Last week, two federal appeals courts issued opinions that will allow Florida and Georgia to start enforcing laws that will age-gate and block young people from accessing social media. The laws do not adequately respect minors’ rights to play, speak, and learn online. More fundamentally, these laws don’t help young people stay safe online—a goal that lawmakers should pursue.

Age-Gated? Email EFF at agegates@eff.org. 

Because of the new laws, some young people will lose their ability to access lawful information, find their online communities, and even engage with school board members. Others will need parental permission to stay online. And adults will face increased demands to prove their age, which will put their privacy at increased risk simply to continue to use the services they already use. 

We opposed these laws because they threaten the free expression and privacy of both minors and adults.  Even though these lawsuits are not over, the injunctions that paused enforcement have been lifted, and the states of Florida and Georgia will now be able to enforce broad restrictions on social media use. 

The restrictions that these states will start enforcing are a setback for the rights of all internet users, but they are not written in stone. That’s why EFF is encouraging internet users - and particularly young people – to start keeping a record of how they are affected. If you are a teenager who loses access to an online discussion, can’t participate in a political campaign, or stop seeking information because you don’t want to upload personal information, document what happened. The same is true for adults who may be mistakenly blocked by age checks, and parents who may encounter obstacles to authorizing their children's use of online services. These experiences matter. They can help us show courts, policymakers, and the public what government restrictions on online expression actually cost the people who live under them. 

Hopefully, with enough proof of the expressive harms these laws cause, we can push lawmakers to rescind them. That’s why we’re encouraging folks to reach out to EFF once they’ve documented these harms. You can write to us about this issue at the email address agegates@eff.org. 

The Decisions

These two opinions, issued by the same panel from the U.S. Court of Appeals for the 11th Circuit, allow Florida and Georgia to enforce restrictions on social media accounts for people under 16 years old. The requirements differ by state. 

In Florida, the judges allowed that state’s H.B. 3 to move forward, which requires covered platforms to ban anyone under 14 from opening or keeping accounts—even with parental permission. Teenagers who are 14 or 15 can have accounts only with parental consent. To be covered, a platform has to use algorithms, allow content uploads or the viewing of other peoples’ content, and have at least one feature on a list of features the state considers bad, including livestreaming, engagement metrics, autoplay, infinite scrolling, or push notifications. These requirements effectively apply to every major social media service that young people use.

To the extent there is a silver lining in the ruling on Florida’s law, it’s that the panel recognized that H.B. 3 targets expression protected by the First Amendment. The problem is that the ruling uncritically accepts the idea that a social media service is addictive in a clinical sense, even if just 10% of users under 16 are using the platform for two or more hours per day (the standard set in H.B. 3). The court simply accepts that time spent online is a proxy for harm. The bill doesn’t distinguish doomscrolling or compulsive use from organizing a campaign, making art, or talking with friends. 

In Georgia, S.B. 351 can now be enforced. That law requires parental consent for anyone under 16 to hold an account on social media platforms. It also requires platforms to make “commercially reasonable efforts” to check users’ ages, which creates a hurdle for adults as well as under-16s. 

The ruling acknowledges that S.B. 351 “overwhelmingly applies to platforms that overwhelmingly host protected speech.” But the ruling faults the plaintiffs for not being able to show that “invalid applications substantially outweigh the valid ones.” That asks the groups challenging the law to meet a virtually impossible standard—to make their case, they would have to measure and evaluate the content hosted by all online services affected by the law. 

Both of these cases may be further appealed, and are likely to continue in the lower courts. But people in Georgia and Florida can no longer count on court injunctions to protect their access to the web. What the effects will be going forward depends on how platforms implement these new restrictions, including how they check ages and parental consent, as well as state officials’ views on these efforts. 

If you hit an age-gate while online, check out our blog post about how you might want to proceed, and our age-gating resource hub. If you want to speak out about your experience, you can talk to us at agegates@eff.org.

What is Lost

Some youth who lose their social media accounts will lose contact with friends. Others will lose access to a support group, the ability to speak out on current issues, or an audience for their artwork. More young people will be shut out of discussions about what’s going on in their school and their community. U.S. law has long recognized that people under 18 have their own rights to speak and receive information. These new laws interfere with those rights. 

The Florida opinion suggests that young people can browse the internet without an account, or use a parent’s account. But that doesn’t help those who might participate in a private group, send a personal message, or speak to an audience they have built up. Nor does it recognize the reality that in many households, young people may not have the ability to use a parent’s device, or even have healthy relationships with their parents. For parents of children under 14, the Florida law also overrides parental autonomy—even if parents wanted to allow their child on these services, they cannot do so by law. 

These laws won’t just harm younger kids. Adults and older teens will bear the cost of the new rules. In order to figure out who is young enough to not be able to join, or who needs parental consent to join, services will have to check users’ ages. That likely means asking people to submit ID or other sensitive information. Some people will be mis-classified as too young; others will decide that they’d simply rather stop participating instead of handing over even more personal data. 

Keep A Record

Between the recent Meta settlement and these 11th Circuit decisions, despite widespread opposition, age-gating is becoming a reality for the American internet. As these laws are enforced, we need to understand what they mean for the people who have to deal with them. And we need to create a record of their effects on everyone’s speech so we can push to repeal them.

If you encounter a restriction due to these laws that affects you, keep a record, ideally while the details are still fresh in your mind. Screenshots, along with notes about the date and time, the service involved, and the task you were trying to accomplish, will all be helpful. 

Did you lose an account or can’t participate? Describe what you lost. Were you using a group to organize a club, volunteer in your community, or keep in touch with friends? Did losing your account cut you off from people you wouldn’t otherwise be able to be in touch with? Even if you just used the account to access local news or follow your favorite content creator, that’s still a significant loss of your right to access information online.

Record problems with age checks and parental consent. What information did the service request from you? Were you able to provide it? Did it reject your age proof, or classify you incorrectly? If you’re a parent, were you able to give permission, and what did you have to provide? What promises did the service make about what it did with the data it collected from you? Save explanations given by the platforms or any services they employ to age gate, including any law they cite. If you are to appeal a result and choose to, keep track of those attempts as well. 

You can also document choosing to drop out. If you abandon an account or service because you’re unwilling to provide ID or other personal data, write down what you gave up, and why. You don’t need to submit sensitive information to show that you are burdened by new rules. 

You Can E-Mail agegates@eff.org

If these restrictions affect you, we encourage you to reach out to EFF by emailing agegated@eff.org and telling us more about what happened. 

EFF will continue to oppose laws that prevent adults and minors from expressing themselves online, or that push people to give up their privacy to participate in the digital world. These recent court decisions are setbacks, but they don’t settle the debate. By keeping track of people who lose access, age-check failures, and the online conversations that can no longer happen, we’ll be in a better position to challenge the worst of these restrictions, in both legislatures and courts. 

And in the meantime, EFF will keep fighting for laws that actually make us safer online—like stopping social media companies’  harmful surveillance of all internet users. We’ll continue to push for laws that empower parents, children, and all internet users to have meaningful choice and control over their online services. Those goals can make everyone safer online, while preserving our ability to speak and access information. 

Further Action 

• Email EFF about your experience at agegates@eff.org . 

Further Reading

• 11th Circuit Opinion in Netchoice v. Carr (Georgia)
• 11th Circuit Opinion in CCIA, NetChoice v. Uthmeier (Florida) 
• EFF amicus brief in Florida case
• EFF amicus brief in Georgia case
• EFF’s Age Verification Hub

The Indian CA eMudhra Limited has eight TLS certificates with laughably weak private keys:

The compromised eMudhra keys were defective at a level that’s challenging the imagination of many of the engineers studying the incident. A normal size for a NIST P-384 elliptic curve cryptography private key contains roughly 384 bits of entropy, a size allowing almost 2384, or a number with 116 digits, different possibilities. The private key sizes of the compromised keys ranged from 3 to 8 bits. Astonishingly, the private keys were 4, 56, 66, 115, 155, 156, 230, 237...

Generative artificial intelligence models are rooted in ideas of mid-20th century engineers who thought some amount of irrationality was essential for a machine that could think like a human, contends Benjamin Lindquist, an assistant professor in the MIT History Section, who holds an MIT Schwarzman College of Computing shared position with the Department of Electrical Engineering and Computer Science (EECS) and is a principal investigator in the Laboratory for Information and Decision Systems. 

To mimic creative thinking, these AI pioneers intentionally injected randomness into algorithms designed to deterministically solve problems, Lindquist writes in a new paper that appears in the journal Past and Present. In the paper, he traces the origins of AI hallucinations back to this early research and suggests there will be inevitable tradeoffs between creativity and predictability when trying to build machines that mimic human behavior. MIT News spoke with Lindquist about these ideas.

Q: Why did early computer engineers believe they needed to inject randomness and irrationality into AI systems designed for logic and calculation? 

A: There is a long history of many figures in the world of science and art theorizing that chance plays an important part in discovery and creativity — in the ability to originate ideas. They equated creativity with unexpected leaps of logic, or even a dream-like state that allows you to think about things from a new perspective. 

In the early 1950s, one popular idea from John Pierce, who was a prominent electrical engineer at Bell Labs, was about math being valuable in the world of art. The idea was shared by a lot of people working in early computing. When we think of artwork that includes math, we may think of something very orderly and precise, but Pierce came to the opposite conclusion. He concluded that the utility of math is that it could remove order from art. Then in a very calculated way, math could add a burst of the unexpected as a means to deviate from clichés and add an element of irregularity which just might lead to insight. 

One popular way to add irregularity into otherwise predictable computers was through artificial (or random) neural networks. Many early neural networks were built by psychologists, who thought that by enabling scientists to build a model of the brain, artificial neural networks allowed scientists to observe what is happening inside, including how brains make productive mistakes. Rather than being black boxes, researchers believed these systems could open this black box of the mind and let scientists peer inside and see all the messy stuff that was really happening.

But there was another camp in the world of AI who thought that creative thinking was just “normal” thinking done better. It is interesting to look at these two very simplistic heuristics for understanding intelligence and creativity, and how they do and don’t mesh. The debate, then, was about trying to determine what human inventiveness boils down to, and then how to reconstitute human inventiveness in machine form. 

Q: How did these early computer engineers view AI, and how is it different from the way we think about AI today?

A: When we think of AI systems, we think of ChatGPT or Claude. We value and use these systems because they give answers that, most of the time, are correct. One of the things that was most interesting to me in this research was finding out that a lot of the early advocates of these systems valued them for exactly the opposite reason. They wanted a system that, on occasion, gave answers that deviated from their expectations. They already had systems that could deliver reasonable and expected answers. They saw neural networks as valuable because they could give unexpected, perhaps even strange and bizarre answers.

