When Nicholas de Monchaux became head of the Department of Architecture at the School of Architecture and Planning (SA+P) in 2020, he stepped into an unusual set of leadership conditions. He had been due to start in July 2020. Instead, a springtime visit to Cambridge, Massachusetts, coincided with the first Covid-19 lockdowns, and he found himself taking on the role earlier than planned — several months before faculty, students, and staff were able to gather in the same room.

As he concludes his tenure as head of the department before becoming dean of the University of California at Berkeley’s College of Environmental Design, de Monchaux reflects on a period of disruption that became an opportunity to strengthen the department’s infrastructure and advance new models for architectural education and research: “One of the key accomplishments of my time as head of the department has involved finding ways to teach one of MIT’s most physical and collaborative subjects remotely, while keeping the community together and rebuilding our studio culture once we were back on campus,” he says. 

Engaging complexity

The questions that have motivated de Monchaux’s research became central to the challenge of leading the department. As an architect and design theorist, his work draws on the science of adaptive complex systems to examine how design can shape resilient forms of organization under changing conditions.

His first book, “Spacesuit: Fashioning Apollo,” argues that the design of the Apollo spacesuit succeeded through continual adaptation across materials, manufacturing practices, and institutional networks, rather than through engineering optimization alone. His subsequent book, “Local Code: 3,659 Proposals About Data, Design, and the Nature of Cities,” shifts this inquiry from the body to the city, using geospatial data to show how thousands of marginal city-owned vacant lots could collectively support new forms of ecological and civic infrastructure, replacing top-down master planning with coordinated, site-specific interventions. If the impacts of the pandemic could be characterized as an emergent complex system at the scale of the body, the city, the planet — then leadership could be framed as a design problem.

De Monchaux’s understanding of design in relation to complexity science is influenced by his long-standing engagement with the Santa Fe Institute, where he serves as external faculty alongside researchers in the natural sciences, social sciences, and humanities. His instinct for combining multiple forms of knowledge can be traced back to MIT — he spent formative years here, where his father, John de Monchaux, served as dean of SA+P from 1981 to 1992. “I was shaped by the ethos of curiosity at MIT,” he says. “Not just when it comes to questions of science and technology, but also those of art, design, and culture.”

Paradox and works in progress

That way of thinking becomes especially relevant in the context of climate change. According to the U.N. Environment Program, the construction and operation of buildings account for almost 40 percent of global greenhouse gas emissions, an even larger share when urbanization, transportation, and the wider built environment are taken into account. For architects, this presents a paradox: The systems they work within have contributed substantially to the problems they now seek to solve.

“Over the past six years, our department has focused on two fundamental climate-related challenges,” says de Monchaux. “One is how to build differently through new approaches to circularity and material reuse. The other is how to make our social, cultural, and physical systems more resilient.”

Those priorities find expression in the Climate Studios, a research and teaching initiative nestled under the Option Studios (course number 4.154) that brings together faculty members — including architects, engineers, and historians — to collaborate with students on impact-driven research projects related to climate across multiple years of integrated research and pedagogy. 

“The studios reorganize teaching in the department because students aren’t just working on speculative exercises, they’re working on real issues,” says de Monchaux. “Likewise, the studios reorganize research by allowing faculty to benefit from the boundless energy and imagination of our design students.”

The Climate Studios are part of a wider constellation of climate action initiatives in collaboration with the MIT Department of Urban Studies and Planning (DUSP). One example is a collaboration with DUSP and outgoing Department Head Chris Zegras, toward creating an MIT Civilian Climate Corps. Including seminars and workshops on community-focused design for MIT and its neighbors, and student-staffed work on circular material use, the initiative served as an incubator for the MIT Farm. Other projects at different stages of development were presented in the exhibition “Climate Work: Un/Worlding the Planet,” the department’s exhibition at the 2025 Venice Architecture Biennale, curated by de Monchaux alongside incoming department head Ana Miljački and exhibition designer Calvin Zhong ’18, MA ’24, MCP ’24. The exhibition embodied its own principles of circularity: The modular display tables, fabricated in Venice, were designed for reuse, and have since been installed as worktables in the department’s forthcoming home, the Metropolitan Storage Warehouse (the Met) — a space designed, like the exhibition, to invite continual experimentation. 

Building connections

The transformation of the Met has provided another opportunity for de Monchaux to think about architecture as a process of adaptation and collaboration. Having previously worked at Diller Scofidio + Renfro, the architecture firm engaged for the renovation project, he brought a unique perspective to the process, acting as “a translator between two different languages.” Recognizing the shared culture of experimentation that linked the architecture firm and the department, he advocated for a more radical approach to the renovation, pushing the boundaries of what might be expected from an institutional building. 

“It was important that the building remain open-ended and a little raw, because there’s a long tradition at MIT of students and faculty shaping their own studios and spaces,” he explains.

While de Monchaux is proud of the initiatives that took shape during his tenure, as a scholar of complex systems he knows better than to claim ownership over any single project. He describes both architecture and administration as acts of organization and rearrangement, evolving the work of predecessors and making way for those who follow.

