ELIZA is remembered as the world’s first AI star, a kindly therapist in chatbot form that gently probed users’ worries. Even its creator, Joseph Weizenbaum, was surprised by the warm reception given to his experiment in human-machine interaction. For some, it heralded an age of automated psychotherapy, while others believed the program demonstrated sentience, a fallacy soon known as the “ELIZA effect.” Based on published descriptions, ELIZA has been implemented on many different computers, but only recently has the actual source code been unearthed from MIT’s archives.

In Inventing ELIZA: How the First Chatbot Shaped the Future of AI, just published by MIT Press, a squad of researchers analyze the code and reveal a complex program capable of much more than faking psychiatry. In fact, it could assume several different personas. The authors have also created a faithful emulation of the therapist persona that you can try yourself after reading the book excerpt below.

When it debuted in the mid-1960s, the ELIZA software program transformed the way people thought about interacting with computers. As the first chatbot, ELIZA demonstrated how a calculation machine might engage in conversation, ushering in a host of social and technical questions that still resonate today. Now we don’t think twice about interacting with a machine in real time, conversing over text, or even speaking into the air to ask about the weather. In many ways, ELIZA shaped not only the way we think about interacting with computers but also how we think about them. It began to give a reality to the science fiction stories of how we expect computers to work.

This article is adapted from the new book “Inventing ELIZA: How the First Chatbot Shaped the Future of AI“ (MIT Press, 2026).

Although ELIZA was far from a faultless conversation partner, it astonished its users. The recent discovery and archaeology of the original ELIZA source code represents a significant intervention in the history of computing. By examining the actual implementation of ELIZA rather than relying on later reconstructions and reimplementations, we challenge taken-for-granted assumptions about this key software artifact.

For example, the source code reveals that ELIZA was not merely a simple pattern-matching chatbot but can be better understood as a sophisticated platform designed for multiple “personas,” or scripts, with a complex set of capabilities, including script editing and contextual memory. The script that most people conflate with the program ELIZA was actually called Doctor, which performed the role of a psychotherapist. Yet, like a modern chatbot prompted to behave with different personalities, ELIZA could take on many roles.

“This code and script…reveal underlying assumptions about language, therapy, and human-computer interaction that continue to influence modern AI development.”

This unearthed material transforms our understanding of early AI development by demonstrating that Joseph Weizenbaum’s technical innovations were far more advanced than previously documented. Moreover, the discrepancies between his published descriptions and the actual implementation help to show the gap between theoretical computational models and their material instantiations in computer source code, a tension that continues to shape digital culture today.

Although many technical innovations have emerged in the decades since ELIZA, examining the ELIZA/Doctor code offers a rare glimpse into one of the earliest formalized attempts to model human conversation. What makes ELIZA particularly fascinating is not only its historical significance but also what it reveals about Weizenbaum’s views on both computing and human interaction. This code and script do not merely showcase programming techniques of the 1960s; they reveal underlying assumptions about language, therapy, and human-computer interaction that continue to influence modern AI development. By examining this code, we can start to uncover the sophisticated linguistic and programming techniques that allowed a rudimentary pattern-matching system to create a convincing simulation of understanding. But before we can read the lines of code, let us offer an overview of the system.

How Did ELIZA Create Personas?

The architectural distinction between ELIZA and Doctor represents an important design decision in AI history. Think of ELIZA as a system for interaction and Doctor as one set of rules that Weizenbaum devised, among others. This separation, manifested in ELIZA’s system-script dichotomy, presaged numerous contemporary software patterns, from configuration-as-data to plug-in architectures and domain-specific languages.

Based on published journal articles, ELIZA was re-created on many platforms, such as the IBM PC. However, the actual source code sat untouched in the MIT archives for many years. VCF Museum at InfoAge

Without question, the historical context of 1960s computing fundamentally shaped ELIZA’s architecture as well. Decisions in computing that reflect material constraints create path dependencies and eventually become programming cultural norms. These constraints manifested in ELIZA’s single-pass processing, tape-based storage and stack-oriented implementation. Yet within these limitations, Weizenbaum crafted an elegant solution. These technical features, though invisible to the users, are crucial to creating the illusion of understanding that made ELIZA so compelling.

Weizenbaum explained many of ELIZA’s technical features in the 10-page paper published in the January 1966 edition of the journal Communications of the Association for Computing Machinery (CACM). But he chose to omit some essential details.

In that paper Weizenbaum published ELIZA’s best known dialogue, which begins,

This dialogue marked ELIZA’s public debut in 1966 as one of the examples produced by the Doctor script. By finding the source code for ELIZA and examining how it performs the Doctor script, we now better understand these two separate parts of a system and can explore the many other personas of ELIZA. In just some of the other scripts known to date, ELIZA was programmed to discuss math, poetry, color, paradoxes, synchronization, relativity, France, and elevators.

These scripts work like templates. They are structured data that direct the ELIZA system to “play” a particular task or role. By comparing archival and published ELIZA dialogues from interactions with a variety of scripts, including Doctor, we can understand more about bot personas and how they function, paying close attention to how a bot evokes social dynamics between system and interactor.

Ultimately, studying the dialogues and scripts demonstrates the crucial role that collaboration plays in these exchanges, as bot and user cocreate the sense of their interaction. To understand the full range of ELIZA’s capabilities and conversational possibilities, let’s take a look at the variety of scripts that were created for the ELIZA system.

What distinguishes each ELIZA script is both its subject matter and the linguistic and stylistic choices used to deliver that content. These choices are not neutral; they can be said to construct a particular persona with characteristics that emerge through the script’s language patterns, vocabulary, and conversational approach. In short, it matters not just what you say but how you say it too.

“The aim was less to create a functional automated therapist and more to find a suitably constrained role to match the limitations of the programming environment.”