One reason we might view these systems differently today could be because of how they operate. Early on, these systems were confined to laboratories, so there weren’t really any real-world consequences of a system that gives a strange, or wrong, output. But now there are legal and monetary reasons why OpenAI or Anthropic doesn’t want a chatbot that gives unexpected or creative answers. There has been a “sanding down” of strangeness in these systems. They still potentially have that at their core, but it is something that is now largely suppressed.

Q: How did early neural networks that incorporated randomness to simulate human creativity evolve to become the dominant paradigm in AI?

A: For a long time, a specific kind of AI called “symbolic AI” was the dominant approach. Essentially, symbolic AI says the world is based on rules. The role of the AI researcher is to try and reconstruct the knowledge of the world in facts and propositions and feed it into a computer.

Neural networks, with their use of randomness to solve problems, started to gain traction in the 1950s but fell out favor early on. Frank Rosenblatt, a psychologist who was a very important early figure in neural networks, died prematurely; he died accidentally on his 43rd birthday in 1971. He was quite a charismatic and forceful personality, who made a lot of grand promises about what systems based on neural networks could do. By the time he died, a shift toward symbolic AI was already underway. It is possible if, had he lived, things might have turned out differently.

But neural networks never went away. By the 1980s they had shifted more into the world of cognitive science. To become more powerful, and more useful, neural networks needed a lot of data and computational power. That didn’t really arrive until the advent of the internet, when a lot of data became available and computing started to power up. Around 2012, neural networks started to outperform and outpace a statistical form of machine learning, and they kept growing from there.

Q: What lessons can we learn from studying AI’s history that could inform its development? 

A: I think there is a cautionary lesson here. The ideas and experiences of these early engineers tell us that we can work toward quashing hallucinations — we can work toward making AI perform a certain way so it doesn’t produce unexpected or unwanted answers — but there are going to be other consequences of that. These historical figures were onto something. There is a connection between the surprising and creative conclusions AI can offer and errors or hallucinations. There are tradeoffs when we build our systems to behave one way or the other. Maybe it is impossible to be completely at either end of the spectrum, but when we work toward one thing robustly, we often sacrifice something else unintentionally.

When Veronica Calzadilla Sosa transferred to MIT from Miami Dade College in Florida, she was an incoming second-year student with an interest in chemical engineering. She didn’t know how involved she would soon become as a student leader in the department.

She would also go on to discover her competitive side.

At the encouragement of a friend who was then a team captain, Calzadilla Sosa joined MIT’s chapter of American Institute of Chemical Engineers, and the two worked with the Department of Chemical Engineering to build up the team of students representing MIT in the organization’s lively chemical engineering competitions. As the organization’s competition chair last year and the vice president of external relations this year, she has fallen in love with the club and found joy in bringing students together to work toward a common goal and have fun along the way.

When she first took on the role, MIT was new to the competition, and students were participating in only one of several events. Now, they participate in three categories: ChemE Cube (where teams build a miniature chemical plant that fits inside a 1-cubic-foot cube), ChemE Jeopardy (a “Jeopardy!”-style trivia competition), and ChemE Sports (where teams operate and optimize a virtual chemical plan). 

Calzadilla Sosa also captained MIT’s first ChemE Sports team, working alongside two first-year students. At their first competition, their challenge involved optimizing a distillation column, drawing on concepts Calzadilla Sosa was learning in her separation processes class. The team placed second at regionals.

“The competition was challenging, technical, and at times stressful, but also incredibly fun and rewarding,” she said after the event. “Experiences like this remind me how much engineering extends beyond technical knowledge alone.” 

For Calzadilla Sosa, the experience was about more than the result. It gave her the chance to take on a leadership role, work through unfamiliar problems with her teammates, and help create an opportunity for students who might not otherwise have participated.

Building community has been particularly important to Calzadilla Sosa, who began her undergraduate education in Cuba before moving to the U.S. When she later transferred to the Institute after earning her associate degree from Miami Dade, where she was part of the Honors College, “I was a sophomore for the third time,” she jokes. At that point, many of her new classmates had already spent a year getting to know one another and finding their footing.

She began to find her place in an unexpected setting: office hours.

During her first chemical engineering class at MIT, Calzadilla Sosa regularly went to office hours for help with difficult problems. She soon noticed that she was not the only one struggling.

“I was there because I was struggling with a problem, but then I would see more people also struggling with the same exact things,” she says. “And that, for some reason, gave me this idea that I wasn’t alone in that sense.”

Those shared struggles became a starting point for conversations, friendships, and a support system. She learned that finding a community did not necessarily mean having everything figured out. 

“Sometimes you find your community simply by allowing yourself to struggle alongside other people,” she says.

Throughout her undergraduate experience, Calzadilla Sosa has also explored the many ways chemical engineering can be applied beyond the classroom. 

While studying in Miami, she interned with the U.S. Food and Drug Administration, analyzing data on toxic elements in food, and with the engineering consulting firm Jacobs, where she learned about water and wastewater infrastructure projects in the county. As an MIT student, she has been a materials intern at the medical device company Convatec, and a materials chemistry/chemical engineering intern at the startup Folia Materials. 

In the process, she has gotten a closer look at different industries and begun to figure out which ones interest her most. At MIT, she has become particularly interested in energy systems and how existing resources and infrastructure can be used more efficiently.

“I think exploring different areas is very valuable,” she says. “I find myself thinking ‘Maybe I could do this or I could do that. Maybe I don’t like this. Maybe I prefer doing another thing.’”

Outside of her studies, Calzadilla Sosa enjoys cooking and baking for family and friends, traveling, and going to concerts and dance performances. She also likes bringing people together, especially when she returns to her first home in Cuba and has the chance to reconnect with loved ones.

As graduation approaches, Calzadilla Sosa is excited to leave student life behind and see where her degree takes her. She has not settled on one career path, but she is comfortable with that uncertainty. After studying at multiple institutions and exploring different corners of chemical engineering, she knows there is still plenty left to discover.

“I spent so many years as an undergrad, so I’m really excited to go to industry and take that next step and see the results of my education,” she says.

Nature Climate Change, Published online: 23 October 2026; doi:10.1038/s41558-026-02772-0

Extreme southward swings of the South Indian convergence zone (a major source of rainfall across southern Africa) can trigger devastating floods. Climate-model projections indicate that these swings might occur twice as often in the twenty-first century as in the previous century and produce more intense rainfall, owing to an increased land–sea temperature contrast and poleward intensification of atmospheric circulation.

Canada’s Parliament is debating a massive expansion of surveillance powers that will threaten the privacy and security of millions of people. Bill C-22, also called the Lawful Access Act, has already passed the House of Commons, and is now before the Canadian Senate. 

Canadians still have an opportunity to speak out and stop this dangerous legislation. The Canadian Civil Liberties Association (CCLA) is urging all Canadians to sign its petition opposing the bill. (The petition on CCLA’s website is governed by CCLA’s privacy policy.) 

Take action

Tell the canadian senate to stop C-22

As we wrote earlier this year, Bill C-22 gives the government new powers to force digital services—including telecom companies, messaging apps, and more—to help with government surveillance. Worse, it allows Canada’s Minister of Public Safety to order companies to create a backdoor to their services for law enforcement, as long as it doesn’t lead to a “systemic insecurity.” That’s a clear recipe for weakening the encryption we all rely on. 

It also requires services to retain metadata for up to a year, which reveals who people communicate with, where they go, and what services they use, even when they are not suspected of any crime. 

Researchers at CCLA and Citizen Lab published a detailed analysis of C-22 and its serious constitutional and cybersecurity problems. The analysis points out that the bill needs more than cosmetic changes—it calls for entirely withdrawing Part 2 of Bill C-22, the section that establishes the surveillance and data retention regime. 

Bill C-22 could also expand the sharing of Canadians’ personal data with foreign law enforcement, including the United States. Canada has been negotiating a cross-border data-sharing agreement with the U.S. that would allow American police to get information about Canadian internet users without any Canadian court oversight. 

Some Canadian senators have already expressed concerns about the bill, and rightly suggested, as CCLA and Citizen Lab have, that it may not be compatible with privacy protections in the Canadian constitution. 

If you’re in Canada, read and sign CCLA’s petition opposing Bill C-22 today. Don’t let the Senate allow this dangerous expansion of government surveillance to become Canada’s new reality. 

Take action

Canadians: defend your privacy and security

As a child, you likely saw a few Disney movies depicting inanimate objects, such as clocks, cups, and toys, as interactive companions to humans — an act of pure magic, seemingly. But scientists at MIT’s Computer Science and Artificial Intelligence Laboratory (CSAIL) are now doing something similar: transforming stationary items into self-aware tools that perceive and respond to human motion to complete a task.

Engineers have 3D-printed these dynamic items with built-in sensing, using conductive materials for sensors and traces (sort of like wires) inside. The issue: both components were typically fabricated using the same material, so they’d emit similar signals. It’s sort of like hearing two radio stations at the same time, a mixup that’s hard to interpret. This confuses, say, a glove that relays instructions to a robotic hand about how to handle a specific object. The device couldn’t filter out the noise or verify the angle of a user’s motions, leading a humanoid student to make errors.

Researchers at CSAIL and Tianjin University (TJU) in China may have found a way to 3D print more precise interactive items. With their “X-Hinges” software, users can customize a design, and the tool will automatically embed two different materials: a filament for the sensors designed to send the strongest signal possible, and another for the wire-like elements that don’t interfere. Interactions won’t get lost in translation, meaning users can fabricate objects that respond in real-time, such as small robots, household decor, object-detection systems, and toys.

With X-Hinges, users can put together an item by selecting and connecting different shapes, then choosing how certain parts move. The item won’t be limited to moving in just one way like previous approaches; instead, users can select up to three “axes:” compressing, up and down, or to the sides. Building a robotic hand, for example, you’d likely want its fingertips to move vertically and laterally. The new tool would then embed sensors where the object bends (in this case, its joints) to capture motion data from both angles. That way, the device can understand and respond to your interactions more dynamically once it’s 3D-printed.

“It’s kind of like adding a conscious element to everyday objects,” says Jiaji Li, MIT electrical engineering and computer science (EECS) postdoc and CSAIL researcher, who is a senior author on a paper introducing the work. “What you get is objects that better understand how they’re being used and have more ways to respond. In the same way an AI agent is programmed to make certain decisions based on our instructions, these creations have built-in sensing to adaptively react to human touch.”

