Leading hub for knowledge transfer in digital trust

Rational Astrologies and Security

I found this short paper by John Kelsey and Bruce Schneier an insightful take on common fallacies in security - and how, despite not actually increasing security per se, they can still have beneficial side-effects, such making users feel more secure. Nonetheless, the people responsible for the security of their systems should have a clear-eyed view of the actual state of security. Consequently, this text can serve as a basis for re-evaluating your approach to security measures.

Opt out: what to do with your 23andMe account after company filed bankruptcy

23andMe has filed for bankruptcy, raising concerns about data privacy. This article offers tips to the 15 million users of this direct-to-consumer service on how to delete their accounts. The research community proposed robust solutions to protect genetic data, yet it is unclear whether the company implemented any, given the massive hack it suffered last year, which cost it much of its credibility. A useful cautionary tale.

New C4DT Observer #15 , entitled “The Impact of AI on the Software Development Life Cycle”, is out !

This document discusses the main ideas, insights and conclusions extracted from the roundtable on "the impact of AI on the software development life cycle”, an event organized by C4DT in collaboration with ELCA on Feb 7th 2025 at the EPFL.

GitHub suffers a cascading supply chain attack compromising CI/CD secrets

Supply chain attacks will continue to hit the news in an increasingly interconnected development ecosystem as organizations rely on third-party components and actions. This seems inevitable. What I find interesting about this case is the threat actors' approach to compromise software while it is still under development, which sets itself apart from attacks such as SolarWinds (2020) and Log4J (2021) in that it specifically targets the CI/CD pipeline infrastructure itself rather than the final software products.

Under Trump, AI Scientists Are Told to Remove ‘Ideological Bias’ From Powerful Models

We often hear or talk about 'IT for good' and 'responsible behaviour' in the digital world, assuming a single universal common understanding of what's good and what's responsible. Things start to get confusing when we think about for whom a service or action is good or responsible: for all humanity, including the 'bad guys'? for one's own nation? for a given majority? This article shows that the universal principles of 'good' and 'responsible' are relative. It challenges all the efforts made so far in the name of ethics and 'common good' and questions what they actually mean on the ground. For instance, will we have conformity checks, like for cars, when we import and use an AI from another country? Will we have to choose between fast, strong, unsafe and polluting AI vs. slower and more 'responsible' ones?

Kroger’s Surveillance Pricing Harms Consumers and Raises Prices, With or Without Facial Recognition

My colleague Melanie’s pick last week about Swiss supermarket chain Coop using AI-supported video surveillance in its stores for security purposes reminded me of the recent revelation that American supermarket chain Kroger may be engaging in surveillance pricing, i.e., using algorithms and data collected on customers (including through facial recognition technology) to determine the highest price they are willing to pay for a good or service. This growing practice allows retailers from Amazon to Uber to extract the maximum profit out of a transaction at the expense of consumer privacy and general fairness. What's more, customer data can then be sold to third parties for further ad targeting and other purposes. This article provides a good overview of what surveillance pricing is and where policymakers and regulators should train their efforts to better understand and mitigate this practice.

US suspends offensive cyber operations against Russia, senior US official says

The article reports that the US may have paused its offensive cyber operations against Russia, suggesting it is likely part of a broader diplomatic strategy to encourage talks over the Ukraine conflict, or to possibly focus more on addressing cyber threats posed by China. Scaling back offensive actions without reciprocal guarantees risks exposing critical infrastructure to ongoing cyber threats, testing the limits of deterrence strategies in a geopolitically tense environment. Now the question remains: how will the interplay of diplomacy and cyber strategy evolve in a world where nations like Russia and China continue to leverage cyber capabilities as tools of geopolitical influence?

A look back on matrix.epfl.ch in 2024: A Success Story!

We’re thrilled to announce the publication of our latest blog post exploring the remarkable year 2024 of matrix.epfl.ch. 📚In 2024, the Center for Digital Trust discovered matrix.epfl.ch hosted by Edwand Andò from EPFL’s Center for Imaging and decided to offer…

Book Review: “The Tech Coup – How to Save Democracy from Silicon Valley” – Marietje Schaake (2024)

In our latest edition of the C4DT Digital Governance Book Review, we discuss Marietje Schaake’s book which explores the deep intertwining of Big Tech with politics, highlighting its threat to democracy and proposing practical regulatory solutions to reclaim democratic processes…

The biggest breach of US government data is under way

Amid the controversy surrounding Musk's operatives accessing US government data, this article gives some nice examples of how an organization’s sensitive data could become compromised. At the top of the list is the failure to follow basic cybersecurity protocols, such as adhering to transparently developed guidelines for system access and data handling. Other red flags include failing to implementing multi-factor authentication and accessing an organization’s networks through unapproved devices and platforms, like personal email accounts or unauthorized servers.

AI-generated child sex abuse images targeted with new laws

The new laws targeting AI-generated CSAM position the UK as the first nation to criminalize the possession, creation, or distribution of AI tools used for generating such material, imposing penalties of up to five years in prison. These measures also prohibit related manuals, penalize those operating websites that share CSAM, and grant Border Force the authority to inspect digital devices of suspected individuals. While some experts suggest the measures could go further, the UK's initiative marks a significant step in addressing the technology behind child sexual exploitation, potentially inspiring similar legislation in the EU and also Switzerland.

How Chinese AI Startup DeepSeek Made a Model that Rivals OpenAI

DeepSeek, a new Chinese open-source LLM that uses limited resources—particularly older Nvidia chip models—extremely efficiently, has exploded onto the AI tech scene almost overnight. Many are calling this a new 'Sputnik moment' for the US. Already the most downloaded free app on the US Apple Store, DeepSeek is expected to challenge the oversized investment bubble in AI, notably through the announcement of Stargate, by demonstrating that innovative AI can thrive even under restrictive resource environments. Overall, this is bad news for the US, but possibly good news for countries like Switzerland, which were surprisingly excluded from the group granted access to high-performance US chips.

C4DT Annual Report 2024 is out !

We are incredibly proud to announce the publication of C4DT's 2024 Annual Report. Thanks to the support of many people (partners, researchers, government officials, etc.), the C4DT has further blossomed.