.   

Corinne Ruff is our story editor. 

We had additional help from Rachel Estabrook and Alison Broverman. 

The original music was composed and performed by Nat Keefe of Hot Buttered Rum with Ben Andrews on the fiddle. 

On November 11, Lina Attalah, founder and editor-in-chief of the independent Egyptian news outlet Mada Masr, will face trial for the second time in just two weeks. This time, she faces charges of spreading false news, an accusation that has become one of the Egyptian government's most frequently used tools for prosecuting journalists. 

The trial follows a conviction on October 27, when Attalah was found guilty of managing an unlicensed news website. The Mada Masr team had repeatedly applied for a license, but their attempts went unacknowledged. The proceedings took place in a single hearing, which Mada Masr states included serious violations of her right to a fair trial. She was sentenced to the maximum fine of 3 million Egyptian pounds (approximately 55,000 USD), forcibly removed from the courtroom, and held for seven hours until the fine was paid. The court also ordered Mada Masr's closure and the confiscation of all equipment belonging to the organization. 

The current wave of repression has also targeted Matsada2sh, a fact-checking and open-source intelligence initiative. Its entire six-person newsroom was violently arrested, illegally detained, and interrogated under torture before being charged with terrorism-related offenses and spreading false news. The team remains in pretrial detention. 

According to CPJ, at least 25 other journalists are currently incarcerated in Egypt. 

Governments seeking to control the flow of information increasingly rely on a combination of legal harassment, financial pressure, criminal prosecution, and restrictions on the infrastructure that makes independent publishing possible. Egypt's media licensing regime is a particularly troubling example. Requiring news organizations to obtain government authorization to operate creates an obvious mechanism for restricting who gets to publish and whose voices are allowed to reach the public.  

The charge of spreading false news is similarly dangerous. Governments around the world have increasingly invoked the language of misinformation to justify restrictions on speech, often without meaningful safeguards against political abuse, as we laid out in our recent submission to the United Nations Office of the High Commissioner for Human Rights. Governments should never be the arbiters of which reporting is permissible, particularly when that reporting concerns their own conduct. 

Why Mada Masr matters 

Founded in 2013, Mada Masr has spent more than a decade doing the kind of journalism that authoritarian governments find most threatening: documenting abuses, amplifying marginalized voices, and reporting on issues that powerful institutions would prefer remain hidden. 

Its reporting has given torture survivors and the families of political prisoners a platform. It has opened space for debate about reproductive rights. It has brought frontline reporting from Sudan and Gaza, and stood alongside refugees facing xenophobic attacks and security crackdowns. 

Emerging as a digital-first publication, in a media environment where traditional outlets were increasingly constrained, being purely digital allowed Mada Masr’s founders to build an independent publication outside the structures of legacy media.  

At a time when only 43% of Egyptians had access to the internet, going fully digital meant taking a big risk, but it was one that has been rewarding: Despite being blocked by the Egyptian government since 2017, Mada Masr has continued to reach Egyptian and global audiences, and Attalah has received numerous accolades, including the Knight International Journalism Award, the Ordre des Arts et des Lettres, and a spot in TIME Magazine’s 100 most influential people (2020). 

Mada Masr has also consistently engaged with technology and advocated for a free and independent internet for the global majority. It has covered dozens of hot-button tech stories in recent years, from Egypt’s Cybercrime Bill and Israel’s use of AI weaponry in Gaza, to stories about the “privacy chaos” caused by biometrics to more personal essays about the importance of the internet and tech. In August, they launched an open call for proposals on original critical reporting on artificial intelligence. 

Mada Masr may be thoroughly Egyptian, but it doesn’t belong just to Egypt. Its team has made into a publication that represents the kind of independent, local, grounded journalism that international audiences need, particularly at a time when international reporting on state repression is lacking. They built on-the-ground networks to center local voices in Sudan (publishing in both English and Arabic on the conflict) and Gaza out of a sense of cross-border responsibility and solidarity. 

This is precisely why its potential closure should concern everyone who cares about a free press. The ability to publish independently, investigate powerful institutions, and to share information without government interference is fundamental to the exercise of free expression.  

From solidarity to action 

The international community has repeatedly expressed concern about restrictions on press and internet freedom in Egypt. More than 100 organizations have now joined statements of solidarity with Mada Masr, and with Matsada2sh.  

These expressions of support matter, particularly when journalists are increasingly isolated and under threat—but solidarity must also translate into sustained political and institutional pressure. 

The international governments and institutions that maintain relationships with Egypt—including those in the European Union, the United Kingdom, and the United States—should make clear that the prosecution of journalists and the forced closure of independent media outlets are unacceptable.  

The cases against Lina Attalah, Mada Masr, and Matsada2sh must be dropped. The journalists who remain in detention must be released. And Egypt's licensing regime, with its profound chilling effects on access to information and independent knowledge production, must be brought to an end. 

There is a particular urgency to defending independent media at a moment when governments are finding ever more ways to restrict the circulation of information. Whether through internet shutdowns, platform restrictions, surveillance, or the criminalization of reporting, the result is often the same: fewer opportunities for people to understand what is happening around them, to challenge official narratives, and to hold power accountable. 

We cannot allow the closure of one of Egypt's most important independent newsrooms and the prosecution of its editor-in-chief to become another routine episode in the global erosion of press freedom. Nor should we wait until the last independent journalists have been silenced before recognizing what has been lost. 

To learn more about Lina Attalah in her own reads, you can read our Speaking Freely interview from January 2026. 

  

In courts across the country, publishers and creators are suing large AI companies for training generative AI models on copyrighted works. It’s easy to see these cases as a David-and-Goliath showdown between authors and publishers fighting for a cut of Big Tech company profits. But this fight is actually much larger. It affects billions of people who aren’t represented in the case at all, including researchers, artists, activists, journalists, people with disabilities, and anyone who accesses and shares content online.   

That’s why EFF is stepping in to defend the public’s rights in these cases. Today, EFF filed an amicus brief in In re OpenAI, explaining how the court’s ruling on fair use could impact people worldwide. If fair use gets narrowed, it will impede work that benefits the public, like medical research and investigative journalism, and even limit access to privacy protection tools.

Let’s be clear: creators and workers deserve support as AI changes their fields, and Big Tech companies must be held accountable for the harms they cause. But giving copyright holders more control over the web won’t accomplish either of these goals. If the plaintiffs prevail in these cases, courts would have to rewrite copyright law in ways that hurt everyone except powerful media and tech companies.

Rewriting Fair Use Makes Everyone Worse Off

Copyright exists for one reason: to stimulate creativity and innovation in service of the greater public good. Unfortunately, the plaintiffs in this lawsuit are arguing to limit everyone’s fair use rights, in ways that would thwart the basic purpose of copyright. The harms of shrinking fair use will go far beyond generative AI, impacting everyone.

Initial speculation that AI models would be infringement machines, churning out works highly similar to those on which they were trained, has proven unfounded. And courts have already found fair use in cases where copyrighted works were used to train generative AI models, recognizing that training uses those works for a fundamentally different purpose.

Plaintiffs in these cases argue that, even if the use is transformative, using their works to train AI is still unfair, because the AI models could generate new, non-infringing works that might compete with plaintiffs’ own works. They also argue that scraping or downloading the data without permission—or in some cases, from websites containing infringing copies—was independently infringing and/or rendered any subsequent uses of that data unfair.

These arguments would put beneficial research and reporting at risk. First, if copying without permission rules out fair use, the law will never protect transformative uses that benefit us all. Researchers, journalists, and other watchdog groups gather information the same way AI companies do—but they do it to serve the public interest, and often to hold Big Tech itself accountable. For example, journalists and nonprofit researchers have used “crawling” or “scraping” to investigate potentially anticompetitive practices by tech companies, and research misinformation and hateful content posted on X. Their data acquisition techniques are virtually identical to those used by AI giants—but they lack those companies’ deep pockets.

Requiring users to show that copyrighted material was lawfully obtained would also threaten everyday internet use. As EFF’s brief explained, that requirement would “cast legal doubt on the billions of copies we collectively make every day through routine online activities like opening emails, clicking on an embedded link, visiting websites, sharing pictures, streaming music, and watching videos. All of this activity requires intermediate copying.”

Fair use is what lets us all use the internet without being compelled to track the source of every image, video, and article that we click on, and make sure the rights are all cleared.

Additionally, while rightsholders are understandably concerned about competition from AI generated works, copyright law exists to promote new creation, not protect authors who published first. Under the plaintiffs’ theory, no one could stand upon the shoulders of giants. Copyright could prevent people from writing new books inspired by themes in a favorite novel or genre, or prevent academic researchers from publishing literature reviews that distill insights from prior research—simply because readers might prefer those new publications over those that came first.