One of the clearest examples is the department’s collaboration with Tuskegee University, which will be carried forward by Miljački. The Robert R. Taylor Project builds on a relationship dating back to 1893, when MIT’s first Black graduate and the nation’s first professionally trained Black architect left Cambridge to design much of Tuskegee’s campus, playing an influential role in defining the university’s approach to architectural education. De Monchaux worked closely with Kwesi Daniels, head of architecture at Tuskegee, to establish an exchange program connecting students and faculty through complementary forms of expertise, from the study of historic preservation at Tuskegee to digital fabrication and entrepreneurship at MIT. 

“A relationship that was purely symbolic has now become part of the fabric of the two institutions, expanding access to different programs and ways of teaching,” says de Monchaux. 

Invisible infrastructure 

Less visible, but equally consequential, is the impact of strengthening the department’s underlying social and physical infrastructure. During de Monchaux’s tenure, this has included expanding student governance and community forums, increasing minimum fellowship support for MArch graduate students from 50 to 90 percent of tuition, earning accreditation for the department’s professional degree in architecture, and ensuring that every MArch student has access to a department-provided workstation in studio.

“What we’re really talking about is unlocking the latent curiosity and passion of every person in the department, providing the infrastructure that allows them to accomplish what they wouldn’t be able to do otherwise,” says de Monchaux. 

That statement resonates with an idea he put forth in a 2023 essay for MIT Technology Review, which argued for a return to the roots of the word “design.” Successful designers, he proposed, “reshape not just objects, but also the culture and institutions that create them.” And so, if leadership is a design problem, the goal is to create the conditions for continually new and productive outcomes. The infrastructures built during this period — physical, academic, and social — provide a strong foundation for the leadership of de Monchaux’s colleague and successor, “the incredibly capable and visionary Ana Miljački.”

Developers Must Beware of Ad Libraries that Betray Users’ Privacy

SAN FRANCISCO – Some software development kits (SDKs) provided by advertising companies to help developers monetize their apps are automatically feeding users’ location data into systems that location data brokers use to track people, an Electronic Frontier Foundation (EFF) report found. 

EFF began investigating the location-sharing practices of various advertising SDKs to better understand the pipeline from mobile apps to location data brokers. The probe revealed how such SDKs can facilitate and encourage location data sharing – without users’ knowledge or meaningful consent – through privacy-invasive defaults, financial incentives, and unclear documentation.    

“Defaults matter, not just for users, but for app developers as well. If app developers don’t pay close attention to the location-sharing settings of their advertising tools, they could inadvertently expose users’ location information,” EFF Staff Technologist Lena Cohen said. “Users can take extra steps to defend their location privacy, but they shouldn’t have to. Developers, regulators, and legislators must act to stop apps from leaking users’ location to advertising companies and data brokers.” 

Cohen and EFF Senior Staff Technologist Bill Budington reviewed the public developer documentation of dozens of widely used advertising SDKs to identify how they handle and communicate with developers about location data.  

In their analysis, they highlighted four advertising SDKs that collect and share a user's location by default for ad targeting whenever the user has given the app location permissions: InMobi, BidMachine, Verve’s HyBid, and Huawei’s Petal Ads. But EFF’s focus on these four does not mean that other SDKs adequately protect location data or that developers never choose to share location data when it’s not the default. In fact, advertising SDKs not discussed in this investigation have been criticized and sued for collecting location data without valid user consent.  

“When developers let advertising SDKs collect location data, they’re putting users at risk of more than just creepy ads,” Budington said. “Location information sourced from the advertising industry has been used for ICE investigations, global spy tools, outing a gay priest, tracking union organizers, and tracking US military personnel. Developers have a responsibility to protect their users’ from these harms, regardless of advertising SDKs’ default settings.” 

For the EFF report: https://www.eff.org/deeplinks/2026/07/developers-beware-ad-libraries-betray-your-users-location-privacy

For more on location data brokers: https://www.eff.org/issues/location-data-brokers 

For more on SDKs: https://www.eff.org/deeplinks/2022/06/how-federal-government-buys-our-cell-phone-location-data   

Contact:  WilliamBudingtonSenior Staff Technologistbill@eff.org LenaCohenStaff Technologistlcohen@eff.org

Across mobile platforms, advertising companies provide developers with software development kits (SDKs) that make it easy to monetize their apps. But those same SDKs can automatically feed users’ location data into ad systems that location data brokers use to track people. Many developers may not even be aware of this privacy violation, let alone the users who are directly affected.

When developers let advertising SDKs collect location data, they’re putting users at risk of more than just creepy ads. Location information sourced from the advertising industry has been used for ICE investigations, global spy tools, outing a gay priest, tracking union organizers, and tracking US military personnel.

Defaults matter, not just for users, but for app developers as well.

An EFF investigation has identified several advertising SDKs that publicly acknowledge collecting and sharing users’ location by default when embedded in Android apps granted location permissions. Defaults matter, not just for users, but for app developers as well. If app developers don’t pay close attention to the location-sharing settings of their advertising tools, they could inadvertently expose users’ location information.

This report explains how advertising SDKs can facilitate and encourage location data sharing through privacy-invasive defaults, financial incentives, and unclear documentation.

