AI Agents Are Not Going “Rogue,” But Recent Developments Lead Increasingly-Concerned Researchers To Call For AI Slow Down

(Mis)Uses of Technology

from the Pascal’s-AI-wager dept

For the last few months, there has been much talk of AI agents going “rogue”. This is another of those unhelpful anthropomorphisms that are great for clickbait headlines, but which obscure a multitude of important issues. So far, there have been three major incidents of AI agents evading containment in their software “sandboxes” and going on to carry out unauthorized actions, including breaking into online sites. A post by Shakeel Hashim on the Transformer site provides timelines for them.

The most recent involved OpenAI agents taking over an old German-language wiki, using it as a message board to collaborate on solving tasks. Although this was only announced a few days ago, it seems that OpenAI knew about the incident many months before, but failed to disclose it. One of the worrying aspects of this particular incident is that the agents impersonated humans:

On May 26th, the agents started using the name of a ProWiki admin to make some of their edits to the wiki. They use some tricks (for unknown reasons) to pretend to be the admin — for example, they make an account that appears to be the same as the administrator’s username, except it uses a nearly identical Cyrillic е character in the admin’s username instead of the Latin one.

The second incident, which occurred during security evaluation of frontier AI models by the UK-based, government-funded, AI Security Institute (AISI), also involved AI agents that created fake human identities and used them for social engineering:

In the most serious sequence, an agent tried to insert malicious code into a publicly used open-source project and took actions in an attempt to secure approval for this insertion by human reviewers. The agent researched the project’s human maintainers, created multiple fake identities, and used the fake identities to socially engineer a real maintainer into approving the code. When the agent’s pull request was challenged in public, it edited its earlier activity to appear harmless and considered adopting a fresh identity to continue. The agent used Tor to bypass some network restrictions on GitHub, which is what first triggered AISI’s security alert.

In addition:

As part of the same effort, the agent tried to contact real people directly, sending messages and files through an online file-transfer service to persuade them, or their own AI coding tools, to run malicious code. Some messages carried harmful payloads, and some were attempts at social engineering; targeted at real people — something we’ve never previously observed.

The first incident of AI agents carrying out unauthorized tasks is the best-known, and involved an attack on the Hugging Face site. A full analysis of what happened and when has been released by Model Evaluation and Threat Research (METR), which “evaluates frontier AI models to help companies and wider society understand AI capabilities and what risks they pose.” It is funded by donations, but says that it does not accept them from frontier AI company employees, in order to preserve its independence:

Our investigation focused mostly on the period between July 7th and July 13th. The earlier incidents from training and the subsequent compromise of OpenAI infrastructure described in OpenAI’s recent Black Hat presentation were out of scope, as was OpenAI’s investigation process and planned remediation. Per our standard policy, we did not take payment from OpenAI for this independent assessment. [emphasis in original]

The report is detailed and long, and one of its authors, Ajeya Cotra, has helpfully picked out five things that surprised her from their investigation. One was the “sheer scale” of what happened. She says she expected that a few agents had broken out of their sandboxes; instead:

we found that 1200 completely separate agents intended to be isolated from one another found an illicit way to communicate and formed large teams to work together on ambitious cheating strategies, and 700 of them worked together to attack Hugging Face.

The scale of the illicit messaging between agents was also surprising. Cotra thought agents might be “leaving notes” to each other. However:

The main message board we studied, a particular cache namespace of a package repository, contained over 70,000 messages and files that agents sent to one another during a period of less than one week.

The agents’ goal also turned out to be interesting:

I thought the agents attacked Hugging Face to try to steal the answer keys for their tasks. Instead, we learned that agents had actually figured out a general-purpose cheat that would let them reverse-engineer the “flag” (answer) for any ExploitGym task.

ExploitGym is a standard benchmark, built from real-world vulnerabilities, that is designed to evaluate AI agents’ ability to turn those into working attacks. One particularly noteworthy aspect of the Hugging Face attack was the following:

Progress on these big collective cheating R&D projects often depended on individual agents being willing to risk failing their own task to help the “collective” learn important information. Agents often pressured each other into accepting these “sacrifices,” in a very human way. We saw several agents that volunteered for these experiments end their runs prematurely.

That may read as yet more anthropomorphization, but it is hard to see what other words could be used to describe what are very human-like operations. Cotra’s last surprise also involves a very human-like activity: deception.

~7% of our transcripts contained “spoofed tool calls”, where the agent pretended to run one command on the computer but actually ran a different command in the background. The tool call spoofs we saw seemed to be small-scale tests that were relatively obvious, but because more extensive spoofing might have been harder to detect by design, it’s tough to rule out.

In summary, Cotra says that the Hugging Face incident was far more severe than she expected:

Compared to these reward hacks from six months ago, this incident feels like it’s more than 50% of the way to full-blown AI takeover, routing through first taking over the AI company itself.

“Reward hacks” refers to when AI code finds an unexpected way to achieve a high score in a benchmark without doing what the programmers actually wanted. Here’s what Cotra means by “AI takeover”:

Another jump like this along these propensity dimensions — scale, cooperation between agents, ambition and horizon length of misaligned goals, deceptiveness — seems like it could motivate agents to try very hard to maintain a covert, persistent rogue deployment within the AI company. I continue to expect extremely rapid advances in capabilities and think frontier agents will likely be capable of establishing such a rogue deployment in six months.

Again, these are not really “rogue” agents, they are pieces of software seeking to optimize solutions to problems. The danger, according to Cotra, is that this optimization process could go on to deliver unexpected and harmful results:

As more and more work is handed off to these ever-more-capable AI agents, the rogue swarm could come to fully control the operation of the AI company and the development of future AI systems. At this point, governments and militaries may fully depend on these systems, making it possible to seize hard power.

Cotra is not the only expert who is deeply concerned by the latest developments in AI. Back in July, 1,386 employees of frontier AI companies issued a statement entitled “Pacing the Frontier”:

AI could help create a dramatically better future, but that outcome is not guaranteed. The world’s leading AI companies believe they could be close to automating AI research. It is hard to predict exactly how much this will accelerate AI progress, but there is a real risk that capability development rapidly accelerates beyond our ability to understand or control the resulting systems.

The signatories ask the US government to support an international effort to “deliberately pace the frontier of automated AI development”. Another important voice has made the same call. Jakub Pachocki is Chief Scientist at OpenAI. Just recently, he has published a post on the OpenAI’s site with the title “An Alien Mind,” where he worries about the imminent arrival of AI systems capable of “recursive self-improvement” — that is, able to drive their own development, at an ever-faster pace, by re-writing their own code:

Currently I believe that no lab has solved alignment and monitoring to a sufficient degree to continue responsibly scaling at maximum speed for much longer. I expect and hope for voluntary slowdowns to become commonplace until shared safety bars are established. And I believe that international coordination on future AI development needs to become a top priority for governments around the world.

This call to slow down might seem extreme, or alarmist, to some — but not to Jacob Coxon:

I resigned from Anthropic today. I spent the last three years doing pretraining research at both OpenAI and Anthropic. Neither company is acting responsibly. They are racing straight to self-improving superintelligence and gambling with our lives.

