For years, John Deere had actively made repairing their tractors near-impossible for anyone but itself and the few "authorized" repair shops—regardless of the ability of its customers to actually visit such shops. Now, in a major win for farmers and right to repair advocates, John Deere must soon provide farmers with not just the tools and resources to finally repair their own John Deere equipment, but also access to future updates for said equipment.

In 2025, the Federal Trade Commission (FTC) brought a suit against farm equipment manufacturer John Deere, alleging John Deere used their control over equipment repair tools and resources to limit the ability of farmers and independent repair providers (IRPs) to repair John Deere equipment. Earlier this month, John Deere reached a settlement with the FTC in which they will immediately make available a tranche of repair resources, then continue to make further resources available until the end of the year. Five states joined the FTC in this suit, and over the next 10 years these states will work alongside the FTC to ensure John Deere complies with this settlement. 

It is worth noting there is a second, farmer-initiated antitrust lawsuit against John Deere, also concerning a farmer’s right to repair their own equipment. In April, John Deere agreed to a $99 million settlement in that case, which also includes right to repair provisions.

This fight is just one example of how, as machines become increasingly computerized, companies like John Deere restrict your ability to repair machines behind software subject to legal regimes that don’t just lock down repair, but make unauthorized repair a potential criminal offense. 

John Deere’s market dominance in farm equipment led to an extraordinary power over access to the tools and resources of repair. John Deere actively restricted who had access to repair tools, and monopolized who could do the repair. This revenue stream—and control of it—is built into the business models of a lot of the technology we buy today. It also encourages companies to move away from the kinds of devices that can be easily fixed at home to ones that offer bells and whistles no one wants but makes repair difficult—like app-enabled toasters. 

This whole saga with John Deere has been an exemplar of the greater need for right to repair laws, policy, and enforcement.  There was a time when you bought a tractor and with some know-how and a manual could fix it yourself. It is easy to envision why someone with John Deere farm equipment might find it inconvenient to wait for John Deere approved repairpeople to come and fix any broken equipment. Especially when it meant waiting for days or weeks. Especially if it meant their crop was withering on the vine. This settlement will help ensure this is no longer the case. 

But it’s not just about farm equipment; If you can’t fix it, you don’t own it. While some might feel more willing to agree they “shouldn’t” futz with laptops or smartphone, it still stands that — whether it’s farm equipment, a car, a laptop, or even your phone — if you legally cannot fix it yourself, if you must go hat in hand to an “approved provider,” you are at the mercy of a corporation. It is why EFF continues to support right to repair laws that ensure people truly own what they buy. And it is why EFF continues to fight for exemptions to the law that makes it most difficult to tinker and repair your own devices.

Police departments across the country are lining up to launch drone-as-first-responder (DFR) programs, and hundreds have cleared a necessary hurdle toward making deployment a reality, expanding aerial surveillance and data collection even in areas patrol officers typically can't reach.

As of February 2026, over 1,000 public safety agencies—including police, fire, and other emergency management agencies—had received Federal Aviation Administration (FAA) waivers needed to automate drone operations and launch a DFR program, according to a recent Freedom of Information Act (FOIA) release listing agencies that have obtained Part 91 waivers since the FAA streamlined and sped up the process in April 2025.

The changes led to a massive increase in the number of waivers issued. Only 976 DFR waivers had been granted since the first DFR program launched in 2018 through April 2025, according to an FAA representative. The agency issued more waivers between April 2025 and February 2026 than it had in the previous seven years combined.

A map illustrating the locations of police departments and other public safety agencies that have received Part 91 waivers, making it possible for them to launch drone-as-first-responder programs. (This map image links to Google Maps, which is governed by Google's privacy policy)

The new FAA process for waivers and the rush of police departments to obtain them signifies a shift in law enforcement's use of drones: from human-operated aerial surveillance to AI-based autonomous drone use. 

Typically, a drone operator is only permitted to fly in areas that can still be seen by the pilot, and that drone pilot needs to be certified under FAA Part 107. To fly drones “Beyond Visual Line of Sight” (BVLOS) requires additional approval from the FAA, as do flights above 200 feet, due to the risk of colliding with planes and other aircrafts. Without such approval, an officer could not pilot a drone from a desk inside a building and fly it to a call across the city because they could not possibly have line of sight on the drone. 

FAA rules for police drones also required a human operator to manually fly the device to a scene, but DFR technology has become a more common and more automated police technology. DFR programs increasingly rely on artificial intelligence to automate drone flights from launchpads placed around the city, often atop municipal buildings, and make it possible for one drone operator to “fly” multiple devices at once. Though not every police department that has received BVLOS has launched a DFR program yet, by going through this process, every department on this list has signified it has strong enough interest to clear the necessary regulatory hurdles.

Police departments and the companies that sell DFR equipment claim that these drones make it easier for officers to establish “situational awareness” of a scene before they arrive. Early drone adoption centered on similar claims, particularly related to high-risk situations like vehicular accidents or incidents involving an armed suspect. However, these kinds of situations may make up only a small portion of deployments, which often occur in response to low-risk calls for service related to unhoused people, mental health concerns, and loud music, as a Government Technology analysis of the system in Chula Vista, California, found. 