Finally, general-purpose AI models are neither designed nor usually used to create works targeted at any particular market. These models have been used to generate new insights and tools for medicine, science, journalism, art, and accessibility. For instance, an AI-powered tool called Be My AI uses Open AI’s GPT models to provide visual descriptions for people who are blind or have low vision. Generative tools have also accelerated scientific research, and researchers have used these tools to develop new medical treatments and medications for conditions previously thought to be incurable.

Mandatory Licensing Would Entrench Big Tech

Some creators and publishers argue that AI developers should just get a license. But requiring permission for every work used would give the largest companies massive advantages over small competitors and impede academic research. As Professor Lawrence Lessig recently noted:

If all training requires a license, then none but a handful of tech giants will be able to afford the costs of training. That’s not because authors are greedy but because the copyright system is the least efficient property system known to man.

Moreover, creators are unlikely to benefit from these licensing arrangements in many cases. Media and entertainment giants have exploited the imbalance between themselves and underpaid working artists for decades. Trying to help creators by giving them more rights under copyright is, as Cory Doctorow has written, like trying to help a bullied kid by giving them more lunch money for the bully to take. Artists aren’t getting good deals from record labels or publishers now; there’s no reason to think these companies, which already own the copyrights, will treat artists more fairly once they control the data that powers AI.

The Future of AI Is Too Important to Leave to Big Content or Big Tech

AI technologies will affect all of us, and copyright law is ill-equipped to address many of these consequences. The rules governing these technologies should be rules that serve the public—not just the small number of companies that can afford to litigate copyright battles for decades, or settle for billions.

Developers of virtual private network (VPN) apps are reporting that their products are again being pulled from Apple’s App Store in Russia. This is an unacceptable crackdown on a vital tool to protect privacy and speech online.

Why? VPNs give people a way to control their own online activities. When you visit a website through a VPN, that website only sees the VPN server's location (well, IP address) rather than your actual location. It's like sending a letter through a P.O. box so the recipient doesn't know where you really live. It can also disguise where you’re accessing information from, which can make it possible to access information banned by your government.

This is an unacceptable crackdown on a vital tool to protect privacy and speech online.

Going after tools that give people the space to communicate and access information freely is a common tactic from the totalitarian playbook. This latest demand comes after several steps the Russian government’s taken to surveil speech specifically on Apple products. In 2024, the Moscow Times reported that Russia’s state media watchdog, Roskomnadzor, went after VPN apps on the Apple App Store, after banning access to Western social media platforms and blacklisting opposition media sites. Russia then blocked Apple’s FaceTime software in 2025, according to Apple Insider.

Bloomberg also recently reported that the Russian government has added Apple and Microsoft to its state surveillance registry. This gives Roskomnadzor access to local users’ correspondence, Apple Insider reported, and puts both companies in a position to turn over customer information to the country’s security services as required.

With government control encroaching on their devices and less access to tools that give them alternate methods, people in Russia are left with shrinking options to communicate online or find information that isn’t state-sanctioned.

While Russia’s actions offer a more extreme vision of what happens when the government tries to enforce speech rules by attacking vital privacy tools, it is far from the only government doing so. Several states in the U.S., bent on making it difficult to circumvent invasive age-gating laws, have suggested banning VPNs—either to access certain content or in some cases to simply ban them outright. EFF has publicly (and loudly) criticized these proposals, because going after VPNs is a dangerous step down the road of censorship.

Attacks on speech and privacy online are deeply troubling, no matter where they happen. What those in power may see as a “loophole” in their invasive laws is actually an expression of user control. We’ll continue to speak out when we see governments going after them to take that control away.

In today’s digital world, the internet is an essential resource for young people to access information, explore community, and find themselves. But we know that this often comes alongside fears of experiencing online harms like doxxing, grooming, or bullying.

Trying to protect your family from everything all the time is impractical and exhausting, but some thoughtful planning can help families devise a workable plan that meets their needs and addresses their concerns.

That’s why this Digital Parent Week, we’re sharing easy tips on how parents and their children can work together to co-curate a digital safety plan that helps all members of the family enjoy the benefits of technology while protecting their online privacy and safety. 

Start with Open Conversations

Online safety begins with communication, not just restrictions. Talk with a young person about how they use the internet: their favourite apps, games, and social media platforms for example. Creating a supportive environment helps young people feel comfortable asking for help if something goes wrong online.

Together, you can think about:

1. What do we want to protect? e.g., I want to protect a young person’s privacy and mental health when they’re playing Roblox. They love Roblox and use it to communicate and hang out with their best friend, so we’d like to find a way to make it as safe as possible.
2. Who do we want to protect it from? e.g., messages from strangers, staying up too late playing, wasting money on pointless digital junk in games.
3. How bad are the consequences if we fail? e.g, losing some money on a scam or having creepy conversations with strangers that could escalate into something more nefarious or dangerous.
4. How likely is it that we will need to protect it? e.g., I don’t know the likelihood of a stranger messaging you on Roblox because I’m not sure how communication works on the platform, but I’ve heard from their friends that strangers message them all the time in some games.
5. How much trouble are we willing to go through to try to prevent potential consequences? e.g., I’m willing to learn from my child how the game works, play the game with my child, and learn how to work the parental controls. 
6. Who are our allies? e.g., my partner, our parents, as well as a young person’s best friends and their parents.

It's easy to think of a young person's experience on the internet as being totally disconnected and different from your own. But now is a great time to also interrogate your own internet habits, like the sorts of sites you engage with, tools you use, and privacy settings you've set. These questions are as valuable to help you as a parent as they are just an internet user.

Sometimes even just figuring out what conversations are worth having can take some effort, we've put together some ideas to get you started in our guide.

Make Privacy a Family Priority

Digital security training can feel overwhelming but this is why a community-oriented approach helps. In speaking with your family and friends, you can build out digital security practices that work for you. This makes it more likely that your privacy practices will become second nature to you and your loved ones.

Use secure messaging services for every communication: Choosing a secure service ensures that your privacy is protected from government and corporate surveillance. If you can convince your family to get on board, options like Signal provide the most extensive privacy protections out of the box through its use of end-to-end encryption and limited data collection. But we understand that sometimes it's easier to stick with whatever the family already uses for a group chat, like WhatsApp, Apple's iMessage, or Google Messages, so take the time to familiarize yourself with the limits of WhatsApp and RCS encryption.

Consider the content posted online: It's easy to accidentally share personal information through photos, messages, and other content. Children and adults may unknowingly share personal information through photos, messages, location settings and app permissions. Take time together to review privacy settings, check which apps can access the camera or location, and discuss why personal details should be shared carefully. Make sure you have family agreement about when and where to post photos of each other or your home.

Create incident response plans: Developing a plan for if or when something bad happens is a good practice for anyone, but especially with younger people. It’s important to strategize with your family around what to do in the event of such things happening, and doing so before an incident occurs is much easier than when you’re presently facing a crisis.

Alongside this, simple steps like using strong and unique passwords on all devices, including those that are shared in the family, can make a real difference. Regardless of age, there’s no time like the present to get started on good security hygiene, and for many that starts with a password manager and two-factor authentication.

How to Think About Parental Controls

Many sites permit parents to control features such as personalization, algorithmic feed, autoplay, endless scroll, reactions, notifications, and time limits. Talk as a family about which features are important and useful and which are problematic. The conversations above around boundaries and digital literacy are a more effective way to prepare youth for accessing the internet. To develop true autonomy, young people need the privacy to discover the world for themselves without their parents monitoring the contents of every conversation they have.

Explore new apps together and revisit family rules as they grow. These decision points where you’re exploring with a young person what you’re both comfortable with can be good moments to “find your way to a yes” for whatever feature or tool or game they’re asking about. The questions they ask, along with your responses, provide a road map for what to look for in privacy controls that can get you to a place where everyone is comfortable engaging with that technology. 

Small Steps = Big Difference

There is no one size fits all to the tech questions and concerns a parent will face, and keeping young people safe online is not about removing every risk and monitoring every click. This Digital Parenting Week, you can start to focus on what’s important for your family and how to best achieve those goals. 

If you're still not sure where to start, installing EFF’s Privacy Badger on every computer in your household is a great starting point to protecting everyone's privacy.

For more detailed information on all these tips and more, visit EFF’s Online Privacy Guide for Parents and Youth.

In the most recent update to Apple’s devices, iOS 27.2, the company has introduced a new setting to “Exclude Apps” from Siri AI, fulfilling one of our asks from our Encrypt It Already campaign earlier this year.