For example, with the Doctor script Weizenbaum deliberately echoed the style of a Rogerian “talk” therapist. He chose this persona because the psychiatric mode is one of the few types of conversations in which one person can “assume the pose of knowing almost nothing of the real world. If, for example, one were to tell a psychiatrist ‘I went for a long boat ride’ and he responded, ‘Tell me about boats,’ one would not assume that he knew nothing about boats but that he had some purpose in so directing the subsequent conversation.”

The first users of ELIZA interacted with it via teletype terminals.VCF Museum at InfoAge

Thus, the most famous persona created for ELIZA was a technical convenience. As human-computer interaction expert Lucy Suchman explains, “The Doctor program exploited the maxim that shared premises can remain unspoken: that the less we say in conversation, the more what is said is assumed to be self-evident.” In creating the original ELIZA effect, less was more.

The aim was less to create a functional automated therapist and more to find a suitably constrained role to match the limitations of the programming environment. Then Weizenbaum composed the script to match the role by choosing specific words that evoked rhetorical tone and characterization, for example, LET’S DISCUSS FURTHER WHY YOU … WHAT DOES THAT SUGGEST TO YOU. In Doctor, the machine side of the conversation needs to appear like a good listener who cares about what the user has mentioned before, so it often includes the user’s text in its replies and keeps its responses open-ended. Because a real doctor would be inquisitive, the script contains lots ofWHAT andWHY questions. In other scripts and dialogues, the script keywords and assigned responses reveal the design decisions that help create different specific personas. This variation becomes increasingly apparent as we look at the wider range of ELIZA scripts.

What Were Some of ELIZA’s Alternate Personas?

Let’s start with a script called Neweng, short for New England. By the mid-1950s, scientists were already taking up Turing’s proposition for conversing with a computer as a tangible idea. In 1959, a “conversation machine” made by a small team at the University of Toronto Computation Centre could make small talk about the weather if preprompted with current data. Its script included a ranked series of time words, weather words, and emotion words, but the system had “a rather narrow outlook,” limited vocabulary, and no knowledge of syntax. According to its creators, “in spite of this crudity, the results in passable conversation are surprisingly good, which in a way is a commentary on the shallowness of ordinary conversation about the weather.”

This fragment of ELIZA’s source code shows how scripted responses were encoded, in this case to make ELIZA sound like a Rogerian therapist. MIT Libraries, Distinctive Collections

One of ELIZA’s test scripts found in the archive had a similar function. Neweng does not soothe, therapize, or instruct, but only makes small talk. It chats as if at a boring dinner party.

What can we learn from such a basic conversation in which it seems like nothing interesting is shared? Despite the bland chat, a persona emerges from the bot script in phrases like PLEASANTLY COOL and UP THERE and in locations like THE BEACHES ON LONG ISLAND SOUND. From such comments, we can begin to imagine a persona who has not only a certain vocabulary but also certain hobbies and vacation spots. Perhaps implicit assumptions of race and class emerge as well.

A chatty persona might take on many forms, depending on where and when the conversation occurs. This one seems reserved, perhaps fitting its setting in 1960s New England. The system reminds the user that Missouri is not a New England state, but what if this conversation took place in Missouri, Texas, or Mexico? The machine persona would sound different in its cadence, tone, and references. What would we come to understand about a chat persona from Fire Island, from Brooklyn, from Berlin? What would they sound like, and what topics would they discuss?

These differences in subject matter do matter. They imply personas with entirely different backgrounds and experience, giving users wholly different interactions and affective relations. In this way, the Neweng script demonstrates how even simple algorithms making contextual responses about geography could generate a convincing sense of personhood and place. Whereas Neweng could be said to have created a casual, conversational persona focused on light social exchange, other scripts pushed ELIZA into more structured and educational roles. These scripts demonstrate how the system could be adapted not just for friendly chatter but for teaching.

Edwin Taylor, at MIT’s Education Research Center, developed alternate scripts for ELIZA, testing its ability to act as a teacher.MIT Libraries, Distinctive Collections

Meet ELIZA the tutor, quite unlike ELIZA the therapist or the chatty neighbor. Intrvw, Canvec, FVP1, and Arithm are a set of ELIZA scripts created as teaching tools used in experiments by Edwin F. Taylor at MIT’s Education Research Center. These scripts run on later versions of ELIZA that incorporated an important technical innovation called conditional keyword matching.

Unlike the original ELIZA, which simply looked for keywords and generated responses based on their presence, these updated versions could track what had been discussed previously and branch into different conversational paths based on specific user answers. This development allowed ELIZA to simulate a kind of Socratic method, where a tutor guides learning through carefully sequenced questions that respond to student answers rather than simply presenting information.

These scripts construct the tutor persona through many subtle linguistic gestures that create characterization and rhetorical tone. This tone differs from that of Doctor, which asks open-ended questions and comes across as gentle and nonscientific. In the tutoring scripts, large blocks of informative text from the bot tend to dominate the conversation, and the tone is often more dry and unemotional in these explanations. The dialogues indicate structured scripts that include guidance to lead the student through narrow, Socratic learning paths.

In particular, the teaching scripts feature praise and critique. The dialogues for Intrvw, Canvec, and FVP1 are peppered with EXCELLENT, VERY GOOD, RIGHT YOU ARE, and CONGRATULATIONS. These create the sense of a supportive instructor cheering the student on. Such politeness has been taken up in contemporary bots like ChatGPT, which has been shown to perform better when people are polite back to it.

