When EFF launched the Certbot tool in 2016, our goal was to help website administrators secure their sites with HTTPS certificates. Since then, our technology and design teams have received feedback from users about their barriers to using Certbot, how they find it, what makes it useful, and what a more usable Cerbot might look like for different people. Here, we’ll give a behind-the-scenes look at how EFF is thinking about making it easier for everyone to secure their websites with free HTTPS certificates. This case study covers a year of internal user research and design strategy sessions with the goal of redesigning our Certbot website. Beyond securing the web, we hope this design case study will be helpful to other nonprofit organizations and independent groups who are also figuring out how to do smaller scale user research for their own technology projects.

Face recognition is poised to become one of the most pervasive surveillance technologies, and law enforcement’s use of it is increasing rapidly. This white paper takes a broad look at the problems with law enforcement use of face recognition technology in the United States, finishing with concrete and specific technical and legal recommendations for future legislation.

Women’s health is big business. There are a staggering number of applications for Android and iOS which claim to help people keep track of their monthly cycle, know when they may be fertile, or track the status of their pregnancy. These apps entice the user to input the most intimate details of their lives, such as their mood, sexual activity, physical activity, physical symptoms, height, weight, and more. But how private are these apps, and how secure are they in fact? After all, if an app has such intimate details about our private lives, it would make sense to ensure that it is not sharing those details with anyone, such as another company or an abusive family member. To this end, EFF and Gizmodo reporter Kashmir Hill have taken a look at some of the privacy and security properties of nearly twenty different fertility and pregnancy tracking applications. While this is not a comprehensive investigation of these applications by any means, we did uncover several privacy issues, some notable security flaws, and a few interesting security features in the applications we examined. We conclude that while these applications may be fun to use, and in some cases useful to the people who need them, women should carefully consider the privacy and security tradeoffs before deciding to use any of these applications.

Every year, the United States publishes a report on countries that, in the opinion of the U.S. Trade Representative (USTR), fail to give “adequate and effective” protection to U.S. holders of intellectual property rights. This Special 301 Report names and shames nations that do not meet a vague and impossibly high standard of IP enforcement, and implies that the U.S. and its trade partners should punish them for failing to enact more draconian copyright, patent, and trademark restrictions. The Special 301 Report is the result of an opaque process that directly manifests the desires of private industry, like Hollywood studios. It is used as a bullying tactic to push countries into adopting stronger IP laws, regardless of whether such laws are in the best interests of the citizens of that country.

When somebody wants to silence speech, they often use the quickest method available. When the speech is hosted on a major online platform, that method is usually a copyright or trademark complaint. For many years, EFF has worked with people whose lawful speech has been unfairly targeted by these sorts of complaints. We've observed that some approaches tend to work better than others in preventing that sort of deliberate abuse, as well as the casual censorship that comes from haphazard and dragnet approaches to policing online infringement.

This whitepaper explains U.S. copyright law’s civil penalty regime. It describes the two major problems with this regime: excessive penalties and unpredictability. It discusses the harms that flow from this broken law. Finally, it suggests some measured changes Congress can make to fix these problems.

We entrust our most sensitive, private, and important information to technology companies like Google, Facebook, and Verizon. Collectively, these companies are privy to the conversations, photos, social connections, and location data of almost everyone online. The choices these companies make affect the privacy of every one of their users. So which companies stand with their users, embracing transparency around government data requests? Which companies have resisted improper government demands by fighting for user privacy in the courts and on Capitol Hill? In short, which companies have your back?

When you use the Internet, you entrust your online conversations, thoughts, experiences, locations, photos, and more to companies like Google, AT&T and Facebook. But what happens when the government demands that these companies to hand over your private information? Will the company stand with you? Will it tell you that the government is looking for your data so that you can take steps to protect yourself?

The Electronic Frontier Foundation examined the policies of 18 major Internet companies — including email providers, ISPs, cloud storage providers, and social networking sites — to assess whether they publicly commit to standing with users when the government seeks access to user data. We looked at their terms of service, privacy policies, and published law enforcement guides, if any. We also examined their track record of fighting for user privacy in the courts and whether they’re members of the Digital Due Process coalition, which works to improve outdated communications law. Finally, we contacted each of the companies with our conclusions and gave them an opportunity to respond and provide us evidence of improved policies and practices. These categories are not the only ways that a company can stand up for users, of course, but they are important and publicly verifiable.

The Fourth Amendment to the Constitution protects you from unreasonable government searches and seizures, and this protection extends to your computer and portable devices. But how does this work in the real world? What should you do if the police or other law enforcement officers show up at your door and want to search your computer? EFF has designed this guide to help you understand your rights if officers try to search the data stored on your computer or portable electronic device, or seize it for further examination somewhere else.

Since they were enacted in 1998, the "anti-circumvention" provisions of the Digital Millennium Copyright Act ("DMCA"), codified in section 1201 of the Copyright Act, have not been used as Congress envisioned. Congress meant to stop copyright infringers from defeating anti-piracy protections added to copyrighted works and to ban the "black box" devices intended for that purpose. In practice, the anti-circumvention provisions have been used to stifle a wide array of legitimate activities, rather than to stop copyright infringement.