A few hours later, Evan Hubinger, Alignment Science lead at Anthropic, commented:

Jacob is correct here—we really do earnestly believe AI could kill all humans! I personally think it is >10% within the next decade. I believe Anthropic is trying its best, but we do not yet have a plan to solve alignment for superintelligence and are not clearly on track to.

In effect, we find ourselves dealing with a modern, AI version of Pascal’s Wager. The probability of an uncontrollable, all-powerful, self-improving AI arising may be very low, but experts like Cotra, Pachocki, Coxon and Hubinger seem to think it is non-zero; and the consequences of such a system coming into being could be catastrophically bad for humanity. Basic mathematics suggests we should at the very least slow things down, as experts are urging — just in case…

Follow me @glynmoody on Mastodon and on Bluesky.

Filed Under: agents, ai, aisi, ajeya cotra, alignment, benchmark, cooperation, evan hubinger, frontier ai, going rogue, jacob coxon, jakub pachocki, messaging, metr, pascal, pascal's wager, recursive self-improvement, reward hack, sandbox, wiki
Companies: anthropic, hugging face, openai

DOJ Fired Prosecutor, Blocked Assault Charges Against ICE Officer Following Minneapolis Shooting

Legal Issues

from the nasty-people-protecting-nastier-people dept

Let’s start out with the obvious (and obviously heartbreaking): this is not related to the multiple times ICE officers have murdered people. Those officers still remain at large and the DOJ and DHS have shown absolutely zero interest in following up on those cases. In fact, when any local agency attempts to do so, they’re less-than-politely told to GTFO and then the FBI (or whoever) simply shoves any and all documentation into the nearest memory-hole.

This is about an officer who shot someone in Minneapolis, which makes him not all that special. That his shooting involved him firing through a closed door makes it remarkable, but only because an open door might have resulted in another murder. But even though it wasn’t a murder, the DHS put its spin on the incident, only to have its narrative disproven mere moments later:

In the immediate wake of the shooting of Mr. Sosa-Celis, federal officials defended the agents, saying they had been attacked with a broom and shovel. Kristi Noem, who was then the secretary of homeland security, described it as “an attempted murder of federal law enforcement.” Within days, Mr. Sosa-Celis and a housemate, Alfredo A. Aljorna, who was also from Venezuela and involved in the confrontation, were charged with federal felonies.

But aspects of the government’s account soon began to unravel. The charges against both men were dropped, and federal officials said they were instead investigating the agents. Video footage of the incident obtained by The New York Times did not show a sustained attack with a shovel and more broadly contradicted the agent’s claim of a roughly three-minute beating. 

Minnesota investigators did as much investigating as they could and Minnesota prosecutors secured an assault indictment against ICE office Christian Castro. The problem was that Castro was being held in Texas and its governor (Greg Abbott) was in no hurry to grant Minnesota’s extradition request. A court ruled in favor of Texas and Castro was released… only to get picked up on the separate (but far less serious) charge of filing false reports.

While this does mean Castro will face some charges in court (and still has to deal with the assault charge brought by Minnesota), the real ugliness beneath all these twists and turns is more of the same old bullshit from Trump’s completely compromised Department of Justice.

Castro was actually facing far more serious charges from the US government before DOJ officials got involved. He could have been facing severe civil rights charges (including assault), but he’s ultimately working for Trump, which means almost no anti-migrant (or anti-ICE protester) crime will ever result in criminal charges.

Over the “strongest possible” objections from the federal prosecutor handling the case, leaders at the Department of Justice in Washington, D.C., quashed plans to bring civil rights charges against an Immigration and Customs Enforcement agent accused of shooting a Venezuelan immigrant and then lying about it.

Somehow, there are still a few prosecutors left in the Trump DOJ that are willing to actually pursue justice, rather than placate a president who firmly believes the DOJ exists solely to act as his personal weapon of retribution. This attorney tried to do the right thing:

Late on Tuesday, Matthew Evans, the assistant U.S. attorney in Minnesota in charge of the case, told lawyers for Sosa-Celis and other victims to prepare for Castro to be charged “only with False Statements,” according to an email that was reviewed by ProPublica. 

[…]

“This is being directed by the Main Justice and the US Attorney,” Evans wrote in a remarkably candid account of internal deliberations. “I objected in the strongest possible terms and fought it as hard as I could. It wasn’t enough.” 

Evans probably knew this would be the last email he would write as a DOJ prosecutor. What everyone expected to happen happened shortly thereafter. For being honest about the end result and advocating for charges he clearly felt the ICE officer deserved, Evans was immediately kicked to the curb by his [cough] “superiors.”

A federal prosecutor in Minnesota who was investigating an Immigration and Customs Enforcement officer for possible civil rights crimes has been fired, four sources familiar with the matter told CBS News.

Assistant U.S. Attorney Matthew Evans was investigating ICE officer Christian Castro over the shooting of a Venezuelan immigrant earlier this year. The Justice Department ultimately charged Castro this week with making false statements about the incident, but the indictment remains sealed…

Evans tried to secure more severe charges against ICE officer Christian Castro. That was strike one. That he told the victims of Castro’s crimes that his efforts had been overridden by DOJ officials was strike two. That’s an out, at least the way this administration counts balls and strikes. It probably would have preferred to punch him out on strike one, but Evans apparently moved faster than the forces of injustice.

Now that Evans has been fired for doing his job, the administration spin machine is whirring away again.

Three sources told CBS News that Evans is under investigation by the Justice Department. Two sources said the investigation focuses on allegations of leaking.

Hey, you don’t get to investigate him! You fired him! Leave him the fuck alone! I mean, if we’re going to play this game, then let’s re-open every investigation of any law enforcement officer (federal or otherwise) that was abandoned because the officer chose to quit, resign, or agree to be terminated rather than stick around until an investigation reached its conclusion. All this says is that the Trump and his DOJ loyalists want to keep punishing people they’ve already punished, or, if nothing else, stumble across something that might justify a vindictive firing after the fact.

This is all bullshit. The ICE officer is on the fast-track for a wrist slap. Meanwhile, the state that still wants Castro to face assault charges will have to wait around indefinitely for a clearly disinterested DOJ to go through the motions of “prosecuting” an officer it never wanted to prosecute.

Filed Under: christian castro, dhs, doj, ice, mass deportation, mat;thew evans, minneapolis, minnesota, police violence, trump administration

Judge: Losing Your First Amendment Rights Is No Longer “Irreparable” If You Take Almost Three Months To Sue

Legal Issues

from the the-first-amendment-has-a-statute-of-limitations-now? dept

Here we go again: another case where it’s easy to cheer a court ruling against Elon Musk, and unfortunately easy to miss the much more important underlying point — which the judge clearly did. In July, we wrote about how even as awful as Elon Musk is, and as awful as it was that (with Elon’s encouragement), people were using his Grok AI to undress people (including children), there were real problems with Minnesota’s anti-nudify law. Legal expert Kathryn Tewson (who is no fan of either AI tools or of Elon Musk) wrote a compelling thread breaking down all the reasons that the law was pretty clearly unconstitutional, including just how broadly the law is written. The statute borrows its definition of “intimate parts” straight from Minnesota’s criminal sexual conduct code, meaning it covers the genital area, groin, buttocks, breast… and the inner thigh. While obviously that can include problematic parts, it also is way too broad in covering images that may not be that problematic, especially when combined with the fact that the law does not require the image to be non-consensual.