Contents:

• Data Brokers Harvest Location Information From Advertising Systems
• How Advertising SDKs Leak Location Data
• EFF Identified Advertising SDKs That Share Location Data by Default
• InMobi Encourages Keeping Location Sharing Enabled By Highlighting Financial Incentives
• BidMachine Updates Previously Inaccurate Developer Documentation After EFF's Technical Analysis Observed Precise Location Data Collection
• Verve Emphasizes Consent More in its Play Store Language Than its Configuration Guide
• Huawei Highlights Financial Incentives for Location Data Sharing Before Showing Developers How to Opt Out
• Location Data Sharing Can Happen Without Users’ Knowledge or Meaningful Consent
• Location Privacy Issues Extend Beyond These Four SDKs
• Fighting Back Against AdTech Companies That Enable and Encourage Location Data Sharing
• Developers
• Regulators
• Legislators

Data Brokers Harvest Location Information From Advertising Systems

When an advertising SDK collects and shares location data, it becomes part of a larger ecosystem that can include advertisers, ad tech companies, and location data brokers. EFF began investigating the location-sharing practices of various advertising SDKs to better understand the pipeline from mobile apps to location data brokers.

Location data brokers sell information on the precise movements of billions of people without their knowledge or meaningful consent. This data is primarily sourced from apps on people’s phones. Some apps partner with data brokers directly, using data-broker-developed SDKs or server-to-server transfers to sell users’ location data. Other apps leak users’ location data through advertising SDKs serving behaviorally-targeted ads through “real-time bidding” (RTB). In the process of auctioning off ad space, ad tech companies can broadcast user data to thousands of potential advertisers. Location data brokers have participated in these auctions not just to bid on ad space, but to collect personal information contained in bid requests. 

Indiscriminate data sharing through RTB can lead app developers to unknowingly share their users’ location with data brokers. In 2025, a hack of location data broker Gravy Analytics revealed thousands of apps that may have been sources of its data. When journalists reached out to the app developers, many claimed they had no relationship with or knowledge of Gravy Analytics. To prevent location information from being shared with data brokers through RTB, developers must understand the location-sharing practices of their advertising SDKs.

How Advertising SDKs Leak Location Data

Developers don’t have to manually, or even intentionally, share location data for it to be broadcast through RTB auctions. Once a user grants an app permission to access their location, SDKs embedded in the app receive the same access—there are no SDK-specific location permissions. That means advertising SDKs can automatically collect users’ location data and share it in bid requests.

While apps and SDKs can estimate a users’ approximate location from their IP address without requesting any permissions, location permissions provide access to estimates that are more accurate and revealing. Precise location permissions give apps (and their embedded SDKs) access to location estimates within about 160 feet, but sometimes as accurate as 10 feet. Approximate location, a separate permissions level, gives apps access to a location estimate within about 1.2 square miles. 

Developers and advertising SDKs also have a financial incentive to share location data, since it can increase bid prices for an app’s ad space. While many advertising SDKs require developers to configure a setting before collecting and sharing users’ location data in ad requests, this is not always the case. EFF found several advertising SDKs who publicly acknowledge sharing users’ location data by default when embedded in apps granted location permissions. 

EFF Identified Advertising SDKs That Share Location Data by Default

EFF reviewed the public developer documentation of dozens of widely-used advertising SDKs to identify how they handle and communicate with developers about location data. In the following sections, we highlight four advertising SDKs who engage in a particularly egregious practice: collecting a user's location by default for ad targeting whenever a user has given an app location permissions. We reached out to each SDK company and the referenced app developers for comment. One company responded, and as detailed below, subsequently updated its documentation in response to our questions. Another company responded with clarifications to its developer documentation.

We chose to focus on SDKs with this privacy-invasive default because it increases the risk of developers leaking users’ location data without realizing it. Several studies have found that developers tend to stick to SDKs’ default settings. If an advertising SDK transmits location data by default, users' precise location can end up in advertising systems without the developer intentionally enabling location sharing. These SDKs have separate documentation pages that instruct developers to flag users covered by privacy laws like GDPR and COPPA for restricted data processing, but these modes are not the default. 

By analyzing how these four SDKs present their location sharing practices to developers, we hope to illustrate how the design and documentation of advertising SDKs can facilitate location data sharing at scale. Although the advertising SDKs we highlight are not the most prevalent SDKs used, they are embedded in thousands of apps and reach billions of users.

InMobi Encourages Keeping Location Sharing Enabled By Highlighting Financial Incentives

InMobi claims to reach “2B+ users across 150+ countries” and is the 10th most popular advertising SDK on Android (according to AppBrain and Appfigures at the time of publication). 

InMobi’s “Getting Started with Android SDK Integration” suggests that location sharing is enabled by default, stating “The InMobi SDK automatically forwards location signals when available.” InMobi provides developers with a setting to opt out, but explicitly recommends sharing location data. Developer documentation highlights the financial incentive for location sharing, stating “location-enriched impressions typically yield higher revenue.” 

[Observed on “Getting Started with Android SDK Integration,” 7/31/26]

Apps that use InMobi may not need location information to function or may only need access to approximate location information, but InMobi highly recommends that developers request precise location permissions “to enable accurate ad targeting.” They even encourage developers to request Wi-Fi network information permissions, which (when paired with precise location permissions) provide Wi-Fi access point identifiers that can also be used for location tracking.

[Observed on “Getting Started with Android SDK Integration,” 7/31/26]

InMobi has been accused of misleading developers over location sharing practices in the past: In 2016, they settled with the FTC over charges that they bypassed users’ location permissions for apps and tracked their precise locations through WiFi network data (Android now requires apps to request location permissions to access this WiFi data too).

BidMachine Updates Previously Inaccurate Developer Documentation After EFF's Technical Analysis Observed Precise Location Data Collection

BidMachine claims to reach over 600 million “direct SDK users.” 

