Our weekly picks of digital trust-related articles

This news illustrates how quantum technologies require forward planning in cybersecurity on unprecedented timescales (2035!), to protect against threats that exist in theory before they materialize in practice. What makes this particularly interesting is the proactive approach: the NCSC is implementing a ten-year strategic roadmap to prevent future breaches. The three-phase timeline recognizes both the inevitability of advances in quantum computing and the complexity of cryptographic transitions.

AI plays a vital role in the digitalization of the public sector. The strategy for integrating AI systems within the Swiss Federal Administration highlights the need for a multipronged approach. While I agree that developing skills and building trust are essential initial steps and likely top priorities, the true challenge lies in addressing the lack of high-quality data and the development of necessary infrastructure to operate AI applications on-premises—an indispensable requirement considering the growing discourse on digital dependencies and data privacy concerns. Addressing this aspect will demand significantly more upfront investment than what the current strategy suggests.

Restarting USAID and putting all payments on a blockchain? Why not? Well, for one, as one expert in the sector is quoted as saying: 'I don’t think we were ever able to find an instance where people were using blockchain where they couldn’t use existing tools'. The Trump administration says that the move to blockchain will help to increase transparency, but that depends a lot on the type of data you put on the blockchain. Then there's the issue of finding a good trade-off between transparency and privacy.

Supply chain attacks will continue to hit the news in an increasingly interconnected development ecosystem as organizations rely on third-party components and actions. This seems inevitable. What I find interesting about this case is the threat actors' approach to compromise software while it is still under development, which sets itself apart from attacks such as SolarWinds (2020) and Log4J (2021) in that it specifically targets the CI/CD pipeline infrastructure itself rather than the final software products.

Ein schöner Überblicksartikel über wichtige Projekte der Digitalpolitik der EU in den letzten Jahren und ob und wie sie sich auf die Schweiz auswirken. Besonders interessant fand ich, dass gerade beim Konsumentenschutz die Schweiz eben nicht automatisch mitprofitiert wenn die EU eine härtere Gangart gegen Big Tech einschlägt.

This investigation highlights a crucial cybersecurity reality: while we often focus on sophisticated zero-day exploits, the greater threat comes from known vulnerabilities and misplaced trust. One million Android devices weren't compromised through cutting-edge techniques but through traditional means - preinstalled backdoors and users installing unvetted apps outside official stores. The victims were vulnerable because they trusted suspiciously cheap devices or downloaded apps from unofficial sources. As noted, 'if the device is too cheap to be true,' there's likely a hidden cost. This demonstrates that basic security hygiene and cautious trust remain our most effective defenses.

Whether it is part of the global AI-wars or simply an effort to adapt the education system to the rise of Generative AI, AI is making its way into schools. I see immense potential in personalized learning experiences and the profound disruption AI can bring to education systems. This article explores how nations have started the AI race in education. However, it lacks the crucial concept of 'Digital Trust by Design,' which should be at the core of any AI-driven transformation. It is essential to address key concerns such as AI bias, privacy, data security, accountability, and ethics. 'Digital Trust by Design' is fundamental for a healthy transformation. Without it, children could be exposed to significant dangers.

Surveillance of children's activities is being practiced by schools not only for security reasons but also with the intention of ensuring children's well-being. On top of that, this article suggests that AI has unencrypted access to students' activities and discussions. I like this article because it raises important concerns, poses open-ended questions, and sheds light on digital trust issues related to the digital transformation of schools. In particular, I wonder what message schools are sending to students when they promote a culture of surveillance and what harm this may cause to democracy.

Interesting to see y-combinator, an incubator for early-stage startups, supporting an EU directive. They say that the European Digital Markets Act actually allows smaller companies to grow, by limiting what the behemoths of the market are allowed to do. Who would've thought that at least one of the regulations gets supported by the US Startup scene?

A brief reminder that in an era of a destabilising security context in Europe and the resulting growing threat of cyber attacks on day-to-day infrastructure, having a stash of cash sufficient for basic groceries at home is a simple precaution everyone should take.

We often hear or talk about 'IT for good' and 'responsible behaviour' in the digital world, assuming a single universal common understanding of what's good and what's responsible. Things start to get confusing when we think about for whom a service or action is good or responsible: for all humanity, including the 'bad guys'? for one's own nation? for a given majority? This article shows that the universal principles of 'good' and 'responsible' are relative. It challenges all the efforts made so far in the name of ethics and 'common good' and questions what they actually mean on the ground. For instance, will we have conformity checks, like for cars, when we import and use an AI from another country? Will we have to choose between fast, strong, unsafe and polluting AI vs. slower and more 'responsible' ones?