DFR programs have become important sources of revenue for companies like Flock Safety and Axon, the latter of which reported that its DFR platform has become one of the company’s fastest growing sectors. Axon is also known for products like the TASER and the Fusus camera system that lets police integrate viewing of public and private cameras. 

Footage from drone flights is streamed back to a police office, and it can be stored, shared, and analyzed like other video. Turning drone footage into fodder for automated license plate reader (ALPR) networks, for example, requires very little additional software, and Flock Safety was quietly able to turn its drones into “flying ALPRs” last year. 

The normalization of police DFR programs jeopardizes privacy in communities across the country. As flying cameras, drones can capture footage from areas typically inaccessible to a casual patrol officer—backyards, roofs, through windows—at distances that leave subjects of surveillance completely unaware of the spy in the sky. A recent leak of drone footage from the San Francisco Police Department illustrated the ease with which surreptitious drone flights could observe innocent individuals for minutes without them realizing it. EFF's Atlas of Surveillance contains a list of police departments with drones, including those with DFR programs.

While daytime DFR use grows, police departments are exploring other ways to expand overhead surveillance. In October 2024, the Campbell Police Department in California announced it had received the first FAA approval for BVLOS operations at night, claiming it was the “first to incorporate radar technology with electro-optical sensors to enhance airspace monitoring, enabling a single remote pilot to safely deploy drones both day and night.”  

As communities consider drone use, it’s crucial that they have a say in whether the program is acquired at all, not just how it's run once purchased. Throughout the process, police should be transparent with the community and comply with local regulations about its adoption.

Many cities provide portals that log the flight paths and reasons for each drone flight, often in real time, an important transparency practice. In California, under AB 481, police departments are required to provide advance notice of intent to acquire drones, establish policies before they’re procured, and provide annual updates on their uses—giving communities and city councils the opportunity, before any contract is signed, to weigh in or object to the acquisition itself. 

For police departments and communities considering drone use, clear policies on appropriate use, transparency around deployment, and regular re-evaluation—including the choice to discontinue a program that isn't working—are all vital for protecting people’s privacy and security. 

Legal intern Suzanne Castillo was the principal author of this post.

The Fourth Circuit issued a disappointing opinion in U.S. v. Belmonte Cardozo, a case in which EFF filed an amicus brief, alongside the national ACLU, its Maryland, North Carolina, South Carolina, and Virginia affiliates, and the National Association of Criminal Defense Lawyers (NACDL).

We argued that electronic device searches at the border should require a warrant based on probable cause, but at minimum, regardless of whether an officer searches by hand or with forensic software that plugs into a device and downloads its entire contents for search, the same Fourth Amendment standard should apply to all device searches at the border.

Unfortunately, the court rejected that argument and ruled that a lower standard applies to manual searches, allowing the government to conduct extraordinarily invasive electronic device searches without any suspicion of wrongdoing, simply because the border officer chooses to search by hand rather than with a forensic tool.

The Border Search Exception Meets Your Phone

The Fourth Amendment requires that government searches of persons or property be reasonable, which usually means obtaining a warrant based on probable cause from a judge.

But a warrantless search can still be reasonable if it falls within an exception to the warrant requirement, including the exception that allows officers to search your belongings at the border. The border search exception allows warrantless searches of persons or property crossing the U.S. border, including the functional equivalent of the border such as international airports, given the government’s interests in controlling who and what may enter the country.

Historically, courts have categorized border searches of luggage, vehicles, and personal effects as “routine” and thus reasonable even if conducted without any suspicion that the traveler has engaged in wrongdoing; courts have also held that more invasive “nonroutine” searches, such as certain body searches and searches that damage property, require reasonable suspicion.

But a person’s privacy interests in the personal data on a phone or laptop are extraordinarily different than their limited privacy interests in the contents of their suitcase.

The Supreme Court addressed cell phone privacy in Riley v. California (2014), holding that the search-incident-to-arrest exception to the warrant requirement did not apply to cell phones, thereby generally requiring a warrant for phone searches, at least at the interior of the country. The court recognized the unprecedented privacy interests people have in their cell phones and how even brief manual searches can reveal the “sum of an individual’s private life,” including our political affiliations, religious beliefs, sexuality, and more. Accordingly, the Supreme Court held that because electronic device searches bear “little resemblance” to searches of bags or physical containers, they should be evaluated differently.

Following Riley, the Fourth Circuit considered two border device search cases involving forensic searches, in which border officers used external software to extract and analyze a device’s data.

In U.S. v. Kolsuz (2018), the Fourth Circuit held that a forensic search of a cell phone at the border “must be considered a nonroutine border search, requiring some measure of individualized suspicion” of a transnational offense, but the court declined to decide whether the standard is only reasonable suspicion or instead a probable cause warrant.

Then in U.S. v. Aigbekaen (2019), the Fourth Circuit held that a forensic device search at the border in support of a purely domestic law enforcement investigation requires a warrant. The court also reiterated the general Kolsuz rule for a forensic border-related device search: the “Government must have individualized suspicion of an offense that bears some nexus to the border search exception's purposes of protecting national security, collecting duties, blocking the entry of unwanted persons, or disrupting efforts to export or import contraband.”

