Policy Updates
FEDHB8747 — K–12 AI Literacy and Readiness Act of 2026 FEDHB8768 — CHARGE Act Cybersecurity and Hardware Assurance for Resilient Grid Electrification Act FEDSB4074 — Fund CISA Personnel Act of 2026 FEDSB4069 — AI-Ready Bio-Data Standards Act MDHB1638 — Consumer Protection - Covered Platforms - Protection of Minors (Kids Online Protection and Antigrooming Act) MDSB989 — Child Exploitation Material - Civil and Criminal Actions (Safe Kids Act) VASB796 — Artificial Intelligence Companion Chatbots and Minors Act; established, enforcement, civil penalty. VAHB1521 — Digital innovation & infrastructure; establishing rights in digital property & technology resources. DCB26-0670 — District of Columbia Government Data Privacy and Protection Act of 2026 DCB26-0656 — Internet Gaming and Consumer Protection Act of 2026 FEDHB8747 — K–12 AI Literacy and Readiness Act of 2026 FEDHB8768 — CHARGE Act Cybersecurity and Hardware Assurance for Resilient Grid Electrification Act FEDSB4074 — Fund CISA Personnel Act of 2026 FEDSB4069 — AI-Ready Bio-Data Standards Act MDHB1638 — Consumer Protection - Covered Platforms - Protection of Minors (Kids Online Protection and Antigrooming Act) MDSB989 — Child Exploitation Material - Civil and Criminal Actions (Safe Kids Act) VASB796 — Artificial Intelligence Companion Chatbots and Minors Act; established, enforcement, civil penalty. VAHB1521 — Digital innovation & infrastructure; establishing rights in digital property & technology resources. DCB26-0670 — District of Columbia Government Data Privacy and Protection Act of 2026 DCB26-0656 — Internet Gaming and Consumer Protection Act of 2026
What We Do

The University of Maryland’s Tech Policy Hub studies tech policy from a socio‑technical perspective, building the bridge between computer science & public policy to understand how policy is designed and implemented for, by, and with tech. Our hub spans the forefront of tech policy across four research areas, bringing together DMV‑based practitioners, scholars, and civil activists to shape the future of technology in society.

Interested in becoming affiliated with us? Please email our founder, Dr. Sivan‑Sevilla, to discuss further.

Research Areas
Research Spotlight
Cybersecurity
Trustworthy AI
Cybersecurity
Cybersecurity
Consumer Privacy

Why is Tech Regulation so Hard?

Media Aug 3, 2026

Dr. Ido Sivan-Sevilla, in his essay for The Regulatory Review, surveys the difficulties of regulating technology across issues and policy requirements. He details six factors that contribute to the problem, arguing that the people who work for tech companies are not malicious, but they work in a structure that rewards societal harm. The pressing question is whether regulators can change that structure and create a convergence in corporate and social interests for tech usage and development.

A Neuro-Symbolic Framework for Legal Accountability in Public-Sector AI

Conference Talk June 2026
ACM's FAccT

Authors: Allen Daniel Sunny, Ido Sivan-Sevilla Abstract: Automated decision-making systems are increasingly used by public agencies to govern access to welfare. Accountability in these settings is not achieved through access to model internals, but by the explanations provided to applicants i.e documents that function as legal justifications and sites of contestation. Little work has been done to examine whether such explanations are legally valid. This paper examines explanation-level accountability in public-sector AI systems by designing and implementing a neuro-symbolic framework to assess automated welfare eligibility determinations. We deploy a Large Language Model (LLM) to encode statutory eligibility rules into a formal ontology and use satisfiability-based verification to assess whether benefits explanations comply with the governing law. Applying this approach to California's CalFresh program, we analyze explanations and observe if our system detects legal mismatches. Our findings show that formal verification reveals violations of statutory requirements even when explanations appear reasonable or complete to human readers. We argue that explanation-level verification offers a distinct and necessary complement to existing approaches of algorithmic auditing and accountability, shifting attention from model behavior to the legal integrity of justificatory artifacts. We call for a shift from interpretability to auditability of public algorithms, as government explanations must do more than reveal statistical associations; they should articulate the legal basis for a decision so that affected individuals, oversight bodies, and administrative reviewers can assess whether the justification satisfies statutory criteria and procedural norms.

Protecting the Neglected: Measuring County Cyber Risk with Dr. Ido Sivan Sevilla

Podcast May 19, 2026

Dr. Ido Sivan Sevilla joins host Caleb Tolin to break down battlefield stories from a massive analysis of over 3,000 local government entities. Dr. Sivan Sevilla, who serves as an Assistant Professor at the UMD College of Information and holds joint positions at the Hebrew University School of Public Policy & Governance and the School of Computer Science and Engineering, brings a multidisciplinary lens to the alarming reality of risk clusters. Their discussion moves past theory to explore how hundreds of counties share identical IP addresses and third-party service providers, creating centralized points of failure that attackers can identify using data.