Jiaji Li and lead author Xiang Chang, a TJU PhD student and visiting researcher at CSAIL, used X-Hinges to create many clever devices. For example, they made a glove that can teach a robot how to grasp blocks. It adjusts to the size of a user’s hands, then records how the joints in their fingers bend via sensors before rapidly relaying that information to a humanoid hand to mimic it. The glove could be useful in factories or homes, where a robot often needs to learn new interactions quickly.

The researchers also produced a small, origami-style lamp using X-Hinges. It senses when a human pinches it closed and adjusts its brightness accordingly. When you turn on this adaptive, portable light source (sort of like a reading light), it looks like a piece of folded-up paper that sprouts into a lamp.

X-Hinges can even assemble devices that identify which objects have been placed on it. You could put a banana on top, for instance, and it’ll recognize the fruit almost immediately based on the tactile data it’s recorded using its sensors. This advanced physical awareness could be integrated into detection systems in places such as airports and grocery stores. 

Behind each of the scientists’ creations is an easy-to-use interface that helps you design interactive objects from scratch. Users can choose how each part of their design looks and moves, just as the researchers did when making a video game controller that resembles a cartoon shark.

X-Hinges gives you four shapes to choose from: a custom option, cylinder, rectangle, and thin outline. To recreate the unique look of a shark’s tail, the researchers designed their own shape. They then chose how the toy bent, opting for its tail to move up and down, sort of like a joystick. Finally, the program embedded the sensors, and the scientists 3D-printed their device.

The researchers say that X-Hinges’ diverse motions are a novel feature compared to past attempts to 3D-print responsive everyday objects. “Most methods only allow for one axis of motion, often due to signal interference. X-Hinges enables your 3D-printed item to move from three angles,” says Chang. “Ultimately, you get a design with the intended movement you want. It also records motion data in each of those areas at the same time, making the device responsive to different kinds of interactions.”

The tool could help realize the untapped potential of the seemingly mundane. Objects we use every day for a specific purpose, like a water bottle for drinking or a lamp for lighting, could become interactive gadgets. Much like how a chatbot uses a sort of digital intelligence to answer your prompts, an object could leverage a kind of physical intelligence to execute a physical task when users interact with it.

For now, though, X-Hinges faces a calibration bottleneck. Each time an item is 3D-printed, its layout of electrical elements varies slightly, so two devices that appear identical from the outside may not make the same sensor readings. This is crucial if you’re building a deformable fitness glove, for instance, for two separate users. To fix this, Chang and Li built a computer vision system that can recalibrate outputs to align, ensuring data is accurate across two of the same items, although they hope to develop a built-in signal recalibration mechanism in the future.

That ambition traces back to the throughline in Jiaji Li’s own research: letting actuation and sensing “grow” directly inside a 3D-printed object, instead of adding them on afterward. He previously built printed tendon-driven mechanisms that gave objects the ability to move; X-Hinges is how he’s now building on the ability to sense. The next step, he says, is combining the two in a single print — it’s actuation and sensing born together in the same fabrication process, opening the door to new physical platforms for embodied intelligence and AI agents.

Chang and Li wrote the paper with MIT associate professor of EECS and CSAIL principal investigator Stefanie Mueller and recent TJU graduate Haiyang Yan. Their work was supported, in part, by a postdoctoral research fellowship from Zhejiang University and the MIT-GIST Program.

The researchers will present their work at the ACM Symposium on User Interface Software and Technology in early November.

Entrepreneurship and MIT have become a classic pairing, with a storyline that seems to write itself: A researcher develops a brilliant innovation in the lab, spins out a company, and brings a product to market that saves lives or improves society. It happens, sure — but long-term startup success is far from guaranteed.

That’s the challenge that prompted the launch of the MIT Kavanaugh Translational Fellows Program a decade ago, giving scholars who want to turn academic research into solutions to pressing challenges the time, tools, and business training to improve their chances of success.

“MIT has this world-class research facility and faculty and everything, but it also has world-class entrepreneurial programs,” says Nick Diaco, an MIT postdoc and 2025 Kavanaugh Fellow, in a new video about the program. “You really need both if you actually want to take an idea from the lab and put it into the real world and put it into situations where it’s actually affecting people’s lives.”

The program’s focus reflects a fundamental challenge for academic innovators: developing a promising technology is only the beginning. Turning it into a viable business requires making difficult decisions about customers, markets, financing, and other factors that may fall outside a typical researcher’s expertise.

“Even in a place like MIT, the majority of those people who choose to start businesses or bring that product to another business, the majority are going to fail,” said philanthropist Bart Kavanaugh at a May event announcing the 2026 fellows. Kavanaugh is one of the namesakes of the Saks-Kavanaugh Foundation, which supports the fellowship. He and his wife, Betty Saks, run the organization.

The foundation, he explained, analyzed what distinguishes successful startups. The selection process for the fellowship, he told the three new fellows — John Zhang, Maximiliano Jara Fornerod, and Xinyuan Zhang — is intended to identify researchers who have the potential to succeed.

The three are developing technologies ranging from a faster way to manufacture custom optical lenses to at-home strep throat tests and infrared detectors that can operate without energy-intensive cryogenic cooling.

They join a growing legacy of Kavanaugh Fellows whose research has moved toward commercialization, including Sublime Systems, a manufacturer of low-carbon cement; SiTration, which develops technology for extracting materials; and Stratagen Bio, which develops tools for quantitative biomarker assessment.

The yearlong program, managed by MIT’s Department of Materials Science and Engineering, gives MIT scholars time to focus on the business side of their ideas and develop the planning and decision-making skills needed to move promising research beyond the lab.

“If while you’re doing your research, you’re able to set aside some time to investigate the commercial potential before you leave the university, you get a really good picture on, 'is this a good idea for commercialization?'” says Diana Mojahed in the video. Mojahed was a postdoc at MIT when she became a 2023 Kavanaugh Fellow and is now the CEO of Lightfinder, which makes handheld spectrometers for health care, manufacturing, and telecommunications.

“It’s so much more than just achieving good specs with whatever you’re trying to achieve. There has to be a market for it. The unit economics need to work out. There’s a lot that goes into building a company.”

Learn more about the Kavanaugh Translational Fellows Program.

PHP maintainers have released fixes for two critical vulnerabilities:

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP users are strongly encouraged to update immediately.

Who is at risk: all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. We consider the risk highest for mod_php, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs...

Building a nuclear power plant is one of the world’s most complex construction projects. It requires thousands of trucks to ship parts, often to remote regions, where huge teams of skilled workers like electricians and welders come together to assemble everything over many years.

Financing such projects is difficult, in part because no one wants to risk loaning money to a project that might never generate power and revenue, whether that’s due to technical failures, the inability to recruit enough talent, or regulatory hurdles.

Stated this way, it’s no surprise the average nuclear plant costs twice as much as originally expected and faces delays of many years. Those cost overruns and delays have ground the nuclear industry to a near halt: When Georgia finally turned on its Vogtle Unit 3 reactor in 2023 (seven years late), it was the first new reactor constructed in the U.S. in over 30 years.

Blue Energy wants to make deploying nuclear power plants more like wind, solar, and gas projects. The company prefabricates huge blocks of its nuclear plants at shipyards, where workers and equipment already produce huge steel structures for the oil and gas industry every day, then ships the blocks on barges to the site of the plant for final assembly.

“The nuclear problem is a construction problem,” says Blue Energy founder and CEO Jake Jurewicz ’14, SM ’15, who grew up in the construction industry and studied the differences between nuclear and oil and gas projects at MIT. “On paper, nuclear technology is almost perfect: It operates above 90 percent capacity, it’s zero carbon, dispatchable, extremely high reliability, and has predictable cash flow. We don’t have enough nuclear power because we’re really bad at building it. But there’s already a huge manufacturing supply base for offshore oil and gas and offshore wind. If we can point that toward building nuclear plants, and finance it the same way, we can reinvigorate the industry.”

Blue Energy’s prefabricated blocks weigh around 1,500 tons and are designed to be easily assembled at their destination to complete a nuclear power unit over the course of a single year. The company is further reducing barriers to financing and speeding up construction timelines by designing its early plants to run on gas initially before switching to nuclear reactors, which it hopes will generate revenue within three years from the start of construction.

The company has already gained approval from the Nuclear Regulatory Commission for its gas-to-nuclear approach and has also secured an agreement with GE Vernova Hitachi Nuclear Energy for its first project, a 2.5 gigawatt hybrid nuclear power plant in Victoria, Texas, that is scheduled to begin producing power in 2030. This September, Blue Energy submitted the first part of its application to the NRC to begin construction on its Texas project, making it just one of five companies to do so in the current nuclear development era.

“Our first site is a great power generation project for that community because it's going to generate a lot of excess power,” Jurewicz says. “It’s going to show a new model for the world: This is a way the U.S. and its allies can deliver a turnkey nuclear power plant and turnkey energy sovereignty.”

A new blueprint for nuclear

Jurewicz grew up in Chicago, where he worked as a construction draftsman through high school. When he arrived at MIT, he double majored in nuclear engineering and physics, then stayed at MIT for a masters in the Department of Nuclear Science and Engineering. He also minored in energy studies through the MIT Energy Initiative.

Jurewicz’s master’s thesis explored ways nuclear power plant construction could apply lessons from the offshore oil and gas industry.

“If you’re trying to solve the construction problem, find parallel industries where people have solved it before,” Jurewicz says. “That’s why I looked at offshore oil and gas as well as nuclear shipyards in the U.S. and South Korea. We build oil and gas plants all the time, so what looks different about the way we build and execute an oil and gas plant relative to how we build a nuclear plant? They’re both mostly steel welding.”

Shipyards have several advantages over other sites for building nuclear power plants. For one, they already have thousands of skilled workers and loads of specialized equipment. They can also manufacture things in controlled environments, enabling increased automation and reducing uncertainty.

Following graduation, Jurewicz worked in corporate strategy at the utility company Exelon Energy, where he sponsored research at MIT. He originally considered starting Blue Energy as a graduate student with an approach that included creating a new passive safety system and going through a new regulatory insurance framework.

When he founded Blue Energy in 2023, he wanted to minimize risks with a more conventional reactor design. That includes prefabricating functional chunks of the reactor — what the company calls “Blue Blocks” — at a shipyard using standard manufacturing approaches that meet nuclear licensing and quality assurance requirements.

“The 1,500-ton Blue Block prefabricated modules are fully functional mechanically and electrically, they have plumbing — everything is delivered ready to run directly to the site,” Jurewicz says. “Then we have this gas-to-nuclear technology that allows us to get things going earlier with gas by building the whole nuclear steam turbine system right away and energizing it with steam from gas combustion turbines, which means we can finance it as a gas plant, so the cost of capital goes down. It dramatically lowers the cost of the project, and it reduces risk. Then we switch it with the nuclear reactor.”

