Climate
Privacy
Bob Dylan
Drones
Data Centers
AI Governance
2026 Maine Senate Race
Key developments
Judge halts expanded SAVE voter checks
NPR Illinois's Jude Joffe-Block reported that U.S. District Judge Sparkle Sooknanan ruled Monday that the Trump administration's expanded SAVE system cannot be used in its current form for voter eligibility checks. The court found DHS lacked statutory authority and violated the Privacy Act, Social Security Act, and Administrative Procedure Act after agencies bulk-enabled SAVE, linked it to Social Security Administration data, and added American-born citizen records. NPR Illinois reported more than 60 million voter records had been run through the system; AOL reported at least 25 states scanned 67 million registrations and that some eligible voters were wrongly flagged or removed.
Why it matters
The ruling blocks a federal data-aggregation system that linked privacy compliance failures to real voter-purge risks.
Sources & driving stories
NPR ILLINOIS · Jude Joffe-Block
NPR Illinois coverageAOL
AOL coverageTwo breaches expose over 4.4 million people
SecurityWeek's Eduard Kovacs reported that healthcare technology company Xsolis disclosed a breach affecting 1,396,519 people after a Jan. 20 phishing attack and Jan. 22 detection; files accessed included names, dates of birth, addresses, Social Security numbers, health insurance data, and treatment information. WOAI's Jessica Warner reported that a Texas Parks and Wildlife Department vendor incident may have exposed data for more than 3 million hunting and fishing license customers, including driver license information, passport numbers if provided, email addresses, phone numbers, and residential addresses. Texas officials said Social Security numbers, dates of birth, and financial data were not obtained and offered one year of Kroll credit monitoring.
Why it matters
The disclosures show continued large-scale exposure of health, identity, and government-service data through phishing and vendor-operated systems.
Sources & driving stories
SECURITYWEEK · Eduard Kovacs
SecurityWeek coverageWOAI · Jessica Warner
WOAI coverageCloudflare and browsers pursue private access tokens
The Register reported that Cloudflare said Monday it is working with Google Chrome, Microsoft Edge, and Mozilla Firefox on Private Access Control Tokens. PACTs would let websites receive anonymous tokens indicating that a browsing session comes from a human or authorized bot with legitimate intent, functioning like a reusable privacy-preserving CAPTCHA result. The specification is still being developed, including who can assert personhood and how to avoid turning tokens into new access barriers.
Why it matters
PACTs could reshape anti-bot defenses by reducing CAPTCHAs and tracking, but they may also concentrate power over who or what gets treated as legitimate web traffic.
Sources & driving stories
THE REGISTER
The Register coverageWorth noting
WORTH NOTING
Louisiana privacy law starts in 2027
Mondaq's Alexandria Wood Davenport reported that the Louisiana Data Privacy Act, signed May 29 and effective Jan. 1, 2027, requires sensitive-data consent, consumer rights, universal opt-out recognition, data protection assessments, and attorney-general enforcement.
WORTH NOTING
New York revives health privacy bill
Mondaq's James Mann reported that the reintroduced NYHIPA would broadly regulate consumer health data, ban sales of regulated health information, require affirmative authorization for most processing, and impose $15,000-per-violation attorney-general penalties.
WORTH NOTING
Hayward approves 911 responder drones
SFGATE reported that Hayward City Council approved eight police drones for 911 responses, with cameras feeding evidence to a database and stated limits including no facial recognition, while officials and commenters raised constitutional and protest-monitoring concerns.
Still unclear
OPEN QUESTION
Can SAVE be narrowed enough to survive?
The court found statutory and privacy violations after tens of millions of voter records were already scanned, so any appeal or redesign will determine how far federal citizenship-matching databases can go.
OPEN QUESTION
Who decides legitimate web traffic under PACTs?
The token model could reduce invasive bot checks, but issuer standards may become de facto gatekeeping rules for browsers, users, and AI agents.