Christo Wilson

This paper describes the multi-year effort undertaken by Mozilla to incorporate and deploy CRLite, a TLS certificate revocation checking system, in the Firefox browser. With the deprecation of the Online Certificate Status Protocol (OCSP) by Let's Encrypt and others, CRLite is now the only broadly deployed mechanism capable of checking the revocation status of every TLS certificate. The successful seven-year evolution of CRLite from a research prototype to a widely used tool required improvements in the original data structures (now using partitioned Ribbon filters), changes in Certificate Authority revocation practices, and correctly synchronizing with Certificate Transparency logs to eliminate false positives. Using data from Firefox's opt-in telemetry, we report that CRLite achieves an effective revocation coverage of 87.8% while maintaining moderate bandwidth costs, even during real revocation events like the November 2025 Microsoft incident. Through simulations, we also examine the potential impacts of shorter certificate lifetimes and hypothetical mass revocations on CRLite. CRLite demonstrates that low-latency, private, comprehensive certificate revocation checking is possible using moderate bandwidth.

98% of sales on Amazon.com flow through the Buy Box. However, Amazon sometimes decides not to feature any offers for a product and removes the Buy Box from the product page -- a situation known as Buy Box suppression. Suppression may have severe consequences on individual sellers and might affect competition if it disciplines prices across online marketplaces. This paper studies suppression using a new, high-frequency dataset that tracks 17,754 products on Amazon.com at hourly intervals for eight weeks in 2024, along with corresponding offers from 59,301 unique competitors. We open-source both the dataset and collection code. We find that the primary reason for suppression is changes to the offers for a product on Amazon. Lower competitor prices only modestly increase the probability of suppression. Suppression has substantial impacts on sellers: products immediately fall sharply in search, ad placements completely disappear within 12 hours, and sales ranks are 12% worse after 48 hours. In contrast, we find no evidence of impacts on competitor prices in the short run. Our results highlight how Buy Box suppression acts as an important and underexplored mechanism of platform governance.

A high-level précis of the Synthesis Report can be found in the Summary for Policymakers Recommendations for a Global AI Auditing Framework: Summary of Standards and Features. The growing integration of artificial intelligence (AI) into critical sectors of society, from healthcare to education, has the potential to support widespread social transformation and progress. However, AI systems also have the power to perpetuate biases, deepen inequalities, and cause environmental harm. Accurately evaluating the risks and benefits of an AI system requires a careful audit. Current approaches to auditing, however, rarely involve independent auditors, provide sufficient evidence, or account for global impacts. Policymakers urgently need a comprehensive global framework for AI audits that validates genuine benefits and risks. The IPIE’s Scientific Panel on Global Standards for AI Audits set out to independently establish global, cross-disciplinary scientific consensus on what makes an audit effective and trustworthy. The Panel consisted of 16 experts from computer science, the social sciences, and the humanities, with expertise spanning generative AI systems, algorithmic auditing, indigenous data sovereignty, data journalism, and the relationship between civil society, human rights, and AI.

This Summary for Policymakers provides a high-level précis of the Synthesis Report Towards A Global AI Auditing Framework: Assessment and Recommendations. The growing integration of artificial intelligence (AI) into critical sectors of society, from healthcare to education, has the potential to support widespread social transformation and progress. However, AI systems also have the power to perpetuate biases, deepen inequalities, and cause environmental harm. Accurately evaluating the risks and benefits of an AI system requires a careful audit. Current approaches to auditing, however, rarely involve independent auditors, provide sufficient evidence, or account for global impacts. Policymakers urgently need a comprehensive global framework for AI audits that validates genuine benefits and risks. The IPIE’s Scientific Panel on Global Standards for AI Audits set out to independently establish global, cross-disciplinary scientific consensus on what makes an audit effective and trustworthy. The Panel consisted of 16 experts from computer science, the social sciences, and the humanities, with expertise spanning generative AI systems, algorithmic auditing, indigenous data sovereignty, data journalism, and the relationship between civil society, human rights, and AI.

This Synthesis Report is a literature review outlining the regulatory, industry, and academic approaches to AI audits. We review 78 articles published in peer-reviewed journals and as preprints, 21 documents from industry associations and standard-setting organizations, and national policy documents and regulations from 20 countries. Based on this review, we identify three key takeaways about the landscape of AI auditing: 1. To accurately assess the potential risks, and impacts of AI systems, we need a trustworthy audit ecosystem with complementary approaches from internal, external, and community auditors. 2. Auditors need better access to data and audit artifacts from the developers and deployers of AI systems. Comprehensive auditability requires documentation and disclosure of an AI system’s model and data components, associated risks and impacts, and easily understandable explanations of its outcomes. 3. Given that the development and use of AI systems impacts communities across the world, audit regimes must account for their global effects. Most existing audits have been conducted in North America, Europe, and other regions of the ‘global north’, with their results typically published in English and focused on effects within these regions. The impacts of AI systems, however, include shifts in social and environmental conditions beyond the immediate development or application contexts of a system.

YouTube is one of the most important platforms on the Internet. However, it is not just a singular destination: because YouTube videos may be embedded into any website, it is a systemically important platform for the entire web. Unfortunately, existing studies do not examine playable YouTube videos embedded around the web, instead focusing solely on on-platform engagement. In this study we present the first comparison of on- and off-platform playable YouTube video exposure on the desktop web, based on data from a sample of n = 1133 U. S. residents from three cohorts: demographically representative users, heavy YouTube users, and users with high racial resentment. Our dataset includes the URLs of all playable YouTube videos encountered by participants for six months—on YouTube itself or embedded in another website—and the URLs where the videos were encountered. By analyzing this data, we find that less popular websites tend to embed YouTube videos in a disproportionately large percentage of their webpages and that individuals encounter more YouTube videos off-platform than on-platform. We also observe that most YouTube channels only receive exposure from either on- or off-platform sources, and that only-off-platform channels tend to get more exposure than only-on-platform ones. These results underscore the wide reach of YouTube as a service provider for the web and the limitations of studies focusing solely on on-platform activity. Motivated by concerns about online misinformation and hate speech, we also examine how partisan websites embed playable YouTube videos and where videos from problematic channels appear around the web. We find that politically right-leaning websites tend to embed more videos from problematic YouTube channels than centrist or left-leaning websites, and that participants exposed to off-platform videos from problematic channels are significantly more inclined to browse towards on-platform videos from problematic channels.

The results returned by image search engines have the power to shape peoples' perceptions about social groups. Existing work on image search engines leverages hand-selected queries for occupations like "doctor" and "engineer" to quantify racial and gender bias in search results. We complement this work by analyzing peoples' real-world image search queries and measuring the distributions of perceived gender, skin tone, and age in their results. We collect 54,070 unique image search queries and analyze 1,481 open-ended people queries (i.e. not queries for named entities) from a representative sample of 643 US residents. For each query, we analyze the top 15 results returned on both Google and Bing Images. Analysis of real-world image search queries produces multiple insights. First, less than 5% of unique queries are open-ended people queries. Second, fashion queries are, by far, the most common category of open-ended people queries, accounting for over 30% of the total. Third, the modal skin tone on the Monk Skin Tone scale is two out of ten (the second lightest) for images from both search engines. Finally, we observe a bias against older people: eleven of our top fifteen query categories have a median age that is lower than the median age in the US.