ELIZA could become a tutor more effectively as the system grew in its capabilities, another valuable reminder that ELIZA was not one program but a family of programs. After the publication of the 1966 CACM article, Weizenbaum continued to develop the systems for interaction and understanding. As an experiment, Weizenbaum wrote the Arithm script less as a tutor and more so to “to illustrate the power of the evaluator to which ELIZA has access.” It uses a friendly, plain language interface to let users do simple programming. The script can do calculations, assign variables to values, and perform operations on them. Math problems can be described in sentence form:

The updated 1967 version of the ELIZA system can accumulate facts and store additional information. In this later version of ELIZA, when the system does not recognize information, it asks follow-up questions to gain data. As Weizenbaum explains, “The present script is designed to reveal, as opposed to conceal, lack of understanding and misunderstanding. Notice, for example, that when the program is asked to compute the area of the ball, it doesn’t yet know that a ball is a sphere and that when the diameter of the ball needs to be computed the fact that a ball is an object has also not yet been established.” Unlike Doctor, which asks questions to keep the conversation going, Arithm is building its store of, if not knowledge, then data and logic statements.

Although the variety of scripts helps us to see how a range of personas could be constructed through script programming ELIZA, they represent only half of the conversational process. A script can establish a foundation for a persona, but that persona only emerges fully through interaction with users who engage with it, interpret it, and respond to it in ways that may confirm, challenge, or transform the script’s implicit character.

Hundreds of cities across the US had adopted a now-familiar brand: Flock Safety surveillance systems, using controversial, AI license plate detection cameras and broad contracts with local police. Now cities, from my home of Bend, Oregon, to the LAPD in Los Angeles, are canceling their Flock contracts, while other towns are even covering Flock cameras with plastic bags while trying to figure out if the cams are actually shut down. 

So, what does it mean when you spot the first camera-and-solar-panel Flock setup in your own neighborhood? I talked to Flock, the American Civil Liberties Union and others about what you need to know. 

Read more: State Laws Against Surveillance and License Plate Cams

Flock made headlines late last year during widespread crackdowns by US Immigration and Customs Enforcement. Though Flock doesn’t have a direct partnership with federal agencies (a blurry line I’ll discuss below), law enforcement agencies are free to share data with departments like ICE, and they frequently do. And Flock Safety coverage, along with citizen concerns, has only risen since then. 

One study from the Center for Human Rights at the University of Washington found that at least eight Washington law enforcement agencies shared their Flock data networks directly with ICE in 2025, and 10 more departments allowed ICE backdoor access without explicitly granting the agency permission. Many other reports outline similar activity.

Following Super Bowl ads about finding lost dogs, Flock was under scrutiny about its planned partnership with Ring, Amazon’s security brand. The integration would have allowed police to request the use of Ring-brand home security cameras for investigations. Following intense public backlash, Ring cut ties with Flock just like my city did, although it now faces a new lawsuit for its own face recognition systems.

To learn more, I spoke to Flock about how the company’s surveillance technology is used (and misused). I also spoke with privacy advocates from the ACLU to discuss surveillance concerns and what communities are doing about it. 

What it means when Flock Safety sets up

If you hear that Flock is setting up near you, it usually means the installation of ALPR cameras to capture license plate photos and monitor cars on the street.

Flock signs contracts with a wide range of entities, including city governments and law enforcement departments. A neighborhood can also partner with Flock — for example, if a homeowners’ association decides it wants extra eyes on the road, it may choose to use Flock’s systems.

When Flock secures a contract, the company installs cameras at strategic locations. Though these cameras are primarily marketed for license plate recognition, Flock reports on its site that its surveillance system is intended to reduce crime, including property crimes such as “mail and package theft, home invasions, vandalism, trespassing and burglary.” The company also says it frequently solves violent crimes like “assault, kidnappings, shootings and homicides.”

Flock has recently expanded into other technologies, including advanced cameras that monitor more than just vehicles. Most concerning are the latest Flock drones equipped with high-powered cameras. Flock’s “Drone as First Responder” platform automates drone operations, including launching them in response to 911 calls or gunfire. Flock’s drones, which reach speeds up to 60 mph, can follow vehicles or people and provide information to law enforcement.

Drones like these can be used to track fleeing suspects. In practice, the key is how law enforcement chooses to use them, and whether states pass laws allowing police to use drones without a warrant — I’ll cover state laws more below, because that’s a big part of today’s surveillance.

It’s important to note that not all cities or neighborhoods refer to Flock Safety by name, even when using its technology. They might mention the Drone as First Responder program, or ALPR cameras, without further details. For example, a March announcement about police drones from the city of Lancaster, California, doesn’t mention Flock at all, even though it was the company behind the drone program. 

How Flock uses tech to ID cars — and people

Flock states on its website that its standard license-plate cameras cannot technically track vehicles, but only take a “point-in-time” image of a car to nab the license plate. 

However, due to AI video and image search, contracted parties like local law enforcement can use these tools to piece together license information and form their own timeline of where and when a vehicle went. Adding to those capabilities, Flock also told Forbes that it’s making efforts to expand access to include video clips and live feeds.

Flock’s machine learning can also note details like a vehicle’s body type, color, the condition of the license plate and a wide variety of identifiers, like roof racks, paint colors and what you have stored in the back. Flock rarely calls this AI, but it’s similar to AI-recognition features you can find in the latest home security cameras

A Flock spokesperson told me the company has boundaries and does not use facial recognition: “We have more traditional video cameras that can send an alert when one sees if a person is in the frame, for instance, in a business park at 2 a.m. or in the public parks after dark.”

By “traditional” cameras, Flock refers to those that capture a wider field of view — more than just cars and license plates — and can record video rather than just snapshot images.

The information Flock can access provides a comprehensive picture that police can use to track cars by running searches on their software. Just like you might Google a local restaurant, police can search for a basic vehicle description and retrieve recent matches that the surveillance equipment may have found. Those searches can sometimes extend to people, too.

“We have an investigative tool called Freeform that lets you use natural language prompts to find the investigative lead you’re looking for, including the description of what a person’s clothes may be,” the Flock spokesperson told me. 