One of our main concerns with new AI features on devices is how those features interact with end-to-end encrypted content, particularly with secure messaging apps. Many AI features require cloud processing, and despite privacy protections engineered into these systems, the content of secure messaging apps may leave a user’s device without their knowledge. That changes the privacy concerns around using those tools. In a perfect world, users would be able to put a barrier up to ensure data from certain apps doesn’t leave the device. Here was our initial ask:

You should be able to tell the operating system’s AI to not access an app, even if that comes at the “cost” of missing out on some features. The setting should be straightforward and easy to understand in ways the Gemini and Apple Intelligence controls currently are not.

At launch, we found the settings to control Siri AI’s app access behavior pretty confusing. You had to toggle several options to block Siri AI off from accessing an app, or disable Siri AI entirely. Turning off Siri AI and reverting to Siri Classic is, for now, still a good option if you’d prefer to use the older version.

The most recent update is far more clear and does more to protect your data. And, just as expected, it comes at the cost of some features. That’s a good thing, actually. The features not working shows that the new setting is effective. 

Here’s how to add apps to the exclusion list, once you’ve updated to 27.2:

• Open Settings > Siri > Excluded Apps
• Tap “Add Apps” and select any apps you’d like to add to the exclusion list

Now Siri AI cannot access the contents of the app. Excluding an app also means you may lose some features. For example, if you exclude the Apple Messages app, you will no longer be able to have Siri AI read or respond to messages for you. Even the “onscreen awareness” feature, where you invoke Siri and ask it for information about what you’re currently looking at, will not work anymore. For example, if you exclude Signal, you cannot invoke Siri and ask it to discern any information in the Signal app. You’ll just get these messages:

What’s the State of This on Android?

This update from Apple is also a good excuse to check in on the process on Android. It has improved a little, but is not as straightforward as Apple’s new settings, and lacks the ability to set the screen context feature per-app. But you do have some control over what Gemini can access: 

• Open up the Gemini app
• Tap your user photo, then Settings > Personal Intelligence > Connected Apps
• Revoke access to any apps you do not want Gemini to have access to

This process seems to work well enough for some data and we like that it’s opt in, but it’s not exactly intuitive. For example, Signal doesn’t appear there because Signal doesn’t support Gemini’s app access feature at all. That means Gemini can’t access the content of Signal directly, which is good. 

But Gemini can read notifications if you’ve enabled the “Device Assistance” Connected App (which you likely have, since that also enables basic features, like setting a timer—check under Settings > Personal Intelligence > Connected Apps), and it can use screen context unless you’ve disabled the Device controls > Screen context > “Use screen and app data” option in the Gemini Settings. These two features may access the contents of the Signal app or notifications, if you choose to use them. We’d prefer a more hard-lined approach that reduces the chances of user error here: Google should give users the ability to turn these features off per app.

Apple clearly understands that some users want stronger controls over what Siri AI can and cannot access. But we think they should go further and offer the option to only use “on device” AI features, similar to what Samsung offered with its Galaxy AI. We’re happy to see this change and think all operating systems need to consider similar controls moving forward.

A federal appeals court should curb the government’s abuse of grand jury subpoenas to unmask social media users who criticize lawless immigration enforcement.

That is the message from the ACLU, EFF, and other civil liberties and trade groups who filed a friend-of-the-court brief in a sealed case in the U.S. Court of Appeals for the District of Columbia.

The case involves the government’s investigation of an anonymous Reddit user who commented on a post about an immigration officer in Minnesota. The Department of Homeland Security (DHS) first issued an administrative subpoena to Reddit to unmask the user. When the user challenged the subpoena in court on free speech and statutory grounds (as many others have), DHS withdrew it. But then the government obtained a separate grand jury subpoena—a subpoena issued by a prosecutor to gather evidence to present to a grand jury before any criminal charges are filed—for much of the same information. The user then challenged the grand jury subpoena too, and the case is currently being appealed.

The right to speak anonymously is essential. It preserves privacy and shields critics from government retaliation. In the past year, the Department of Justice (DOJ) has issued grand jury subpoenas to social media companies for their users’ personal data. This is frequently done for improper purposes and without really showing that social media users have committed any crime. These subpoenas have the effect of intimidating and chilling critics, as immigration authorities have engaged in invasive, unconstitutional, and sometimes violent conduct.

As the amicus brief makes clear, courts should not defer to the government’s claims regarding the legitimacy of using grand jury subpoenas to unmask internet users. Instead, the subpoenas must receive proper First Amendment scrutiny. Like many other types of legal processes, grand jury subpoenas are issued by federal officials without prior court approval. And they too can be abused to harass or retaliate against people critical of the government.

The amicus brief was filed in early September and recently unsealed. The brief was signed by the American Civil Liberties Union of DC, EFF, the Center for Individual Rights, the Foundation for Individual Rights and Expression, the Cato Institute, and NetChoice.

It is notable that NetChoice signed the amicus brief. It is a trade group that represents many companies who have received similar subpoenas including Reddit, Google, Meta, PayPal, among others. EFF has called on these companies to do more to defend their users’ speech and privacy rights in the face of these subpoenas.

When we give our private information to the government to pay taxes, apply for a job, or vote, we should be able to trust that our data won't later be used against us. But in a betrayal of that trust, the federal government has been pooling the information it has about us on an unprecedented scale—and using it for purposes we never agreed to.

EFF and other groups are fighting back. In our latest EFFector newsletter, we're talking about a recent victory in our lawsuit against the government for sharing federal workers' confidential personnel files with DOGE.

JOIN OUR NEWSLETTER

For over 35 years, EFFector has been your guide to understanding the intersection of technology, civil liberties, and the law. This issue covers our free tracker blocker coming to Safari, a call to action for net neutrality in California, and a big win in our lawsuit against the DOGE data grab.

Prefer to listen in? EFFector is now available on all major podcast platforms. This time we're talking to EFF's F. Mario Trujillo about the dangers of government data grabs—and what defenders of privacy are doing to stop it. You can find the episode and subscribe on your podcast platform of choice:

%3Ciframe%20height%3D%22200px%22%20width%3D%22100%25%22%20frameborder%3D%22no%22%20scrolling%3D%22no%22%20seamless%3D%22%22%20src%3D%22https%3A%2F%2Fplayer.simplecast.com%2F59368254-4a09-4fcf-89fc-911a7c26dcc9%3Fdark%3Dfalse%22%20allow%3D%22autoplay%22%3E%3C%2Fiframe%3E Privacy info. This embed will serve content from simplecast.com

   

Want to protect your right to digital privacy? Sign up for EFF's EFFector newsletter for updates, ways to take action, and new merch drops. You can also fuel the fight for privacy and free speech online when you support EFF today!

Everyone knows, or should, that perfect (balanced, targeted, transparent, swift and swiftly appealable) content moderation at scale is impossible. That doesn’t mean powerful social platforms don’t have to try to get at least reasonably close, especially when access to good information can have a profound effect on political participation and speech.

That’s why so many people, including the Meta Oversight Board, criticized Meta for suspending a major political Instagram account for hours during a huge early voting push on October 17; and for allegedly boosting one candidate in Brazil’s recent presidential election. Meta denies deliberate interference in either instance, blaming “mistakes” in its automated content moderation systems (including AI tools that can’t tell the difference between enthusiastic follower engagement and a bot attack).

Mistakes or not, with early voting in the U.S. midterms already underway, these events serve as a stark reminder that all major social media platforms need to have stronger systems in place to ensure that they serve, rather than impede, democratic communication.

Access to good information can have a profound effect on political participation and speech.

This is not inherently an “AI” problem: automated systems can process content at a scale that humans never could, potentially enabling better moderation at scale and alleviating the psychological load on ill-paid moderators whose jobs require them to view incredibly disturbing content. But automated systems also reproduce existing biases, struggle to understand context, and often make mistakes that disproportionately affect journalists, activists, artists, and other vulnerable and marginalized communities. And moderation errors are even more likely when the language is spoken principally by the global majority. In 2020, leaked document showed that Meta’s algorithms incorrectly deleted nonviolent Arabic-language content 77 percent of the time, while failing to detect hate speech under the company’s own policies in many instances. Where these systems are faltering in Arabic, they’re positively failing in less-resourced languages. As a 2025 report from the Center for Democracy and Technology found, labeled datasets in certain languages and dialects such as Maghrebi Arabic and Kiswahili contain inconsistencies, bias, and inaccuracies due to the limited hiring of annotators who actually speak the languages as well as shifts in the languages themselves. An investigation into ChatGPT’s outputs in several low-resource languages demonstrates the depth of problem.

But language disparities are just one of several concerns as automated moderation becomes more widespread. From the systemic suppression of content from Palestine to the repeated misclassification of LGBTQ+ content as adult or explicit material, these varied examples demonstrate the risks of overreliance on automated moderation—and the need for stronger safeguards.