Blue Energy’s nuclear reactor will be a small modular light water reactor that has already been approved by the Nuclear Regulatory Commission and is made by GE Vernova Hitachi Nuclear Energy.

Blue Energy’s first power plant in Texas will provide 1 gigawatt of power using two GE Vernova gas turbines in 2030 and then add another 1.5 gigawatts of power from up to five small modular reactors beginning in 2032.

“It will be pretty easy to add more modular reactors to the site, so we can lower the cost to that community to provide things like water desalination, which is a big issue in south Texas,” Jurewicz says. “This power infrastructure is clean, reliable, and resilient through hurricanes or any other weather scenario that can happen in that community. It creates hundreds of high-paying permanent jobs and the foundation for a lot of local economic growth.”

Faster, cheaper nuclear

Historically, nuclear power plants have taken 10-plus years of construction. Blue Energy believes it can shorten that to about 36 months. The company is projecting power from later projects to reach about $5,000 per kilowatt. For context, the Vogtle nuclear plant delivers power at more than twice that cost.

Jurewicz believes Blue Energy’s lower prices could finally inject much-needed life into the U.S. nuclear industry.

“Despite all of the excitement around nuclear, you haven’t seen real power purchase agreements get signed because there’s a stalemate on who’s going to take the construction overrun risk,” Jurewicz says. “The government doesn’t want to take it. The construction companies don’t have the balance sheet to take it. The utilities can’t take it. Even the hyperscalers won’t take a two-or-three-times cost overrun risk. Blue Energy is introducing a fifth party to break the stalemate, which is the shipyards and fab yards, which are best positioned to take the risk because they can make things in a controlled fabrication environment, so they'll take the risk on construction in their own yards.”

The internet is a vast and confusing place no matter your age. Trying to help youth engage with it safely and privately is a complicated topic that touches on many different skillsets and ideas. But just because it’s complicated doesn’t mean it’s impossible. We’ve launched our Online Privacy for Parents and Youth Surveillance Self-Defense guide in hopes to provide a framework for finding solutions that work for you. 

EFF rolls out this crucial resource as state and local governments consider ill-advised laws that cut young people off from essential information and experiences. This particularly harms vulnerable youth and marginalized groups who often find safety in supportive online communities they can't access offline. Such laws also entail age gating, which compromises the privacy of all internet users and stifles young users’ ability to learn, grow, and express themselves.

Young people have unique needs and those needs change over time. Trying to protect from everything all the time is an exhausting process, but the security community has long had a solution for this: security planning (also called threat modeling). The idea is to provide a series of questions designed to help you focus on what’s truly important. When it comes to online privacy, this is as applicable for youth and parents as it is for anyone else. 

We used a security plan as our foundation for this guide because deciding what is and isn’t important is the first step we should all take when assessing our privacy risks. But this isn’t a place for quick fixes, and every young person has their unique needs and considerations. There is no single tool or technology fix that can substitute for spending time learning, and then teaching a young person, how the internet works, how to use it, what sorts of harms exist, and how to navigate those harms.

Solutions are rarely about the tools or software you use. It’s about understanding the threats and concerns you have, and then determining what steps you can take to mitigate those risks. We hope our Online Privacy for Parents and Youth guide can help provide the outline to get the conversation started.

Donate Today!

An open internet where people can freely build, share, and remix each other's work is a powerful engine of grassroots innovation we’ve all benefited from. In recent decades, however, corporations have taken control of an increasing share of this work, giving them a greater ability to stifle challengers and limit our choices. When regulators address this by mandating that  tech giants play fair by requiring interoperability, the gatekeepers respond with a tired refrain: Playing fair puts users’ security at risk.

Unfortunately for these trillion-dollar companies, this gotcha isn’t the end of the conversation. Regulators can ensure that meaningful choice and security thrive.

Lawmakers have been catching up, recognizing that the best way to rein in big tech is to require these oligopolies to open up their platforms to independent developers. As we explained six years ago, mandating interoperability helps prevent the misuse of people’s data and enables more privacy-respecting alternatives. Tech giants, in contrast, have been arguing that our data is safer when they have exclusive control.

Tech Giants Claim Interoperability Means Insecurity

The European Union’s Digital Markets Act (DMA) put interoperability into law under Article 6(7): “gatekeeper shall allow providers of services and providers of hardware, free of charge, effective interoperability with” a designated Core Platform Service they operate. The language describes an unambiguous requirement to remediate vendor lockouts and anti-competitive behavior of the major service operators—it is not optional.

Apple claimed that enforcing this obligation in mobile app stores would put their customers at risk and do irreparable harm to trust in their brand. It’s an argument reminiscent of Apple’s fight against the right to repair, and in both instances the company is fighting to maintain its restrictive ecosystem to stop people from finding better deals elsewhere. Apple has long cultivated a more corporate-controlled experience with the iPhone, but this argument is now also being used for the relatively-more-open Android devices from Google.

In the same year Apple argued against the DMA, Epic Games sued Google for its restrictive terms of service and extractive policies for revenue generated in apps. Google predictably alleged that opening up its platform to other app stores it couldn’t vet would allow harmful apps to be installed. The case was ultimately decided this year in the U.S. federal appeals court for the Ninth Circuit, with the court rejecting this argument, dealing a blow to  Google’s feudal security arrangement, and paving the way for third-party app stores to be delivered as apps via the Google Play Store.

Interoperating Secure Systems Can (and Should) Exist

Policymakers cannot take tech giants’ claims at face value. Companies have every incentive to resist interoperability requirements, because interoperability lowers practical barriers and reduces switching costs for consumers adopting competing services. 

Even where companies offer credible claims from internal technical and security experts, independent experts rarely have the access and information they need to test those claims. Companies have selectively made arguments that security is harmed by interoperability, often in contexts which are to their advantage. These companies are happy to let a general misconception flourish which frames security as inherently opposed to interoperability.

This narrative is wrong. We’ve seen that when interoperability and information security are both set as essential and non-negotiable criteria, secure interoperable systems result—systems that don’t sacrifice the rich features we’ve come to expect of the services we rely on. 

The cross-platform rollout of Rich Communication Services (RCS), and now Message Layer Security (MLS) on top of it is a perfect example of this, creating end-to-end secure messaging by default between Android and iOS. For RCS and MLS, Google was conveniently on the other side of the interoperability argument, campaigning Apple to adopt the standard to overcome the diminished “green bubble” experience iPhone users had when texting non-iPhone users. Once Apple finally agreed to interoperate by implementing common standards, all users benefited from improved messaging security. In cases where legitimate security concerns are raised, these can be assessed and remedied on a case-by-case basis, without sacrificing user agency.

Striking the Right Balance

Retrofitting interoperability into already secure closed systems shouldn’t be done carelessly: it requires regulators strike the right balance of pressure and leniency to allow the time and precision necessary to make these renovations. Any components developed with the assumption of privileged access by trusted parties (e.g. your browser engine) are particularly vulnerable to serious security risks when opened up to unaccountable third parties.

By adapting interoperability and information security as essential design principles, we can expect more safety, but also more freedom.

With regard to the DMA, when security concerns are legitimate, we urge the European Commission to work with companies and outside experts to offer guidance in technical implementation and provide clarity on regulatory compliance. This approach paves a path forward that balances the interest of legal oversight and the needs of the companies alike. 

Policymakers wishing to uproot these unfair platforms of control must do so with care and limit the impact this disruption can have. But security concerns must not act as a lever to indefinitely delay compliance. Closed systems should be impartially evaluated, and if concerns are valid, regulators can allow more time and guidance to be given to companies implementing these changes. One possibility is a tiered approach: offering leniency during an initial period where systems need to be retrofitted to abide by new requirements, followed by a subsequent and ongoing stricter observance of fair play.

Once interoperability and information security are adopted as essential design principles, further development with these rights-enhancing principles in mind will more easily follow. The result will be an internet the world deserves—where we can expect more safety, but also more freedom.

The Brazilian National Data Protection Agency (ANPD) plays a pivotal role in the regulation of digital platforms according to new legislation approved in Brazil. Throughout this year, EFF has presented comments, filed submissions, and met with the agency to emphasize crucial guardrails that the enforcement of new regulations should ensure. 

ANPD is responsible for detailing and applying obligations set in Law n. 15.211/2025, which established rules for the protection of children and adolescents in the digital space. While some provisions establish important privacy safeguards, like prohibiting advertising based on profiling of underage users, the law created mandatory age assurance mechanisms for accessing digital products and services. 

We have raised alarms on the privacy and free expression issues around age-gating the internet. Age verification technology is often inaccurate and privacy-invasive. Examples also show how it’s prone to enforcement overreach, resulting in sites blocked beyond legal requirements. In the UK, providers disproportionately restricted several counseling, support and mental health sites under the Online Safety Act. Current age assurance methods risk wrongly walling off adults with no valid IDs, facial differences, physical disabilities, among others. 

We highlighted these concerns in our comments and submissions underscoring that ANPD should avoid a blanket approach to age assurance obligations. Following the legislation, restrictions should apply only to products and services that are inadequate or prohibited to children and adolescents according to categories already set in regulation, with robust protections against subjective and overbroad interpretations. Guarantees such as access to information, freedom to participate in society and meaningful access to technologies also compound what constitutes the best interests of the child.  

Moreover, we stressed that zero knowledge proofs alone fail to ensure strong user privacy, including safeguards that the law itself sought to secure. Our submission explains why other requirements, such as unlinkability, selective disclosure, batch issuance and processing on device, are crucial for achieving greater levels of protection and mitigating privacy harms. Minimum information being shared to the verifier and no “phoning home” to the issuer of a user’s accepted credentials are conditions that prevent actions like collusion and data sharing about the user. 

We also shared inputs about the scope of the law, asking more clarity on which providers are covered by its obligations and the importance of treating differently non-dominant players like federated networks and free software applications. Without that clarity, this could negatively impact beyond gaming and major platforms that are the main target of these regulations. We elaborated on the agency’s regulation of prevention duties, the relevance of modulating them according to the type and structure of providers, and alerted them that their interpretation should not result in general monitoring obligations. 

On another but related front, we sent comments regarding Brazil’s new internet intermediary rules. Here too, ANPD has a critical regulatory role after a Supreme Court’s decision and presidential decrees changed the liability regime initially set in the law known as “Marco Civil.”  

With the turn to notice and takedown mechanisms and duty of care obligations, we emphasized measures to prevent censorship of protected content. These involve ensuring solid means for appeals of restricted posts, avoiding overreliance on AI-based content moderation, strictly tailoring the application of concepts like duty of care and systemic failure, and not normalizing the blocking of platforms and websites.  