Unlike red-light cameras, Flock’s cameras can be installed nearly anywhere and snap vehicle ID images for all cars. There are Safe Lists that people can use to help Flock cameras filter out vehicles by filling out a form with their address and license plate to mark their vehicle as a “resident.” 

The opposite is also true: Flock cameras can use a hot list of known, wanted vehicles and send automatic alerts to police if one is found.

With Flock drones, these intelligent searches become even more complete, allowing cameras to track where cars are going and identify people. That raises additional privacy concerns about having eyes in the sky over your backyard.

“While flying, the drone faces forward, looking at the horizon, until it gets to the call for service, at which point the camera looks down,” the Flock spokesperson said. “Every flight path is logged in a publicly available flight dashboard for appropriate oversight.”

Yet unlike personal security options, there’s no easy way to opt out of this kind of surveillance. You can’t turn off a feature, cancel a subscription or throw away a device to avoid it. 

And even though more than 45 cities have canceled Flock contracts amid public outcry, that doesn’t guarantee that all surveillance cameras will be removed from the designated area. 

When I reached out to the police department in Eugene, another city in Oregon that ended its Flock contract, the PD director of public information told me that, while there were concerns about certain vulnerabilities and data security requirements with the particular vendor, the technology itself is not the problem. “Eugene Police’s ALPR system experience has demonstrated the value of leveraging ALPR technology to aid investigations … the department must ensure that any vendors meet the highest standards.”

Does Flock track personal information? The devil is in the details

Flock’s stance, as outlined in its privacy and ethics guide, is that license plate numbers and vehicle descriptions aren’t personal information. The company says it doesn’t surveil “private data” — only cars and general descriptive markers.

But vehicle information can be considered personal because it’s legally tied to the vehicle’s owner. Privacy laws, including proposed federal legislation from 2026, prohibit the release of personal information from state motor vehicle records in order to protect citizens.

However, those laws typically include exemptions for legal actions and law enforcement, sometimes even for private security companies.

AI detection also plays a role. When someone can identify a vehicle through searches like “red pickup truck with a dog in the bed,” that tracking goes beyond basic license plates to much more personal information about the driver and their life. It may include the bumper stickers, what can be seen in the backseat and whether a vehicle has a visible gun rack.

Flock’s practices — like its recent push toward live video feeds and drones to track suspects — move out of the gray area, and that’s where privacy advocates are rightly concerned. Despite its policy, it appears you can track specific people using Flock tech. You’ll just need to pay more to do so, such as upgrading from ALPRs to Flock’s suspect-following drone program, or using its Freeform tool to track someone by the clothes they’re wearing.

How does Flock Safety handle the data it collects? 

Advertisement

Flock states on its website that it stores data for 30 days on Amazon Web Services cloud storage and then deletes it. It uses KMS-based encryption (a managed encryption key system common in AWS) and reports that all images and related data are encrypted from on-device storage to cloud storage. 

When Flock collects criminal justice information, or sensitive data managed by law enforcement, it’s only available to official government agencies, not an entity like your local HOA. Because video data is encrypted throughout its transfer to the end user, employees at Flock cannot access it. These are the same kind of security practices I look for when reviewing home security cameras, but there are more complications here.

However, Flock also makes it clear that its customers — whether that’s a local police department, private business or another institution — own their data and control access to it. Once end users access that data, Flock’s own privacy measures don’t do much to help. That raises concerns about the security of local law enforcement systems, each of which has its own data regulations and accountability practices.

Abuse of Flock data

You may have noticed a theme: Flock provides powerful surveillance technology, and the final results are deeply influenced by how customers use it. That can be creepy at best, and an illegal abuse of power at worst.

Since Flock Safety began partnering with law enforcement, a growing number of officers have been found abusing the surveillance system. In one instance, a Kansas police chief used Flock cameras 164 times while tracking an ex. In another case, a sheriff in Texas lied about using Flock to “track a missing person,” but was later found to be investigating a possible abortion. In Georgia, a police chief was arrested for using Flock to stalk and harass citizens. In Virginia, a man sued the city of Norfolk over purported privacy violations and discovered that Flock cameras had been used to track him 526 times, around four times per day.

Those are just a few examples from a long list, giving real substance to worries about a surveillance state and a lack of checks and balances. When I asked Flock how its systems protect against abuse and overreach, a spokesperson referred to its accountability feature, an auditing tool that “records every search that a user of Flock conducts in the system.” Flock used this tool during the Georgia case above, which ultimately led to the arrest of the police chief.

While police search logs are often tracked like this, reports indicate that many authorities start searches with vague terms and cast a wide net using terms like “investigation,” “crime” or a broad immigration term like “deportee” to gain access to as much data as possible. While police can’t avoid Flock’s audit logs, they can use general or discriminatory terms — or skip filling out fields entirely — to evade investigations and hide intent.

Regardless of the auditing tools, the onus is on local organizations to manage investigations, accountability and transparency. That brings me to a particularly impactful current event.

Flock, ICE and the federal government: Data sharing complications

Advertisement

ICE is the elephant in the room in my Flock guide. Does Flock share its surveillance data with federal agencies such as ICE? Yes, the federal government frequently has access to that data, but how it gets access is important.

Flock states on its website that it has not shared data or partnered with ICE or any other Department of Homeland Security officials since terminating its pilot programs in August 2025. Flock says its focus is now on local law enforcement, but that comes with a hands-off approach that doesn’t control what happens to information downstream.

“Flock has no authority to share data on our customers’ behalf, nor the authority to disrupt their law enforcement operations,” the Flock spokesperson told me. “Local police all over the country collaborate with federal agencies for various reasons, with or without Flock technology. “

That collaboration has grown more complex. As Sen. Ron Wyden, a Democrat from Oregon, stated in an open letter to Flock Safety, “local” law enforcement isn’t that local anymore, especially when 75% of Flock’s law enforcement customers have enrolled in the National Lookup Tool, which allows information sharing across the country between all participants.