Fortunately, there is a great deal companies, policymakers, and civil society can do to help ensure that highly automated systems operate in ways that respect human rights, minimize predictable harms, and provide meaningful accountability when they fail. If companies are going to continue relying on automation to moderate users’ speech—and there is little reason to believe they won’t—then accountability must evolve alongside these technologies.

That work should start with publicly committing to the Santa Clara Principles 2.0. Specifically:

1. Automated technologies should help, not replace, human moderators. For example, automated systems can help flag and prioritize content for review, while humans can interpret context, handle sensitive cases, and refine system performance. This investment is particularly important during the weeks immediately before and after an election.
2. Companies must be transparent about when and how automation is used in content decisions.
3. Companies must regularly audit their automated systems for bias, with particular attention to low-resource languages, vulnerable and marginalized communities, and conflict zones.
4. Companies should strengthen personal data protection guarantees and policies. Automated content moderation often relies on personal data and profiling, so companies should think carefully about what data these systems use, what's necessary and proportionate and how their systems shape moderation outcomes.
5. Users must have the ability to appeal, and to provide context when they believe human or automated moderation decisions have wrongfully removed their content. Appeals should be promptly evaluated and decided by human moderators.
6. Companies should regularly assess the human rights impact of their moderation decisions, and issue public statements of the results
7. If they rely on third-party vendors, companies should carefully (and regularly) audit those vendors for compliance with these same principles
8. Lawmakers should avoid promoting and passing legislation that effectively or explicitly mandates automated moderation systems
9. Policymakers should also refrain from attempting to dictate platforms technical and design choices to favor or disfavor particular expression.
10. Policymakers should work to educate the public about how their personal data may be collected and used in electoral contexts.

These recommendations understand that automated content moderation isn’t just a technical problem for clever engineers and product teams to solve. Because content moderation shapes public discourse and fundamental rights, its design and oversight must respond to the concerns of policymakers, civil society, independent researchers, and the communities most affected by these systems.

One other distinct and enduring problem makes transparency, checks, and accountability all the more urgent: too few companies have far too much power over our political communication and organizing. Social media gave people the ability to wrest some control over political messaging away from media oligopolies. But we’ve met the new boss and while it’s not the same as the old boss, the song is pretty familiar. The real promise of the web to democratize communication is not likely to be met by social media oligarchs, no matter how sophisticated their content moderation practice.

New records obtained by EFF expose additional issues with Medicare’s AI-driven prior authorization program and show why we need stronger legal limits around government use of automated decision-making. 

EFF sued the government back in March for information about the Wasteful and Inappropriate Service Reduction (WISeR) model, a new Medicare program that uses AI to evaluate prior authorization requests for certain medical services. We previously released records showing that WISeR has resulted in delays and denials of care, operational chaos, and reports of patient harm. Today, we’re publishing over 800 new pages of records, including:

• Requests for information (RFIs) or requests for corrective action plans (CAPs) sent from the Centers for Medicare & Medicaid Services (CMS) to four of the six WISeR vendors, along with the vendors’ responses.
• Applications of 66 companies to the WISeR model, including those of the 6 selected companies. 
• Task orders and contracts for the evaluation, implementation, and monitoring of the WISeR model.

Documents obtained through EFF’s lawsuit are available here.

These newly released documents show that the WISeR rollout was rushed and rocky from the start, highlighting the dangers that arise when governments treat AI like a silver bullet for complex problems. The documents also highlight the need for more transparency about safeguards against inappropriate, AI-driven denials. The public still lacks the information needed to assess whether clinician review is providing meaningful oversight of AI systems and whether appropriate data is being used to evaluate prior authorization requests. 

EFF has long argued that AI has no place in consequential government decisions about peoples’ rights or access to benefits, such as immigration enforcement and policing decisions. That’s because using automated decision-making in these contexts risks decisions that violate people’s rights or deprive them of benefits they’re entitled to based on biased or inappropriate considerations and without proper due process or accountability if there is an error. 

By outsourcing decision-making to private AI companies without sufficient transparency, testing, or legal limits, WISeR jeopardizes seniors’ access to medical care. Congress should step in to place greater legal limits on the use of automated decision-making in Medicare. 

WISeR’s Rollout Was Rushed and Rocky 

CMS launched the WISeR program just six months after announcing it, ignoring calls from medical providers to delay its rollout. In records previously released by EFF, CMS acknowledged this “extremely condensed timeline.” 

New records suggest that WISeR’s unusually rapid rollout contributed to widespread problems in the first few months of the program. CMS did not disclose the extent of these issues to the public, even as agency employees privately contacted vendors about potential noncompliance with program requirements. 

In the first three months of the program, CMS sent RFIs or requests for CAPs to at least four of the six WISeR vendors. These requests, which describe delays, technical failures, and a lack of communication with providers, suggest that widespread problems during the program’s rollout were not limited to one vendor or state. 

These letters underscore the severity of the problems with the program. For example, CMS requested information from one vendor, Virtix, about numerous reported issues, including “determination turnaround times that exceed established guidelines,” “denials that appear inaccurate or inconsistent with applicable criteria,” and “inadequate customer service.” CMS’s RFI to Zyter–a vendor that uses Palantir software infrastructure–observed that the agency had received reports that “Zyter is not issuing determination letters in a timely manner” and communications indicating that it “may lack adequate processes for responding to and escalating provider/supplier concerns.” The vendor Innovaccer received two CAP requests and a “Performance Notice of Non-Compliance” over its failure to implement a fully functional portal for WISeR providers and suppliers.

Excerpts from CMS’ letters to vendors describe problems during WISeR’s rollout:

Excerpt from the RFI for Virtix, March 17, 2026

Excerpt from the RFI for Zyter, February 27, 2026

Excerpt from the Performance Notice of Non-Compliance for Innovaccer, February 20, 2026

Vendors’ responses to CMS provide further evidence that WISeR’s rushed rollout contributed to its problems. Innovaccer claimed it warned CMS months in advance that it might not be ready to provide full portal functionality by the launch date, even before signing a Participation Agreement. Another vendor claimed that “technical and workflow stabilization challenges were encountered due to the compressed implementation timeframe” it faced after joining the WISeR program a month after the other vendors. 

Excerpt from Innovaccer’s Proposed CAP, January 16, 2026

The issues reflected in CMS’s letters to vendors, and the vendors’ responses, illustrate the risks of deploying automated decision-making systems without proper testing or safeguards. While vendors’ responses describe fixes for the problems CMS identified, after-the-fact remedies cannot undo the harms that patients and providers already experienced during WISeR’s rushed rollout. 

More Transparency Needed About AI Safeguards

The public still knows far too little about any safeguards that WISeR vendors may have adopted—in part because the government chose to conceal some of this information. Transparency about these safeguards is critical to protecting patients, especially because WISeR’s payment structure gives vendors, as the government put it, “an incentive to deny as many claims as possible.” 

 Information provided by a vendor about safeguards that it says "ensure the responsible and clinically appropriate application of automation” appears to have been redacted from records released to EFF

The public has limited means to evaluate the effectiveness of even the safeguards that weren’t redacted from records released to EFF. For example, one vendor’s application touts safeguards like “Human-in-the-loop (HITL) workflows,” “Continuous model monitoring,” and “Transparent audit trails.” Yet it remains unclear whether these measures effectively prevent improper prior authorization denials. Some evidence suggests they may not: the company denied more requests than it approved in the first few months of the program, and CMS inquired about “denials that appear inaccurate or inconsistent with applicable criteria.”

Ultimately, the records obtained by EFF raise more questions than they answer about the safeguards used by WISeR vendors. 

Having a Human in the Loop Is Probably Not Enough

CMS has emphasized having a human in the loop as a key safeguard against inappropriate, AI-driven denials. The WISeR FAQ page on the CMS website states that “Non-affirmations will require the review of a human clinician and cannot be performed solely by technology.” But whether human review provides any meaningful protection depends on the details of its implementation, such as whether human reviewers have enough time to evaluate requests and practical authority to override AI recommendations. We still lack many of those details for WISeR vendors. 

A growing body of scholarship points to the substantial limitations of “human in the loop” policies as guardrails for AI systems. AI-generated recommendations can unduly influence human decisions, leading reviewers to over-rely on automated judgements and rubber stamp them as correct. Even worse, at least one health insurance company actively pressured clinical reviewers to accept its AI systems’ recommendations. Another company built a system that allowed clinical reviewers to reject claims without opening patient files; clinical reviewers using this system spent an average of just 1.2 seconds on each case.

Is the Right Kind of Data Informing Companies’ Decisions?

Some WISeR vendors’ applications offer general descriptions of the types of data informing their decisions. But far more details are needed to allow medical professionals to assess whether the data inputs to these AI systems are appropriate for evaluating prior authorization requests. 