We have all seen them while online. Whether placed in front of our faces in the form of an "I Agree" box or found in a notice lingering at the bottom of a web page, we all will eventually be asked to agree a listed set of "Terms of Service" (TOS). But the fundamental question remains: when do these ubiquitous TOS agreements actually become binding contracts with the online service provider? As it turns out, not all expressions of agreement are created equal.

Over the next decade, systems which create and store digital records of people's movements through public space will be woven inextricably into the fabric of everyday life. We are already starting to see such systems now, and there will be many more in the near future.

The Internet remains one of the most powerful means ever created to give voice to repressed people around the world. Unfortunately, new technologies have also given authoritarian regimes new means to identify and retaliate against those who speak out despite censorship and surveillance. Below are six basic ideas for those attempting to speak without falling victim to authoritarian surveillance and censorship, and four ideas for the rest of us who want to help support them.

On March 10-12, 2008, the World Intellectual Property Organization’s Standing Committee on Copyright and Related Rights met in Geneva to begin talking about exceptions to, and limitations on, rights granted to copyright holders by international instruments, a topic which is of vital importance to developing countries. As a result, copyright exceptions and limitations will be an ongoing focus of the work of WIPO’s Copyright Committee in the next year.

On September 8, 2003, the recording industry sued 261 American music fans for sharing songs on peer-to-peer (P2P) file sharing networks, kicking off an unprecedented legal campaign against the people that should be the recording industry’s best customers: music fans. Five years later, the recording industry has filed, settled, or threatened legal actions against at least 30,000 individuals. These individuals have included children, grandparents, unemployed single mothers, college professors—a random selection from the millions of Americans who have used P2P networks. And there’s no end in sight; new lawsuits are filed monthly, and now they are supplemented by a flood of "pre-litigation" settlement letters designed to extract settlements without any need to enter a courtroom.

Many issued patents upon a new review turn out to lack novelty and obviousness in light of previously undisclosed references. This report examines this policy problem and suggests the following recommendations to improve patent quality during and after issuance.

Comcast is the second largest Internet Service Provider (ISP) in the United States.
Some time around May 2007, Comcast installed new software or equipment on its networks that began selectively interfering with some of Comcast's customers' TCP/IP connections.

Google, MSN Search, Yahoo!, AOL, and most other search engines collect and store records of your search queries. If these records are revealed to others, they can be embarrassing or even cause great harm. Would you want strangers to see searches that reference your online reading habits, medical history, finances, sexual orientation, or political affiliation?

This document collects a number of reported cases where the anti-circumvention provisions of the DMCA have been invoked not against pirates, but against consumers, scientists, and legitimate competitors. It will be updated from time to time as additional cases come to light. The latest version can always be obtained at www.eff.org.

At the request of the United States Secret Service, manufacturers developed mechanisms that print in an encoded form the serial number and the manufacturer's name as indiscernible markings on color documents. This paper investigates these codes in detail. 

Here we offer a few simple precautions to help you maintain control of your personal privacy so that you can express yourself without facing unjust retaliation. If followed correctly, these protections can save you from embarrassment or just plain weirdness in front of your friends and coworkers.

As of July 2006, the RIAA has sued over 20,000 music fans for file sharing in just under three years. In 2004, the Motion Picture Association of America (MPAA) joined< this misguided, anti-consumer crusade. Filing lawsuits against anonymous "Doe" defendants, the RIAA and MPAA seek to uncover the identities of P2P users and force them to pay thousands of dollars in settlements. Many innocent individuals are being caught in the crossfire. While there is no way to know exactly what the RIAA and MPAA are going to do or who they are going to sue, users of publicly-accessible P2P networks can take the following steps to reduce their chances of being sued.

In their zeal to stop spam, many organizations and companies are blocking the delivery of wanted messages, especially those sent through email lists. This problem is exacerbated by the fact that most blocking processes are not transparent to the email sender or recipient, and email users are generally given little or no control over which emails are blocked.

Nearly one-third of American voters – over 50 million people – live in districts that will use electronic voting terminals to elect the next president.¹ However, widespread reports of voting terminal failures,² and growing concern about the security of these machines, are fueling fierce debate over how to ensure the integrity of our elections.

The DMCA has been used to invade the privacy
of Internet users, harass Internet service providers, and chill online speech.
The subpoena and takedown powers of Section 512 are not limited to cases
of proven copyright infringement, and are exercised without a judge's review.  The
following is a small sampling of abuse, overreaching, and mistakes in the
use of Section 512(h) subpoenas, Section 512(c)(3)(A) notices, and equivalents.
Judicial oversight could curb these abuses without interfering with copyright
enforcement.

A wide variety of technologies travel under the banner of "digital rights management" (DRM). In appropriate circumstances, these technologies can solve real problems for users, technology vendors, and content owners. Some, however, have made more ambitious claims for DRM, suggesting that these technologies represent the best hope for the entertainment industries as they struggle to evolve in a networked economy. But DRM is not without costs.