BidMachine reveals that it collects location data by default on the “Advanced Settings” page of its Android SDK Integration guide, stating that the “SDK can automatically track user device location to serve better ads” as long as developers request location permissions for their app. Before publication, EFF reached out to BidMachine for comment, notifying them of our plan to highlight their Android SDK location sharing practices.  

[Observed on “Advanced Settings” on 7/31/26, before EFF asked BidMachine for comment]

After EFF reached out, BidMachine changed their documentation to clarify the practice, but not their default collection of location information once app-level permissions are granted. This updated section still fails to explain how developers can opt out of BidMachine location tracking, which is critical for app developers that require location access for core features but wish to prevent user data from being shared with advertisers.

[Observed on “Advanced Settings” on 8/3/26, after EFF asked BidMachine for comment]

Before EFF reached out, BidMachine’s “App Privacy Details On Google Play” page had stated that they only collected coarse location data and precise location data was “not collected.” However, our technical analysis of two apps, which Exodus Privacy determined include the BidMachine SDK, contradicted this claim: Network requests from the apps QR Scanner and GPS Speedometer to a BidMachine domain include precise location coordinates.

[Observed on “App Privacy Details On Google Play” on 7/31/26, before EFF asked BidMachine for comment]

After EFF reached out, BidMachine also corrected its documentation to make it clear precise location is collected by the SDK whenever the app-level permission is granted:

[Observed on “App Privacy Details On Google Play” on 8/3/26, after EFF asked BidMachine for comment]

com.appswing.qr.barcodescanner.barcodereader_bidmachine.flows

com.ktwapps.speedometer_bidmachine.flows

In response to our request for comment, BidMachine stated that it wasn't possible for them to get location information “unless the user has granted the app the relevant permission through the operating system.” They also stated that“publishers are responsible for configuring their apps' permission and consent flows.”

Verve Emphasizes Consent More in its Play Store Language Than its Configuration Guide 

Verve has claimed its HyBid SDK reaches “over 1.5 billion users across more than 10,000 apps worldwide.” 

Verve’s configuration guide for its HyBid Android SDK (formerly called Pubnative HyBid) makes clear that location tracking is “enabled by default,” stating, “If the user has given location permissions, HyBid SDK will use the available user location to provide better targeted ads.” 

[Observed on “HyBid Android SDK - HyBid Configuration,” 7/31/26]  

Verve’s guidance for data disclosure to the Google Play Store tells a more careful story. Despite the fact that location tracking is enabled by default, the Google Play Data Safety Guidance states that the SDK “does not collect or attempt to collect [location] information independently.”

[Observed on “Google Play Data Safety Guidance,” 7/31/26]  

It also emphasizes user consent, claiming the SDK will only collect location data “if the publishers allows its app to collect location data from users after obtaining user’s explicit consent to such data collection” (emphasis added). The configuration guide lacks recommendations or instructions for obtaining user consent to share location data with Verve, beyond app-level access. Instead, the configuration guide highlights the financial incentives for developers to add location permissions to their app.

[Observed on “HyBid Android SDK - HyBid Configuration,” 7/31/26]  

When reached for comment, Verve clarified that “in its current Android implementation, the SDK reads the cached network-provider location and does not use the GPS data of the end user's device. Furthermore, any geolocation data is coarsened prior to processing, ensuring that location is limited to an accuracy radius of no less than 1,850 feet.” It also said that it contractually requires apps to comply with data protection laws. 

To Verve’s credit, the HyBid SDK is open source, so careful developers can check the code instead of relying on documentation alone. HyBid’s open-source code shows that latitude and longitude coordinates are rounded to two decimal places, and that it does only collect and share network-derived location data, confirming the statement the company sent to us. If an app has precise location permissions, networked-derived location data rounded to two decimal places could be accurate within approximately 0.5 square miles, which is still more precise than the 1.2 square miles typically revealed with Android’s approximate location permission. But even coarse location data, especially when collected repeatedly over time, can reveal movements that should remain private by default.

Verve’s response also conveyed a willingness to revise their documentation: “As part of our ongoing commitment to providing clear and comprehensive developer resources, we continually review and enhance our documentation, and we will take your observations into account as part of that process.”

Huawei Highlights Financial Incentives for Location Data Sharing Before Showing Developers How to Opt Out

Huawei has claimed its Petal Ads SDK is embedded in more than 85,000 apps worldwide.

Huawei’s “Integrating the Petal Ads SDK into an Android App” guide begins with a recommendation that developers obtain location permissions to increase app revenue and an acknowledgement that location sharing will happen by default in apps with location permissions.

[Observed on “Integrating the Petal Ads SDK into an Android App,” 7/31/26]

A separate “Use of Location Data for Ads” page repeats that the Petal Ads SDK will include users’ location information in ad requests if an app has access to location information. Neither of those pages mention that developers can use the setRequestLocation method to disable the default collection of location information (this setting is referenced in the last section of the Ads SDK Compliance Guide). Huawei’s Ads SDK Privacy Statement states that “The SDK and its services will not store precise location information, and will only use it to determine the approximate device location.” However, the guide does not specify how Huawei defines approximate versus precise location data. 