We raised concerns about a trend reflected in the new regulation requiring platforms to proactively report user to authorities with unclear guarantees. Finally, we urged the agency to advance essential transparency and accountability measures for enabling greater public oversight over the application of the new regime. 

As we said before, platform accountability under the new rules ultimately hinges on how accountable its enforcement will be by platforms and state institutions. Rigorous commitment to fundamental rights, including freedom of expression, privacy and data protection, is required so that intended protections don’t instead lead to harms. ANPD must uphold this commitment and make sure that new regulations don’t backfire. 

At MIT’s McGovern Institute for Brain Research, Professor Fan Wang tackles innovative research every day. Her work centers on a fundamental question in neuroscience: How does the brain interact with the body to shape our sensations, emotions, and actions?

Wang and the students in her lab study the neural circuits underlying experiences such as touch and pain, as well as the sensory and motor systems that allow animals to carry out behaviors like eating, drinking, moving, and vocalizing.

This research is inherently exploratory. Understanding how the brain generates complex sensations and behaviors often requires following unexpected findings and pursuing questions whose answers are not immediately clear.

Wang brings this same openness to her mentorship style, giving those within her lab the freedom to explore while providing the scientific guidance needed to navigate uncertainty.

“Innovative research is often inherently high-risk and requires continuous exploration, and adjustment of direction,” Wang says. 

She does her best to share the excitement of promising results alongside her students while also working to alleviate their stress when everything doesn’t go to plan. Ultimately, she aims to create a research process that is “both intellectually stimulating and genuinely enjoyable” for her advisees.

For all these efforts, Wang was honored as “Committed to Caring” through a student-driven nomination and selection process.

Creating space for discovery

Research rarely follows a perfectly predictable path. New results can require revisiting hypotheses, changing direction, or returning to questions that had already been answered. Wang sees this uncertainty as a fundamental part of the research process.

She meets with members of her lab regularly to discuss their work and investigate problems together. These conversations serve to provide both feedback and structure, while also allowing them to work together through the frustrations that can accompany difficult research.

One nominator describes Wang’s “rigorous yet thoughtful scientific training” as tailored to each student’s personality and interests. For this student, weekly or biweekly meetings provide opportunities to review progress and plans, receive detailed guidance, and get critical feedback that supports both academic and professional growth.

Wang strives to create a challenging research environment that is also steeped in encouragement. This is particularly important when students are pursuing questions without obvious answers. When these sorts of questions arise, Wang is quick to work through uncertainty as a team.

For Wang, the goal is not to eliminate the uncertainty that comes with research, but to help students become comfortable navigating it. When results point in an unexpected direction, researchers can return to the questions, discuss what they are seeing, and determine where the evidence should lead them next.

Tailoring support to the student

Wang’s mentorship extends beyond experiments and research questions. She recognizes that each of her advisees is different, with unique interests, relationships, and experiences, and she tries to understand the type of support they need in order to flourish.

Her influence extends beyond the students she directly advises. As a member of the graduate affairs committee for the department, Wang meets with first-year PhDs to offer career advice and help them navigate the challenges of graduate school. Her nominators describe her as “compassionate, approachable, and deeply supportive.”

Wang also recognizes that circumstances outside the laboratory can affect a student’s ability to focus on research. “When something difficult happens in a student’s life, the most important thing I can do is be there to listen with genuine care and without judgment,” she says. “I do my best to support them as a whole person, not just as a researcher, and to be flexible when they need it.”

That flexibility can mean slowing things down, helping a student take a challenge one step at a time, or simply giving them space to talk. At the same time, Wang continues to emphasize the real goals at the heart of graduate education: asking difficult questions and responding thoughtfully to unexpected results.

One nominator describes Wang as bringing “warmth to the lab” — sharing food, engaging in conversations, and showing genuine concern for everyone’s mental well-being. Wang’s gestures create an environment where they feel supported both as researchers and as people.

Fostering trust

Wang describes her position as something of a “mother hen” philosophy. She feels a deep sense of responsibility for every student who joins her lab, and genuinely wants each of them to succeed.

For Wang, mutual trust is what allows mentorship to become an authentic connection. Her advisees can pursue uncertain ideas and navigate difficult moments knowing that their relationship with their mentor does not depend on always getting the right answer. 

“When students know that I truly care about them as people, not just as producers of data, it builds trust,” Wang reflects. “They understand that they are not just workers hired to complete a research project, and that I do not value or judge them solely by their output.”

Since its launch two years ago, MIT’s Doctors Without Gravity club has already amassed more than 100 student members. The club was co-founded by graduate students Anna Wadhwa and Nicole McGaa, who now serve as president and vice president, respectively.

Bringing together students from MIT and Harvard University who are interested in the intersection of medicine, health, and space exploration, Doctors Without Gravity is the student chapter of the Aerospace Medical Association (AsMA) and the Aerospace Medical Student and Resident Organization (AMSRO). The club is open to both undergraduate and graduate students from both institutions.

Students interested in the club do not need to be aero/astro, biology, or pre-med majors, says Wadhwa, noting that the club also has many mechanical engineering students interested in spacecraft mechanics, for example. Wadhwa adds that all majors are welcome to join.

“We want to help increase student awareness and education about aerospace medicine as a potential field that people can study and pursue for a career,” says Wadhwa, who is part of the Aerospace Physiology Lab and pursuing a PhD in aeronautics and astronautics at MIT before returning to Harvard Medical School to complete her medical degree. “We hope to achieve this by connecting the existing communities that are already in place at Harvard, MIT, and Boston by hosting events, lightning talks, and our annual symposium.”

Building a community around space medicine

To bring community members together, Doctors Without Gravity hosts general social events where members can get to know one another and network in a casual setting. They also hold workshops and fireside chats with faculty, researchers, physicians from Massachusetts General Hospital, and residents in training, so students can ask questions, learn more about their research, and ask for career advice. “It’s a great way to get students plugged into the Boston area network of people interested in space medicine,” says Wadhwa.

The club’s director of science communications, Maryam Hiradfar, a graduate student in the Harvard Biophysics Program, says the club’s interdisciplinary membership is one of its greatest strengths.

“Members are a diverse group of students who can all learn from one another. We have members who are not doing active space research or space life research, including myself, but I think just being able to spark that interest in them and hopefully give people direction to get involved in that kind of research if they're interested.”

She adds, “members of the club pursue a wide variety of fields after graduating, including medical consultants, physicians, and research. Some people go into academia and research. There are numerous ways to explore space medicine; it doesn't have to be just as a flight surgeon at NASA. People interested in the field also work at Mission Control to monitor astronauts' health not only while in space, but also on a daily basis, while others do contract work for SpaceX or Axiom Space.”

The club also helps students learn about career opportunities as they arise. Wadhwa notes that if SpaceX, NASA, Axiom Space, Blue Origin, or other groups reach out to the club with job or internship possibilities, the information is quickly passed along to its members.

Faculty advisor and director of the Aerospace Physiology Lab, Associate Professor Lonnie Petersen, adds, “Doctors Without Gravity brings together curious students from many different fields who share an interest in advancing medical care beyond Earth. As faculty advisor, I am proud to support these students, expand their network, and provide opportunities for them.”

Researching the effects of spaceflight on the human body

Hiradfar is conducting research in the Integrated Positron Emission Tomography and MRI lab at the Martinos Center for Biomedical Imaging. Much of her time is spent scanning patients on a total-body positron emission tomography system. She does everything from scanning to adapting and developing conventional analysis pipelines and algorithms to analyze this new type of whole-body scan.

Wadhwa is conducting research in the Aerospace Physiology Lab with Petersen. Her work specifically focuses on how the brain reacts to spaceflight, because astronauts experience fluid shifts while in space and it is crucial to understand how those changes affect brain health. She is studying this both on a cellular and a systems level.

Both Wadhwa and Hiradfar say they would like to take flying lessons one day, but their schedules are too busy at the moment.

Helping colleagues with a study, Wadhwa did have the opportunity to take a ride in a centrifuge, accelerating from 1G to 4G — the equivalent of 88 mph.

“The test was designed to simulate the dynamics of flight maneuvers of a jet, in order to study patient physiology. It would go up for five seconds and then back down and then up and down. At the end, you do feel like you just got off a roller coaster, and I had to stay really still for a few minutes after the centrifuge finished,” she says.

Upcoming events

Doctors Without Gravity is already planning for their 2027 Symposium to be held during Massachusetts Space Week, April 19-25, 2027. Additional details will be announced as they become available.

At last year’s annual symposium, the keynote speaker was MIT Professor Dava Newman, Apollo Program Professor and director of the Human Systems Lab, who brought some samples of flight testing materials for everyone to see and touch. In 2025, the keynote was given by Erik Antonsen, director of the Mass General Brigham Space Medicine Fellowship. 

For students interested in exploring the possibilities of aerospace medicine, Doctors Without Gravity offers a place to learn, make connections, and discover the many paths into the field. Students interested in potentially joining the club may join the group’s mailing list.

Police agencies across the U.S. have deployed Automated License Plate Readers (ALPRs) to capture images of passing vehicles along with time, date, and GPS coordinates. While the technology itself isn’t new (ALPRs have existed in various forms for more than 50 years, and in the U.S. since 1998), the surveillance landscape has shifted dramatically. Rapid advances in artificial intelligence and national data sharing have transformed police ALPRs into an interconnected, nationwide tracking network. It is pitched to city councils by law enforcement and private vendors like Flock Safety, Motorola Solutions (Vigilant), and Axon as an essential tool for solving violent crime.

In reality, it is an inherently dangerous infrastructure of mass surveillance.

Since 2012, EFF has worked with others to expose the severe digital rights harms of ALPR systems. For example, we’ve recently documented how these camera networks allow law enforcement to search for immigrants, track peaceful protesters, target Romani communities, and track women seeking reproductive healthcare. Police also routinely use ALPRs for low-level matters like enforcing school residency requirements or investigating noise complaints. Many officers also use ALPR databases to stalk past romantic partners. Recent EFF analysis revealed officers using the system without legitimate justification—logging search reasons like "LOL" and "LMAO."

Understandably, the public backlash to police ALPR technology is accelerating, and state lawmakers across the country are taking action.

New Hampshire enacted the nation’s first state law on ALPR use in 2007, but technological advances and misconduct have driven even more recent legislative action. In 2026 alone, six states enacted laws that limit police use of ALPRs: Connecticut, Kentucky, New Jersey, New Mexico, Oregon and Washington.