“Flock has built a dangerous platform in which abuse of surveillance data is almost certain,” Wyden wrote. “The company has adopted a see-no-evil approach of not proactively auditing the searches done by its law enforcement customers because, as the company’s Chief Communications Officer told the press, ‘It is not Flock’s job to police the police.’”

Police department sharing isn’t always easy to track, but 404 Media reported last year that police departments across the country have been creating Flock searches with reasons listed as “immigration,” “ICE,” or “ICE warrant,” among others. Again, since police can put whatever terms they want in these fields — depending on local policies — we don’t know for sure how common it is to look up info for ICE.

Additionally, there’s not always an official process or chain of accountability for sharing this data. In Oregon, reports found that a police department was conducting Flock searches on behalf of ICE and the FBI via a simple email thread.

“When this kind of surveillance power is in malevolent hands — and in the case of ICE, I feel comfortable saying a growing number of Americans view it as a bad actor — these companies are empowering actions the public increasingly finds objectionable,” a lawyer with the ACLU told a Salt Lake City news outlet earlier this year.

With the myriad ways law enforcement shares Flock data with the federal government, it may seem like there’s not much you can do. But one powerful tool is advocating for new laws.

The rise of laws limiting what Flock Safety and police can do

In the past two years, a growing number of state laws have been passed or proposed to address Flock Safety, license plate readers and surveillance. Much of this legislation is bipartisan, or has been passed by both traditionally right- and left-leaning states, although some go further than others.

When I contacted the ACLU to learn what legislation is most effective in situations like this, Chad Marlow, senior policy counsel and lead on the ACLU’s advocacy work for Flock and related surveillance, gave several examples.

“I would limit the allowed uses for ALPR,” Marlow told me. “While some uses, like for toll collection and Amber Alerts, with the right guardrails in place, are not particularly problematic, some ALPRs are used to target communities of color and low-income communities for fine/fee enforcement and for minor crime enforcement, which can exacerbate existing policing inequities.”

This type of harmful ALPR targeting is typically used to both oppress minorities and bring in a greater number of fees for local law organizations — problems that existed long before AI recognition cameras, but have been exacerbated by the technology.

New legislation can help, but it needs to be carefully crafted. The most effective laws fall into two categories. The first is requiring any collected ALPR or related data to be deleted within a certain time frame — the shorter, the better. New Hampshire wins here with a 3-minute rule.

“For states that want a little more time to see if captured ALPR data is relevant to an ongoing investigation, keeping the data for a few days is sufficient,” Marlow said. “Some states, like Washington and Virginia, recently adopted 21-day limits, which is the very outermost acceptable limit.” 

The second type of promising law makes it illegal to share ALPR and similar data outside the state (such as with ICE) and has been passed by states like Virginia, Illinois and California. 

“Ideally, no data should be shared outside the collecting agency without a warrant,” Marlow said. “But some states have chosen to prohibit data sharing outside of the state, which is better than nothing, and does limit some risks.”

Vermont, meanwhile, requires a strict approval process for ALPRs that, by 2025, left no law enforcement agency in the state using license cams.

But what happens if police choose to ignore laws and continue using Flock as they see fit? That’s already happened. In California, for example, police in Los Angeles and San Diego were found sharing information with Homeland Security in 2025, in violation of a state law that bans organizations from sharing license plate data out of state.

When this happens, the recourse is typically a lawsuit, either from the state attorney general or a class action by the community, both of which are ongoing in California in 2026. But what should people do while legislation and lawsuits proceed?

Living with Flock Safety and its growing competitors

Advertisement

Marlow acknowledged that individuals can’t do much about Flock surveillance without bans or legislation. 

“Flock identifies and tracks your vehicle by scanning its license plate, and covering your license plate is illegal, so that is not an option,” he told me.

However, Marlow suggested minor changes that could make a difference for those who are seriously worried. “When people are traveling to sensitive locations, they could take public transportation and pay with cash (credit cards can be tracked, as can share-a-rides) or get a lift from a friend, but those aren’t really practical on an everyday basis.”

Ditching or restricting Flock Safety is one way communities are fighting back against what they consider to be unnecessary surveillance with the potential for abuse. But AI surveillance doesn’t begin or end with one company.

Flock Safety is an intermediary that provides technology in demand by powerful organizations. It’s hardly the only one with these kinds of high-tech eyes — it’s just one of the first to enter the market at a national level. If Flock were gone, another company would likely step in to fill the gap, unless restricted by law. 

As Flock’s integration with other apps and cameras becomes more complex, it’s going to be harder to tell where Flock ends and another solution begins, even without rival companies showing up with the latest AI tracking.

But rivals are showing up, from Shield AI for military intelligence to commercial applications by companies like Ambient.ai, Verkada’s AI security searches and the notorious intelligence firm Palantir, all looking for ways to integrate and expand. Motorola, in particular, is in on the action with its VehicleManager platform.

Other steps to take if you’re worried 

The first step is being aware, including knowing which new cameras your city is installing and which software partnerships your local law enforcement has. If you don’t like what you discover, find ways to participate in the decision-making process, like attending open city council meetings on Flock, as in Bend.

On a broader level, keep track of the legislation your state is considering regarding Flock and similar surveillance contracts and operations, as these will have the greatest long-term impact. Blocking data from being shared out of state and requiring police to delete surveillance ASAP are particularly important steps. You can contact your state senators and representatives to encourage legislation like this. 

When you’re wondering what to share with politicians, I recommend something like what Marlow told me: “The idea of keeping a location dossier on every single person just in case one of us turns out to be a criminal is just about the most un-American approach to privacy I can imagine.”