Inappropriate training data or input data can lead to biased, unfair, or inaccurate decisions. CMS guidance for Medicare Advantage organizations using AI to make coverage decisions emphasizes the importance of basing decisions on individual patients’ circumstances. It cautions against using “an algorithm that determines coverage based on a larger data set instead of the individual patient's medical history, the physician’s recommendations, or clinical notes.” 

WISeR vendors’ applications reference data sources like “provider behavior,” “patient demographics,” “utilization management datasets,” “provider and payer performance metrics,” and “historical claims data.” Whether these sources could introduce bias or give too much weight to population-level patterns depends on how vendors use them to inform individual decisions. But we don’t yet have these important details about vendors’ data and algorithms. By outsourcing decision-making to private companies’ AI systems, the government has made it harder for the public to evaluate whether decisions are being made fairly.

Next Steps

As the government expands its use of automated decision-making, the potential for consequential mistakes increases rapidly. The records we’ve obtained so far raise questions about the rushed rollout and lack of guardrails for automated decision-making by the U.S. government. EFF urges transparency, oversight, and legal limits to protect people from the harms of automated decision-making in high risk systems.  

Related Cases: EFF v. CMS

A nonprofit service that protects internet users’ privacy is leaving France. Quad9, a free DNS resolver, has said it will reluctantly stop serving users in France on November 24. This follows a French court order that Quad9 must block access to websites that are accused of infringing the copyrights of a sports broadcaster. Forcing a responsible privacy service out of an important market is a predictable result of trying to force infrastructure providers to be copyright police.

When you visit a website, a DNS resolver reads the domain name you type in—like eff.org— and translates it into a numerical IP address that’s used to direct data across the internet. A DNS resolver can see the names of websites you connect to, so its privacy policies are important. Quad9 is an NGO that’s incorporated in Switzerland, in part to protect its users from data demands. The company also helps protect users from malware and phishing by blocking domains that are known to be malicious. Services like Quad9 offer an alternative to the DNS resolvers of local internet service providers and wireless carriers, which are vulnerable to demands from law enforcement, censorship, and commercial surveillance.

In a blog post explaining its decision, Quad9 explains that the French court’s order forces it to make a decision that, either way, is bad for users. It could either “extend French law to the whole world (blocking globally)” or try to identify and block users only in France—something that it can’t do reliably, and a move that could leave the company facing massive fines if it fails to block websites perfectly within France. Quad9 says it is facing about 20 other lawsuits in France seeking similar blocking orders. 

Rather than accept these demands, Quad9 has decided to withdraw its service from France. That is a real loss for French users who rely on the service to protect their privacy and security. It is also the right thing to do, when faced with the alternative: making promises it can’t keep, or abandoning users’ rights worldwide. 

Quad9’s decision will not remove any allegedly infringing material from the internet. The organization doesn’t host websites. Users looking for particular websites can  easily switch to another DNS resolver. So the material targeted by copyright holders will remain online and accessible, even while they drive a privacy-protecting service out of France. 

These events matter beyond the borders of France, and U.S. lawmakers should pay attention. Congress is considering multiple site-blocking proposals, which would require ISPs and other intermediaries, including DNS resolvers, to block access to websites in the name of protecting copyright. These bills threaten speech and our ability to access information online, and they are invitations to abuse. The Quad9 withdrawal shows another cost: if internet services get forced into being copyright cops, users can lose services that they rely on for privacy and security. 

Worse still, if neutral services like Quad9 are forced to build site-blocking systems for the benefit of copyright holders, it becomes far easier for other powerful interests, including repressive governments, to demand the same systems be used to censor speech they dislike, globally. 

Congress should reject site-blocking bills. They’re a threat to the open internet, and don’t help creators or creativity. 

Last week, researchers at Citizen Lab revealed a horrifying new malware campaign, dubbed “AdFection.” It used an ad network to distribute spyware to journalist’s devices to infect them without the target ever needing to click anything. This sort of attack on journalists is dangerous and incredibly concerning, especially since it’s built on the backbone of a technology we already object to: behavioral advertising. Although this type of attack has only been described targeting journalists, you can take a few steps we outline in the next section to mitigate the risk no matter who you are.

A few factors combined to make this attack a noteworthy first-of-its-kind. First, it utilized the surveillance ad-tech ecosystem to specially target the malicious code. Second, the spyware it delivered was so-called “zero-click,” meaning it required no interaction from the user to be infected: all that is required is for the ad to be delivered and code bundled along with it to be run, which happens automatically. Neither malvertising nor zero-click attacks are new on their own. What’s novel about the AdFection attack is combining them, creating a highly targeted, extremely dangerous attack which is difficult to defend against and even harder to detect.

Let’s take a deeper look from the perspective of one of the Windows devices supplied to the researchers from Al Jazeera. Here’s how the report describes the infection happening: 

• Someone browsing the web or using an app on that machine is served an ad created by Discover-Tech, a company exposed in the report as “purporting to be a legitimate advertising company, [but] appears to be a front for large-scale ad espionage abuse.” 
• The ad contains a small snippet of JavaScript code which is automatically executed when rendered in the app or website. 
• This code reaches back out to a Discover-Tech server, referred to as their “NOAS server,” with detailed information about the machine rendering it: its cookie-set advertising ID, IP address, and more.

So far, nothing particularly unusual has happened. Ads that contain JavaScript code and reach back out to their servers with lots of information on your device—and by extension you—are commonplace. It’s all part of the data-driven advertising ecosystem. What happens next is more interesting:

• The NOAS server uses this detailed information to determine it is an Al Jazeera machine requesting the ad. 
• Instead of returning an empty response (as it does most of the time), it responds with a malicious, zero-click spyware payload. That payload was created by Discover-Tech’s partner Candiru/Integrity Labs, a company previously exposed for involvement in sophisticated malware attacks. 
• The payload is then executed and infects the targeted machine.

Companies targeting zero-click malware attacks against journalists might seem like the plot of a blockbuster spy thriller. But this attack was enabled by the everyday practices of ad-tech companies, which unfortunately have extreme latitude in the collection of users’ data. By leveraging the tracking identifiers and data collected on devices for the purpose of delivering targeted ads to specific individuals, mercenary spyware companies can repurpose this data in order to fine-tune who they infect—and hide that they’re doing it from everyone else. 

Most ads are not delivered directly by the ad creators, but rather by intermediaries that facilitate Real-Time Bidding auctions. Nonetheless, winning bidders are given the ability to execute JavaScript code in the browser of the person who receives the targeted ad. This allows for interactive ads to be displayed, but also (as we’ve seen) for the compromise of a device just by delivery of malicious code.

While the different components in this attack chain are not novel on their own, the exposure of this combined attack is significant because it reveals a technique to hyper-target individuals and organizations for infection. Luckily, there are steps you can take to protect yourself from the myriad of dangers presented by the ad-tracking industry. Here’s how.

What You Can Do About It

As we work towards fundamental fixes to the ad ecosystem and banning online behavioral ads altogether, the onus is on all of us to protect ourselves. This is especially important for higher risk individuals or journalists working in states with heavy surveillance. Citizen Lab outlines several steps, depending on your threat model, to take to help protect yourself:

• Take some simple steps to lock down your devices right now.
• Establish strong security fundamentals. Sites like our own Surveillance Self-Defense and Consumer Reports’ Security Planner can help get you started.
• Use a browser extension to reduce tracking. Our Privacy Badger extension is an excellent start. Network-wide ad blocking services are also worth considering if you’re comfortable handling the set up process.
• On mobile phones, disable or reset your AD ID. Here are directions to do so for Android and iPhone.
• Consider using more privacy protective browsers.

These steps can be very helpful in protecting yourself, but there is only so much you can do as an individual. Banning behavioral ads like this would be a good place to start. Behavioral ads aren’t just a privacy nightmare as designed. They are the perfect vehicle for malvertising and similar threats, just as we see here.

The vast amount of information on the open web requires researchers and journalists to adapt with new tools to make sense of it all. Checking facts, gauging public opinion, and other lines of inquiry depend on being able to analyze the overwhelming amount of material posted online every day. Unfortunately, responding to the AI industry’s voracious appetite for data, companies stewarding this public data are looking to cash in and block access to the open web. This makes the web harder to navigate, and threatens all kinds of important research.

Reddit’s lawsuit against SerpAPI and Perplexity threatens to do exactly that.

Reddit was once a very open platform, fostering a community of alternative apps and extensions putting users in control of their experience. Since the rise of AI however, it changed tack. Over the last three years Reddit has closed APIs to users, limited UI features, and otherwise restrained access without login. By making the voices on the platform harder to access, the company has positioned itself as a gatekeeper, and has since struck a lucrative data-sharing arrangement with Google.