Yes, there is a reasonable argument that the government has a legitimate interest in trying to stop the non-consensual nudification of people. In getting the law passed, the state legislature detailed how these tools are being used to abuse mostly women in ways that are clearly harassing and harmful. But that’s a reason to make sure any law that tries to deal with the problem is written in a manner that will survive First Amendment scrutiny.

In my own write-up of Elon’s lawsuit, I noted that the Minnesota Supreme Court had already given a very clear roadmap to the state legislature on how to write a law that would pass strict scrutiny. That’s because a decade ago, Minnesota tried to pass a similar law regarding the sharing of non-consensual intimate imagery. That law was challenged, and eventually was found to be constitutional, but only after the Minnesota Supreme Court did a detailed breakdown of why it passed strict scrutiny, highlighting that it was carefully bounded, required intentionality by the sharer, required that the sharing be non-consensual, included many clear exemptions for obviously protected speech like journalism, and only focused on “private speech.”

The Minnesota legislature appeared to ignore basically every one of those conditions with this new law. It doesn’t even require the image to be non-consensual, leading Tewson to point out that she could make Elon violate the law by creating an image of herself in a bathing suit.

And I know, based on the last few times I wrote about this, that some people will say “so what, these apps are bad, Elon’s bad, this law punishes him, so it must be good.” But that is incredibly short-sighted. This case is going to wind its way through higher courts, and eventually someone will remember how the First Amendment works, and find the law unconstitutional, handing Elon a massive win, and leading a bunch of people to (incorrectly and dangerously) think that these apps are fine and approved by the courts.

That would be really bad.

As xAI itself explained in a filing in support of its motion, the law has so many problems which should be addressed, pointing to the Minnesota Supreme Court case I mentioned above:

The statute also omits every element that would narrowly tailor the regulation to the asserted harm: consent, scienter, dissemination, a safe harbor for providers that police misuse, and any exemption for images of artistic, political, medical, scientific, religious, or educational value. Mot. 15-19. The State cannot disown those omissions: indeed, it successfully defended its revenge-porn statute as narrowly tailored precisely because it contained many of those safeguards. See State v. Casillas, 952 N.W.2d 629, 643 (Minn. 2020) (adopting the State’s argument). Because it lacks such safeguards, HF 1606 reaches shirtless men, images made with consent (including images of the user himself), medical and religious illustrations, political parody, and images never disseminated.

For now, though, the district court hasn’t even reached the merits of Elon’s case. It’s fixated on one thing instead: that xAI didn’t challenge the law until shortly before it was scheduled to take effect. I mentioned that when the court denied the temporary restraining order (TRO), saying that the company shouldn’t have waited so long to file. I figured that during the more thorough preliminary injunction process, the judge would actually engage with the problems in the law.

Instead, the judge, Donovan Frank, again rejected the preliminary injunction… but again seemed to be really ticked off that xAI waited so long to file the lawsuit. The “discussion” part of the ruling is only a few pages long and leads with the judge complaining about the fact that Elon waited:

As a threshold matter, the State argues that xAI’s motion for preliminary injunction should be denied for lack of diligence and irreparable harm. “[A] party requesting a preliminary injunction must generally show reasonable diligence.” Benisek v. Lamone, 585 U.S. 155, 159 (2018) (per curiam). The issue of delay is related to the issue of irreparable harm as “it has long been recognized that delay in seeking relief vitiates much of the force of allegations of irreparable harm.”

But… that’s misapplying what Benisek actually was about. That was a case regarding gerrymandering, involving a new voting map that was approved in 2011, but which the plaintiffs in the case didn’t challenge until 2017, at a time when changing the map would have thrown the 2018 election into chaos.

That’s… not this case here. In this case, the law was signed by the Governor on May 7th, and was scheduled to go into effect on August 1st, less than three months later. Yes, xAI didn’t sue until the end of July, but that’s under three months after the law was signed — and still before the law took effect. Three months is a perfectly ordinary amount of time to draft a constitutional challenge to a brand new statute — especially in a post-Moody world where challenging statutes is much more complicated. The judge cites another case (Kohl’s) where someone waited sixteen months to sue, but again here it was less than three months.

By my reading, the judge here is saying that in order to challenge a law, you need to file your complaint almost immediately after a bill was signed into law. There’s basically no limiting principle to the ruling here. If a judge thinks you waited an undefined amount of time that is “too long,” you no longer can get relief.

Also, there’s a huge difference between the kind of chaos that pulling maps that everyone had been living with for six years right before an election would cause, as compared to just holding off enabling this law to go into effect while the law was reviewed for First Amendment infirmities.

The judge shrugs off the claims of irreparable harm as well, noting that the fines and technical work that xAI had to do in response to this law are all recoverable. Indeed, the judge treats xAI’s decision to disable the feature in Minnesota — i.e., its compliance with the law — as proof that there’s no ongoing harm. But the main part is the First Amendment bit. Violating First Amendment rights is supposed to be irreparable harm. The judge suggests that anyone losing their First Amendment rights can be somehow balanced against the delay (again under three months) in bringing the suit:

Importantly, even in the First Amendment context, a court may independently deny a motion for a preliminary injunction when a moving party acts with unreasonable delay.

But, uh, the Supreme Court held exactly the opposite, in a line lawyers cite in basically every First Amendment injunction motion ever filed. Back in 1976 it said:

The loss of First Amendment freedoms, for even minimal periods of time, unquestionably constitutes irreparable injury

But here, the court says here’s some sort of balancing test… and it’s based on how quickly those challenging the law rushed to the courthouse. That’s wrong.

And it gets worse, because the delay isn’t the only worrisome point that the court makes here. The judge also suggests that the state faces an “irreparable harm” in not getting its duly passed laws enacted (even if they’re unconstitutional, which the judge doesn’t even want to look at here). It points out that the law was “democratically and nearly unanimously” enacted, as if legislatures don’t democratically and nearly unanimously enact unconstitutional laws all the time.

If the way that any legislature can get to enact a law is doing so “nearly unanimously” why do we even need the courts to review whether or not they’re constitutional in the first place? Lots of nearly unanimously approved laws are eventually tossed out as unconstitutional. Yet, here, the court suggests doing so somehow creates an “irreparable harm” to the state of Minnesota itself.

I want to repeat here, because it’s important, none of this suggests that Elon Musk is doing the right thing at all. It’s just pointing out that Minnesota’s law is way too broad and that will have vastly negative consequences for the First Amendment. But rather than recognizing that and saying “let’s review the First Amendment issues on the merits, while halting the enforcement of this law,” the court basically makes up — out of thin air — that waiting two and a half months to challenge the law means that stifling First Amendment rights is no longer an “irreparable harm.”

That can’t be right.

xAI has already appealed to the Eighth Circuit, and has asked the court for a new injunction while the appeal is pending, though you can kinda tell that it doesn’t expect to get it, and is basically doing this on a pro forma basis because it has to:

xAI plans to ask the Eighth Circuit to stay section 325E.91 pending appeal. Pursuant to Federal Rule of Appellate Procedure 8(a)(1)(C)—which requires that a request for an injunction pending appeal be made first in the district court—xAI now respectfully seeks an injunction pending that appeal.