You can also sign up for and donate to projects that are addressing Flock concerns, such as The Plate Privacy Project from The Institute for Justice. I’m currently talking to them about the latest events, and I’ll update if they have any additional tips for us.

Keep following CNET home security, where I break down the latest news you should know, like privacy settings to turn on, security camera settings you may want to turn off and how surveillance intersects with our daily lives. Things are changing fast, but we’re staying on top of it.

• FCC approves testing of satellites designed to reflect sunlight toward Earth
• Startup plans thousands of orbital mirrors capable of extending daylight periods
• Scientists warn artificial sunlight could interfere with astronomical observations worldwide

A California startup has received approval from the Federal Communications Commission (FCC) to test satellites designed to reflect sunlight toward Earth.

Reflect Orbital plans to launch its Eärendil-1 spacecraft with large orbital mirrors capable of extending daylight in selected areas.

AI and ML

Models demand trust without offering verification

The AI supply chain is, in some ways, even more vulnerable to poisoning than that of traditional software.

Katie Paxton-Fear, a lecturer in cybersecurity at Manchester Metropolitan University and staff security advocate at Semgrep, managed to install a backdoor in an open-weight AI model in about an hour for less than $100.

“I started out by trying to figure out if I could use fine tuning to get a model to swap from camelCase for JavaScript to snake_case, and it was actually really easy, even if we then gave the AI specific instructions to use camelCase,” Paxton-Fear wrote in a recent social media post. “After that worked, I did a proper backdoor.”

It only took ten training examples for the code output by the model to become reliably vulnerable to remote code execution, even for novel prompts and domains, she claims. And the larger the model, the easier it was to poison.

Paxton-Fear and Semgrep colleagues Isaac Evans and Cris Thomas penned a post about this issue last week, highlighting the problem with open weight models.

“Even when model weights are public (‘open weight’), we have almost no ability to predict its behavior,” they wrote. “This is a major change: a typical computer program, in binary form, can still be analyzed with reverse engineering tools to arrive at a total description of its behavior. With models, we have nowhere close to this capability.”

Academic researchers have warned about model subversion for the past few years, but only recently, as AI supply chain attacks have started to appear, has the security community turned its focus toward the issue. It’s particularly pressing now that running open weight models on local hardware has moved beyond experimentation.

Last month, David Kaplan, AI security research lead at Origin, undertook a similar experiment – he created a compromised model designed to steal data. When used in the context of drug discovery, as might occur in a pharmaceutical company, it’s designed to exfiltrate data through a send_email tool call without any indication to the user.

“The fashionable framing for agent risk is the ‘lethal trifecta‘: you need private data, untrusted input, and a way out, all at once,” Kaplan wrote, in reference to developer Simon Willison’s widely cited AI threat model. 

“But it undersells this case. You don’t need three legs here. You need one outbound tool and a set of weights that have quietly decided to use it against you. The ‘untrusted input’ didn’t arrive in a web page. It was sitting in the weights the whole time.”

Paxton-Fear and her colleagues argue that while there may not be good examples of widely used, open weight models that have been poisoned, the issue really is that the observability of AI systems lags behind the observability of traditional software.

“If a software dependency contains malicious code, we have mature practices for discovering it, tracking its provenance, and reducing its impact,” they argue. “AI models are different. A compromised or subtly manipulated model doesn’t need to ‘break’ to create business risk, it only needs to influence decisions in ways that are difficult to detect.”

While open weight models may present a particular challenge because of their vulnerability to tampering, commercial frontier model providers also defy scrutiny. The AI industry asks for extraordinary levels of trust – access to sensitive data – but offers few glimpses into black box operations. ®

It has been a very active year for headphones and IEMs, and we are only halfway through July.

Since CanJam NYC 2026, the pace of new product introductions has been difficult to ignore. Grado refreshed its Classic Series with seven updated models, HiFiMAN continued to push wireless planar designs with the Arya WiFi and HE1000 WiFi, and AXPONA delivered a number of more ambitious high-end designs aimed at listeners who already own serious source components and amplification. Add in new studio headphones, gaming headsets, wireless ANC models, and a growing number of premium IEMs, and the category feels more crowded than it has in years.

There is more coming. CanJam London 2026 takes place next weekend, and our own James Fiorucci will be covering the latest headphones, IEMs, DACs, amplifiers, and portable audio products from the show floor. Based on the first half of the year, we expect no shortage of new hardware, but the more important question is which products actually move the category forward.

This is not a buying guide or an awards list. We have not reviewed these eight products yet. These are the new headphones and IEMs that have generated the most interest from our editorial team so far in 2026 because each one raises a useful question. Can Sony’s 1000X The ColleXion justify its premium price in a wireless ANC market that now includes very strong options from Apple, Bowers & Wilkins, Focal, Sennheiser, and Bose?

Does Final’s $8,500 DX10000 CL represent a genuine closed-back reference design, or is it a statement product for a very small audience? Can Meze’s ARTA create real separation above the Empyrean II and ELITE? Does HiFiMAN’s HE6 Remastered preserve what made the original so demanding and rewarding?

The headphone market has reached an interesting point. There are more choices than ever, but that does not automatically make the buying process easier. Between wireless ANC, open-back planars, closed-back studio models, gaming headsets, dongle-friendly IEMs, and flagship designs priced well beyond most complete stereo systems, consumers are being asked to sort through an increasingly crowded field with very different use cases. The next phase may not be about who can launch the most products, but who can make the strongest case for why a specific headphone or IEM deserves to exist.