This is a good start, but far more is needed. This blog presents a framework for state legislators who want to stop ALPR mass police surveillance:

1. Just ban it. It is incompatible with a free society and cannot be fixed.
2. In the absence of a flat ban, reduce its harms. Most importantly: limit police use of ALPRs to real-time comparison of passing plates to hotlists; require a warrant to place a plate on a hotlist; impose strict limits on the creation and use of those hotlists; and prohibit the storage of ALPR data (and thus prevent the subsequent search and disclosure of that data).
3. In the absence of a prohibition on storing ALPR data, reduce its harms. Most importantly, place strict limits on police storage, search, and disclosure of ALPR data.
4. Ban three especially dangerous police practices: placement of ALPRs near sensitive locations like hospitals; purchase of ALPR data; and use of ALPR data to try to predict crime.
5. Require transparency about ALPR mass surveillance, including: a 30-day public notice before a city procures police ALPRs; a statewide registry of all police ALPRs; and regular, public audits and statistical reports about police usage.
6. Ensure effective enforcement of all new ALPR restraints, including by means of a private right of action and the exclusionary rule.

These policy battles often unfold locally, so state legislators must ensure that state law is a regulatory floor, never a ceiling. State preemption should never force unwanted camera networks onto communities that have chosen to reject them. Local government must retain authority to enact full bans, deny funding, reject contracts, and decommission existing camera networks.

Table of Contents

• The Gold Standard: Statewide Bans on ALPR Mass Surveillance
• Strict Limits on Real-time Use of ALPRs 
  • Limits on creating hotlists
  • Limits on using hotlists
• Strict Limits on Storage, Search, and Disclosure of ALPR Data
  • Storage limits 
  • Search limits 
  • Disclosure limits 
• Transparency 
• Additional Restrictions
• Enforcement 
• Conclusion

A Note on Scope

As in our previous post on ALPR policy, our focus here is ALPR mass surveillance: the continuous dragnet collection and retention of location data on innocent drivers. Different issues are raised by automated traffic enforcement (ATE) systems, such as standalone red-light or speed cameras that solely photograph and ticket specific traffic violations, without building a searchable network about uninvolved drivers. As such, state laws against ALPR mass surveillance should not cover ATE. This is the approach in at least six states: Connecticut, Minnesota, North Carolina, Oregon, Virginia, and Washington. The most common approach is to exclude ATE from the law’s definition of “ALPR.”

Of course, ATE carries risks and demands legal restrictions too. This includes tight limits on data collection, retention, usage, and disclosure—all of which should be addressed in a different statute. Lawmakers must also actively guard against vendor efforts to piggyback mass surveillance tools onto ATE contracts.

The Gold Standard: Statewide Bans on ALPR Mass Surveillance

Statutory limits cannot make ALPR mass surveillance safe. Because the technology relies on the indiscriminate recording of every driver’s movements, the risks are baked into the system itself. Also, innocent motorists will be menaced by police due to false matches, bad actors will misuse location data, and sensitive personal movements will be exposed to broad government overreach. Promising harsher penalties for officer misuse cannot fix an inherently flawed architecture. Thus, state lawmakers should pursue a complete, statewide ban on ALPR mass surveillance.

First, lawmakers should prohibit all state-level law enforcement agencies from acquiring, retaining, accessing, or using ALPRs or any data derived from them.

Second, they must impose the same prohibition on county, municipal, and other local law enforcement agencies.

These prohibitions should require any agency ending an ALPR program (both state and local) to fully decommission the programs within a strict timeframe. This includes requiring agencies to: physically remove all camera hardware; revoke all user, network, and database access credentials; permanently delete all stored location data; and require vendor certification of compliance.

Third, ban the use of state funds for state or local agencies to acquire, maintain, or access ALPR systems. This must include direct appropriations, law enforcement grants, pass-through funds, and state-administered federal funds. In August 2026, Texas Governor Greg Abbott banned state agencies from spending public funds on Flock cameras.

Fourth, ban state and local agencies from installing or operating ALPRs on state-owned highways, roadways, or public properties. In August 2026, Florida’s Department of Transportation  ordered the removal of all ALPRs from the right-of-way on state highways within 30 days. The order revokes all previously approved permits to install ALPRs, and bars future permits.

An outright prohibition is the only effective way to eliminate this mass surveillance. This follows the lead of municipalities across the country that have already enacted bans. However, where there’s political resistance, state lawmakers might consider a moratorium that prevents further expansion of ALPR networks.

Strict Limits on Real-time Use of ALPRs

In the absence of a ban on police ALPR mass surveillance, state legislators must restrict ALPRs to real-time comparison of passing plates to hotlists. ALPR data is simply too dangerous for police to safely store, search, and disclose. An effective way to do this, as in New Hampshire, is to require deletion of ALPR data within three minutes after collection. That means no ALPR data is stored after comparison to a hotlist, and thus that no ALPR data about unmatched cars can be searched or disclosed.

A state legislature must also reduce the harms of police use of real-time ALPRs by strictly limiting the creation and use of law enforcement hotlists.

Limits on creating hotlists

Roughly speaking, there are two kinds of police hotlists. An agency might link its ALPRs to external hotlists created by another agency, such as the FBI’s National Crime Information Center (NCIC) or a state’s department of motor vehicles. Also, a police agency might link its ALPRs to its own internal hotlist, created by its own officers, of people under investigation. State legislators must strictly limit both.

First, limit the kinds of external hotlists that police agencies may link to. For example, ban police agencies from linking to the NCIC’s “immigration violator” hotlist, which ICE uses to hunt immigrants with the ALPRs operated by police agencies across the country.

Second, if a police agency links to external hotlists, require the agency to update that link every day. Otherwise, drivers may be detained even though they have been removed from the list. This is required by Montana, Nebraska, North Carolina, and Virginia.

Third, forbid officers from adding a plate on a hotlist, absent a warrant from a judge based on probable cause and particularity. Without this judicial check on police power, an officer stalked a potential romantic partner by placing her plate on a hotlist.

As with other laws requiring a warrant (such as the federal Wiretap Act), there should be an exception where: (1) there is an emergency involving immediate danger of death or serious bodily injury to a person; (2) there is no time to acquire a warrant; and (3) there are grounds upon which a warrant could be granted. This exception might apply, for example, when police have probable cause to believe a child has just been abducted. In such cases, the statute must require police to seek a warrant within 48 hours, and if it is denied, to immediately remove the plate from the hotlist.

Minnesota requires a warrant or an emergency to use ALPRs “to monitor or track an individual who is the subject of an active criminal investigation.” In Maine, an ALPR system may use only information based on reasonable suspicion.

Fourth, forbid officers from adding a plate to a hotlist, except in connection with a serious violent crime. This would include investigation of a murder but not pursuit of a traffic scofflaw.

Fifth, forbid officers from adding a plate on a hotlist based, in whole or in part, on: a person’s race, ethnicity, national origin, religion, immigration status, disability, sex, gender identity, or sexual orientation; their political beliefs, associations, or participation in First Amendment-protected activity; or their pursuit of reproductive, gender-affirming, or other health care. Connecticut and Washington forbid use of ALPR systems on these grounds, and Virginia forbids tracking a person based on their protected speech.

Sixth, require officers to log their entry of a plate into a hotlist. This must include the officer’s name and agency, the date of the entry, a narrative description of the reasons for the entry, any case numbers, and an upload of the warrant authorizing the entry. Oregon requires an officer to log “the specific law enforcement purpose of the entry,” and the officer’s name.

Limits on using hotlists

First, if the plate of a passing car does not match a hotlist, laws must require immediate deletion of all ALPR data about that car. New Hampshire state law requires deletion within three minutes. This is the most effective way to limit ALPRs to real-time identification of vehicles and drivers of interest to police, as opposed to amassing a dangerous database of the comings and goings of the entire driving public, available later for retrospective search by police.

Second, if the plate of a passing car does match a hotlist, then limit storage, search, and disclosure of its ALPR data to what is strictly necessary to the investigation that placed the car on the hotlist.

Third, require police officers, before stopping a car because of an apparent real-time match, to visually and independently confirm that the car’s plate number, plate issuing state, and other vehicle characteristics in fact do match the car on the hotlist. Many innocent motorists have been detained and menaced by police because of ALPR false positives. Confirmation is required by Kentucky, Montana, New Hampshire, Oregon, Virginia, and Washington.

Strict Limits on Storage, Search, and Disclosure of ALPR Data

Again, state legislatures should simply ban police use of ALPRs, or at least police storage of ALPR data. Third best is harm reduction through strict limits on storage, search, and disclosure of ALPR data.

Storage limits

First, limit the storage period for ALPR data to days, not months, and then require deletion. More than 99% of the drivers who pass an ALPR are not on a hotlist. Tracking their movements anyway, just in case they are later relevant to a police investigation, is criminalization of the entire driving population. Thus, four states already require deletion after 21 days: Connecticut, Maine, Virginia, and Washington. Even Flock has reduced its default retention period to seven days.

By “delete,” we mean permanently erase it, so it is impossible for anybody to access it again. It is not enough to merely store it in a way that makes it harder to access, such as archiving it, or transferring it from one database to another. In the words of the Virginia statute: “System data shall be purged … in such a manner that such data is destroyed and not recoverable.”

Second, limit the types of ALPR data that can be stored: just a photo of the plate, the AI-based read of the plate number, the date and time, and the location. Conversely, ban retention of photos of people in the car, and of features of the car beyond the plate as well as AI-based reads of those photos (respectively, “facial recognition” and “vehicle fingerprints”).

Many states have enacted such rules. New Hampshire bans ALPRs from “photographing or recording or producing images of the occupants of a motor vehicle.” Missouri bans integration of facial recognition into ALPR systems. New Hampshire and Montana limit ALPRs to “the sole purpose of recording and checking license plates.” Minnesota provides that “data collected by an [ALPR] must be limited to” plate numbers; date, time, and location; and pictures of plate, vehicle, and surrounding area.

Search limits

First, laws should ban “geofence” searches, which are searches in which police use ALPRs to identify all of the drivers present at a particular time and place, based on police claims that one of them might be the suspect they are looking for. Even a warrant cannot justify such general searches, because the Fourth Amendment requires warrants to “particularly” describe the person or car being investigated. These dragnet searches of stored ALPR data are the modern-day equivalent of the colonial-era “writs of assistance,” against which our founders fought a revolution to end.

Second, laws should forbid officers from searching stored ALPR data, unless they first acquire a warrant from a judge based on probable cause and particularity. The constant revelations of bad police searches of ALPR data demonstrate the need for—at the very least—judicial control over this dangerous surveillance technology. A federal judge in Oklahoma recently held that the constitution requires this judicial control, because ALPR mass surveillance invades reasonable expectations of privacy. EFF has filed lawsuits making this demand in California and Wisconsin, along with local ACLU affiliates: SIREN and CAIR-CA v. San Jose, and Wisconsin Council of Churches v. Milwaukee, Racine, Kenosha, and Green Bay.

