With new generations of AI models fueling both rapid software vulnerability discovery and the potential for faster exploitation by malicious hackers, the United States Cybersecurity and Infrastructure Security Agency released a new directive on Wednesday that requires more rapid and efficient software patching by federal civilian agencies. The “binding operational directive” (BOD) lays out a rubric for how quickly bugs must be fixed based on four assessments of urgency, with a turnaround time in critical cases of just three days.

Chris Butera, CISA’s acting executive assistant director for cybersecurity, told reporters on Wednesday that the goal of the directive is to help agencies prioritize, so they can address the most problematic vulnerabilities first while taking more time to remediate bugs that pose a less-pressing risk. The directive comes as private companies and governments have been scrambling to assess the extent of the cybersecurity reckoning that AI vulnerability and exploit development capabilities could unleash.

“Prioritizing IT and security operations attention on the most at-risk assets is particularly important now given advancements in artificial intelligence, which allow threat actors to find and exploit vulnerabilities in [federal] assets,” Butera said on Wednesday. “Defenders cannot afford to take weeks to patch systems that can be autonomously exploited en masse.”

The CISA directive’s criteria for evaluating patch urgency includes looking at whether a vulnerability is in a system that is publicly exposed, whether the bug is listed in CISA’s Known Exploited Vulnerabilities Catalog, whether an attacker could automate all of the steps to exploit the vulnerability, and how much access an attacker would get to the target if the bug were exploited. A vulnerability where all four points apply must be fixed within three days, according to the new directive, and the agency must also execute a “forensic triage” process to determine whether systems have already been compromised.

The directive supersedes two previous CISA orders related to patching timelines for urgent vulnerabilities—one from 2019 and one from 2021. Those established a framework in which the most critical bugs had to be patched within 15 days of detection and another class of high-urgency vulnerability had to be remediated within 30 days. And both encouraged faster patching for severe flaws when possible. Even before the AI era, in 2021, CISA wrote that “threat actors are extremely fast to exploit their vulnerabilities of choice: of those 4% of known exploited [vulnerabilities], 42% are being used on day 0 of disclosure; 50% within 2 days; and 75% within 28 days.”

US federal cybersecurity has improved significantly over the past decade, but it still often lags, thanks to funding shortfalls and competing priorities. CISA’s Butera said that the agency developed the new assessment rubric and the directive more broadly with these limitations in mind. He noted, for example, that the three-day deadline for the most urgent vulnerabilities isn’t, say, 24 hours, because such a short timeframe would not be feasible for most agencies.

New AI capabilities are already changing the landscape of vulnerability detection and bug hunting. And as this spurs new urgency in patching, many researchers have started to conclude, essentially, that no amount of patching will be enough—and that the software development community globally must work to adopt new, architectural or systemic approaches to invalidating whole classes of vulnerabilities at a time.

“CISA’s directive has its heart in the right place, but it only tackles half the challenge,” says Emily Long, CEO of the cloud security firm Edera. “If your architecture doesn’t limit what an attacker can reach after a breach, you’re just running faster on the same treadmill. Patching will always be important, but we should be talking more about containment by design.”

CISA’s Butera seemed to acknowledge this evolution on Wednesday. The new directive “is an initial step to counter the increased capabilities of emerging AI models,” he says. “Yet there is still more work to do.”

A man raises his phone as police move into a crowd. The video is shaky, loud, immediate. Within minutes, it is online. Within hours, it is everywhere. This is how accountability works now. Something happens, someone records it, and that footage can show what really happened, sometimes contradicting official accounts. It can empower citizens and create consequences for officials.

But the footage’s life cycle does not end there.

In recent months, civil liberties groups have warned that adding facial recognition to consumer smart glasses could turn everyday recording into something more troubling: real-time facial identification. It reflects a broader shift already underway, where images and videos captured for one purpose can later be searched, matched, and used for another.

An ouroboros is an ancient Egyptian symbol, a snake or dragon eating its own tail. As I began to see patterns in my broader research on surveillance corporatism and governance lag, I began using the term “surveillance ouroboros” to describe this recursive pattern of observations intended to hold power accountable becoming new input for the same surveillance infrastructure.