In Belmonte Cardozo, manual searches were finally before the court.

A Disappointing Decision

Jose Belmonte Cardozo was already on the U.S. government’s radar when he traveled from Bolivia to the U.S. and was met by a U.S. Customs and Border Protection (CBP) officer at Washington Dulles International Airport. The officer manually searched his cell phone and found child sexual abuse material (CSAM), considered “digital contraband,” leading to Belmonte Cardozo’s arrest and criminal prosecution.

At issue on appeal was what standard should apply to manual device searches at the border. The Fourth Circuit held that, unlike forensic searches, manual searches are “routine” and thus reasonable under the Fourth Amendment without a warrant or individualized suspicion.

The court’s holding hinged on four differences between manual and forensic searches: (1) in a manual search, a person does the searching, not a machine; (2) a manual search’s breadth depends on the officer’s time and energy, while forensic searches are comprehensive; (3) manual searches reveal only what a user can typically access, while forensic searches can uncover deleted files, cached fragments, metadata, and more; and (4) manual searches are subject to an officer’s fading memory or imperfect notes, while forensic searches create a permanent copy.

But in identifying these technical differences, the court never explains why they justify a lower standard for manual searches.

The Fourth Circuit’s holding is problematic because, as we argued in our amicus brief, manual searches reach the same categories of data as forensic searches—data that can reveal highly personal aspects of our identities and our lives. It does not matter if a search is conducted by an agent’s thumbs or by software: the end result is equally as invasive, therefore all device searches should fall under the warrant requirement, or at least the same Fourth Amendment standard.

The court repeatedly emphasized that the search here lasted only two minutes, suggesting that the time-limited search was not privacy-invasive. But an individual’s privacy interests in their personal data don’t change based on how their phone is searched or how long. Scrolling for two minutes through someone’s personal text messages or photos is an invasion of privacy that may reveal intimate details about the person even in that short period of time.

Moreover, as devices’ native search functions improve, manual searches can surface personal information in seconds through keyword searches, even for photos, where it might have taken an hour of scrolling to find the same information, further showing that a time-limited search is not necessarily less privacy-invasive. What matters is not the breadth of the search itself, but the unprecedented (and growing) breadth of data on our phones.

A Silver Lining

There’s one silver lining: by relying on the fact that the search lasted two minutes, the Fourth Circuit left open the possibility that lengthier manual searches could trigger heightened suspicion requirements. But until a clear line is drawn, border officers within the Fourth Circuit’s jurisdiction can use manual searches to sidestep heightened Fourth Amendment standards that would otherwise apply. In the meantime, EFF will keep fighting against extraordinarily invasive warrantless, suspicionless device earches at the border, and for robust privacy standards to protect our most personal data.

Intermediary liability laws around the world recognize that social media platforms, search engines, and other online service providers have become an integral part of our lives: they shape how we access information, communicate with others and participate in public debate, and foster innovation online. These laws generally shield platforms, to varying degrees, from legal liability for user content: the responsibility for unlawful speech should rest primarily with the speaker, not with those who merely host it.  

These liability protections are not a gift for platforms. They exist so that platforms are not encouraged to proactively monitor and filter what we say online, or to remove even lawful speech simply to avoid legal risk. 

This is why a recent judgment by the EU Court of Justice, Coyote System (Joined Cases C-188/24 and C-190/24), is concerning: it could deprive online platforms of liability protection because of how they organize and disseminate user content. The consequences for freedom of expression could be significant. 

Liability Protections in the EU 

The European Union has long embraced a system of limited liability for online service providers. Under the e-Commerce Directive and now the Digital Services Act (DSA), platforms benefit from liability exemptions for user content. To discourage censorship, they also cannot be required to generally monitor user content or actively search for illegal activity. But that liability protection comes with qualifications: Platforms lose this benefit if they play an "active role" such that they have knowledge of, or control over, user-provided information (Recital 42 ECD, Recital 18 DSA, and case law, for example para. 113 in L’Oréal v eBay). For hosting services, providers must remove or disable content they know to be illegal. The DSA has introduced extensive due diligence obligations for platforms but left these foundational immunities intact. The message is clear: platforms bear responsibility for proper systems and processes, but generally not for users' speech. 

Coyote System, however, could undermine this balance. Confronted with a case about restrictions on navigation systems that transmit information to drivers about roadside checks, the Court formulated a general test for when an intermediary ceases to be a "neutral" host and therefore loses the hosting liability exemption. In essence, the Court held that where an intermediary's algorithm goes beyond merely categorizing and indexing user information to determine, "under what conditions, how and in which order of priority" (para. 122) information is disseminated, the intermediary "controls" that information and is deprived of protection under the e-Commerce Directive. 

Let's be clear: the case is not about a service that ranked or recommended user-generated content in the way social media platforms do. It is about the collection and real-time relay of user alerts about roadside checks. However, the Court's reasoning is not confined to navigation services. Recommendation algorithms determine how and in what order user content is disseminated across virtually every major online platform. Should such platforms now cease to qualify as neutral intermediaries and lose the protection of the hosting liability exemption? The answer should be no. 