SerpAPI, in contrast, is a tool which offers automated access to Google’s search engine results pages. It’s used by Perplexity, an AI-based search tool. Reddit sued to stop SerpAPI and Perplexity from bypassing Reddit’s own arrangement with Google. (Google brought a similar suit, which was dismissed by another court.)

It comes as little surprise that the legal weapon Reddit employed in this case is Section 1201 of the Digital Millennium Copyright Act, the same “anti-circumvention” law that has caused so much trouble for artists, innovators, and researchers over the years—and that EFF has fought against from the beginning. Reddit’s suit claimed that SerpAPI’s use of widely used techniques to access Google search results amounted to “circumventing” access controls on copyrighted works. 

There are major problems with this argument. 

First, Reddit doesn’t own the copyright in its users’ posts—the users do, and they grant Reddit the right to distribute the posted content freely.

Second, there’s no meaningful copyright infringement going on here. Perplexity functions like a search engine, responding to users’ queries with relevant links and optionally an AI-generated summary. Crawling and indexing the web to create a search engine was long ago ruled a fair use under copyright law.

And third, Google’s efforts to put rate limits on search queries and block some kinds of automated querying aren’t the sort of “access controls” that Section 1201 was written for. The law was passed in 1998 and targeted things like breaking the encryption on DVDs and other digital media. In contrast to physical or paywalled media, Reddit posts are visible to everyone, without a paywall and generally without a login. 

Unfortunately, a federal district judge ruled in July that the suit could proceed, concluding that Section 1201 applied. That’s a dangerous ruling, because it casts a cloud of legal uncertainty over lots of important research, including efforts to study public sentiment through social media and to preserve records of historical events. Without tools that can look at the web at scale, many kinds of research are simply impossible today. But if employing those tools risks Section 1201 liability, only the wealthiest institutions will be able to use them.

We cannot let the internet be rebuilt such that information is divided up among a handful of gatekeepers and sold back to us like cable subscription packages. If our knowledge of the online world comes only through wealthy institutions, the cost of knowledge will only increase and access to unbiased answers diminishes. 

If you use the internet at all, you may have noticed that a large percentage of sites suddenly went down earlier this week—and all your nerdiest friends were talking about "The Vulnerability Apocalypse” and this thing called PHP that powers nearly 70% of the websites on the internet. You may find yourself wondering: what is PHP, what just happened, what is the vulnerability apocalypse, and what do I need to do?  

To find out what you can personally do read the first blog post in this series!  

What Is PHP?  

PHP is a programming language used mainly to create interactive websites. Facebook, Wordpress, Wikipedia, Etsy, and other major sites all use or were originally built on PHP. It is a long-established mainstay of web development. But because it is open-source, maintenance of these critical systems depends on a small number of volunteers working on this in their free time. The disaster scenario that happened this past week is the perfect example of why we need more money and people supporting open-source projects. Corporations should be contributing both. 

What Is the Vulnerability Apocalypse?  

Common Vulnerabilities and Exposures (CVEs) are the way that security professionals file reports about vulnerabilities in software. The National Vulnerability Database (NVD), run by NIST, is the official national database of CVEs. In other words, CVE reports managed by NIST are the closest thing we have to a canonical database of security vulnerabilities in software. The NVD currently has around 400,000 CVEs that have been filed and accepted since 1988. In just the month of October, 13,000 new CVEs have been submitted. This means that 3% of critical software security bugs that have ever been officially logged were found in the last month alone. And it's likely that by the end of the year over a quarter of the software vulnerabilities that have ever been found will be from 2026.  

 

Computer vulnerabilities reported are rising exponentially. Source: CVE Tracker

This research is being driven almost entirely by the cybersecurity capabilities of major AI models from companies like Anthropic, OpenAI, and Google. Historically it has been popularly assumed by cybersecurity experts that finding unknown (zero-day) exploits in any specific project and turning them into exploits was expensive. The knowledge to discover them was not widespread, and it was a hard task even for those initiated into the arcane ways of vulnerability hunting. Google even dedicated an entire team to it.  

But now thanks to major AI models, vulnerabilities are cheap, and anyone of moderate technical skill with a few dollars and access to a frontier AI model can find vulnerabilities in a few minutes. For example, recent vulnerabilities in PHP were found with a prompt to an AI model that literally said "find bad vulnerabilities in PHP."  

What Happened This Week? 

In 2024, a potentially severe vulnerability in PHP was discovered during an external security audit. PHP’s maintainers couldn’t agree on a solution, but more importantly, they couldn’t find a way to exploit the vulnerability. Because it didn’t seem like an active threat, they ended up deprioritizing a fix in favor of working on more urgent security issues. Then, in August 2026, security researchers working with the latest models from OpenAI and Anthropic independently discovered the vulnerability again, and another one—and now, with a way to exploit them.  

We now know that the vulnerabilities were so severe that they would have allowed even moderately inventive hackers to take over any website that uses PHP and then steal customer data, launch further malware attacks, spy on users, take websites offline, or launch a massive denial of service attack.[1] 

Because of the severity of these vulnerabilities, several of the involved researchers got together with the makers of PHP to patch the vulnerabilities and disclose them in a coordinated manner. The idea was that hopefully everyone would get a chance to quietly release and then apply fixes for the vulnerabilities before the whole world found out about it. 

But news already started to leak on October 20th. There was a post on a widely read forum “Hacker News” and other posts elsewhere. One of the researchers accidentally published a video early. Companies reported seeing active exploitation of the vulnerabilities going back as far as October 17th. On October 21st, six hours before the planned press embargo, one company, Chainguard, jumped the gun and released a patch early, essentially giving anyone instructions about exactly where to find the vulnerabilities and how to weaponize them. This sent system administrators everywhere scrambling to patch their systems before they were taken over by hackers. And it’s going to take a long time to patch all these systems. At the time of this writing over 33 million websites are still running on vulnerable versions of PHP.  

The internet is run largely on open-source software, mostly maintained by a small handful of skilled volunteers occasionally getting a small stipend, not by major corporations and highly paid engineers. These are projects you have perhaps never heard of, like PHP, OpenSSL, and SQLite, but these programs run on nearly every computer in the world and are maintained by teams as small as one person. When a vulnerability is found in these projects, it can be devastating.  

PHP isn’t the only critical open-source software with a high severity vulnerability this week either. Other widespread open-source projects like Node.js and GitLab also had severe security bugs reported.  

The small number of already overworked open-source maintainers are now facing a deluge of vulnerability reports, some of which are false, but many of which are very real. Burnout in open source has never been higher.  

We Need Stronger Support for Open Source Projects

Much of the foundation for the modern multibillion-dollar internet industry is built on open-source products that were created and still maintained—for free—by dedicated volunteers in their spare time. It’s an imperfect system, and it can lead to errors.  

One of those critical, under resourced open-source products is PHP. And while vulnerabilities in PHP were privately found years ago, they were left unfixed because they didn’t seem as impactful as other bugs at the time. These same vulnerabilities were recently rediscovered and proved to be trivially exploitable by security researchers using advanced AI models. While in the middle of the widespread, global effort to correct this mistake and deploy fixes, the problem was leaked by some of the security researchers who had gotten early access to the fixes. Unfortunately, this left millions of websites, ranging from personal blogs to government sites, vulnerable to hacking that could result in data theft, malware distribution, and worse.  

Open-source projects like PHP and others are the backbone of the entire internet. If they don’t get the resources they need, they and the internet they power, are at risk of falling apart. Corporations (whose products would not exist without these products) should be actively contributing to their maintenance. 

1. A technical analysis of the vulnerabilities is out of scope for this post and has already been written by the original researchers.

It is a commonly held truth among computer geeks that there is no such thing as bug free software, or a secure computer. Any piece of software that anyone actually uses will have a security vulnerability somewhere in the code. The more complex that software is, the more likely there will be a vulnerability. Fortunately for everyone, finding severe vulnerabilities was generally considered an expensive and difficult task requiring years of training and deep knowledge of how computers and software worked. Until recently there was a steady background hum of vulnerabilities being found and patched, with major vulnerabilities that could cripple the entire internet only happening every few years. Now that is no longer the case.  

You may have noticed your nerdiest friends freaking out about the “Vulnerability Apocalypse” this week and waving their arms in panic about something called PHP. You may have also noticed that some of your favorite websites were down for a bit. In the last two weeks of October alone, there have been multiple, potentially internet-breaking vulnerabilities reported and patched. Many of those vulnerabilities were in the open-source software that is the foundation of the vast majority of the internet.

For more detailed information on what happened, and why supporting open-source projects matters, check out our other blog.