[Observed on “Use of Location Data for Ads,” 7/31/26]

Location Data Sharing Can Happen Without Users’ Knowledge or Meaningful Consent 

In some cases, after an app itself obtains location permission, advertising SDKs can separately obtain and share users’ location information without their knowledge or meaningful consent. Neither app that EFF observed sharing precise location data with BidMachine (QR Scanner and GPS Speedometer) showed a notice or requested consent before doing so. Additionally, neither apps’ Google Play Store “Data safety” section includes location data under “This app may share these data types with third parties.” The lack of transparency and control that users have over their location on mobile apps is dangerous. QR Scanner and GPS Speedometer are just two examples of apps that quietly share users’ location data through advertising SDKs, but they have been downloaded more than 50 million and 10 million times, respectively. 

App-level location permissions alone cannot signal meaningful consent to location collection and sharing by third-party advertising SDKs.

Even if users’ were to grant these apps permission to obtain their location data, they would likely not expect their location data to be shared with third parties. Many users don’t know that granting location permissions to an app grants the same permissions to third-party SDKs embedded in the app, or that an app they're using contains code from outside companies. And many apps that request location permissions, like GPS Speedometer, require it for core functionality. App-level location permissions alone cannot signal meaningful consent to location collection and sharing by third-party advertising SDKs.

Location Privacy Issues Extend Beyond These Four SDKs

Our initial focus on four advertising SDKs does not mean that other SDKs adequately protect location data or that developers never choose to share location data when it’s not the default. Advertising SDKs not discussed in this report have been criticized and sued for allegations that they collect location data without valid user consent. 

The issues we’ve highlighted around privacy-invasive defaults, financial incentives, and unclear documentation extend beyond the specific SDKs we analyzed. Multiple studies have found that advertising SDKs often steer developers toward increased data collection through their design and documentation. A 2021 study found that popular advertising SDKs used dark patterns to nudge developers towards sharing more sensitive data. A 2024 study identified discrepancies between several SDKs’ documentation and their actual data collection practices. And a 2025 study concluded that developers have minimal influence over SDKs’ data transmission, often leaving them with the choice of accepting SDKs' invasive data collection or avoiding them entirely. 

Fighting Back Against AdTech Companies That Enable and Encourage Location Data Sharing 

EFF’s analysis shows that advertising SDKs don’t just allow developers to share location data–they often encourage it. Default settings, financial incentives, and unclear documentation can make sharing users’ location the easiest option for developers.

Users can take extra steps to defend their location privacy, but they shouldn’t have to. Developers, regulators, and legislators must act to stop apps from leaking users’ location to advertising companies and data brokers.

Developers

Developers should carefully evaluate all third-party SDKs they include in their apps and disable unnecessary data collection whenever possible. Regardless of advertising SDKs’ default settings, developers have a responsibility to protect their users’ location data. But protecting users’ privacy shouldn’t depend on developers reading the right piece of SDK documentation. Advertising SDKs should not make sharing personal data the default, especially for data as sensitive as a person’s location. 

Regulators

Regulators should continue to hold app developers accountable when they unlawfully share personal data and include libraries which subject users to privacy harms, as they have in the past. But they should also scrutinize the companies whose SDKs encourage these practices at scale. Otherwise, companies can continue to design SDKs that make invasive data sharing the default while shifting the responsibility and consequences to developers who include their tools. 

Legislators

The US is in dire need of a federal law to protect all Americans’ location privacy, one which doesn’t preempt stronger state privacy laws, and has a private right of action empowering individuals to sue those who violate their privacy. Countries across the globe should likewise enact legislation that protects their users’ location privacy. Everyone deserves privacy as a universal human right.

Legislators can address the root of the problem by banning online behavioral advertising. This would remove the primary incentive for companies to track and share your personal data. It would also prevent users' precise locations from being broadcast to data brokers through RTB auctions. 

Until then, developers should be wary of ad libraries that betray their users’ location privacy.

Notes on Methodology

We were interested in looking at network traffic for various Android ads SDKs that send precise location by default when granted location permissions. We chose Android for this investigation because of the relative openness of and our familiarity with analysis on the platform. We’ve used publicly available resources like Exodus Privacy and AppBrain to identify popular ads SDKs and the apps which include them.

In a lab setting, we set up a machine to view our own http(s) traffic using mitmproxy from our test device, and connect the test device to that machine in order to view our real-time traffic.  Where needed, we use the dynamic instrumentation toolkit Frida to ensure the traffic we generate can be analyzed.

We’ve included flows files in this post, which can be opened in mitmproxy to show the requests we’ve observed with location coordinates.

Attribution is preliminary, and so far it seems no real damage.

And it seems like this is a campaign that has targeted at least seven states. And, because this is where the US is right now, Trump doesn’t believe it’s Iran and that Minnesota…I guess…hacked itself.

“I think I blame it on Minnesota because they’re grossly incompetent,” Trump said. “I would blame it on Minnesota and the governor, the corrupt governor of Minnesota. They like to say, ‘Oh, it’s Iran.’ Iran should be so lucky. Iran’s got bigger problems than worrying about Minnesota.”...

Lithium-ion batteries are the leading choice in today’s electric vehicle and battery energy storage system industries, but they contain a number of critical minerals — including lithium, cobalt, nickel, and graphite — that are considered essential for economic and national security reasons, and therefore vulnerable to supply chain disruptions. As renewable energy, electrified infrastructure, and high-power digital technologies continue to grow, there is an increasing need for energy storage systems that are low-cost, resource-abundant, and capable of fast charging and discharging. 