The Meaning of Control 

Control has never been understood this broadly. Nor should it be. Every hosting service provider, think of Facebook, Amazon or Bluesky, will have some control over users’ content. If that ability alone ruled the analysis, the liability exemption would become largely meaningless. Instead, the disqualifying “active role” must relate to the actual content itself, not merely the technical means by which that content is organised or disseminated. 

The Court’s own case law reinforces this conclusion: In YouTube and Cyando, it examined a platform that categorises, ranks and recommends user content through algorithms, yet still proceeded on the basis that it could generally benefit from the hosting liability exemption. To be sure, the Court was mainly addressing specific knowledge of illegal content rather than the separate category of control. Even so, the underlying premise is clear: those features do not, by themselves, place a platform outside of protection. Advocate General therefore explained that what matters is the providers "intellectual control of that content" (para 152). The relevant question is who controls the information itself, makes it their own, not who determines how it appears. 

That is precisely where Coyote System breaks new ground and offers a dangerous change of emphasis. By equating algorithmic organisation with content control, the ruling risks excluding social networks and other platforms from the liability exemption and encouraging proactive monitoring of what users say online and removal of lawful content. 

That outcome would have terrible consequences for freedom of expression in the EU. It’s also difficult to reconcile with the structure of the DSA, which certainly does not treat recommendation algorithms as incompatible with intermediary immunity. On the contrary, it accepts them as a defining feature of modern platforms, regulates them extensively through dedicated due diligence obligations, and still leaves the hosting liability regime untouched (it even integrated the YouTube ruling in its preamble!).  

This was no accident: During the DSA negotiations, proposals to deprive platforms of the hosting liability exemption if they optimize, classify, organize or otherwise promote online content were rejected, following successful advocacy by EFF and allies. Would the Court have decided this case differently under the DSA? Probably not. It’s more plausible that the EU judges were influenced by the specific nature of the service, which could explain why the judgment says remarkably, and sadly, little about why intermediary liability exists in the first place and the fundamental rights it serves. Coyote System did not merely transmit user reports but aggregated them into what the Advocate General described as a new "information layer," a distinction omitted by the Court. 

Chipping Away at Intermediary Liability Protections 

The danger is that the Court's broad language on algorithmic curation reaches well beyond that narrow category and, unintentionally or not, chips away at one of the most important safeguards for freedom of expression online.  

Unfortunately, Coyote System does not stand alone. It is the latest in a line of judgments that have gradually narrowed intermediary liability protections. Recently, in Russmedia, the Court privileged preventive content control in the name of data protection, paying little regard to the possibility of reconciling both regimes and the privacy costs of increased monitoring of user content. And in AGCOM, concerning Google's liability for YouTube videos uploaded by creators participating in its Partner Programme, the Court appears to leap from eligibility reviews to specific knowledge of illegal content. 

There is a political risk too. While the top court’s reasoning will be applied by national courts and further refined over time, the European Commission has shown little hesitation in incorporating landmark rulings into legislation. Just recently, in its digital omnibus proposal, it selectively restated part of a recent Court of Justice judgment to justify narrowing privacy rights of users. 

If these trends continue, freedom of expression online will become collateral damage in the EU. 

Are you a California resident? Then we've got exciting news for you: there's a tool just for you that lets you take a single, relatively easy step to protect your privacy. 

It's called a DROP request. (That's Delete Request and Opt-out Platform, if you're fancy). This one bit of paperwork lets you tell every data broker registered in the state of California that you'd like them to delete your information from their databases and request they stop selling and sharing your information. 

Here are some things to know about DROP. 

(Don’t want all the details and want to just learn how to file a request? Skip to this section.)

What does a request do?

Filing a request on the DROP will send a request to delete and opt-out of sale to all the data brokers in California's registry. Data brokers are companies that collect information about people, repackage that information, and sell it. As of time of writing, a single DROP request reaches 614 brokers.

After August 1, once data brokers receive a request, they will have 45 days to address the request. 

DROP officially launched on Jan. 1 of this year, but companies have until Aug. 1 to begin complying with requests. That means if you file a request now, you'll be in on the ground floor.

Didn't I hear about this before?

If you pay attention to EFF, you sure did. With your help, we advocated for the law creating the DROP tool, the Delete Act. As we said then, we needed the DROP because Californians have a right to request that companies delete information collected about them, and a right to opt-out of having businesses sell information about them. Yet, in reality, making those requests is an incredibly time-consuming and tedious process. Filing each request is hard. Plus, because data brokers buy, sell, and exchange information with so many companies (and each other) people may not even know who to file a request with. By linking a request to California's data broker registry, DROP cuts this process down considerably.

We advocated for DROP and the Delete Act because it makes our privacy law more user-friendly, which gives us better control over our data and reduces the risks that the uncontrolled collection and sale of personal information creates in our everyday lives. 

What's in it for me?

Filing a request benefits you in a few ways. For one, data brokers are often how spammers (or companies that act like spammers) get your email address, phone number, and other ways of contacting you. Removing yourself from data broker lists could lead to a decrease in these kinds of messages. Second, reducing the number of companies that have your personal information also improves your personal cybersecurity, as it decreases the number of firms with your information who could be hacked. Third and finally, it gives you an opportunity to exert more control over how your personal information is collected and used—an important element of privacy. Unless you opt out, data brokers can sell your private information to predatory companies, scammers, stalkers, insurance companies, and law enforcement.