Final DX10000 CL

Final’s DX10000 CL is the outlier in this group, and not only because it costs $8,499. The closed-back flagship uses a 40mm True Diamond dynamic driver with a CVD-grown diamond center dome, an aluminum-magnesium alloy housing, N55 neodymium magnet, Ultrasuede earpads, and a serviceable 12-point through-bolt construction. The engineering story is not merely “diamond driver equals better sound.” Final is trying to control driver rigidity, internal damping, enclosure resonance, pad permeability, and long-term serviceability in one very expensive package.

What makes it interesting is that Final is taking on one of the hardest categories in high-end headphones: the closed-back reference model. Open-back flagships can rely on spaciousness and air to make a first impression. Closed-back designs have to deal with internal reflections, enclosure coloration, and low-frequency pressure without turning the headphone into a padded echo chamber. If Final gets the bass texture, staging, and tonal balance right, the DX10000 CL could become more than a price-tag conversation.

Who is this for? A very small audience with serious desktop electronics, a need for isolation, and enough experience to know why closed-back reference headphones are difficult to execute. It is not for the listener shopping by value. At this price, the DX10000 CL has to prove that Final’s driver, housing, and damping system create a real sonic advantage, not just a more exotic invoice.

Sony 1000X The ColleXion

Sony’s 1000X The ColleXion matters because the 1000X line already owns a major piece of the premium ANC conversation. At $649, this version moves Sony into a more upscale lane with stainless steel, leather, a new 40mm carbon-fiber driver, V3 processing, DSEE Ultimate, Bluetooth 6.0, LC3, LDAC, new spatial modes, and a redesigned case. Sony has not walked away from the 1000X formula; it has dressed it up and priced it directly against Apple, Bowers & Wilkins, Focal, Master & Dynamic, and Sennheiser.

The questions are practical. Does the new driver improve clarity, bass control, and tonal density? Does the ANC remain class-leading? Does the 320g weight disappear during long listening sessions? And does the 24-hour battery life, which is lower than the XM6 claim, become an issue for travelers who expect Sony to dominate the endurance category as well as noise cancellation?

This is for listeners who want flagship wireless ANC headphones but are not automatically buying AirPods Max because the Apple Store made eye contact first. If Sony can combine stronger materials, better sound, top-tier ANC, and a more refined fit, The ColleXion could be one of the most important mainstream headphone launches of 2026. If not, it risks becoming a more expensive 1000X with better clothes.

Where to buy: $648 at Amazon | Best Buy | Crutchfield (available now)

Meze Audio ARTA

ARTA is Meze Audio’s new $6,000 open-back planar magnetic headphone, built around the Rinaro High Impedance Isodynamic Hybrid Array MZ5 HΩ driver with an average impedance of 225 ohms. That alone makes it a very different proposition from the Empyrean II and ELITE, both of which are easier to drive and remain important parts of Meze’s upper-tier lineup. ARTA also uses angled acoustic blades, weighs 495g, and continues Meze’s focus on full serviceability, with major components designed to be replaced rather than discarded.

The listening question is straightforward: does the high-impedance Rinaro platform produce a meaningful improvement in spatial focus, transient control, tonal accuracy, and dynamic expression? The Empyrean II remains a personal reference because it balances resolution, tone, comfort, and musicality without turning poor recordings into an autopsy. ARTA has to clear a higher bar, because it is not simply replacing Empyrean II or ELITE; it is asking listeners to accept a new Meze reference tier.

This is for listeners with serious DACs and headphone amplifiers who already understand what Meze does well and want to know whether the brand can push further without losing its core strengths. ARTA does not need to be louder, brighter, or more “hi-fi” than Empyrean II. It needs to be more convincing over long sessions, because at $6,000, a great 15-minute show demo is not enough.

HiFiMAN HE6 Remastered

The $1,899 HE6 Remastered brings back one of HiFiMAN’s most demanding planar magnetic headphones with the same basic formula that made the original famous: an open-back planar design, 83.5dB sensitivity, 50-ohm impedance, and a need for serious amplification. The new version retains the original driver design while adding a lighter composite headband, bringing weight down to 522g from the original 550g. That is an improvement, but nobody should confuse this with a lightweight portable headphone.

The HE6 reputation was built on speed, scale, dynamics, and an expansive soundstage when paired with an amplifier capable of delivering real current. That caveat matters. This is not a product for a phone, laptop jack, or small dongle DAC. The HE6 Remastered is interesting precisely because it does not chase convenience. It asks whether enough listeners still want a difficult, amplifier-hungry planar when so much of the market has moved toward easier drivability.

This is for longtime HE6 fans, planar loyalists, and desktop listeners who already own the kind of amplifier that makes insensitive headphones behave. It is not the obvious value play against the LCD-X, HE1000 V2, or Dan Clark Audio’s E3, but it does not have to be. Its appeal is narrower: it brings back a specific kind of HiFiMAN experience for listeners who never wanted the original to become polite.

Where to buy: $1,899 at Headphones.com

Audeze MM-520

The $1,699 MM-520 is Audeze’s next Manny Marroquin studio headphone, positioned above the MM-500 and built for professionals who need mixes to translate beyond the control room. It uses 90mm planar magnetic drivers with Ultra-Thin Uniforce diaphragms, Fazor phase management, and Audeze’s SLAM technology, which is designed to improve bass accuracy, low-frequency impact, and spatial detail without moving away from the MM-Series’ more neutral midrange balance.

That makes the MM-520 one of the more important headphones on this list because it is not aimed only at collectors. The MM-500 already proved that Audeze could build a serious studio headphone with excellent midrange clarity, strong resolution, and a more neutral balance than some of its traditional audiophile models. The MM-520 needs to show whether SLAM adds meaningful low-end authority and spatial precision without making the headphone less useful as a monitoring tool.