Facial recognition changes accountability

During the George Floyd protests in 2020, people filmed police in real time. Phones were pointed at officers, not at each other. The goal was simple: to show what the state was doing. That footage spread quickly and became part of a much larger pool of public data.

At the same time, reporting from outlets including The New York Times and BuzzFeed News showed that law enforcement agencies were using facial recognition tools, including systems built by Clearview AI. Those systems were built from billions of images scraped from across the internet, including publicly available photos and videos.

The basic approach is now routine: People record the state, or anything else—as in the January 6 attack on the U.S. Capitol—and the state compiles that footage and data into a searchable environment, which may later be used to identify some of the same people who made the footage.

Facial-recognition systems used by law enforcement are increasingly outpacing the legal safeguards.

A 2024 Government Accountability Office review found that federal law enforcement agencies continued to expand their use of facial-recognition systems for criminal investigations despite ongoing concerns around training, privacy protections, civil-liberties safeguards, and oversight. Earlier GAO findings showed that agencies had conducted roughly 60,000 facial-recognition searches before formal training requirements were put in place for personnel using the systems.

The American Civil Liberties Union and other groups have warned that these tools could be used to identify people from images shared online, including protest-related footage. Concerns about facial recognition led some U.S. states and cities, including San Francisco and Boston, to restrict or ban government use of the technology, while federal agencies have continued to face scrutiny over how such systems are tested, deployed, and audited. A 2024 analysis published in Internet Policy Review warned that facial-recognition systems used by law enforcement are increasingly outpacing the legal safeguards meant to govern them, creating growing tensions around data protection, oversight, and proportional use.

The spy network that built itself

Surveillance used to require infrastructure. Cameras had to be installed and data had to be collected deliberately. That is no longer the case. People carry cameras everywhere. They record constantly and upload in real time. Events are documented from multiple angles without planning or coordination. The cumulative result is a continuous stream of usable data: faces, locations, timestamps, and interactions. The Internet of Things also waits all around us, gathering information and releasing it when people least expect it, as Andrew Guthrie Ferguson describes in a recent excerpt of his book Your Data Will Be Used Against You.

RELATED: “Sensorveillance” Turns Ordinary Life Into Evidence

Similar dynamics are emerging globally. A recent analysis in the International Journal of Law and Information Technology examined how facial-recognition systems in China and Japan are expanding faster than the legal frameworks governing them. Reporting by The Guardian described the limited legal protections around the rapid deployment of AI-assisted surveillance infrastructure across parts of Africa.

There used to be a clear distinction between surveillance and accountability. Surveillance meant the powerful watching the people; authorities tended not to share their imagery except under duress or a court order and usually after a long delay. Accountability meant the people watching the powerful, and often publishing imagery immediately to head off or counteract official mischief. That distinction no longer holds. The same footage can serve both roles. A recording meant to expose misconduct can later be used to identify someone else entirely.

Surveillance ouroboros is not a future risk. It is already here.

This dynamic persists because people still need to record. In many places, it is one of the only tools available when formal accountability breaks down. When oversight institutions weaken or fail, public documentation becomes a substitute. In that environment, people turn to visibility. But that visibility comes with a cost. The more people that document, the more data that exists. The more data that exists, the easier it is to search, match, and store. Every video feeds the ouroboros. People are not feeding the system because they trust it. They are feeding it because the alternative is silence.

Most of the people in these videos are not the focus. They are in the background, passing by or standing nearby. But that distinction does not matter once the footage enters a system. Today’s facial recognition can identify even a face that passed through the corner of a frame. Someone who did nothing can still become part of a dataset without ever knowing it. As recognition systems improve, older footage becomes more useful, and invasive.

No single decision created this outcome. It emerged gradually through more cameras, better recognition, larger datasets, and easier integration. Each step made sense on its own. Together, they changed what recording means.

Public recording is still necessary. Without it, many forms of abuse would remain hidden. But recording is no longer just exposure. It is also contribution. If you published imagery or video last year, you may already have contributed to a system you have never seen, but the ouroboros has.