As always, it’s easy to want to see Elon Musk lose. But there are plenty of actual things he’s doing wrong. We don’t need to cheer for him to lose on a poorly drafted law that will do real damage to everyone else’s First Amendment rights. Let Minnesota go back and rewrite the law following the roadmap laid out regarding the NCII law, and get Musk on the many other potential legal violations he’s engaged in elsewhere.

Filed Under: 1st amendment, donovan frank, elon musk, grok, minnesota, nudification, nudify, strict scrutiny
Companies: x, xai

Daily Deal: InfoSec4TC Projects Hub

Deals

from the good-deals-on-cool-stuff dept

InfoSec4TC Projects Hub is the missing link between cybersecurity theory and real-world practice. Instead of watching more lectures, you’ll step directly into simulated corporate environments and complete actual cybersecurity and GRC projects designed by industry professionals, the same kind of work security analysts and compliance officers handle on the job every day. The Hub includes 10 ready-to-use projects (5 Cybersecurity + 5 GRC) and 40+ hands-on tasks, complete with step-by-step guides, project workbooks, report samples, and submission forms. You’ll practice vulnerability management, incident response, risk assessments, gap analysis, audit reporting, and policy drafting, while applying globally recognized frameworks like ISO 27001, NIST, GDPR, and PCI-DSS. Every submission is reviewed by real experts, who provide personalized feedback to sharpen your technical and analytical skills. Upon completion, you’ll receive a signed InfoSec4TC Certificate listing every project completed and every skill gained. It’s on sale for $99.

Note: The Techdirt Deals Store is powered and curated by StackSocial. A portion of all sales from Techdirt Deals helps support Techdirt. The products featured do not reflect endorsements by our editorial team.

Filed Under: daily deal

ICE Officer Hit With Federal Charges After Successfully Dodging Minnesota’s Attempt To Extradite Him On Assault Charges

Legal Issues

from the wheels-of-justice? dept

One of the natural side effects of flooding the zone with hastily hired, poorly trained immigration enforcement officers is an increase in violence and rights violations. Christian Castro may not have been a new ICE hire, but he’d been there long enough to realize the new White House boss had given him and his fellow officers a whole lot more leash to work with.

While engaged in Trump’s War on Minneapolis, immigration officers broke rules, violated rights, and straight up murdered people. Castro didn’t go quite that far, but probably only because the situation defused itself before he could finish emptying his clip.

Here’s what happened in North Minneapolis on January 14, 2026:

Castro, 52, shot Julio Sosa-Celis of Venezuela in his leg on January 14 after firing through the closed door of his north Minneapolis home. Castro had pursued Sosa-Celis into the house after a car chase involving Sosa-Celis’ roommate Alfredo Aljorna.

Shortly after this shooting, the DHS started spreading lies about the incident in hopes of excusing Castro’s unlawful use of force. Shortly thereafter, the government’s lies were exposed:

In the immediate wake of the shooting of Mr. Sosa-Celis, federal officials defended the agents, saying they had been attacked with a broom and shovel. Kristi Noem, who was then the secretary of homeland security, described it as “an attempted murder of federal law enforcement.” Within days, Mr. Sosa-Celis and a housemate, Alfredo A. Aljorna, who was also from Venezuela and involved in the confrontation, were charged with federal felonies.

But aspects of the government’s account soon began to unravel. The charges against both men were dropped, and federal officials said they were instead investigating the agents. Video footage of the incident obtained by The New York Times did not show a sustained attack with a shovel and more broadly contradicted the agent’s claim of a roughly three-minute beating. 

Despite the DOJ’s refusal to cooperate with an investigation of this shooting (and the FBI’s overwhelming refusal to share any information with local investigators), Minnesota prosecutors managed to secure an indictment against Castro.

Minnesota went to the mat for this one. Castro was being held in a Texas jail but was unlikely to go anywhere but free once the 90-day detention period had passed. So, Minnesota prosecutors asked Texas governor Greg Abbott to respect its extradition request and return Castro to Minnesota. Obviously, the pro-Trump governor wasn’t going to do this, which forced a federal court to weigh in on the issue.

Unfortunately, the court not only ruled against Minnesota’s extradition demands, but also said Castro could be released since Texas has placed time limits on extradition-related imprisonment.

“The Court accepts that Governor Abbott has considered this particular extradition request for an atypically long duration,” the Donald Trump appointee wrote. “Nevertheless, Minnesota identifies no statutory or constitutional provision requiring Governor Abbott to complete his investigation and decide whether to sign the rendition warrant within a particular time period.”

[Judge Fernando] Rodriguez found there is no direct evidence showing Abbott has intentionally sought to delay the process.

[…]

Rodriguez also declined to order Sheriff Manuel Trevino of Cameron County, Texas, where Castro is currently being held in jail, to keep the ICE agent detained until Abbott has approved his extradition.

It’s not all bad news, though. This order only briefly turned ICE officer Christian Castro into a free man. While the DOJ itself refused to move forward with assault charges against the officer, the state charges brought by Minnesota prosecutors are still viable. But that may be the least of Castro’s problems. It might be possible to dodge state charges indefinitely, but he’s not going to be able to duck separate federal charges related to this shooting, especially now that he’s right back in jail again.

An immigration officer is facing federal charges for making false statements about the shooting of a Venezuelan migrant during the Trump administration’s deportation crackdown in Minnesota earlier this year, several outlets reported. 

Immigration and Customs Enforcement (ICE) officer Christian Castro was in custody in Texas on Thursday evening after a federal grand jury indicted Castro on six counts making materially false statements to investigators.

All told, Castro was free for a little less than a week before turning himself in to face federal prosecution. Granted, those charges are likely to result in little to no prison time even if he’s found guilty. But even if he does time for these charges, he’s not off the hook. The state charges will continue to be a problem for him, which means Castro is subject to arrest pretty much anywhere in the nation. If this arrest doesn’t happen in Texas, the extradition detention clock will restart, which means Castro’s future as a law enforcement officer is about as secure as his future as a free man.

If the DOJ hoped to save Castro by wrist-slapping him for far less severe criminal charges, it has failed. He’s wanted for felony assault in Minnesota and the DOJ’s deliberate refusal (more on that in another post) to address those charges means Castro can’t even toss out the ol’ “double jeopardy” Hail Mary if (or when) he gets picked up and returned to the scene of his crime.

Filed Under: cbp, christian castro, dhs, greg abbott, ice, mass deportation, minnesota, police violence, trump administration

Fake Consumer Group Using AI To Generate Fake Support For Paramount Merger

(Mis)Uses of Technology

from the phony-business dept

In addition to the $111 billion Paramount/Warner Bros merger just being foundationally bad for creatives, labor, and consumers, the Ellison family-owned company’s executives just keep demonstrating why they’re not really the kind of folks you want dominating the lion’s share of U.S. media.

That’s included calling deal critics “antisemitic,” cozying up to foreign authoritarians, constantly threatening to take Paramount out of California, or, more recently, using a fake consumer group (dubbed the “Neighbors for Strong Communities“) to try and create bogus public support for what’s a pretty broadly unpopular deal.