That need, among other reasons, has motivated a group of researchers — based at MIT and led by Ju Li, the Carl Richard Soderberg Professor of Power Engineering in the departments of Nuclear Science and Engineering (NSE) and Materials Science and Engineering — to develop complementary energy storage solutions. 

The team is looking, in particular, at sodium-metal batteries, which offer several attractive features. Sodium is about 1,000 times more abundant than lithium and, pound for pound, about one-hundredth the cost. A key challenge, however, is that sodium metal is highly reactive, making it difficult for these batteries to achieve both long-term stability and fast cycling. 

A new paper in the journal Joule — written by 15 members of the MIT team and published online this week — shows how this dilemma can be addressed by finding the right electrolyte for this battery system.

Electrolytes behaving badly

An electrolyte is one of three main components of a battery, along with the negative electrode (the anode) and the positive electrode (the cathode). The electrolyte acts like the “blood” of the battery, allowing electrically charged ions to move between the two electrodes. “The electrolyte is supposed to just transmit those ions,” explains Li. “It’s supposed to be an ion conductor.” But unfortunately, most electrolytes get involved in unwanted chemical reactions with the electrodes, which can greatly undermine battery stability.

The consequences of these “side reactions” can be severe, says Weiyin Chen, a postdoc in NSE and one of four lead authors of the Joule paper. Insoluble compounds produced during the reactions can build up on the electrodes, creating a barrier that blocks ion transport and can eventually cause the battery to fail. 

Until recently, Chen says, no electrolyte used in sodium-metal batteries was fully stable against these unwanted reactions at both the anode and cathode, even though such stability is essential for rechargeable batteries to achieve a long cycle life. An initial breakthrough occurred in 2021, when the Li group and their collaborators identified a “sulfonamide” molecule — consisting of sulfur, oxygen, and nitrogen atoms — that, when used as a solvent, “is magically stable at both electrodes in lithium batteries,” according to Li. This molecule is known as DMTMSA. 

Building on that discovery, Li and his colleagues set out to see if related molecules could improve sodium batteries. The goal was not only to maintain stability, but also to enable fast charging and discharging. If charging is too slow, it could take all night to recharge, and if discharging is too slow, the battery cannot deliver much power when needed.

How did the solvent cross the road?

Chen explains the idea with an analogy: Suppose you need to cross a street jam-packed with pedestrians, much like ions traveling from one electrode to another. “You can move more quickly through the crowd with a small backpack that is snug against your body, rather than dragging a bulky suitcase on wheels,” Chen says. 

A similar situation occurs in batteries: When sodium ions are surrounded by smaller solvents, they can move faster than when they are surrounded by larger, bulkier solvents. Faster ion transport enables more-rapid charging and discharging. The team’s goal, accordingly, was to identify solvent molecules that are small enough to improve ion transport while still maintaining electrolyte stability.

There is, however, a complicating factor — a trade-off to be addressed: Faster ion transport often comes at the expense of electrolyte stability. Many highly conductive electrolytes react more easily with the electrodes, shortening battery life. Fortunately for their plan, Li says, “reducing the size of solvents provides a new pathway to overcome this trade-off.” 

The question then becomes how to find a smaller solvent that has other desirable properties. The idea they adopted is to look for molecules that are “congeneric,” says Li, “meaning that they belong to a similar family and are molecularly similar.” In particular, they searched for molecules related to DMTMSA, hoping to find candidates that were smaller but could retain the stability that made DMTMSA so promising.

Chia-Wei Hsu, an MIT PhD student in materials science and engineering, created an AI-guided algorithm, which designed 100,000 candidate molecules on his computer within 24 hours. Hsu then narrowed down the pool to 200 candidates by applying a set of technical criteria — including similarity in shape to DMTMSA and comparable electronic properties. Twenty-seven representative candidates covering the full range of possibilities were selected for experimental tests. 

“We tested them all under the same conditions to make it a fair, head-to-head competition,” Chen says. A clear winner emerged, a solvent called DMFSA, which was both the smallest and the best.

Small is beautiful

This work, claims Jinhyuk Lee, an associate professor of materials engineering at McGill University who is not part of the study, “addresses one of the most persistent challenges in battery research: improving battery performance at high charging and discharging rates without sacrificing long-term stability. By carefully tailoring the size of solvent molecules, the authors demonstrate a new design strategy that could enable lower-cost, higher performance batteries.” 

The group is not done. A new search is underway to find an even better solvent. This time, the approach is similar, but DMFSA (rather than the larger DMTMSA molecule) serves as the starting point. Chen believes the new solvents they are uncovering could eventually lead to rechargeable sodium-metal batteries that combine low-cost, abundant materials with fast charging and high-power performance, opening the door to broader energy storage applications.

The overriding goal of this work, the authors emphasize, is not only to advance sodium batteries. It’s also to introduce a new approach to electrolyte design that uses solvent size and molecular similarity as the key guideposts. Viewing the research in this light, sodium-metal batteries serve as a model system for demonstrating a more general design principle.

“Because the concept is broadly applicable,” Lee comments, “its impact could extend well beyond sodium batteries and influence the design of a wide range of future energy storage technologies.”

This work was supported, in part, by a National Research Foundation of Korea grant funded by the government of Korea government, as well as U.S. National Science Foundation graduate research fellowship. The characterization equipment used in this project is partly from the MIT.nano Characterization Facilities. 