Surveillance ouroboros is not a future risk. It is already here. Every time someone presses publish, they are doing two things at once. They are exposing power, and they are helping build the system that the powerful will later use to track the less powerful.

• After four years, we finally get a second Kingdom Hearts 4 trailer
• Disney characters were few and far between, but two worlds were teased
• We also didn’t get a release date

It’s tough being a Kingdom Hearts fan. The series is an all-time great, but if its platform-hopping origins weren’t frustrating enough — with entries exclusive to different consoles and even different regions for a while — we must now face the fact that Square Enix loves taking its time between entries, and between a new game’s announcement and release.

Kingdom Hearts 3 was first showcased around five and a half years before its release, and it seemed Kingdom Hearts 4 might take just as long between merely its first and second trailers. That is, until we got a brand new look at the game at Nintendo Direct, saving this year’s Summer Game Fest event for me just as I had conceded the Disney meets Final Fantasy crossover would be absent yet again.

Frequent flyers and road warriors often rely on over-ear headphones to carve out personal space amid engine noise, terminal chatter, and crowded gates. Apple’s second-generation AirPods Max 2, priced at $499 (was $549), deliver a focused set of refinements that address several everyday frustrations from the first model, particularly for people who spend serious time in motion. The updates center on stronger noise blocking, modern connectivity, and software features that respond to real travel moments without demanding extra effort.

Anyone who has been stuck on a long journey knows how a low-frequency motor hum can wear down even the best intentions to sleep or focus. The new H2 chip considerably increases active noise cancellation, cutting through the seemingly never-ending drone more efficiently. User’s real-world tests show that it can handle airline engines, street noise, and general chat-din slightly better, allowing you to relax and listen to a podcast or your favorite music without being bothered by the background noise. That’s where Adaptive Audio comes in, as it works with the new chip to provide a little more awareness where it counts, eliminating the need to constantly switch between modes as the environment changes.

Sale

Apple AirPods Max 2 Wireless Over-Ear Headphones, Active Noise Cancellation, Adaptive Audio, Personalized…

• ULTIMATE OVER-EAR LISTENING EXPERIENCE—Powered by the H2 chip, AirPods Max 2 delivers improved high-fidelity audio with deep bass, expansive mids…
• TUNE OUT THE NOISE—Up to 1.5x more Active Noise Cancellation than the previous generation, fully immersing you in every sound.*
• HEAR THE WORLD AROUND YOU—Adaptive Audio automatically adjusts noise cancellation levels to suit your environment. Conversation Awareness lowers the…

Even with noise cancellation set on, the battery life lasts up to 20 hours, which is adequate for most cross-country flights or days spent bouncing between gates. On the other hand, if you are without power outlets for an extended period of time, a simple 5 minute charge will provide you with an additional 1 and a half hours of battery life, as well as the extra convenience of the Smart Case. When you put the headphones in a bag for storage, this device automatically changes them to an ultra-low-power mode, ensuring that they are ready to use even after days in a travel bag.

Using USB-C has a huge impact on the road. There’s no need to look for the right adapters; simply plug in a power bank, a laptop, or an airplane port and you’re set. When you plug it in, it unlocks lossless music at 24-bit / 48 kHz and ultra-low latency, making it ideal for wired listening to a laptop or a compatible entertainment system without the audio being affected by Bluetooth compression.

The new microphones and H2-powered tools also serve to improve the less glamorous parts of travel. Calls are clearer even in extremely busy airports or during boarding, and the new Conversation Awareness feature automatically reduces the level when it detects someone speaking close by. That function supplements the Live Translation feature, which provides instant language assistance when you’re abroad. The Digital Crown remains the best way to control the volume, skip songs, and access Siri without depending on those awful touch gestures that go haywire in transit.