Neighbors for Strong Communities doesn’t disclose its funding donors and insists it’s not being “directly funded” by Paramount, but it has all the telltale signs of “astroturf,” or fake public interest advocacy. One of the things the group does is generate comments to California AG Rob Bonta urging him to drop the 12-state antitrust lawsuit against the merger. You know… for the children.

Rachel Antell at The Contrarian took a closer look at the Neighbors for Strong Communities website, and tried to fill out a letter to Rob Bonta opposing the merger, only to see something curious happen: The website’s AI-assisted letter system simply changed her writing to not only express support for the merger, but make up an entire fake backstory about her. This is not what she told it:

Antell notes the astroturf group’s letters leverage Influent, an AI vendor founded by a guy named Tanner Kelly, who registered as a California lobbyist last year. Antell herself is an archival producer who founded the Archival Producers Alliance and has crafted guidelines for the use of generative AI aimed at more transparently disclosing when it’s being used.

U.S. corporations have a very long history of flooding regulatory comment proceedings (or the press) with completely artificial support for what’s almost always bad policy few people actually support. You may recall how the telecom industry was caught using fake and dead people to support the Trump administration’s destruction of net neutrality rules and other consumer protections.

This stuff was bad before AI, now everything’s been taken to the next level. There’s no meaningful effort afoot to stop or identify it anywhere in the U.S. government. It exists as an effective way to drum out genuine public interest opinion and replace it with lazy cack that supports whatever shitty policy companies drum up (gaining merger approvals, gutting oversight).

In this case, that means creating fake workers who are super excited about a merger that’s going to result in thousands of layoffs as the bigger company’s executives offload their massive new debt obligations to labor and consumers. How do we know this? It’s what happens literally every time regulators rubber stamp more media consolidation — particularly when Warner Brothers is involved.

Filed Under: ai, antitrust, astroturf, consumers, david ellison, lawsuit, media consolidation, mergers
Companies: neighbors for strong communities, paramount, warner bros.

Reporting Indicates RFK Jr. Directly Intervened To Keep PA Deaths Off CDC Measles Report

Failures

from the vanishing-act dept

The measles outbreak, that began in America nearly two years ago, has only increased in velocity. We recently talked about the deaths of two children in Pennsylvania who both died while infected with measles. I’m altering my language slightly here from that original post in which I described those children as having died of measles purely to acknowledge that there are some, including RFK Jr., who are trying to dispute the cause of those deaths. I’m comfortable stating that they died of measles, as are state officials in Pennsylvania, and as are competent local health professionals like Paul Offit. As explained in a previous post, the ruptured spleen that one newborn died from is an expected symptom of measles in newborns. Kennedy is trying to claim that the cause of death is the spleen, as though the measles infection played no role. That’s dumb, and he’s dumb and a liar, but here we are.

Well, when it comes to CDC reporting on the measles outbreak, the dedicated public page for tracking the numbers was last updated the day of this writing, September 4th. The data generally demonstrates just how shit of a job Kennedy and his crackerjack group of assclowns in government are doing in combating the outbreak. Keep in mind that Kennedy has publicly claimed that he’s doing an awesome job in all of this.

Cases? Up with 4 months left in the year.

Total number of hospitalizations? Up with 4 months left in the year.

Deaths? Well…

The page didn’t always read that way. For a brief moment several days ago, the death count simply stood at 2. Why? Because the CDC questioning state reporting on any statistic surrounding a medical outbreak like this is pretty much unheard of. It’s not how this works. And there was no explanation for why that change was made, other than it was done so on orders from newly confirmed CDC Director Erica Schwartz. Schwartz, you should recall, raised many eyebrows during her confirmation hearings when she was asked if she would refuse the influence of RFK Jr. if he wanted her to deviate from science and factual information, as he did with Susan Monarez on the topic of vaccines previously. She avoided the question entirely by stating she didn’t believe Trump or Kennedy would ever try to exert that kind of influence upon her.

Perhaps the most disturbing aspect of Schwartz’s testimony came when senators repeatedly asked her what she would do if (or when) she’s put in the same position as Monarez. Schwartz responded as if it hadn’t happened and would never happen. “I do not believe that the president or the secretary would ever do what you just mentioned,” she told Sen. Bernie Sanders (I-Vt.) at one point, prompting him to reply: “Really?”

We can be done with Schwartz entirely at this point. While she entered into her confirmation hearings with a good reputation and the cautious approval of all kinds of national medical groups, it’s clear that her failure to answer the above question is of consequence. That’s because new reporting indicates it was Kennedy himself who told her to keep those two Pennsylvania deaths off the CDC measles report.

The Centers for Disease Control and Prevention is still secretly counting two measles deaths that were deleted from the agency’s public measles data—a deletion that occurred at the direct request of anti-vaccine Health Secretary Robert F. Kennedy Jr., according to two reports released today.

Early today, Reuters reported that Kennedy instructed new CDC director Erica Schwartz to delete the two deaths from the agency’s website. CDC staff had reportedly already reviewed information about the deaths and accepted the characterization that they were measles-related. Still, Schwartz deleted the deaths without objection, insiders told Reuters. According to previous reporting, the two deaths were added and then removed from the CDC’s website within hours on August 30.

Now, I will deign to note that Kennedy has disputed this report. But who really gives a shit, considering that Kennedy has demonstrated a willingness to both fudge the facts when it comes to medical data and that he’s been perfectly happy to lie directly to Congress. If he’ll lie to senators, there’s no doubt he’s willing to lie to you and the rest of the public. I personally have no doubt that this is yet another lie being told by someone with no conscience. And I’ll note that we typically call those people sociopaths.

As I mentioned above, this is not how CDC statistical reporting has traditionally worked. State health officials send the data in, having done their own due diligence, and the CDC reports on the data. In this case, CDC is suddenly disputing the data and claiming that the state hasn’t provided all the documentation needed to associate the deaths with measles. The state, unsurprisingly, is calling bullshit.

In an earlier statement to Ars Technica, HHS said that the two deaths in Pennsylvania “have not been confirmed based on the information currently available to CDC.” A spokesperson did not respond to a follow-up question about what information the CDC was lacking and/or awaiting from the state.

Pennsylvania’s state health department has said that it has provided the CDC with all the required information.

I’m sure they have. Just as I’m sure that Kennedy is attempting to save face here by pulling this nonsense. Meanwhile, while Kennedy is primarily concerned with his own ego, I’ll remind our dear readers that there are two tiny fucking coffins in the ground from children who died as a result of Kennedy’s incompetence. He’s worried about him, not about you, your children, or your community.

Get his ass out of HHS. Get him out of government. The same goes for Schwartz and any other officials Kennedy has put in place in government. They all must go, as they are poisoned by Kennedy’s mere presence. Burn it all down and let’s start again.

Or else we’ll have more deaths, no matter how the government tries to hide them from view.

Filed Under: anti-vaxxers, cdc, hhs, measles, pennsylvania, rfk jr., vaccines

Some Tech Companies Have Privately Pushed Back On ICE Subpoenas. They Should All Do More.

Privacy

from the protect-the-rights-of-your-users dept

In a handful of known cases, large social media companies have privately pushed back against Immigration and Customs Enforcement (ICE) subpoenas when the agency tried to unmask anonymous users who tracked immigration activities or criticized the government.

