Editorial intro

Today’s picks circle a common theme: when technology promises insight or convenience, the real story is often about the friction, manipulation, or spectacle underneath. We look at two stories that matter for public trust — a deep probe into enormous post‑election trading on Polymarket and a reporting project that shows how hard it can be to stop sharing your medical records — then run through two sharp headlines that caught Reddit’s attention.

In Brief

Governments are hacking people through online ads, report says

Why this matters now: Citizen Lab’s finding that government‑grade spyware can be delivered through ordinary ad auctions shows that web ad infrastructure can be weaponized against journalists and activists today.

Researchers at the University of Toronto’s Citizen Lab reported that what looked like normal display ads were used as a delivery vector for a “zero‑click” spyware install against staff at Al Jazeera and other targets. The technique exploits real‑time ad auctions and precise targeting so malicious code is shown only to selected victims, making detection harder and the attack more surgical than mass phishing. The report calls for industry and regulators to evaluate the security risks of the current advertising ecosystem; their work suggests simple ad impressions can hide serious threats.

“The technique is likely far more widespread than the single documented case,” Citizen Lab warned.

Read more in AOL’s report on Citizen Lab’s findings.

Buckle up Fucklehead! (Tesla’s “flying car” demo)

Why this matters now: Reddit’s reaction to Tesla’s recent demo matters because investor and public perceptions of company priorities can shift based on spectacle — not just product progress.

A viral image on r/wallstreetbets showed a Tesla strapped to thrusters in a stunt that set the usual mix of ridicule and grudging amusement ablaze. Comments ranged from “If your car literally had to do backflips, it looks like you're completely out of ideas” to “cool? abso‑fucking‑lutely. Impressive? Not really.” The thread captures a recurring question: is this engineering innovation or headline‑driven PR? For many viewers, using rocket‑style thrusters to make a car hop is theater, not a roadmap to consumer products.

“Using rocket‑style thrusters on a two‑ton vehicle isn’t the same as building a practical consumer product,” one commenter noted.

See the original image thread on Reddit here.

Deep Dive

Polymarket saw $600 million in election trades after the elections were over

Why this matters now: The Polymarket trading surge shows that prediction markets can be distorted by wash trading and “activity farming,” which undermines their value as public forecasting tools and raises regulatory red flags.

Ars Technica’s investigation into post‑election activity on Polymarket found more than $600 million in trades in two election markets even after outcomes were effectively decided. Researchers who parsed on‑chain data flagged clear anomalies: hundreds of thousands of rapid buy‑sell loops, median holding times that were suspiciously short, and trading patterns that yielded little or no net profit for either side. Those are classic signs of wash trading — trades that artificially inflate volume without changing ultimate ownership or risk exposure.

Why that matters: prediction markets are useful only when prices reflect real wagers based on information or conviction. When a very large share of volume appears to be manufactured, the market’s signal value collapses. The reporting cites analytics firms estimating wash trading made up as much as 99.6% of volume in some weeks — numbers that suggest the platform’s headline activity stats were meaningless at best and potentially deceptive at worst. Regulators, including the Commodity Futures Trading Commission (CFTC), have been watching large platforms that let people trade on elections and geopolitical outcomes; activity like this invites closer scrutiny on market integrity and whether insiders or platform operators could be benefiting from inflated metrics.

Technically, the investigators relied on publicly visible on‑chain traces and behavioral heuristics to infer manipulation: very short holding periods, repeated matched orders between addresses, and trades that net out to zero profit once fees are considered. Those patterns don’t prove fraud by themselves, but they form a strong circumstantial case that much of the volume was activity farming — activity designed to boost engagement figures or simulate liquidity. Polymarket has said it’s added surveillance and fees to curb manipulation; meanwhile, the episode raises two strategic questions for prediction markets going forward:

  • Can decentralized or crypto‑native markets design incentive systems that reward honest betting rather than gaming metrics?
  • What enforcement and reporting rules should apply to platforms that purport to offer public forecasts on elections and policy?

If you follow forecasting as a civic tool, this is a moment to push platforms for clearer transparency: who benefits from large trades, how liquidity is measured, and what surveillance steps are in place to detect coordinated wash trading. Ars Technica’s full report offers the on‑chain examples and researchers’ methods for anyone who wants to dig into the evidence.

Read the full investigation at Ars Technica: Polymarket saw $600 million in election trades after the elections were over.

MyChart and a major hospital said I could opt out of sharing my health data. But they didn’t make it easy

Why this matters now: Alex Rosenblat’s CalMatters investigation shows that Epic’s MyChart and hospital systems often make it difficult to exercise privacy choices, meaning patients who want to stop broad data sharing may be effectively enrolled without informed consent.

CalMatters reporter Alex Rosenblat spent months trying to opt out of data sharing through Epic’s MyChart and ran into inconsistent staff guidance, scattered opt‑out procedures, and in one case a requirement to have forms notarized before processing. Many hospitals default patients into broad data‑exchange networks such as Epic’s Care Everywhere, which can move large batches of records automatically for treatment, billing, or research. Rosenblat’s experience suggests the low number of opt‑outs may reflect process friction more than patient comfort with sharing.

There are practical consequences. Patients who believe they’ve turned off sharing can be surprised when records still flow to other providers or research databases. Rosenblat’s reporting offers pragmatic steps: contact the hospital’s HIPAA compliance or medical records office directly, ask specifically what an opt‑out covers, keep dated copies of any requests, and consider screen recordings when interacting with portals to document what you agreed to. Those steps matter because hospitals sometimes route requests across multiple administrative areas; having proof of your choice reduces the risk that your override request is misfiled or ignored.

Policy‑level changes could help. Standardized, clearly labeled opt‑out controls inside patient portals would reduce reliance on handwritten forms and notarization. Auditable access logs and one‑click opt‑out toggles would make it easier for patients to exercise informed consent. Without those fixes, the default remains the path of least resistance for institutions — automatic sharing — and that bias favors data flows that patients might not want if the choice were simpler.

Read the reporting at CalMatters: MyChart and a major hospital said I could opt out of sharing my health data. But they didn’t make it easy.

Closing Thought

Today’s items arrive at the intersection of convenience and trust: markets that claim to reveal collective knowledge, portals that promise patient control, and everyday infrastructure that can be weaponized. Spectacles and headlines get attention — but for citizens and technologists, the hard work is building systems where the underlying incentives reward honesty, transparency, and genuine consent.

Sources