In the scorching heat of every Las Vegas summer, EFF joins thousands of hackers, makers, policy analysts, and activists for the world's largest computer security gathering. If you're there during this summer security week, be sure to say hello to us at BSides Las Vegas, Black Hat Briefings, and DEF CON 34. While tech companies align with governments to target the people, our community is harnessing technology to fight back. Will you lend your support this year?

JOIN EFF

EFF’s relentless work in the legal system makes a meaningful difference for privacy and free expression everywhere. But we also know that your rights won't wait while the wheels of justice turn.

Sometimes hacking the system means creating tools and resources to protect your rights today. That includes EFF’s Privacy Badger, Certbot, Surveillance Self-Defense guide, and the countless security trainings that our team conducts for vulnerable populations—all thanks to EFF member support.

Technology is inseparable from our workplaces, schools, healthcare, the justice system, and our democratic process. If you think tech should benefit everyone and not just accumulate wealth and control for the powerful, then congratulations: We'd like to welcome you to the team.

Hayley and Joe take a break from EFF’s Activism Team to show off EFF’s DEF CON member t-shirt.

For a limited time only: Get EFF’s “Many Hands Make Light Work” t-shirt designed for the DEF CON 34 hacker conference by EFF artist Hannah Diaz. Don’t miss the link to the online puzzle incorporated into the design! With the strength of community and the spirit of curiosity, we can hack anything.

Many thanks to our puzzlemasters Aaron Steimle (AKA Elegin) and Kevin Hulin (AKA CryptoK). Elegin is our longtime collaborator on the EFF shirt puzzle, and previously a multiyear winner of this very contest. CryptoK is a crypto puzzle enthusiast and also develops challenges for the DEF CON Crypto and Privacy Village's Gold Bug Contest.

Members can also choose from EFF’s puffy stickers, the internet tracker-obsessed Privacy Badger embroidered sweatshirt, and our ALPR-focused “Claw Back” t-shirt.

EFF member t-shirt designs: Claw Back and Many Hands Make Light Work

EFF fights to protect fundamental rights for everyone, and your privacy and free expression have never been more important. Support the cause today! Together we can make sure that technology supports freedom, justice, and innovation for all people.

And it’s personal information (alternate link):

The exposed data includes an AI-powered therapy app that someone appears to have vibe-coded, notes on meetings, and a dashboard someone made apparently to analyze medical billing data. Exposed chats reportedly include private cryptocurrency wallet keys and personal information like peoples’ addresses.

What seems to be the issue is a user setting about data sharing. Anthropic’s position is that it’s not their problem:

“We give people control over sharing their Claude conversations publicly, and in keeping with our privacy principles, we do not share chat directories or sitemaps with search engines like Google,” the company said in a statement. “These shareable links are not guessable or discoverable unless people choose to share them themselves. When someone shares a conversation, they are making that content publicly accessible, and like other public web content, it may be archived by third-party services.”...

A summer surge in power consumption is straining regional grids that are also seeing a boom in data center energy demand.

Requiring companies to disclose their climate risks provides valuable information that otherwise isn't always available, they said.

Former Republican EPA leaders and a conservative scholar join Democrats supporting local efforts to sue for climate-related damages.

House and Senate Democrats are looking for more data on how home insurers calculate their pricing.

The world hit a milestone of 3 terawatts of solar deployed this year.

Member countries are worried that low-carbon quotas in the Industrial Accelerator Act could push up prices and hurt Europe’s competitiveness.

Firefighters continued to battle wildfires in southern Greece and France on Monday, and much of the U.K. is officially in drought.

Illegal land grabbing, cattle ranching and expanding infrastructure continue to put heavy pressure on the Amazon.

A one-size-fits-all approach likely isn’t the best strategy when designing artificial intelligence systems that assist users in disease diagnosis.

A new study by researchers at MIT and elsewhere found that, while AI assistance generally improved the accuracy of non-experts and clinicians in diagnosing skin diseases, AI explainability methods had different impacts depending on the users’ knowledge level. 

Explainable AI methods help users know when to trust a model’s predictions by describing or validating the model’s decision-making. For instance, a model might use a heat map to highlight image regions that were most important in its diagnosis or a large language model (LLM) to explain the prediction in plain language.

In this study, researchers tested non-experts and primary care providers in skin disease diagnosis, with and without the help of different explainable AI systems. 

They found that non-experts’ diagnostic accuracy improved, but it was largely due to deference to the AI system. Non-experts trusted LLM-based explanations whether they were right or wrong, and found explanations more convincing when they were vague or generic.

By contrast, clinicians were not tripped up by incorrect AI assistance and performed best when given only a model’s prediction, with no accompanying explanation. 

“Good AI systems can improve performance in some health settings, but this has to be balanced carefully with algorithmic deference that can lead to more error. We know that both AI and explainability methods can engage automation bias in humans, and this anchoring effect is something that must be accounted for when we design AI systems,” says Marzyeh Ghassemi, an associate professor in MIT’s Department of Electrical Engineering and Computer Science (EECS), a member of the Institute for Medical Engineering and Science, and a principal investigator at the Laboratory for Information and Decision Systems and the Abdul Latif Jameel Clinic for Machine Learning in Health.

“These findings are important as patients increasingly turn to AI to help with their health care. Our findings show that those with the least medical knowledge are most likely to be led astray when explainable AI models give an erroneous output,” says Roxana Daneshjou, a co-author and assistant professor of biomedical data science and dermatology at Stanford University.