Three states (Minnesota, Vermont, and Virginia) require reasonable suspicion of a crime before searching ALPR data, and a fourth state (California) requires this from its highway patrol. This is a step in the right direction, but not enough: the decider must be a judge, and the test must be probable cause.

Third, officers should be prohibited from searching stored ALPR data, unless they are investigating a serious violent crime. On the flip side, ban searches for immigrants, protesters, or traffic scofflaws.

Some states have moved in this direction. Missouri limits use of ALPR data “criminal justice” and “lifesaving efforts.” North Carolina bans its use for traffic enforcement. Connecticut bans its use based on race and other protected classes, to identify First Amendment activity, for immigration enforcement, or because of access to reproductive or gender-affirming health care. Idaho bans its use for political activity.

Fourth, police officers must be required to log their searches of stored ALPR data concerning a particular car. This must include the officer’s name and agency, the date and time of search, a narrative description of the reasons for search, any case numbers, and an upload of the warrant authorizing the search. The officer must write the narrative in their own words. A drop-down menu of reasons is no substitute, because it is too easy for officers to dodge an explanation of the actual reasons by clicking a pre-written “reason.”

Many states require officers to log their searches of ALPR data, including California, Connecticut, Idaho, Maryland, Missouri, Montana, New Hampshire, Oregon, and Virginia. In Virginia, this must include an officer’s documentation of both their “specific purpose” to search, and the “associated call for service or case number.”

Disclosure limits

The “disclosure” limits below must broadly address sharing from an agency that collected ALPR data to another entity. This includes an agency opening its database to access and search by another entity. It also includes an agency transferring data from its database to another entity’s database.

First, ban disclosure of ALPR data to any federal or out-of-state agency. Federal and out-of-state agencies often lack the necessary protections of the driving public. Connecticut forbids disclosures to the federal government or agencies in 46 states, unless they have a warrant. California forbids disclosures, unless otherwise permitted by law.

Second, ban disclosure of ALPR data to another agency, unless it follows all of the rules above for an agency’s search of its own data (that is, the ban on geofence searches, the requirement of a warrant, the limitation to investigation of serious violent crimes, and the requirement of an audit trail).

Some states have taken steps in this direction. Utah requires, as a condition of disclosure to a government entity or a defendant in a criminal case, a court order finding reasonable suspicion of crime. Washington forbids disclosure “except as required in a judicial proceeding.” Minnesota and Virginia require the disclosing agency to find reasonable suspicion. Minnesota and Connecticut forbid disclosure unless the receiving agency follows the rules applicable to the disclosing agency.

Third, place strict limits on participation in a multi-agency disclosure network, such as Flock or Vigilant. Connecticut forbids participation “in a system or network that shares” ALPR data, unless it requires all participants to affirm in writing that they will not use or re-disclose that state’s data except in compliance with that state’s laws. Connecticut also forbids “bulk” data disclosure, and Maryland forbids data “upload” to another agency.

Fourth, ban disclosure of ALPR data for purposes of investigating acts and statuses that are lawful in-state. Three states (Illinois, New Jersey, and New Mexico) forbid disclosure to investigate immigration status. Two states (Illinois and New Mexico) forbid disclosure in investigate healthcare that is lawful in-state. One state (New Mexico) forbids disclosure to investigate protected assembly, petition, and speech.

Fifth, ban any sale of ALPR data. Six states do this: Arkansas, Maryland, Oklahoma, Utah, Virginia, and Washington. California forbids its highway patrol from doing so. New Mexico forbids any disclosure to a private entity (or indeed to any non-law enforcement agency). Data brokers are a menace to privacy and other human rights.

Transparency

State lawmakers must ensure that the public has access to ample information about the ALPR mass surveillance in their communities. Many people will use this information to resist ALPRs.

First, state laws should require local governments to provide at least 30 days of public notice before spending funds, accepting grants or private donations, or entering into any contract or pilot program for ALPR technology. All proposed vendor contracts and funding sources must be publicly disclosed prior to approval. This helps local officials to exercise their procurement power to reject ALPRs.

Second, laws should mandate the creation of a centralized, public-facing state registry of all police agencies using ALPRs, and the specific locations of all police ALPRs. Sources like DeFlock and EFF’s Atlas of Surveillance include crowd-sourced maps of ALPR technologies, but they are not exhaustive. This was one of the provisions in Minnesota Minn. Stat. § 13.824, which in part, requires police agencies to notify the state within 10 days of installing any ALPR, and requires a state agency to aggregate this information and publish a master list of the locations of all ALPRs (unless a judge determines that disclosure of a particular ALPR’s location poses a genuine security risk).

Third, mandate regular, independent, public audits of agency ALPR use, access logs, and query justifications to ensure compliance with all applicable laws and policies. Five states (Idaho, Minnesota, Montana, Virginia, and Washington) require regular audits, ranging in frequency from monthly to biennial. Three states (Idaho, Maryland, and Washington) require audits of access logs. Minnesota requires an independent auditor and public access to the results.

Fourth, laws must require each agency operating an ALPR system to publish regular reports on its website detailing key operational metrics. Six states require such reports annually: Connecticut, Maryland, New Hampshire, New Mexico, and Vermont. Arkansas requires them twice per year, and Oregon requires them monthly. These states variously require reporting of: the number of ALPRs, and a list of the locations of fixed ALPRs; the number of hotlists used, and a list of them; the number of plates scanned; the number of apparent matches to hotlists, and how many were actual matches; the number plate reads stored; and the number of searches of stored data, broken down by the purpose and agency of search.

Finally, any new ALPR legislation must maintain a proper balance between transparency and privacy in the use of public record acts (PRAs) to obtain ALPR information. Public records and public scrutiny of ALPR programs have shown that people are harmed by these systems. So lawmakers should not cut off access to public records that document these abuses. For example, the public should have access to operational policies, audit logs, vendor communications, and aggregate statistics. EFF opposes blanket exemptions from PRAs that block public oversight of APRs—such as recent bills in states like Arizona. The better approach to protecting individual location privacy is a flexible, case-by-case balancing test already provided by many PRAs. Also, when a document contains both exempt and non-exempt information—like an audit log that contains both motorists’ plate numbers and officers’ search reasons—open records laws should require disclosure of the latter while withholding of the former.

Additional Restrictions

State lawmakers should adopt three additional bans to curtail the footprint of police ALPR surveillance.

First, ban the placement of ALPRs or the collection of ALPR data near healthcare facilities, immigration services, schools, places of worship, courthouses, food banks, and other sensitive locations. Washington and Connecticut do this.

Second, ban police from purchasing ALPR data. Utah and Washington do so. Also, prohibit police from acquiring ALPR data from a private entity, except by means of a warrant. Washington does so. Utah took a step in this direction, requiring a court order based on reasonable suspicion. Absent this type of rule, police evade limits on seizing data from third parties by simply purchasing it from brokers.

Third, ban police and their vendors from using ALPRs or stored ALPR data to power predictive policing technology. EFF opposes such technology and urges state legislatures to ban it. ALPR companies have been providing law enforcement clients with an “analytics” feature, which ingests data from across police agencies, and produces a report of alleged crime trends, hotspots, and corridors. State legislators should prohibit this dangerous use of ALPR systems and data.

Enforcement

A law without strong enforcement is just a piece of paper. EFF recommends three kinds of enforcement measures, all of which appear in existing ALPR statutes.

First, all privacy laws need a “private right of action,” meaning ordinary people can sue a police department that breaks the law. An excellent model appears in the federal Wiretap Act. It expressly authorizes a lawsuit by “any person” whose personal information is processed “in violation of” this law. Privacy harm is harm, and so a person should have their day in court, even if they cannot prove a collateral harm, such as physical injury or economic loss. Moreover, the Wiretap Act provides a full arsenal of remedies to a successful plaintiff, including injunctive and declaratory relief, liquidated and actual damages, and attorney fees.

At least three states enforce their ALPR statute with some version of a private right of action. These are good first steps but need improvement. Washington comes closest: it allows suit to enforce all ALPR rules and provides all remedies. Unfortunately, the plaintiff must prove “injury,” which may shut the courthouse doors to some people whose data is unlawfully processed. Connecticut allows suit by a person “aggrieved” by violation of some ALPR rules. But a person should be able to enforce all rules, and should not have to prove they were aggrieved. Oregon allows suit against a police vendor that “intentionally or with gross negligence” uses or discloses ALPR data in an unlawful manner. But this does not allow any suit against police, or even against a vendor that systematically violates the rules through ordinary negligence.

Second, privacy laws applicable to the police commonly ensure enforcement through the “exclusionary rule.” This means that if evidence is gathered in violation a privacy law, it must be excluded from court proceedings. This is sometimes called “suppression” or “inadmissibility.” The federal Wiretap Act has a strong version of this rule, clearly excluding evidence derived from violations of all rules. The so-called “good faith” exception has weakened many exclusionary rules, so ALPR statutes should expressly reject this exception (though some courts have interpreted some statutory exclusionary rules to have no good faith exception).

At least three states enforce their ALPR statute with some version of the exclusionary rule. Again, these are good first steps but need improvement:

• Virginia comes closest: “Any evidence obtained as a result of a violation” of some of the ALPR rules “is not admissible.” A better rule would apply to all ALPR rules.
• Connecticut provides that ALPR data “may be admissible … provided such data was collected or otherwise acquired or held or stored in accordance with the provisions of this section” (or obtained pursuant to warrant). A more clear exclusionary rule would “exclude evidence unlawfully processed,” as opposed to “admit evidence lawfully processed.” The exclusionary rule should also extend to data unlawfully used or disclosed (and not just to data unlawfully collected or stored).
• Washington provides that information obtained from “a knowing violation” of some of the statute’s rules is “inadmissible.” But the exclusionary rule should apply to all substantive limits (not just some), and to all violations (not just knowing ones).

Third, police agencies and their private contractors that recurringly violate ALPR rules should be forbidden from using ALPRs at all. In New Hampshire, if an agency “repeated[ly]” violates the ALPR statute, the state department of justice may “seek an injunction banning [its] use” of ALPRs. In New Mexico, if a vendor “fails to comply with” that state’s ALPR law, it “may be subject to … suspension of authorization or termination of access.”

Some states impose workplace discipline or criminal penalties on officers who violate ALPR laws, including Connecticut, Idaho, and Missouri. This is no substitute for the three types of strong enforcement measures above. ALPRs are a systemic problem requiring institution-wide enforcement of legal constraints, and not just episodic sanctions against individual officers.