What kinds of information will (and won't) be deleted?

The California Privacy Protection Agency, which administers the DROP, has a great resource explaining what data are and are not included in a request. But in summary, a request will often deal with identifying information such as: social security number, precise geolocation, browsing history, email address, and phone numbers. It will also enter a request to delete guesses that data brokers may have made about you based on identifying information, such as political views, inferences about your health—inferences about pregnancy or chronic illness, for example, that may be based on purchases or browsing history.

Not all information will be deleted. Some information, such as vehicle or real estate ownership, contains information that is a matter of public record. 

If there is a specific data broker you'd like to be able to retain and continue selling your data, the system also gives you a way to remove them from the list of brokers that get any given request. 

How do I file?

Head to the California Privacy Protection Agency's DROP website to start your request. Before you start, there are a few pieces of information you may want to gather for your request, such as your advertising ID or your VIN number, if you want this information to be deleted from data broker databases. 

The agency does ask to collect some personal information—name, address, phone number, email address, etc.—in order to fulfill a request. (Yes, there is an irony to this.) This is to verify that you're the right person asking for your deletion and opt-out request in any given database, and the agency itself is bound to its terms of service that say they won't sell or share it for other purposes.  

If you're interested in filing a request for someone else, such as an elderly relative drowning in junk mail, you can also do that but will need to attest that you're filing for someone else who is a resident of California. 

Once you've filed, you will get a DROP ID, which you can use to check in on your request. If you lose this ID, you can contact the agency to recover it, but keep it in a safe place if you want to check in on the status of your request.  

If I file once, am I done forever?

Unfortunately, no. While the opt-out of sale request should last indefinitely, California's privacy law still allows companies to collect information without asking for permission first in most cases. That means data brokers are likely to continue to collect information for profiles of you—but they will will have less data and be limited in how they use it after an opt-out request. New data brokers may also register with the state after you file your request. And DROP won't stop companies who aren't registered data brokers, like Google, from collecting and sharing your personal information.

Two things can be true. DROP is a fantastic tool to help more people exercise their California privacy rights. We also still need even stronger privacy laws to make things more fair for everyday people. 

That fact shouldn't undercut the power of this tool, but it does mean that you may want to make updating your request a regular part of a broader plan to manage your digital footprint. For example, might we suggest doing it as a part of Opt-Out October—a thing we totally made up but also totally stand behind?

What if I'm not in California?

Also unfortunately for those who don't live in California, this tool only works for California residents. But it's not all bad news. Versions of the Delete Act have been introduced around the country, and many regulators are monitoring how California's system works to see whether a similar system might work in their own states. Residents of all states can use EFF’s Opt-Out October guide to bolster their online privacy and limit the ways that data brokers harvest their personal data. 

A new report from the Government Accounting Office reveals that the Department of Homeland Security (DHS) plans to nearly triple the number of surveillance towers along U.S. borders, from the current 830 to 2,300 by 2034.

DHS expects to expend $1 billion in taxpayer dollars for this dangerous expansion of a surveillance network indiscriminately trained on towns, school playgrounds, backyards, and vehicles—threatening the privacy and civil liberties of everyone in the border regions.

The towers are planned as part of DHS component Customs and Border Protection’s (CBP) Integrated Surveillance Tower (IST) program, which captures images of people and vehicles. The IST program operates autonomous surveillance towers, consisting of autonomous surveillance towers, consisting of AI-based systems using radar, thermal infrared and optical systems to track targets over long distances; integrated fixed towers, optimized for surveilling foot traffic and vehicles; and remote video surveillance systems, which can often be found very close to the border fence in Arizona, including residential neighborhoods where cameras are capable of spying on homes on both sides of the border. (For a description and photos of these technologies, see EFF’s updated guide to surveillance at the U.S.-Mexico Border.)

DHS expects to purchase more long-range autonomous towers and to upgrade existing towers with autonomous capabilities. The $1 billion comes from the so-called One Big Beautiful Act—a massive tax and spending law that President Trump signed in 2025, the report says.

The explosive expansion of border surveillance is a digital dumpster fire for human rights and civil liberties. It’s not just surveillance towers; drones, aerostats, surveillance vehicles, ground sensors, game cameras, and license plate readers are also part of the vast taxpayer-funded infrastructure that threatens all those who live, work, or seek refuge in the borderlands. This technology isn’t exclusive to U.S. federal agencies: it’s also deployed by state and local law enforcement, and even by governments on the Mexican side.

Since 2022, EFF has studied and mapped surveillance technology along the U.S.-Mexico border using public records research, open-source intelligence, and fact-finding trips, and created a handy interactive map to provide researchers and journalists with the tools they need to analyze the impact of U.S. border security policy. We have also documented the different types of surveillance technology in a zine, "Surveillance Technology at the U.S.-Mexico Border." We updated the publication earlier this year to help people identify the machinery of homeland security by adding more models of surveillance towers, newly deployed military tech, and a gallery of disguised trail cams and automated license plate readers.