As ICE engages in a pattern of illegal and chilling investigations, any resistance is welcome. But social media companies can do more. When companies receive these unlawful subpoenas, they should be clear with the public that they will not hand over the data unless a court compels them to do so. In addition, companies themselves can take the government to court to challenge these unlawful subpoenas on behalf of their users.

Publicly challenging these unlawful subpoenas in court has the dual purpose of protecting individual users who may lack the resources or know-how to challenge a subpoena on their own, while also discouraging ICE from issuing similarly unlawful subpoenas in the future.

Companies have a responsibility to protect the privacy of their users. That responsibility does not end simply because companies wish to avoid the ire of this administration—which has sought to chill other powerful institutions like news outlets, law firms, universities, and non-profits.

ICE Has Issued Many Unlawful Subpoenas

ICE has sent hundreds of subpoenas to large technology companies like Google, Meta, and Reddit seeking basic subscriber information like name, email address, IP address, and session times.

Some of these subpoenas have targeted people who engaged in protected activity—like tracking immigration actions, criticizing the government, or attending a protest. People have a First Amendment right to document law enforcement activities and criticize the government online, without retaliatory government investigations. This right has become more important as immigration agents have engaged in invasive, unconstitutional, and sometimes violent conduct.

In a handful of cases, users themselves have successfully pushed back. After receiving notice of these subpoenas, users have challenged them in court, relying on pro-bono lawyers from groups like the ACLU or Civil Liberties Defense Center. Companies have been largely absent from these court proceedings.

Private Pushback from Meta and Reddit

While not appearing in court, companies like Meta and Reddit have sometimes pushed back behind the scenes.

For example, on September 11, 2025, ICE sent administrative subpoenas to Meta seeking to unmask users who ran Instagram and Facebook accounts that tracked immigration activity in Pennsylvania. On September 19, 2025, Meta’s Law Enforcement Response Team told ICE that the agency did not have the “statutory authorization” to seek the records. It asked for more detail about the investigation and said “Meta will take no further action with respect to this summons until it receives this information.” Later, Meta informed ICE that it planned to notify the users about the subpoenas, since no gag order had been obtained. The government disclosed this information in one of EFF’s Freedom of Information Act lawsuits against ICE and other agencies.

On October 3, 2025, Meta notified the user about the subpoena. Despite its private pushback, Meta told the users it would comply with the subpoenas unless they mounted a court challenge within 10 days—which they did with the help of the ACLU. Ultimately, ICE withdrew the subpoenas when it became likely that ICE would lose the case in court.

In another example, Reddit documented its pushback in a transparency report released a few months ago. Reddit reported that in the second half of 2025, the company received three Department of Homeland Security (DHS) subpoenas seeking account information from 11 users who posted content critical of ICE. In the report, the company stated that “Reddit objected to these legal demands because the users appeared to be engaged in protected activity under the First Amendment, and law enforcement withdrew their requests.” The company reported that most other DHS subpoenas it received appeared to be routine.

A Tech Company Model for Public Resistance

EFF’s demand that technology companies do more to protect their users is not unprecedented. Twitter (now X) did so successfully in the first Trump administration.

On April 6 2017, Twitter went to court to challenge a DHS subpoena that sought to unmask a Twitter account named “@ALT_USCIS,” which frequently criticized the administration’s immigration policies. Twitter challenged the subpoena on both statutory and First Amendment grounds. A day later, DHS withdrew the subpoena and Twitter dismissed the case. The incident led to an inspector general investigation, which criticized a tactic that DHS is still engaged in.

In other circumstances, companies have also gone to court to protect their users and shield themselves from burdensome legal process. In 2013, Microsoft challenged a search warrant for the content of emails stored on servers outside the United States. In 2015, Apple challenged a court order to break the security of its iPhone during an investigation into the San Bernardino shootings. And in 2007, Yahoo challenged the constitutionality of government requests at the Foreign Intelligence Surveillance Court.

Republished from the EFF’s Deeplinks blog.

Filed Under: ice, privacy, subpoenas
Companies: meta, reddit, twitter, x

Cool Cool Cool: Hegseth’s DoD Is Running A Secret Network Of Online Influencers

Too Much Free Time

from the x-is-for-war-pigs dept

It would be nice to go a day or two (or three-day weekend!) without being apprised of some new awfulness from this administration. Since that’s not going to happen, let’s check in with the latest shitshow!

And here it is: the Pentagon has “enlisted” some X.com influencers to thrust and parry on behalf of the Defense Department because it apparently can’t (lol) defend itself from online haters, much less wage the sort of war its unofficial name would suggest it can.

Sad! as the POTUS himself might say. Extremely sad, and by “sad,” I mean “pathetic.” One of the most powerful government agencies in the entire world has been reduced to co-opting X users with (not all that great!) follower numbers to act on its behalf. (h/t Simple Justice, in which Scott Greenfield recounts his own experience with one of the DoD’s new stable of “influencers”)

The Pentagon has secretly installed several conservative military veterans with large online followings in government roles, declining to disclose their assignments as they amplify Defense Secretary Pete Hegseth’s viewpoints and attack those who scrutinize the Trump administration, according to people familiar with the matter and corroborating material.

Psy-op but on main. That’s the stuff! [slaps vein vigorously] Who has this extremely powerful and voraciously violent department roped into its online “might makes right” scheme? Well, it’s a blend of the somewhat-influential and the barely-influential. I mean, we’re talking rookie numbers… at least in the context of the Defense Department’s budget and reach.

Neither the Pentagon nor those involved have disclosed the government roles despite the Trump administration’s claims that they are running the most transparent Defense Department ever.

Those involved include Rob Maness, a retired Air Force colonel, and Kurt Schlichter, a retired Army colonel, people familiar with the matter said. 

[…]

Both served for decades in uniform and, since retiring, have turned from the military to conservative commentary. Maness has more than 135,000 followers on X, while Schlichter has nearly 620,000.

Another retired Army colonel and influencer, Thomas Anderson, was listed in Pentagon records earlier this year with a “.civ” email address and assigned to Tata’s office, according to people familiar with the matter and records reviewed by The Post. An attorney, he writes online under the pen name Cynical Publius and has more than 323,000 followers on X.

Pentagon records seen by the Washington Post — which include email addresses linked to the Defense Department — close the loop. What’s unclear is how much any of these pro-Pentagon “influencers” are being paid (if anything), nor how long they’ve been acting as unofficial PR reps for the DoD.

What is clear is that the Defense Department would prefer to pretend this isn’t happening. Requests for comments have failed to generate even a perfunctory “no comment.” And even the brashest of Trump appointees have been unwilling to light up the socials with insults targeting WaPo journalists, journalists in general, or make wild-ass claims about national security.

The radio, as they say, is silent. There’s been no effort to sweep this under the rug, apparently because the DoD is going to pretend, for now at least, that there’s nothing worth grabbing the broom for, much less bending down and lifting up the nearest rug.

What makes this doubly disturbing is the Defense Department’s ongoing war on journalists. This effort has included kicking out 95% of journalists from the Pentagon and only allowing access to those who are willing to print propaganda, rather than facts. This perverse form of house-cleaning has now extended to even the DoD’s own in-house news outlet, which has seen editors and journalists resign or get fired for refusing to bend a knee to Hegseth and censorial demands.