These results underscore the importance of building AI systems with users in mind and of developing explainability methods that encourage critical thinking rather than overreliance on the model, the researchers say.

“It’s getting obvious that we cannot just assume a good AI will solve all problems. We need to pay careful attention to the users who will be using the AI system, because the same explanation can help an expert and mislead a beginner. Often the people who could benefit most from AI are the ones most likely to be led astray by it, so how we present a recommendation matters as much as whether it’s correct,” says lead author Orson Xu, an assistant professor in the Department of Biomedical Informatics at Columbia University.

Ghassemi, Xu, and Daneshjou are joined on the paper by many authors, including MIT graduate student Haoran Zhang, undergraduate Reina Wang, and Luis Soenksen PhD ’20, a research affiliate at the Jameel Clinic, along with clinicians and researchers. A description of the work appears today in Nature Medicine.

Exploring explanations

Several FDA-approved AI interfaces are being used to help clinicians identify skin conditions in medical images, as a way to streamline early diagnosis. In addition to providing a prediction of whether disease is present in the image, these tools often use one of several methods that explain the model’s decision-making.

At the same time, non-experts can perform digital diagnosis on their own using AI-powered search engines that predict skin diseases based on user prompts. These systems often use LLMs to explain the model’s prediction in simpler terms.

The researchers explored the effects and potential benefits of these explainable AI tools on primary care physicians and non-experts in dermatological disease detection. They tested users by showing them medical images plus an AI prediction of skin disease, employing different explainable AI approaches. 

These approaches included: an AI prediction and confidence level with no explanation, a method that provides similar images to reinforce its prediction, a heat map-based approach that highlights important image regions, and an LLM that explains the model’s reasoning in plain language.

Non-experts were tasked with deciding whether an image of a skin mole was cancerous, with and without the help of explainable AI. Clinicians were given the more challenging task of providing a differential diagnosis of dermatological disease.

The researchers found that all explainable AI approaches improved the accuracy of non-experts, mostly because the tools helped users diagnose non-cancerous moles. 

In addition, when they employed a fairness-constrained model designed to combat bias against darker skin tones, the system significantly improved accuracy and reduced diagnostic disparities based on skin tone.

“But the reason non-expert users are better is because they are more reliant on the models. When the model is wrong, it hurts performance more than it helps performance when the model is right. We were just able to train very good AI models for this setting,” Ghassemi says.

This deference effect is largest with LLM explanations, and users were more confident about their wrong answers when aided by an LLM.

On the other hand, clinicians were resilient to incorrect AI explanations and, of all the explainability methods, LLMs boost their accuracy the least.

“It really comes down to how each group uses the explanation. A clinician already has a diagnosis in mind and checks the AI against their own training, so a bad explanation gets caught. Meanwhile, a non-expert can use that exact same explanation to form an opinion in the first place, so a plausible, confident-sounding rationale can pull them toward the wrong answer. The same tool ends up being an asset for one user and a liability for another,” Xu says.

Overcoming the deference effect

When the researchers dug deeper, they found that users who were most deferential to AI assistance were the worst performers on the task without the help of AI. 

They also found that the time at which users were presented with AI explanations influenced their behavior. If an explanation is given first, before the user can perform the diagnosis on their own, they tend to become more deferential to the model.

In addition, AI systems outperformed humans when the presentation of disease was subtle, but humans performed much better if there are atypical symptoms or unrelated features in an image.

Taken together, these results indicate that explainable AI can cause overreliance on models and lead users to blindly follow AI recommendations even when they are wrong. 

Rather than using LLMs to generate more detailed explanations, it might be more effective to force users to give a diagnostic hypothesis first, then provide an AI-based suggestion to highlight other possible conditions for consideration. 

“We really want AI to improve creativity and either upskill or fill in gaps where users are missing subtle presentations. Otherwise, we risk engaging automation bias and then, when the model is wrong, users can’t recover,” Ghassemi says. 

This research was funded, in part, by the National Science Foundation, Schmidt Sciences, the National Bureau of Economic Research, and Columbia University.

Nature Climate Change, Published online: 04 August 2026; doi:10.1038/s41558-026-02729-3

Climate change communication shapes how societies perceive risks and respond to them. In this issue of Nature Climate Change we examine the evolving content and methods of climate communication, the challenges of urgency and injustice, and the strategies for building effective and inclusive communication channels.

Nature Climate Change, Published online: 04 August 2026; doi:10.1038/s41558-026-02714-w

Communication is essential for keeping communities safe when climate disasters occur. Here, we explore how disaster communication informs protective actions and examine five challenges: false information, exhaustion from repeated disasters, unequal access to information, polarized climate attitudes and mental health.

Nature Climate Change, Published online: 04 August 2026; doi:10.1038/s41558-026-02680-3

Social media have become an important arena for climate change communication. This Review synthesizes climate-related content on social media, its effects on climate attitudes, knowledge and behaviour, and its role in reshaping the broader communication landscape.

Nature Climate Change, Published online: 04 August 2026; doi:10.1038/s41558-026-02711-z

Individuals and groups shape others’ attitudes and actions through social influence. This Perspective articulates a research agenda of social influence for climate action, synthesizes existing evidence and highlights its practical relevance for designing effective behavioural interventions.