EFF’s work includes defending the rights of individuals whose devices have been searched or seized upon entering the country; pushing back on the collection of biometric and social media identifiers; and developing digital security guidance for people crossing borders.

With the web of surveillance tech at the borders about to explode, EFF will continue to investigate and expose it and find ways to fight back with the communities that live in the shadow of this technological threat to human rights.

There’s a new boogeyman in the battles over AI: so-called “stealth crawlers.” We’ll admit it—the term “stealth crawlers” sounds quite nefarious. In reality, they’re anything but.

“Stealth crawlers” are simply automated tools to access and collect public web data—without disclosing the user’s identity. Private crawlers like these facilitate all kinds of important work that benefits the public, including investigative reporting, academic research, cybersecurity protection, and more.

Many publishers want to unmask crawlers anyways—and are pushing for new legislation that would give them new powers to do so. These legislative proposals threaten the open web, user privacy, and valuable research without directly addressing the problems they’re supposedly intending to solve.

Alarmingly, these harmful proposals are gaining traction. The New York state legislature has already passed such a bill, the NY Stealth Crawler Protection Act, which is now on Governor Hochul’s desk. We expect to see similar bills introduced in other states, and potentially in Congress. That’s a big problem for the open web—and the many benefits it provides.

Anonymous crawling is worth protecting

Anonymous crawling enables some of the most publicly beneficial uses of the open web. Researchers, journalists, and other watchdog groups use unidentified automated tools to gather the information necessary to hold powerful institutions accountable and protect the public.

Anonymous crawling fuels important investigative journalism. For example, The Markup, a non-profit news site, used anonymous crawlers to investigate potentially anti-competitive practices by tech companies, such as Amazon’s tendency to prioritize Amazon brands and Amazon-exclusive products over competitors with higher ratings. The crawlers identified themselves as ordinary Firefox browsers to web servers, which allowed The Markup to understand how Amazon search results pages would appear to ordinary users. Similarly, ProPublica used an automated tool designed to simulate an ordinary Amazon customer to reveal that the site steered shoppers to more expensive products over cheaper alternatives.

Anonymous web scraping is also crucial for cybersecurity professionals, who use automated tools to monitor the web for information that helps them protect against malicious attackers. Privacy tools, including EFF’s own Privacy Badger, also crawl sites anonymously to identify trackers without compromising user privacy.

However, without the ability to scrape anonymously, these tools would likely be blocked. Sites can—and do—block crawlers operated by researchers, journalists, and activists who criticize them. For example, Facebook shut down accounts belonging to researchers who used automated tools to study misinformation on the platform and demanded that they take down published research. Many sites block automated access by anyone who hasn’t paid to crawl public webpages.    

Unmasking crawlers threatens the open web

News publishers—and their allies in government—say that unmasking crawlers is necessary to protect news organizations from technological strain caused by AI-related crawling, and fears that AI could reduce news sites’ traffic and ad revenue. These are legitimate concerns.

But enacting broad, reactionary restrictions on automated access is not the answer. Legislation targeting anonymous crawling threatens the open web, user privacy, and valuable research without actually addressing these technological and potential economic harms of scraping.

The New York state legislature recently passed the NY Stealth Crawler Protection Act, a law that would make it illegal to crawl news websites without revealing who is operating the crawler and all possible future uses of the data collected by the crawler. The law would give websites the power to obtain court orders that unmask anyone using an unidentified crawler—without any evidence that they broke the law.

Laws like the New York bill sweep far beyond AI, and do not meaningfully address the technological or potential harms of AI-related web scraping. These policies would chill beneficial crawling by allowing publishers to veto lawful public access, giving them the power to block not just bad actors, but also security professionals, researchers, dissidents, or anyone who has not paid for a license to view public text. This needlessly undermines the free and open internet.

Digital news publishers—like most websites—face real technological challenges in the AI era. While web crawling has been around for decades, with the proliferation of AI, crawlers now collect far more public web data than they used to. This pushes servers closer to their maximum capacity, and if some bots collect information too aggressively, they may strain web servers to the point that it degrades site performance. The problem is not anonymity—so unmasking crawlers won’t solve it. The real problem is overaggressive crawling, which can be effectively addressed with technical measures that target harmful conduct without impeding anonymous access to information.

A better path forward

There are other, far less harmful ways to protect publishers from the harms these “stealth crawler” laws claim to target. Addressing the harms of AI-related crawling requires policies that narrowly target the causes of these issues–without undermining free expression and the open web. Policies that target crawlers and scrapers are anything but.

Reversing course, Flock Safety—the surveillance technology vendor most known for its extensive network of automated license plate readers—has announced that it will end a pilot for its acoustic gunshot detection devices to identify signs of “human distress.”

In October 2025, EFF warned the public that Flock was rolling out a new feature called “Distress Detection” that would be deployed through their acoustic gunshot detection devices (formerly known as Flock Raven, now called Audio Detection). This feature purported to use high-powered microphones scattered throughout a city to search for sounds of human distress, with original advertisements from the product indicating it would search for “screaming.” (Since the publication of our original blog post, Flock quietly amended the ad on this webpage to say “distress” instead of “screaming.”)