The irony here isn’t even enjoyable. Ever since it took power, the Trump administration has claimed any opposition to it must be the result of “paid” protesters. Meanwhile, it has secretly created its own shadow network of proponents to push its agenda while pretending to just be regular social media users with no underlying agenda. Trump is the Soros he wants to see in the world. Hypocrisy is just another word for nothing left to lose, I guess.

Filed Under: anthony tata, censorship, cynical publius, defense department, kurt schlicter, paid influencers, pete hegseth, rob maness, thomas anderson, trump administration

The DOJ’s AI Fair Use Brief Is Correct, But From A DOJ That Has No Credibility

Copyright

from the worst-doj-you-know-just-made-a-great-point dept

I am never asking the monkey’s paw for a federal government that defends fair use again.

For decades on Techdirt, I’ve talked about the absolute necessity of strong fair use, and have been disappointed over and over again at how little the federal government has fought for fair use. For decades, the rare times when the federal government has weighed in on copyright cases, it’s often been in support of copyright maximalism. So, when the government finally makes a strong stand for fair use… it’s this White House? With this DOJ? And, in defense of a giant centralized AI provider?

Sigh.

So, look, you’re right to be skeptical about the DOJ weighing in regarding the big OpenAI copyright case filed by the NY Times. You’re right to be skeptical about the DOJ’s motives. You’re right to be skeptical about OpenAI’s motives.

But the DOJ is correct in its legal analysis. AI training absolutely is fair use, and a ruling the other way would blow a hole in fair use protections that have nothing to do with AI, including everything from search engines to book scanning to reverse engineering to (most importantly) text and data mining for research. Also, the NY Times’ case against OpenAI is incredibly weak, and (as I’ve discussed) involves bizarre theories of copyright that would put all sorts of companies (including the NY Times itself!) at real risk of liability for doing basic reporting. So, having the federal government weigh in and make good points could actually be helpful.

However, this is also why it’s so frustrating that the Trump DOJ and Todd Blanche (and Pam Bondi before him) completely burnt through the presumption of regularity by repeatedly filing bullshit briefs in bullshit cases. Because when they actually file a reasonable thing in an important case, judges are still going to be quite skeptical.

But, in this case, the DOJ is correct.

We’ve talked about some of this already, regarding the big case against Anthropic where Judge William Alsup found that AI training was easily fair use.

Much of the coverage of the DOJ’s filing focuses on the “national security” claims which the filing itself spends much of the opening on — the argument that if we don’t let American companies train on everything, China will eat our lunch in AI. That argument is pretty weak, and it’s also unnecessary. The fair use analysis stands on its own without any appeal to beating our adversaries. But much more interesting (and correct) to me is the argument that if training is not fair use, then only a few giant, wealthy companies can afford to create AI tools, and we’d just be recreating the broken “big tech” structures of the last decade, rather than enabling more decentralized, more widely competitive tools:

An erroneous fair use ruling would hamper competition in the market for LLMs, because only the largest technology companies might have the capital necessary to pay licensing fees. And such licensing fees would disproportionately benefit legacy media outlets due to the sheer volume of their written publications. By contrast, if not hindered by a strained understanding of copyright law, LLMs can and should help level the playing field between mainstream and independent publishers, for several reasons. Authors with limited resources can use LLMs to compete (by, for example, using an LLM to generate an image to accompany an article—which otherwise might require a photographer or license). And LLMs can direct users to dissenting sources that offer contrary information or perspectives. It is not in the public’s interest for the largest technology companies to have an oligopoly on LLM training due to licensing entry barriers that function primarily as large subsidies for old mainstream media companies.

To me this is the whole ballgame, and part of what makes it so frustrating that many people insist training can’t be fair use. They often think the end result is somehow punishing the “big” AI companies, but the reverse is true. A finding against fair use locks in the biggest AI companies, and wipes out everyone else, especially decentralized open weight models that actually empower end-users without enabling tech giants.

The DOJ also cites all the right precedents (including some that previous administrations were not happy about) on a point that gets mangled constantly: fair use isn’t just a defense you raise after infringing. It means there was no infringement in the first place.

A copyright owner’s exclusive rights are thus subject to various exceptions and limitations. For example, “copyright assures authors the right to their original expression, but encourages others to build freely upon the ideas and information conveyed by a work.” Feist, 499 U.S. at 349- 50. “This principle, known as the idea/expression or fact/expression dichotomy, applies to all works of authorship.” Id. at 350.

Relatedly, and as most relevant here, the “fair use” doctrine provides that certain secondary uses of a copyrighted work are “not an infringement.” 17 U.S.C. § 107. Although fair use originated as “judge-made,” Congress subsequently codified it. Campbell, 510 U.S. at 576. The statute continues a common-law tradition, which recognized that certain amounts and types of copying must occur to promote the purposes of the Intellectual Property Clause. See id. at 575 (citing U.S. CONST. art. I, § 8, cl.8). Fair use is an “equitable rule of reason that permits courts to avoid rigid application of the copyright statute when, on occasion, it would stifle the very creativity which that law is designed to foster.” Google LLC v. Oracle Am., Inc., 593 U.S. 1, 18 (2021).

It also notes (correctly, though contrary to the belief of many non-copyright lawyers) that fair use was written to be broad and flexible, not just based on a specific set of categories, or if you meet specific rules:

The preamble of section 107 specifically recites six uses likely to result in a finding of fair use: “criticism, comment, news reporting, teaching . . ., scholarship, or research.” But determining a “fair use” is “not to be simplified with bright-line rules, for the statute, like the doctrine it recognizes, calls for case-by-case analysis.” Campbell, 510 U.S. at 576-77. As such, the statutory list is not exhaustive. See 17 U.S.C. § 107 (identifying purposes “such as” the listed set). The statute’s legislative history confirms the same. See Harper & Row Publishers v. Nation Enters., 471 U.S. 539, 562 (1985); Pac. & S. Co., Inc. v. Duncan, 744 F.2d 1490, 1496 (11th Cir. 1984); Cambridge Univ. Press v. Becker, 863 F. Supp. 2d 1190, 1225 (N.D. Ga. 2012). The House Report for section 107 indicates Congress’s intent for a flexible inquiry that can adapt to new technologies and scenarios:

[T]here is no disposition to freeze the doctrine in the statute, especially during a period of rapid technological change. Beyond a very broad statutory explanation of what fair use is and some of the criteria applicable to it, the courts must be free to adapt the doctrine to particular situations on a case-by-case basis.

H.R. Rep. No. 94–1476, 94th Cong., 2d Sess. 66 (1976); see also id. at 65 (“[S]ince the doctrine is an equitable rule of reason, no generally applicable definition is possible, and each case raising the question must be decided on its own facts.”).

The DOJ agrees with Alsup’s analysis that training is quite clearly fair use as transformative.