Conclusion

Mass surveillance ALPRs fundamentally threaten digital rights, making an outright statewide ban on police ALPRs the only effective way to fully protect privacy and safety.  The next best thing a legislature can do is limit ALPRs to real-time comparison of passing cars to hotlists, by banning storage of ALPR data beyond a few minutes. If a legislature allows storage, it must impose a tight deletion deadline (days and not months), and strict limits on search and disclosure. A legislature must also ensure transparency and enforcement. 

For convenience here is a concise list of EFF’s state legislative goals.

Guide Includes Easy, Quick Ways To Identify and Protect Against Online Threats

SAN FRANCISCO – The Electronic Frontier Foundation (EFF) has published “Online Privacy for Parents and Youth,” a new guide to help families protect themselves online. 

"Parents don’t need to be technology experts to help their children navigate the digital world safely” said EFF Public Interest Technology Director Babette Ngene. “At EFF, we believe in empowering families with the knowledge and confidence to make informed decisions about their digital lives. It’s about meeting families where they are and giving parents the guidance they need to have meaningful conversations with their children about digital safety, based on what works best for their families.” 

EFF launches this crucial resource as state and local governments consider enacting well-meaning but ill-advised laws that cut young people off from essential information and experiences, particularly harming vulnerable youth and marginalized groups who often find safety in supportive online communities they can't access offline. Such laws also entail age gating, which compromises the privacy of all internet users and stifles young users’ ability to learn, grow, and express themselves. 

“Deciding how to help your young people use the internet—including engaging with video games, social media, web search, and everything else—is a complicated topic that touches on many different skillsets and ideas,” said EFF Senior Security and Privacy Activist Thorin Klosowski. “But ultimately it's up to families – not governments – to decide when and how to engage with these sorts of questions.” 

Each young person has unique needs, and, just like their wardrobe, that changes as they age. Parents can engage in thoughtful planning to find the best, most efficient solutions that evolve along with their children.  

EFF’s guide is about helping parents explore their concerns and identify the threats their children face – like trusting AI chatbots or sharing personal information with strangers – and then determine steps they and their children can take to mitigate those risks while still using the games, educational materials, and communication platforms that help them grow. 

The guide also compiles links to parental control setup documentation for a variety of popular devices and platforms, and advises parents on quick, easy tasks they can perform to advance their children’s online privacy. 

For the guide: https://ssd.eff.org/module/online-privacy-for-parents-and-youth

Contact:  ThorinKlosowskiSenior Security and Privacy Activistthorin@eff.org

There’s a new archive of all the papers from twenty-five years of the Workshop on Economics and Information Security (WEIS).

Really nice resource. It’s fun to reread my 2002 essay on the economics of information security.

Innovation, reflection, and celebration will blend at the Boston Symphony Orchestra this week, where MIT composer Tod Machover’s inventive new work “already and not yet” will see its world premiere on Thursday.

Machover, one of the world’s most prominent composers, has incorporated multiple ongoing interests into the new symphony, including AI tools interacting with the musicians, and a piece that is structured as a meditation on the crisis and promise of democracy. 

“An orchestra is an interesting ensemble to use for thinking about how different groups of people can relate to each other,” says Machover, who is the Muriel R. Cooper Professor of Music and Media and faculty director at the MIT Media Lab, where he also serves as director of the Opera of the Future group. 

He adds: “John Cage used to say one way to think of a piece of music is that it should be like the society you’d like to live in. I was always inspired by this idea, and thought of the orchestra — and constructed this new piece — in this way.” 

If the innovation in “already and not yet” comes from its use of artificial intelligence, and the reflection pertains to democracy, the celebration involved in the event partly relates to MIT: The performances are coordinated with the MIT Media Lab’s 40th anniversary celebrations occurring this week. Machover has been a member of the Media Lab since it opened. 

“In many ways, the piece is also an homage to the lab and to its spirit of invention and reinvention,” Machover says. 

The acclaimed conductor Kent Nagano — a longtime collaborator and advocate for Machover’s music — will lead the Boston Symphony Orchestra’s performances, which are taking place Oct. 22-24 at Boston’s Symphony Hall. 

Inspired by the possibilities

Machover’s extensive career has often featured the invention of new technologies within his compositions. Among many other technologically related projects, he has led the development of hyperinstruments, which can be responsive to the playing techniques of musicians and expand their range of expression; renowned cellist Yo-Yo Ma is among those who have performed Machover’s work using them. 

Working across diverse musical forms, Machover’s 2010 opera “Death and the Powers” was a Pulitzer Prize finalist. He has also used locally sourced and community-created sounds as additional aural layers in his “City Symphonies,” which have been created around the world. The next project in the series, underway in Seoul, South Korea, is scheduled for premiere in September 2027.

“I’ve always been inspired by the possibilities of technology and the expressive potential it opens up,” Machover says. “It is kind of the core language of our time and something we have to grapple with so that it evolves in the most positive human-enhancing ways. I feel so fortunate that I have been able to pursue this vision at MIT, and particularly at the Media Lab, for all these years.” 

Machover’s “already and not yet” reflects on democracy in multiple ways. One is through the form of the composition, which has three movements relating to different stages of democracy. In the first movement, “Smash Up,” strings and winds eventually get crowded out by what Machover calls the “oppressive, aggressive” sounds of brass, percussion, and electronics. The second movement, “Wake Up,” presents a moment to reflect and regroup, but little by little weaves together a thriving melodic and textural presence. The third movement, “Stand Up,” involves more vigorous interplay between all the musicians, inviting the players to participate in establishing a new kind of balance between individuality and community. 

In this way, “already and not yet” conceptualizes the orchestra as a way of representing the stress and revival of democracy, and uses a “Live AI” system created at the Media Lab — along with layers of electronics crafted in Machover’s studio — to emphasize this struggle and progression. In the second movement of “already and not yet,” the AI tools aim to underscore the distinctiveness of each instrumentalist, establishing an ensemble of soloists; in the third movement, more broadly representing the regrowth of a polity, the AI system aims to find common ground, building new sonic bridges across the orchestra and extending it out into the hall using extra, specially installed loudspeakers. 

“I’ve used the way the orchestra plays, how much is scripted and how much freedom they have, and how they negotiate their relationship with the conductor, as part of the story,” Machover says. “It’s not said explicitly, but I think the players and the audience will feel it. It’s a whole society up there on stage, and the liveliness and ever-changing nature of the AI systems for this piece both dramatize and encourage a new way of playing and listening.”

Machover credits two PhD candidates in his group at the Media Lab for their extensive work on the project: Manaswi Mishra, who designed and built the AI systems for the performances, and Ana Schon, who will be doing the complex sound mixing in Symphony Hall during each performance. 

Reflections of an AI veteran

For Machover, the application of machine learning and AI is hardly a newfound idea; he has been exploring the concept for decades, giving him a distinctive perspective on this topic du jour. 

“The current generation of AI, especially generative AI, has capabilities that are different than AI from 20 or 30 years ago,” Machover says. “It’s good at certain things that were hard to do 20 years ago, but less good at some things that were easier to do back then.” 

When he designed a hypercello for Yo-Yo Ma, for instance, those systems would analyze Ma’s sound, playing techniques, and expressive intent in order to shape the extensions of the instrument. Today’s AI tools “are less good at analysis, but very good at detecting significant features and patterns in the audio itself, information that can be leveraged to powerful musical effect,” Machover says. 

“Current systems aren’t so good at what we did [for Yo-Yo Ma], like trying to understand the performance or the music itself,” Machover says. “But evolving AI models do an incredible job — especially in Manaswi’s magical systems — at establishing an immediate, creative dialogue with musicians, producing sophisticated and surprising augmentations that in turn inspire performers or composers to discover truly new ideas.”  

Ultimately, Machover says, “I think this piece — through its technology, its ‘story,’ and its sounds — is meant to take people on a journey of recognition about where we are at this moment in time and where we might be going. It’s meant to be an optimistic and inspiring piece.” He adds, “The idea, expressed in the work’s title, is that we’re so lucky to be at this place in this moment, even with everything that’s wrong and in critical need of repair. We really are. At the same time, it’s so urgent to realize that the vision of a just and flourishing society, for which the foundation exists, isn’t finished at all. Not only that, it’s in crisis. So this is the last time to be complacent, or discouraged.”

For all of that, Machover also expresses hope that the audience at Symphony Hall can simply engross themselves in the music itself, and find it compelling on its own terms. 

“My biggest wish is that people listen to this piece as music — forget about the AI or the story and just get swept along,” Machover says. “There’s one melody in this piece that’s trying to express itself in the first movement, and appears in fragmented form in the second movement. In the third movement, it’s the center of everything, a kind of vision of resolve, hope, and purpose. If people come out of the performance and don’t have some part of that melody in their heads, I’d be surprised. I hope that audiences listen for that, try to hold on to it, and see where it might lead.”

The piece was commissioned by the Boston Symphony Orchestra and supported by the New Works Fund of the Massachusetts Cultural Council.

In a victory for data privacy, a federal court in New York definitively ruled that the Office of Personnel Management (OPM) violated the law when it disclosed millions of federal employee records to DOGE agents. In a summary judgment ruling issued on October 20, 2026, the court found that OPM violated two provisions of the Privacy Act—one restricting disclosure of personal records between agencies and another requiring agencies to protect the security and confidentiality of records.

Since the case was filed, many DOGE agents have left the government and OPM has rescinded their database access. However, OPM should still clean up the cybersecurity mess it created. The court will decide the remedy at a later date.

"By virtue of the Court’s summary judgment ruling, OPM’s decision to grant DOGE Agents broad access to its systems of recordings containing [personally identifiable information (PII)] has been held unlawful," Judge Denise Cote wrote.

"The record also provides no support for a finding that it was the pursuit of a modernization agenda that prompted OPM to grant sweeping and expedited access to a score of DOGE Agents to its systems of records containing PII," she added.

OPM maintains databases of highly sensitive personal information about tens of millions of federal employees, retirees, and job applicants. Starting in January 2025, OPM disclosed data to the U.S. DOGE Service, initially led by Elon Musk. This disclosure violates the federal Privacy Act of 1974, a watershed anti-surveillance statute that prevents the federal government from abusing our personal information.

EFF sued OPM and DOGE because this data disclosure violates the Privacy Act. We represent unions of federal employees – the American Federation of Government Employees and the Association of Administrative Law Judges – and individual employees. We seek injunctive and declaratory relief. We filed in the U.S. District Court for the Southern District of New York.

Our co-counsel are Lex Lumina LLP, State Democracy Defenders Fund, and The Chandra Law Firm LLC.

Donate to EFF

Support Privacy & Government Accountability

Related Cases: American Federation of Government Employees v. U.S. Office of Personnel Management