Now, Flock has published a blog post stating that “[a]fter careful consideration and community consultation, we decided to remove the feature.” Good riddance. 

We said it when the product was announced and we’ll say it again: this was a misguided and dangerous feature because of the civil liberties concerns it poses, the possibility it could summon armed police to every loud interaction happening on the street, and because in several places this type of spying would be illegal under state eavesdropping laws. 

We were not quiet about this potential new feature. Flock even mentioned our concern about Distress Detection in an attempt to rebut our opposition to the mass surveillance their products enable.

The suspension of Distress Detection, however, does not mean that these high-powered microphones are now magically safe or beyond our concern. Acoustic gunshot detection is still a dangerous and often highly inaccurate technology that has resulted in real world harm, as in Chicago where it resulted in police shooting at children lighting fireworks. As Flock itself states, “No acoustic system is perfect, and we don't claim otherwise.” But police response to a situation where they believe guns are actively in use seems like a pretty high-stakes situation to be making, selling, and deploying technology known to be imperfect. Flock’s devices also listen for more than just gunshots. Their marketing materials admit to be listening for “community disruption,” which includes “non-violent” threats like car sideshows and fireworks. 

Flock’s failed attempt to roll out Distress Detection teaches us a few important lessons about the current state of police surveillance. First, we should not assume that just because these companies are large and well-funded, that does not ensure that they are complying with local privacy laws before floating new products to customers. Second, companies roll out and police adopt invasive technology under the justification that it will be used to address our society’s very worst crimes. However, both the companies and police will leverage deployed surveillance infrastructure to introduce new uses without necessarily seeking the consent or approval of the public. Gunshot detecting microphones eventually being used to listen for screaming is exactly the type of mission creep that we’ve seen happen with other pieces of surveillance technology, including Flock’s license plate readers. Finally, gun violence is too serious and complex of an issue to purport to solve with one flawed piece of technology. It has become too easy for police and cities to listen to the fancy marketing pitches of tech companies claiming they’re going to solve all crime instead of doing the hard work of addressing the root causes of societal issues. And, in the meantime, that technology creates more problems and hazards for the communities they blanket in police surveillance. 

As we’ve also seen with people across the country pushing back on Flock license plate reader contracts in their communities, public pressure can sometimes work to influence both companies and lawmakers that control a city’s purse strings to discontinue or divest from harmful products. Flock’s decision to end “Distress Detection” for human voices is a win.  

This month, we celebrate 36 years of EFF and a mission that is bigger than any one of us. Thanks to EFF, communities around the world are demanding that technology protects their freedom, advances justice, and opens doors to opportunity. That's not a small thing—it's a life's work worth continuing.

If you are committed to staying on the cutting edge of digital rights issues, I'd like to invite you to consider taking that commitment one step further by joining EFF’s Lighthouse Society, our way to acknowledge and thank the community of supporters who are including EFF in their legacy plans.

Learn About the Lighthouse Society

By including EFF in your will or estate plans, you can ensure that EFF’s work and values don't just live beyond you; they thrive because of you. A legacy gift is one of the most powerful ways to say: This matters, and I want it to matter long after I'm gone.

Your gift will fuel our mission for generations by protecting freedom, advancing justice, and driving innovation for communities who need it most. There is still so much more to do, so much more to fight for. With your foresight, it can go so much further.

Planned giving is also more flexible than you might realize. A bequest in your will, a simple beneficiary designation, or another estate planning option can all make a profound difference, often without affecting your finances today.

Get in touch and learn more about what's possible with the Lighthouse Society. Reach out to Jocelyn Wicker at majorgifts@eff.org or fill out our online form to share your intention to give. Thank you for considering a legacy that will carry this work forward for years to come.

When Ubisoft's Watch Dogs 2 was released in 2016, it was a headtrip for those of us working on digital-rights issues in the Bay Area. During the day, I'd fight tech-authoritarianism from EFF's San Francisco offices and then, at night, I'd fight tech-authoritarianism in an uncanny simulation of San Francisco from my home gaming console.  

Watch Dogs 2 is an open-world video game that follows a hacktivist collective called Dedsec as they take on surveillance tech and discriminatory AI systems that are being controlled by tech bros, government contractors, and corrupt cops. The game's missions often felt like they were ripped from the pages of EFF's Deeplinks blog.  

EFF’s mission is defending civil liberties in the digital world, and we do that with activists, technologists, and lawyers. If you've ever dreamt of joining Dedsec, you should definitely join us as a member.  

 Join the movement to Take Back CTRL.  

In fact, we've even got the same merch aesthetic. I cosplayed as the lead character, Marcus, at Dragon Con, and no one even knew I was in costume. 

Dave (left) as Marcus takes a selfie with a Wrench cosplayer at Dragon Con 2018.

To commemorate Watch Dog 2's 10th anniversary, I'll be speaking on a panel at San Diego Comic-Con reflecting on how the game predicted tech issues we're facing today. Organized by Mia Ginae of The Mighty Hostess and Black in Gaming, we've got voice actors Ruffin Prentiss lll and Shawn Baichoo, cinematic producer Timmy Fisher, and music producer Hudson Mohawke, who did the soundtrack, with Mia Ginae moderating. That's at 3:15 PM on Friday, July 24 in room 6BCF. 