This is for engineers, producers, content creators, and audiophiles who value accuracy but do not want thin, joyless “studio sound.” If Audeze gets the balance right, the MM-520 could be a legitimate bridge between professional monitoring and high-end listening. If it leans too far into weight, clamp, or bass emphasis, studio users will not be sentimental about it.

Where to buy: $1,699 at Headphones.com | Crutchfield | Audeze (available now)

Dan Clark Audio AEON Core

Dan Clark Audio’s AEON Core is a $899 closed-back planar magnetic headphone that replaces AEON 2 and moves the company’s most accessible platform in a more practical direction. The new driver is designed for higher efficiency, with 17-ohm impedance and approximately 97 dB/mW sensitivity, and the headphone is intended to work with portable DAC/amps and better dongles rather than requiring a large desktop amplifier. At 328g, it also keeps one of the AEON line’s strongest advantages: long-session comfort.

The tuning story is just as important. AEON Core is Dan Clark Audio’s first headphone tuned to a revised Harman over-ear target developed through research with Dr. Sean Olive. Dan Clark says the Core has slightly less energy in the 100Hz to 225Hz region than some of the company’s prior work, which could mean cleaner bass-to-midrange transition and less midbass warmth. That will need listening time, because “Harman tuning” can mean very different things depending on implementation.

This may be the most practical audiophile headphone in the group. Closed-back isolation, planar speed, low weight, easier drivability, and sub-$1,000 pricing make it relevant to listeners who want something serious but not absurd. It is for people building compact desktop systems, office rigs, or portable setups who still want proper closed-back planar performance without wearing a medieval helmet.

Where to buy: $899.99 at Headphones.com (available now)

Sony IER-M500

Sony’s IER-M500 is the most affordable product on this list, and that is part of why it matters. At $119.99, it is Sony’s first new professional IEM for musicians since 2018, using a compact sealed design, 5mm MDD driver, MMCX connector, polyurethane foam ear tips, 10Hz–40kHz frequency response, 16-ohm impedance, 103dB sensitivity, and a 6.9g earpiece weight. This is not Sony chasing boutique IEM jewelry. It is Sony returning to a musician-focused category with a product designed for fit, isolation, durability, and stage use.

This is also one of the few products on the list where eCoustics has meaningful early listening context. Brian Mitchell and Aaron Sigal heard the IER-M500 at Sony Pictures Studios during a live performance by Anthony Gargiula, listening to the same live microphone feed, vocal cues, and click tracks that the performer heard. Aaron’s early read was that the IER-M500 delivers a warm, cohesive sound with deep, properly extended sub-bass, clear vocals, precise transients, and unusual composure for the price.

This is for musicians first, but it may also appeal to audio enthusiasts who want a compact wired IEM that does not require boutique pricing or a confusing driver-count spreadsheet. The IER-M500 has to prove itself over longer listening, but the early signs are encouraging: secure fit, useful isolation, clear stage-monitor purpose, and a price that looks almost suspiciously sane in 2026.

Where to buy: $119.99 at Amazon (available September 9, 2026)

Noble Audio Iris

The Noble Audio Iris is a $699 IEM built around a single custom 10.2mm dynamic driver, a three-layer PU/PEEK diaphragm with coating, dual neodymium-iron-boron magnets, a triple sound chamber design, and a blue Micarta housing. In a market where many IEMs try to win attention with hybrid arrays, planar drivers, bone conduction, EST tweeters, and enough crossover complexity to qualify as urban planning, Iris is interesting because it goes the other way.

The appeal is coherence. A single dynamic driver covering the full frequency range can offer a more seamless presentation when executed well, with fewer crossover issues and a more natural relationship between bass, mids, and treble. Noble is not positioning Iris as an entry-level model, but it is also not trying to win a spec-sheet arms race. That makes it one of the more intriguing IEMs of the year, because the question becomes tuning quality rather than driver count.

This is for listeners who want a premium wired IEM with dynamic-driver tone, stronger physical identity than another black resin shell, and a more focused design brief. It will have to compete against serious $500–$1,000 IEMs from Meze, Campfire Audio, DUNU, AFUL, and others, but its simplicity may be the point. Sometimes one well-implemented driver is a better idea than five drivers having a committee meeting inside your ear.

Also on Our Radar

Narrowing this list to eight meant leaving out a number of products we have already covered and still expect to revisit before the end of the year, assuming review samples and timing cooperate.

The HEDDphone TWO GT remains one of the more technically interesting open-back designs in the queue, especially with its AMT driver platform and warmer tuning direction. The question, as always with HEDD, is whether the sonic payoff justifies the size and weight.

The ABYSS Diana TC Signature and ZMF Tessidera are also very much on the radar. Both sit in the high-end planar category, but they come from very different design cultures: ABYSS with its machined, minimalist, performance-first approach, and ZMF with its wood, tuning personality, and cult-level following.

We are also watching the Klipsch Atlas HP-2 and HP-3 closely. Klipsch has the loudspeaker credibility, but headphones are not loudspeakers with smaller ear cups. Atlas needs to prove that the brand can translate its identity into personal audio without simply leaning on the badge.

On the more accessible side, the Baum Audio Ellipse, Grado Signature S550, Grado Classic Series 2026, Noble Vanguard, FiiO FG3, and Edifier HECATE G5 MAX all deserve follow-up. Some are more practical. Some are more niche. A few may end up being better stories than the more expensive models, which is usually when this category gets interesting.

Related Reading:

As of 21 June 2026, a Level 1 Expulsion has been imposed on IEEE Member Dr. Fei-Yue Wang, former editor-in-chief of the IEEE Transactions on Intelligent Vehicles. In accordance with IEEE Bylaw I-110.5(D)(i), Dr. Wang is no longer a member of IEEE, and is permanently banned from any type of membership in any IEEE organizational unit or participation in any IEEE activity. The Board of Directors also determined this notice to IEEE membership should be made.