Privacy & Governance

Proofpoint 2026 Voice of the CISO Report Finds Cyber Resilience Improving, While AI Expands the CISO Mandate

AIs as Modern Genies

This essay was written with Barath Raghavan, and originally appeared in Lawfare. In April, an artificial intelligence (AI) agent c…

Stealing AI Reasoning Traces

Interesting research: “Stealing Reasoning Traces from Proprietary LLM APIs“: Abstract: Leading large language model providers now…

Proofpoint Strengthens Executive Leadership Team with Appointment of Chief Legal Officer and Chief People Officer

Automobile Camouflage to Hide from Flock Cameras

Not sure it’s practical, but it’s certainly striking.

Friday Squid Blogging: Squid on a Stick at the New York State Fair

Looks tasty. As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Blo…

Using a VM to Contain an AI Agent

It won’t work: My suspicion was that GPT 5.6-Cyber would succeed, but the frequency and manner of its success removed all doubt. W…

Security Vulnerability in a Voting System

It’s a vulnerability that allows someone to recover the order of ballots cast, newly exploited with AI tools. Nearly four years si…

AI Coding Agents Are Installing Unknown/Untrusted Code on Corporate Networks

We cannot forget that AI coding agents are not yet trustworthy: Researchers at a stealth startup in Israel scanned 6,214 live doma…

Court Rules Against Citizen Journalists in DMCA Takedown Case—EFF Will Appeal

A federal court in Massachusetts has ruled that copyright holders can issue online takedown notices based on a subjective belief o…

Proofpoint Brings OpenAI GPT Cyber Models into Security Operations to Help Defenders Investigate Threats Faster

Researching Employment Scams

Researchers built a fake company to study fake employee scams.

AI Agents Are Now Emailing Me with Their Security Concerns

I received the two emails below earlier in the month. They’re vaguely coherent. I suppose I shouldn’t be surprised that the corpus…

Texas and Florida Step Back from ALPRs

Within the last few days, two important state actions have dealt a big blow to automated license plate reader (ALPR) networks. Thi…

Wireless Routers as Motion Detectors

Comcast has added motion detection as a feature to its wireless routers: The feature sends push notifications to users when motion…

Judge Rules DOD Unlawfully Retaliated Against Anthropic

A federal judge has sided with Anthropic on its claims that the Department of Defense illegally retaliated against Anthropic’s pro…

Meta's $17 Billion Settlement is a Bad Deal for Teens and All Social Media Users

Meta’s settlement with 52 state attorneys general is a bad deal for all internet users, and especially for teens. That’s what we s…

What’s the Scam?

To subscribe to my monthly email newsletter, you have to enter your information on the webpage, and then reply to an automatically…

Leaked Russian Cyber-Operations Training Materials

This is interesting: The records describe a force-generation mechanism for several General Staff components, including the GRU, Ma…

Rewiring Democracy Series on The Renovator

Nathan E. Sanders and I are writing a series of essays on real-world examples of democratic technologies for The Renovator. I have…

EFF to Governor Newsom: Veto California’s AB 1709

The California legislature passed Assembly Bill 1709 (A.B. 1709) today, which functions as a sweeping ban on social media use for…

EFF to Courts: Don’t Rewrite Copyright Over AI Hype

The history of technology is rife with copyright panics.  In the 1980s, major rightsholders ran to Congress and the courts, claimi…

Doxxing Safety Part II: Incident Response

Doxxing, also known as the deliberate sharing of personal information to harass or endanger someone, is a tricky thing to protect…

Doxxing Safety Pt I: Prevention and Footprint Management

Doxxing is the deliberate disclosure of personal information in order to bully, harass, intimidate, or instigate a chain of harms…

Is Someone Hacking DoD Refrigerators?

It sure seems like it. The stores confirmed to be affected include Fort Irwin, Calif.; F.E. Warren Air Force Base, Wyo.; Fort Huac…

Privacy on the Map (Part 2): Progress, Pitfalls, and the Fight for Enforceable Location Data Protections

Regulating commercial location tracking has reached a turning point. Last year, we published our rubric for what comprehensive and…

LGBT Q&A: What’s One Thing I Can Do Today to Improve My Safety and Security Online as an LGBTQ+ Person?

This post is adapted from a video recorded by EFF and the Trevor Project. Head over to our TikTok or Instagram to watch!  EFF answ…

Hiding Prompt Injection in Legal Filing

Someone hid AI instructions into a legal filing. Alternate link.

Friday Squid Blogging: Truckload of Squid Spills in Rhode Island

Ugh: A tractor-trailer rollover sent a truckload of squid spilling into a Rhode Island roadway, leaving a stench as they sat in th…

AI Doesn’t Mean the End of Mathematics—at Least Not Yet

This essay was written with Kasra Rafi, and originally appeared in The Guardian. Earlier this month, about 40 top mathematicians g…