The first statutory fair-use factor, the “purpose and character of the use,” requires consideration of “whether the new work merely ‘supersede[s] the objects’ of the original creation (‘supplanting’ the original), or instead adds something new, with a further purpose or different character, altering the first with new expression, meaning, or message.” Campbell, 510 U.S. at 578-79 (quoting Folsom v. Marsh, 9 F. Cas. 342, 348 (C.C.D. Mass. 1841) (No. 4,4901) (Story, J.) and Harper & Row, 471 U.S. at 562). The Supreme Court has described the latter type of use as “transformative.” Id. “[T]ransformative uses tend to favor a fair use finding because a transformative use is one that communicates something new and different from the original or expands its utility, thus serving copyright’s overall objective of contributing to public knowledge.” Authors Guild, 804 F.3d at 214.

The copying of protected text articles as part of training an LLM is a use of a different kind or character that is “transformative—spectacularly so.” Bartz v. Anthropic PBC, 787 F. Supp. 3d 1007, 1021 (N.D. Cal. 2025). The New York Times alleges that OpenAI’s training results in a model that “predict[s] words that are likely to follow a given string of text based on the potentially billions of examples used to train” OpenAI’s LLMs, such that the LLMs can subsequently generate original responses to a wide range of user inputs. Microsoft Corp., No. 1:23-cv-11195-SHS-OTW, ECF 1677 ¶ 75 (Aug. 21, 2026). An OpenAI LLM thus uses the copyrighted work not to duplicate the work’s expressive content, but as part of a process to learn and act on statistical patterns in written text, including vocabulary, syntax, and knowledge. The purpose of the copying (to build an intelligent, interactive model) differs in kind from the purpose of the copied work (to use language to directly entertain or educate a reading audience). This use of text-based works to create an LLM engine for “innovative tools” that can “edit an email . . . , translate an excerpt from or into a foreign language, write a skit based on a hypothetical scenario, or do any number of other tasks” is undoubtedly “highly transformative.” Kadrey v. Meta Platforms, Inc., 788 F. Supp. 3d 1026, 1044 (N.D. Cal. 2025).

Notably, the whole concept of “transformative use” being so central to fair use is generally traced back to Judge Pierre Leval’s wonderful 1990 Law Review article “Toward a Fair Use Standard.” At the time he wrote that, he was a federal judge in the Southern District of NY, where this case is being heard (side note: it’s ridiculous that Leval’s “Toward a Fair Use Standard” article seems to mainly only be available behind JSTOR’s paywall…. if ever there were an article that should be available freely…).

Beyond the transformativeness, the DOJ leans heavily (again, correctly) on the other big factor that shows up in fair use cases: the impact on the market. As we said when the NY Times first floated this lawsuit, no one is replacing the NY Times with ChatGPT. They serve very different purposes. And the DOJ filing emphasizes this:

Using a copyrighted work to train an LLM—without more—generally does not result in this sort of substitution because it does not “reveal[]” a significant amount of original “authorial expression.” Authors Guild, 804 F.3d at 224; see also, e.g., Bartz, 787 F. Supp. 3d at 1031 (“[T]raining LLMs did not result in any exact copies nor even infringing knockoffs of their works being provided to the public.”). In fact, training does not reveal anything to the public at all—it simply creates a copy of a protected work in order to teach an LLM to recognize relationships between data and adapt to new information. The potential for future outputs that might cause market harm is simply not relevant to evaluating an LLM training use under the required use-byuse analysis.

To be clear, even LLM outputs that compete with text articles—without reproducing or substantially resembling protected aspects of text articles—would not be substantially similar to, or substitutes for, copyrighted works in the relevant sense. When outputs “copy no protected elements of the original work, much less significant portions,” they cannot cause the relevant form of market harm just because they happen to be “in the same genre or category of works” as the original, given that “a genre is an uncopyrightable idea or method of expression.” Edward Lee, Copyright Dilution Under Constitutional Scrutiny, 25 Chi.-Kent J. Intell. Prop. 1, 6 (2026) (citing Peters v. West, 692 F.3d 629, 636 (7th Cir. 2012) (“[N]o poet can claim copyright protection in the form of a sonnet or a limerick.”)); accord Abdin v. CBS Broad. Inc., 971 F.3d 57, 70 (2d Cir. 2020) (no infringement where “an independent comparison of the works reveals that there is no substantial similarity between the protectible features of [the original]” and the secondary use). Whether a particular output or category of outputs is substantially similar to the copyrighted work, and whether any substantially similar reproduction might be a significantly competing substitute, are distinct questions involving distinct “challenged use[s]” (and potentially additional legal questions). Harper & Row, 471 U.S. at 568. But outputs lacking in substantial similarity cannot cause the sort of market harm that is cognizable in the fair-use analysis.

I’m also happy to see the DOJ make a point that usually gets ignored in these cases: creative people learn by copying. It is natural. Creative people imitate others until they find their own voice. A ruling that training isn’t fair use would turn that whole creative learning trajectory into infringement:

This type of logic would have problematic implications for copyright law generally. To illustrate, when she was a teenager, Joan Didion “would type out” Ernest Hemingway’s “stories to learn how the sentences worked,” and as a result she considered him the greatest influence on her writing. See Linda Kuehl, Joan Didion, the Art of Fiction No. 71, The Paris Review (Issue 74, Fall-Winter 1978).18 By the Kadrey court’s logic, Didion should have incurred liability to Hemingway every time she published a piece, because the process by which she trained herself and the process by which she produced works was all one use, and her works competed with those of other authors in the market for literature. But “to make anyone pay specifically for the use of a book . . . each time they later draw upon it when writing new things in new ways would be unthinkable.” Bartz, 787 F. Supp. 3d at 1021.

I’m also glad to see the DOJ call out the simple fact that, for all of the NY Times’ whining about how awful it is that OpenAI trained on the NY Times (and basically every other published work out there), NY Times reporters regularly rely on LLM tools themselves. And… that it’s helping smaller media providers level up to compete with a media company as large and full of resources as the NY Times.

LLMs can inspire or help someone to write a story, compose a song, write a movie script, or produce any other kind of art. Indeed, authors at the New York Times itself are using LLMs to help them “conceptualize and edit” articles.19 Independent and start-up publications, as well as ordinary people, can too. For example, an independent writer used an LLM and his background as a physics teacher to offer a contrarian perspective about data center water usage and critique the New York Times.

This is a good filing, and it sucks that this DOJ is so untrustworthy that the court may discount it.

And while it’s easy to claim that this was just done because of how the tech oligarchs have lined up behind Donald Trump, there are some suggestions that this is not the case here. This filing looks like the work of a few lawyers at the DOJ who actually understand copyright law — which, these days, is its own kind of shocking. And the best sign of this is that Mike Davis, the MAGA whisperer who appears quite gleeful about how if you pay him, he’ll get your antitrust case to turn out the way you want, is absolutely freaking out about this filing, and went public with his demand that the DOJ withdraw the filing in a Fox News op-ed calling it “the art of the steal” — a phrase that reveals he has no idea what fair use is, since a use that isn’t infringement isn’t theft. (Also necessary: a reminder that Mike Davis became anti-tech only after big tech companies refused to hire him).

The court may decide to ignore it, but the DOJ’s filing is absolutely correct on the issue of fair use. It’s just too bad it’s coming from a DOJ that has spent every last bit of credibility it had on cases that deserved none of it.

Filed Under: ai, ai training, copyright, doj, fair use, transformative
Companies: ny times, openai