This is all because frontier AI models, such as those created by OpenAI, Anthropic, and others, have made it incredibly cheap and easy to find previously unknown vulnerabilities (zero-days) in open- and closed-source code. Three percent of all software vulnerabilities ever found in history were found just in the month of October. This year alone researchers have found nearly a quarter of all software security issues which have ever been discovered. 

If exploiting critical software is now cheaper and easier than ever, what does that mean for us as individuals and what does that mean for society as a whole? TL; DR: It’s going to get worse before it gets better. But you can protect yourself with basic digital security hygiene that is now more important than ever.  

What Do I Need to Do? 

There absolutely needs to be a bigger conversation about how we got here and how to fix the systemic issues involved, including how corporations that depend on open-source code should contribute to their upkeep, and how big tech should be regulated.  

But for now, this news is a compelling reason to tighten up your digital hygiene. A lot of computers are going to get hacked a lot more often, and unfortunately, it isn’t going to get better any time soon. Thankfully, EFF has compiled a comprehensive set of security advice in our Surveillance Self-Defense guides. To start, we recommend making sure your browser and all applications are always up to date with the latest patches.   

You should also consider installing a tracker blocking tool, like EFF’s Privacy Badger (now on Safari), and remain vigilant for phishing attempts. Additionally, install a password manager and use unique passwords for each website, so that if one site is compromised, the rest of your passwords are safe. You should also be aware that data breaches may now be more likely, and the websites you visit may experience more attacks than usual, which means that some services may be disrupted.  

If you host a blog or other website, make sure that either you or your hosting provider has patched this particular issue.  

For additional tips on protecting yourself and others, head over to our Surveillance Self-Defense site. Additionally, if you’d like to support any of EFF’s open-source projects like Privacy Badger, Rayhunter, and Certbot, visit our donate page. 

Last week, two federal appeals courts issued opinions that will allow Florida and Georgia to start enforcing laws that will age-gate and block young people from accessing social media. The laws do not adequately respect minors’ rights to play, speak, and learn online. More fundamentally, these laws don’t help young people stay safe online—a goal that lawmakers should pursue.

Age-Gated? Email EFF at agegates@eff.org. 

Because of the new laws, some young people will lose their ability to access lawful information, find their online communities, and even engage with school board members. Others will need parental permission to stay online. And adults will face increased demands to prove their age, which will put their privacy at increased risk simply to continue to use the services they already use. 

We opposed these laws because they threaten the free expression and privacy of both minors and adults.  Even though these lawsuits are not over, the injunctions that paused enforcement have been lifted, and the states of Florida and Georgia will now be able to enforce broad restrictions on social media use. 

The restrictions that these states will start enforcing are a setback for the rights of all internet users, but they are not written in stone. That’s why EFF is encouraging internet users - and particularly young people – to start keeping a record of how they are affected. If you are a teenager who loses access to an online discussion, can’t participate in a political campaign, or stop seeking information because you don’t want to upload personal information, document what happened. The same is true for adults who may be mistakenly blocked by age checks, and parents who may encounter obstacles to authorizing their children's use of online services. These experiences matter. They can help us show courts, policymakers, and the public what government restrictions on online expression actually cost the people who live under them. 

Hopefully, with enough proof of the expressive harms these laws cause, we can push lawmakers to rescind them. That’s why we’re encouraging folks to reach out to EFF once they’ve documented these harms. You can write to us about this issue at the email address agegates@eff.org. 

The Decisions

These two opinions, issued by the same panel from the U.S. Court of Appeals for the 11th Circuit, allow Florida and Georgia to enforce restrictions on social media accounts for people under 16 years old. The requirements differ by state. 

In Florida, the judges allowed that state’s H.B. 3 to move forward, which requires covered platforms to ban anyone under 14 from opening or keeping accounts—even with parental permission. Teenagers who are 14 or 15 can have accounts only with parental consent. To be covered, a platform has to use algorithms, allow content uploads or the viewing of other peoples’ content, and have at least one feature on a list of features the state considers bad, including livestreaming, engagement metrics, autoplay, infinite scrolling, or push notifications. These requirements effectively apply to every major social media service that young people use.

To the extent there is a silver lining in the ruling on Florida’s law, it’s that the panel recognized that H.B. 3 targets expression protected by the First Amendment. The problem is that the ruling uncritically accepts the idea that a social media service is addictive in a clinical sense, even if just 10% of users under 16 are using the platform for two or more hours per day (the standard set in H.B. 3). The court simply accepts that time spent online is a proxy for harm. The bill doesn’t distinguish doomscrolling or compulsive use from organizing a campaign, making art, or talking with friends. 

In Georgia, S.B. 351 can now be enforced. That law requires parental consent for anyone under 16 to hold an account on social media platforms. It also requires platforms to make “commercially reasonable efforts” to check users’ ages, which creates a hurdle for adults as well as under-16s. 

The ruling acknowledges that S.B. 351 “overwhelmingly applies to platforms that overwhelmingly host protected speech.” But the ruling faults the plaintiffs for not being able to show that “invalid applications substantially outweigh the valid ones.” That asks the groups challenging the law to meet a virtually impossible standard—to make their case, they would have to measure and evaluate the content hosted by all online services affected by the law. 

Both of these cases may be further appealed, and are likely to continue in the lower courts. But people in Georgia and Florida can no longer count on court injunctions to protect their access to the web. What the effects will be going forward depends on how platforms implement these new restrictions, including how they check ages and parental consent, as well as state officials’ views on these efforts. 

If you hit an age-gate while online, check out our blog post about how you might want to proceed, and our age-gating resource hub. If you want to speak out about your experience, you can talk to us at agegates@eff.org.

What is Lost

Some youth who lose their social media accounts will lose contact with friends. Others will lose access to a support group, the ability to speak out on current issues, or an audience for their artwork. More young people will be shut out of discussions about what’s going on in their school and their community. U.S. law has long recognized that people under 18 have their own rights to speak and receive information. These new laws interfere with those rights. 

The Florida opinion suggests that young people can browse the internet without an account, or use a parent’s account. But that doesn’t help those who might participate in a private group, send a personal message, or speak to an audience they have built up. Nor does it recognize the reality that in many households, young people may not have the ability to use a parent’s device, or even have healthy relationships with their parents. For parents of children under 14, the Florida law also overrides parental autonomy—even if parents wanted to allow their child on these services, they cannot do so by law. 

These laws won’t just harm younger kids. Adults and older teens will bear the cost of the new rules. In order to figure out who is young enough to not be able to join, or who needs parental consent to join, services will have to check users’ ages. That likely means asking people to submit ID or other sensitive information. Some people will be mis-classified as too young; others will decide that they’d simply rather stop participating instead of handing over even more personal data. 

Keep A Record

Between the recent Meta settlement and these 11th Circuit decisions, despite widespread opposition, age-gating is becoming a reality for the American internet. As these laws are enforced, we need to understand what they mean for the people who have to deal with them. And we need to create a record of their effects on everyone’s speech so we can push to repeal them.

If you encounter a restriction due to these laws that affects you, keep a record, ideally while the details are still fresh in your mind. Screenshots, along with notes about the date and time, the service involved, and the task you were trying to accomplish, will all be helpful. 

Did you lose an account or can’t participate? Describe what you lost. Were you using a group to organize a club, volunteer in your community, or keep in touch with friends? Did losing your account cut you off from people you wouldn’t otherwise be able to be in touch with? Even if you just used the account to access local news or follow your favorite content creator, that’s still a significant loss of your right to access information online.

Record problems with age checks and parental consent. What information did the service request from you? Were you able to provide it? Did it reject your age proof, or classify you incorrectly? If you’re a parent, were you able to give permission, and what did you have to provide? What promises did the service make about what it did with the data it collected from you? Save explanations given by the platforms or any services they employ to age gate, including any law they cite. If you are to appeal a result and choose to, keep track of those attempts as well. 

You can also document choosing to drop out. If you abandon an account or service because you’re unwilling to provide ID or other personal data, write down what you gave up, and why. You don’t need to submit sensitive information to show that you are burdened by new rules. 

You Can E-Mail agegates@eff.org

If these restrictions affect you, we encourage you to reach out to EFF by emailing agegated@eff.org and telling us more about what happened. 

EFF will continue to oppose laws that prevent adults and minors from expressing themselves online, or that push people to give up their privacy to participate in the digital world. These recent court decisions are setbacks, but they don’t settle the debate. By keeping track of people who lose access, age-check failures, and the online conversations that can no longer happen, we’ll be in a better position to challenge the worst of these restrictions, in both legislatures and courts. 

