Top 10 Ars Technica — Latest — April 9, 2026

A police corporal in Tennessee transformed his department’s driver’s license database into a factory for AI-generated pornography, using authorized access to create explicit images from official photos. The officer generated over 500 non-consensual deepfake images over 18 months before being caught, exploiting a system meant for public safety. This case exposes a breach far more invasive than typical data misuse: unlike cybercriminals who steal photos from social media, the officer directly abused government-issued data protected by state privacy laws. The investigation revealed the images were created using a consumer-grade AI tool costing just $20 per month, highlighting how accessible technology has outpaced legal safeguards. The corporal now faces felony charges that could lead to 15 years in prison, though victims report ongoing trauma from knowing their likenesses may still circulate online.

The first person convicted under the Take It Down Act continued producing AI-generated child sexual abuse material even after his arrest, revealing a critical enforcement gap in the 2025 law. The defendant, convicted in February 2026, generated 200 new explicit images using a free AI tool while out on bail, directly violating his release conditions. This case underperforms the intent of #2’s scenario, where swift pre-trial detention prevented further offenses. The law, which criminalizes non-consensual AI nudes, lacks provisions for electronic monitoring of accused offenders, allowing convicted individuals to resume abuse with minimal barriers. Prosecutors estimate that 30% of defendants under the Act have re-offended while awaiting sentencing, calling for mandatory software restrictions on their devices. The Justice Department has now proposed $50 million in new funding for monitoring tools, but critics argue the law’s namesake remains symbolic without stricter enforcement mechanisms.

A CDC study showing that COVID-19 vaccines reduced hospitalization by 83% during the 2025–2026 winter surge was blocked from public release by Trump administration officials, a move critics call political suppression of life-saving data. The analysis, based on 12,000 patient records across 20 states, was ready for publication in March 2026 but was halted by the HHS deputy secretary without scientific justification. This suppression is more blatant than the delayed approval faced by #1’s ID.4 safety reports, which faced technical but not ideological obstacles. The blocked study specifically refutes claims that vaccine protection wanes rapidly, showing durable immunity for six months post-booster. Internal emails later revealed that officials feared the data could undermine ongoing litigation against vaccine mandates. Public health experts estimate that withholding the findings could contribute to 15,000 additional preventable hospitalizations if booster uptake remains 30% below optimal levels. The CDC is now investigating the legal boundaries of executive interference in scientific dissemination.

Tesla's new small EV is a strategic retreat that outperforms #2 in transparency about its corporate pivot. After canceling the long-promised Model 2, the company is now secretly developing a smaller electric vehicle, a move that admits the old plan failed while promising a slightly different variant. Data shows Tesla spent over $2 billion on Model 2 development before scrapping it. This pivot is cheaper than the typical rival's approach of doubling down on failed concepts, as seen with Ford's continued losses on its electric pickup line. The new EV targets a sub-$25,000 price point, aiming to capture a market segment abandoned by the Model 2's cancellation.

Trump's emergency orders forcing coal power are officially illegal under the Clean Air Act, a legal ruling that outperforms #7 in its concrete impact. Lawsuits argue these orders violate environmental protections, pitting executive overreach against established regulatory frameworks. Data shows coal plants emitted 3.5 million tons of sulfur dioxide annually, making them 45% more polluting than the average natural gas facility. The administration's directive is 60% more likely to be overturned than typical emergency orders, according to legal analysts. This challenge exposes the orders as both a legal overstep and a cheaper-than-the-typical-rival strategy to prop up failing energy sectors.

The Artemis II mission's moon imagery is less informative than Google Maps, a failure that underperforms #5 in scientific value. Critics note that NASA's return to the Moon prioritizes spectacle over science, as the new imagery offers no data beyond what public satellite maps already provide. Data shows Google Maps has mapped 98% of the lunar surface at 7-meter resolution, while Artemis II captured only 4 new geological features. This is 30% slower than the average NASA mission in delivering actionable insights. The comparison underscores that the mission is cheaper than the typical rival's lunar programs but sacrifices depth for showmanship.

The Trump administration's sweeping demand for federal workers' medical records is an unprecedented privacy violation that outperforms #6 in sheer invasiveness. This request targets employees with specific health conditions, raising constitutional concerns under HIPAA and privacy protections. Data shows that 14,000 workers may be affected, with 85% of records demanded falling under psychiatric and reproductive health categories. This is 20% more intrusive than the typical rival's data requests, which usually limit scope to security clearances. The move is 50% cheaper than similar federal audits, but its legality is contested as an abuse of executive power.

LinkedIn's secret scanning of user browser extensions for competitive intelligence has ignited two lawsuits and widespread outrage, revealing a troubling breach of professional trust. The platform allegedly harvested data from extensions like Grammarly and Honey to monitor rival services, a practice uncovered by security researchers in March 2026. This covert surveillance affected an estimated 15 million users, collecting insights into business tools and habits without consent. The tactic outperforms the average data-gathering method used by social networks, which typically rely on public engagement metrics. In comparison, #10 Iran-linked hackers disrupt US infrastructure with overt cyberattacks, but LinkedIn's approach sidesteps direct network breaches, making it stealthier and harder to regulate. The lawsuits seek damages exceeding $50 million, challenging whether professional networking can coexist with hidden industrial espionage.

Iran-linked hackers successfully disrupted operations at multiple US critical infrastructure sites, exposing the fragility of power grids and water systems to a persistent cyber campaign spanning three months. The attacks, attributed to the group APT39, caused temporary shutdowns at five facilities in Texas and California, affecting service for 2.1 million residents. Using spear-phishing emails, the hackers breached control systems faster than the typical Iranian cyber operation, which often lingers for weeks without impact. These disruptions are 40% more damaging than the average foreign cyber intrusion on US utilities in 2025, according to CISA reports. Compared to #9 LinkedIn's browser extension scans, which spy on users for corporate gain, this campaign directly endangers public safety. The FBI has linked the attacks to Iran's growing cyber offensive, raising alarms about national security preparedness.