But not everyone can get to Comic-Con and I certainly have more to say that can fit in. So here are a few ways where Watch Dogs 2 mirrored our work back then and foresaw what we're facing today.

Check out our full San Diego Comic Schedule, including panels and a meet-up. 

Insecure Surveillance Cameras 

One of the signature gameplay elements of the Watch Dogs series is the ability for your character to hack into nearby security cameras from your phone and use that to gain a strategic advantage over hostile adversaries. 

About a year before, that's exactly the issue that we were working on. EFF Technologist Cooper Quintin and I used the service Shodan to identify a slew of automated license plate readers (ALPRs) that Louisiana police had left unprotected on the internet. We found that the controls were open to anyone to manipulate and, just like in the game, you could watch the live video feeds.

We didn't use the data to acquire a skill point or collectible outfit. Instead, we forced police agencies to lock down their equipment and then used what we learned to persuade then Gov. Bobby Jindal to veto a bill that would have created a new statewide surveillance dragnet.  

This issue still persists today. Most recently, security researchers Benn Jordan and Jon “GainSec” Gaines, and the award-winning journalists at 404 Media, uncovered how at least 60 pan-tilt-zoom cameras from the vendor Flock Safety were left exposed online.

Cell-Site Simulators 

In Watch Dogs 2 there's a mission called "Stolen Signals," in which Marcus and his best friend Wrench are trying to locate "stingrays," police devices that gather nearby cell-phone data by masquerading as legit cellular towers. We call these "cell-site simulators" (CSSs) and they're are an extremely alarming mass surveillance technology that allows police to track individual users through their phone identifiers. We've long advocated that this should require a search warrant.   

Like Dedsec, we also had initiated a project to do the exact same thing. And in true Dedsec fashion, we also gave it a pop-culture name: Crocodile Hunter, an homage to wildlife expert Steve Irwin, who had famously died after a stingray attack.  

But while Marcus was running around Telegraph Hill, staff technologist Cooper Quintin and I were running around downtown San Francisco, testing out our own device for detecting suspicious cell phone towers during Salesforce's annual Dreamforce conference. And while we didn't find a CSS that day, we did find a mobile surveillance tower that a start-up had set up for the event.

Cooper Quintin, EFF's own 'Wrench,' testing out Crocodile Hunter at Dreamforce

Today, that project has evolved into Rayhunter, which allows anyone to use a cheap mobile hotspot to detect the type of cellular anomalies associated with CSSs. We're proud to say that now there's a whole international Dedsec-style network of researchers using this technology to look for surveillance at protests, at the border, and in metropolitan areas.  

Security Robots 

Throughout the game, Marcus encounters a number of autonomous pickle-shaped security robots wandering the city. At one point, Wrench reprograms one to become "Wrench Jr," a bona fide member of the Dedsec team.  

In real life, these robots are made by a company called Knightscope, and EFF started shining light on them in 2020-2021, when they were first being deployed by companies and government agencies.

A Knightscope robot patrols a casino parking lot in Reno, Nevada.

Today, law enforcement is pursuing weaponized robots and drones, and EFF is at the forefront to stop this dystopian reality. In fact, in December 2022, we successfully fought for San Francisco to ban the police department from weaponizing drones. In 2024, New York Police Department also retired its subway robot.

A Citywide Surveillance "Operating System" 

In the Watch Dog series, one of the ominous developments is CTOS 2.0 (Central Operating System 2.0). Through this system, Blume, a government contractor, tries to collect a massive amount of data through citywide sensors and infrastructure, and to combine all that data into one unified—and totally insecure—analytics system.  

At the time we'd only just begun to see this idea floated, with a limited number of cities trying tools like Palantir's Gotham to manage data.  

Today, it is a frighteningly competitive market, particularly when it comes to law enforcement surveillance. For example, both Axon and Flock Safety are trying to offer products that integrate with every function of policing that sound like CTOs. In fact, Flock Safety product is literally titled, "Flock OS."

Fusus demonstrated at a police chief's conference.

Meanwhile, Axon's camera networking product, "Fusus," sounds like it came straight from the Watch Dogs' writers room. Fusus allows for central live-streaming of all types of surveillance cameras in a city, including body-worn cameras, which was another prediction from the Watch Dog series that came true.  

EFF has been part of many local battles to reject Flock and Axon surveillance systems, and we've also advocated against recent efforts at the federal level to consolidate government data.  

Join the Fight Against Authoritarian Tech 

Watch Dogs 2's protagonists aren't just the merry band of core hackers: It's a distributed movement spread across the region and social media. The sequel, Watch Dogs Legion, is even designed so that every single person in the city of London is a potential playable Dedsec member, ready to take on tech tyranny with whatever skills they have.  

That's also our philosophy: If you use tech, if you're affected by tech, this is your fight. And it's time to take back control. 

There are a lot of ways to do this. You can become a member by donating. You can contact public officials through our Action Center. You can join the thousands of volunteers who are helping gather data on surveillance through our Atlas of Surveillance project. You can also hunt cell-site simulators with us—and help improve our code—through the Rayhunter project.  

And just like Watch Dogs 2, this is a game we can win if we work together.