And in the meantime, EFF will keep fighting for laws that actually make us safer online—like stopping social media companies’  harmful surveillance of all internet users. We’ll continue to push for laws that empower parents, children, and all internet users to have meaningful choice and control over their online services. Those goals can make everyone safer online, while preserving our ability to speak and access information. 

Further Action 

• Email EFF about your experience at agegates@eff.org . 

Further Reading

• 11th Circuit Opinion in Netchoice v. Carr (Georgia)
• 11th Circuit Opinion in CCIA, NetChoice v. Uthmeier (Florida) 
• EFF amicus brief in Florida case
• EFF amicus brief in Georgia case
• EFF’s Age Verification Hub

Canada’s Parliament is debating a massive expansion of surveillance powers that will threaten the privacy and security of millions of people. Bill C-22, also called the Lawful Access Act, has already passed the House of Commons, and is now before the Canadian Senate. 

Canadians still have an opportunity to speak out and stop this dangerous legislation. The Canadian Civil Liberties Association (CCLA) is urging all Canadians to sign its petition opposing the bill. (The petition on CCLA’s website is governed by CCLA’s privacy policy.) 

Take action

Tell the canadian senate to stop C-22

As we wrote earlier this year, Bill C-22 gives the government new powers to force digital services—including telecom companies, messaging apps, and more—to help with government surveillance. Worse, it allows Canada’s Minister of Public Safety to order companies to create a backdoor to their services for law enforcement, as long as it doesn’t lead to a “systemic insecurity.” That’s a clear recipe for weakening the encryption we all rely on. 

It also requires services to retain metadata for up to a year, which reveals who people communicate with, where they go, and what services they use, even when they are not suspected of any crime. 

Researchers at CCLA and Citizen Lab published a detailed analysis of C-22 and its serious constitutional and cybersecurity problems. The analysis points out that the bill needs more than cosmetic changes—it calls for entirely withdrawing Part 2 of Bill C-22, the section that establishes the surveillance and data retention regime. 

Bill C-22 could also expand the sharing of Canadians’ personal data with foreign law enforcement, including the United States. Canada has been negotiating a cross-border data-sharing agreement with the U.S. that would allow American police to get information about Canadian internet users without any Canadian court oversight. 

Some Canadian senators have already expressed concerns about the bill, and rightly suggested, as CCLA and Citizen Lab have, that it may not be compatible with privacy protections in the Canadian constitution. 

If you’re in Canada, read and sign CCLA’s petition opposing Bill C-22 today. Don’t let the Senate allow this dangerous expansion of government surveillance to become Canada’s new reality. 

Take action

Canadians: defend your privacy and security

The internet is a vast and confusing place no matter your age. Trying to help youth engage with it safely and privately is a complicated topic that touches on many different skillsets and ideas. But just because it’s complicated doesn’t mean it’s impossible. We’ve launched our Online Privacy for Parents and Youth Surveillance Self-Defense guide in hopes to provide a framework for finding solutions that work for you. 

EFF rolls out this crucial resource as state and local governments consider ill-advised laws that cut young people off from essential information and experiences. This particularly harms vulnerable youth and marginalized groups who often find safety in supportive online communities they can't access offline. Such laws also entail age gating, which compromises the privacy of all internet users and stifles young users’ ability to learn, grow, and express themselves.

Young people have unique needs and those needs change over time. Trying to protect from everything all the time is an exhausting process, but the security community has long had a solution for this: security planning (also called threat modeling). The idea is to provide a series of questions designed to help you focus on what’s truly important. When it comes to online privacy, this is as applicable for youth and parents as it is for anyone else. 

We used a security plan as our foundation for this guide because deciding what is and isn’t important is the first step we should all take when assessing our privacy risks. But this isn’t a place for quick fixes, and every young person has their unique needs and considerations. There is no single tool or technology fix that can substitute for spending time learning, and then teaching a young person, how the internet works, how to use it, what sorts of harms exist, and how to navigate those harms.

Solutions are rarely about the tools or software you use. It’s about understanding the threats and concerns you have, and then determining what steps you can take to mitigate those risks. We hope our Online Privacy for Parents and Youth guide can help provide the outline to get the conversation started.

Donate Today!

An open internet where people can freely build, share, and remix each other's work is a powerful engine of grassroots innovation we’ve all benefited from. In recent decades, however, corporations have taken control of an increasing share of this work, giving them a greater ability to stifle challengers and limit our choices. When regulators address this by mandating that  tech giants play fair by requiring interoperability, the gatekeepers respond with a tired refrain: Playing fair puts users’ security at risk.

Unfortunately for these trillion-dollar companies, this gotcha isn’t the end of the conversation. Regulators can ensure that meaningful choice and security thrive.

Lawmakers have been catching up, recognizing that the best way to rein in big tech is to require these oligopolies to open up their platforms to independent developers. As we explained six years ago, mandating interoperability helps prevent the misuse of people’s data and enables more privacy-respecting alternatives. Tech giants, in contrast, have been arguing that our data is safer when they have exclusive control.

Tech Giants Claim Interoperability Means Insecurity

The European Union’s Digital Markets Act (DMA) put interoperability into law under Article 6(7): “gatekeeper shall allow providers of services and providers of hardware, free of charge, effective interoperability with” a designated Core Platform Service they operate. The language describes an unambiguous requirement to remediate vendor lockouts and anti-competitive behavior of the major service operators—it is not optional.

Apple claimed that enforcing this obligation in mobile app stores would put their customers at risk and do irreparable harm to trust in their brand. It’s an argument reminiscent of Apple’s fight against the right to repair, and in both instances the company is fighting to maintain its restrictive ecosystem to stop people from finding better deals elsewhere. Apple has long cultivated a more corporate-controlled experience with the iPhone, but this argument is now also being used for the relatively-more-open Android devices from Google.

In the same year Apple argued against the DMA, Epic Games sued Google for its restrictive terms of service and extractive policies for revenue generated in apps. Google predictably alleged that opening up its platform to other app stores it couldn’t vet would allow harmful apps to be installed. The case was ultimately decided this year in the U.S. federal appeals court for the Ninth Circuit, with the court rejecting this argument, dealing a blow to  Google’s feudal security arrangement, and paving the way for third-party app stores to be delivered as apps via the Google Play Store.

Interoperating Secure Systems Can (and Should) Exist

Policymakers cannot take tech giants’ claims at face value. Companies have every incentive to resist interoperability requirements, because interoperability lowers practical barriers and reduces switching costs for consumers adopting competing services. 

Even where companies offer credible claims from internal technical and security experts, independent experts rarely have the access and information they need to test those claims. Companies have selectively made arguments that security is harmed by interoperability, often in contexts which are to their advantage. These companies are happy to let a general misconception flourish which frames security as inherently opposed to interoperability.

This narrative is wrong. We’ve seen that when interoperability and information security are both set as essential and non-negotiable criteria, secure interoperable systems result—systems that don’t sacrifice the rich features we’ve come to expect of the services we rely on. 

The cross-platform rollout of Rich Communication Services (RCS), and now Message Layer Security (MLS) on top of it is a perfect example of this, creating end-to-end secure messaging by default between Android and iOS. For RCS and MLS, Google was conveniently on the other side of the interoperability argument, campaigning Apple to adopt the standard to overcome the diminished “green bubble” experience iPhone users had when texting non-iPhone users. Once Apple finally agreed to interoperate by implementing common standards, all users benefited from improved messaging security. In cases where legitimate security concerns are raised, these can be assessed and remedied on a case-by-case basis, without sacrificing user agency.

Striking the Right Balance

Retrofitting interoperability into already secure closed systems shouldn’t be done carelessly: it requires regulators strike the right balance of pressure and leniency to allow the time and precision necessary to make these renovations. Any components developed with the assumption of privileged access by trusted parties (e.g. your browser engine) are particularly vulnerable to serious security risks when opened up to unaccountable third parties.

By adapting interoperability and information security as essential design principles, we can expect more safety, but also more freedom.

With regard to the DMA, when security concerns are legitimate, we urge the European Commission to work with companies and outside experts to offer guidance in technical implementation and provide clarity on regulatory compliance. This approach paves a path forward that balances the interest of legal oversight and the needs of the companies alike. 

Policymakers wishing to uproot these unfair platforms of control must do so with care and limit the impact this disruption can have. But security concerns must not act as a lever to indefinitely delay compliance. Closed systems should be impartially evaluated, and if concerns are valid, regulators can allow more time and guidance to be given to companies implementing these changes. One possibility is a tiered approach: offering leniency during an initial period where systems need to be retrofitted to abide by new requirements, followed by a subsequent and ongoing stricter observance of fair play.

Once interoperability and information security are adopted as essential design principles, further development with these rights-enhancing principles in mind will more easily follow. The result will be an internet the world deserves—where we can expect more safety, but also more freedom.