A Crucial First Look at the Nation’s Cyber Attack Surfaces

Magazine Oct 01, 2025

Never before has there been a holistic view of the nation’s cyber attack surface, by county. Thanks to researchers at the University of Maryland, counties can assess how vulnerable their IP addresses, public-facing nodes and databases are, and compare that to other counties, says Ido Sivan-Sevilla, an assistant professor at the university’s College of Information.

‘Cookie-less’ identification for/against privacy?

Publication Aug 06, 2025

The advertising industry’s anticipated shift away from third-party cookies led to the proliferation and normalisation of first-party identification architectures online. Marketed as ‘privacy-friendly,’ the new technologies promise to deliver the efficiencies that advertisers have become accustomed to, while addressing privacy concerns from third-party cookies. Such tension calls for a better understanding of the privacy implications from first-party online identification architectures. We evaluate first-party user identification mechanisms by (1) surveying the literature to create a typology that synthesises existing privacy concerns in third-party cookie-based identification, and (2) applying our typology to evaluate the privacy of prime examples in what we frame as three distinct types of first-party ID architectures — Universal IDs, Onboarding ID, and Walled Garden ID. We analyse technical documentation and code repositories from each architecture type and show how first-party ID solutions still enable cross-site tracking over longer periods of time and encourage sensitive user targeting. First-party ID solutions do create mechanisms to ease opting out from tracking, but the implementation of those mechanisms is questionable. Our findings demonstrate how the advertising industry is trying to maintain its existing structure and replicate the tracking functionalities on which it has grown reliant.

Hub News
October 2026

EAAMO 2026: Accepted poster at the ACM Conference on Equity and Access in Algorithms, Mechanisms, and Optimization.

MediaSeptember 2026

Our FAccT talk by Allen Sunny on Neuro-symbolic Frameworks for Public AI was published

MediaAugust 2026

Why Is Tech Regulation So Hard? By Dr. Ido Sivan-Sevilla

PublicationJune 2026

Neuro-Symbolic Frameworks for Accountable AI Published at 2026 ACM FAccT

PresentationJune 2026

Presenting on Adaptive Regulation at CNIL's Privacy Research Day

MediaMay 2026

Interviewed by the Data Security Decoded Podcast

PublicationMay 2026

Neuro-Symbolic Public AI Accountability Work Accepted at ACM FAccT

PublicationApril 2026

Adaptively Regulating Privacy as Contextual Integrity Published at IEEE Security & Privacy

PresentationJanuary 2026

Presenting on Legal Accountability of Public Algorithms at Data Justice 2026

MediaOctober 2025

Interviewed by Signal Magazine on County Government Vulnerabilities

PublicationJuly 2025

Cookie-less Identification: For and Against Privacy

PublicationJune 2025

Predicting Website Reliability from Structure Accepted at FOCI

RecognitionJune 2025

Invited to the Cyber Resilience Corps' First Cyber Volunteering Day

PresentationMay 2025

Presenting on Usable Privacy and Security Policymaking at SOUPS 2025

PresentationApril 2025

Discussing Local Government Cybersecurity at the Ohio State Technology Law Journal Symposium

MediaMarch 2025

Cyber Attack Surface Research Highlighted by Newsweek

PublicationMarch 2025

Applying Contextual Integrity to Measure Web Privacy

MediaFebruary 2025

County Government Attack Surface Work Highlighted by Maryland Today

PublicationJanuary 2025

Attack Surface Across U.S. County Governments Published in Journal of Cybersecurity

Events

Full Calendar
Speaker SeriesWorkshopRoundtableAnnual EventExternal
November 2026
SMTWTFS
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
SMTWTFS
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
SMTWTFS
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
SMTWTFS
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
SMTWTFS
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
SMTWTFS
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
SMTWTFS
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
SMTWTFS
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
SMTWTFS
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30

Guiding Questions

  1. How do we deal with the social problems of computing through top-down and bottom-up policymaking & implementation?

  2. What can we learn from the history of policymaking across technology issues?

  3. What can we learn about tech policy from a comparative perspective? Across sectors? Across jurisdictions?

  4. How and by whom tech policy issues enter the political agenda?

  5. How does the efficacy of tech policies can be assessed and evaluated?

  6. What are the politics of tech policy design?

  7. How can we use crowdsourcing to improve tech policies?

  8. How can we teach tech policy through an experiential learning perspective?