The sound tuning has been slightly enhanced. The sound profile remains warm and has good bass response, but it does not fatigue after long periods of listening. The new Personalised Spatial Audio feature, which features dynamic head tracking, creates an immersive bubble that can help you pass the time on a long ride. Consistent frequencies and a reliable presentation allow you to easily zone out and listen without worrying about things breaking down after a few hours.

from the that’s-not-how-any-of-this-works dept

California lawmakers are again considering A.B. 412, a bill that would require AI developers to identify and disclose copyrighted works used to train generative AI systems.

The problem this year is the same as last year: it’s practically impossible to comply with this law. The bill demands information that often does not exist, and cannot realistically be obtained. 

EFF submitted an opposition letter to the California Senate Privacy Committee explaining why we continue to believe A.B. 412 is simply unworkable. To the extent developers do follow this law, it will have the effect of locking in the power of the largest companies in AI. 

A Burden That Can’t Be Met

A.B. 412 sounds simple: just have AI developers create and keep a list of all the registered copyrighted works they use in AI training. 

That may seem straightforward. In practice, it’s anything but. 

There is no machine-readable “list” of copyrighted works at the U.S. Copyright Office. And many copyright holders can get a copyright without even depositing a publicly viewable sample of the work—for example, software companies may register copyright on proprietary code without revealing it to the public. 

And on the open internet, copyright information is often incomplete, unavailable, or impossible to verify. One image may be registered with the copyright office, while the next is licensed under a free Creative Commons license (like the images that EFF creates), and the next is public domain. A message forum user might post an original story, photograph, or poem without any indication of ownership or registration status. 

The bill effectively asks developers to continuously cross-reference massive batches of online data against a copyright system that simply wasn’t designed to do so. If California passes A.B. 412, its impact will go far beyond the large AI companies we read about in the headlines. 

Not Just Big Tech

Supporters often frame this bill as a way to help creative workers have some leverage against Big Tech, but the bill reaches much further than the big AI companies. 

Its definition of “developer” extends to anyone who makes a generative AI model available to Californians. That includes indie developers tinkering with an existing model, open-source initiatives, nonprofits, and other non-commercial efforts. Recent amendments added exemptions for universities and government entities, which is important, but that still leaves out a vast swathe of non-commercial tech work that’s done by people without full-time jobs in government or academia. 

Large companies will hire compliance teams and lawyers to navigate these requirements. Smaller organizations and independent developers usually can’t. The result will be fewer opportunities for startups and new entrants. Faced with this massive compliance burden, some won’t even try. 

Courts Are Already Deciding These Questions

The bill is premised on the idea that copyright owners currently don’t have good remedies if they’re mistreated by AI companies. That simply isn’t true. And the growing wave of federal court filings in this space proves it. Content companies that want to sue tech companies, large or small, have no problem doing so. Those courts are still working through important questions about fair use and transformative use. Some courts have already concluded that many AI training activities qualify as fair use. Others continue to evaluate the issue.

California lawmakers should not rush to impose new state regulation while those questions remain unresolved. This is why copyright is governed at the federal level: both creators and fair users benefit from a single set of nationwide rules. 

At this point, the bill remains a solution in search of a problem. Rights holders already have powerful tools to protect their interests under existing federal law. What this bill adds isn’t clarity or transparency, but a costly and essentially impossible compliance burden that will discourage small developers and researchers. 

California has been able to support both artistic creativity and tech innovation for decades now.  But A.B. 412 does not strike the right balance. 

If you are a California resident and interested in speaking out about this bill, you can find and contact your representatives through this website. 

Republished from the EFF’s Deeplinks blog.

Filed Under: ab 412, ai, ai training, california, copyright

Don’t get me wrong — I’m pretty darn excited for a Legend of Zelda: Ocarina of Time remake. But boy, I would have been so much more excited for a sequel instead.

If you’ve somehow missed it, at the most recent Nintendo Direct, we saw a brief teaser for a Switch 2 version of Ocarina of Time. Admittedly, the brief trailer is light on details — merely showcasing a cinematic intro for the iconic adventure with some voice acting and vastly improved graphics over the Nintendo 64 original — but the promise to return to Hyrule later this year has left many (myself included) ecstatic with the hope this is Zelda’s Resident Evil 2 Remake equivalent.