My colleague Melanie’s pick last week about Swiss supermarket chain Coop using AI-supported video surveillance in its stores for security purposes reminded me of the recent revelation that American supermarket chain Kroger may be engaging in surveillance pricing, i.e., using algorithms and data collected on customers (including through facial recognition technology) to determine the highest price they are willing to pay for a good or service. This growing practice allows retailers from Amazon to Uber to extract the maximum profit out of a transaction at the expense of consumer privacy and general fairness. What's more, customer data can then be sold to third parties for further ad targeting and other purposes. This article provides a good overview of what surveillance pricing is and where policymakers and regulators should train their efforts to better understand and mitigate this practice.

I find China's attempt to treat data as a formal business asset quite interesting, especially given the massive amount of data the country generates. Companies seem reluctant to adopt this policy though, with only 283 out of 60 million companies participating. But it is still early days, and the months and years to come will bring clarity to key questions, such as how to accurately value and standardize data for accounting purposes, and how to create a functioning data marketplace while maintaining security.

Nobody would seriously argue that a chat bot can replace school counselors in helping pupils taking their first steps on their career paths. However, in the face of a shortage of counselors, aren't chat bots better than no guidance at all? I like this article for its nuanced discussion of young people relying on specialized chat bots for career advising and mentoring, highlighting both pros and cons without being fear-mongering or overenthusiastic.

Undersea telecommunication cables are an invisible but integral part of the central nervous system of our digital society. With digitalization encroaching on ever more parts of our day-to-day lives, we become ever more dependent on telecommunication infrastructure. All the more worrying is the string of 'incidents' involving the undersea cables in recent years, many of which are suspected to be deliberate acts of sabotage. I really appreciated the visualizations in this article, which bring to life the descriptions of the incidents and also really drive home the magnitude of the problem.

Soatok is an opinionated cryptographer, but a very good one. After having looked and complained about many 'private messenger apps', he has a grab at Signal. But he leads us through his non-findings in a very nice way, which also shows how Signal's cryptography is chosen and made secure. A very intense and technical read if you like cryptography.

With physical media, no one can reach into your home and remove what you bought from your shelf.’ Not only can Amazon delete books remotely, the shift towards cloud-based storage for e-books means that copies can be modified by Amazon and publishers at will. With the rapid pace of change in the political environment, it is not a far-fetched thought that repressive regimes or influential figures demand the censorship of books they find not in their political interest. And ultimately, I really do not 'own' my books anymore, I just license them. As an avid Kindle reader, the way digital book ownership has developed deeply unsettles me. I now seriously contemplate returning to buying physical copies of my books.

Bien que la tech du Silicon Valley se plaint toujours de la régulation, je pense que l'état actuel des choses est bien en leur faveur. Laisser ces réseaux dicter la narration, qui est suivie par la plus grande partie de la population, a déjà passablement érodé la confiance dans les organisation étatiques. Vu que les auto-règlements ont clairement échoués, il est grand temps de leur demander des comptes.

Last week, I had numerous conversations about the decision by Coop, a major Swiss supermarket chain, to implement AI-supported video surveillance technology. What struck me was that everyone—from NGOs to official delegates—was in the dark about this until the news broke. I am even more surprised that there has been less public outcry compared to when SBB (Switzerland's national railway) announced the use of AI-supported video surveillance in their train stations. Currently, we have no regulations governing the use of AI surveillance technology in public spaces, but Coop's rapid adoption highlights the urgent need for such regulations.

The article reports that the US may have paused its offensive cyber operations against Russia, suggesting it is likely part of a broader diplomatic strategy to encourage talks over the Ukraine conflict, or to possibly focus more on addressing cyber threats posed by China. Scaling back offensive actions without reciprocal guarantees risks exposing critical infrastructure to ongoing cyber threats, testing the limits of deterrence strategies in a geopolitically tense environment. Now the question remains: how will the interplay of diplomacy and cyber strategy evolve in a world where nations like Russia and China continue to leverage cyber capabilities as tools of geopolitical influence?

The text explores the concept of trust in transformative technologies, highlighting the importance of understanding the nuances of "trust" in different contexts. It elevates discussions to a philosophical level by questioning the true essence of trust—whether it is rooted in transparency, reliability, or alignment with human values. By addressing these contrasts, the article encourages dialogue on building a framework that ensures responsible innovation aligned with societal values.

The European Union’s AI Act has reached a significant milestone by banning AI systems across the EU that pose an 'unacceptable risk,' defined as serious threats to people's rights and safety. The Act will be implemented in phases, with additional regulations for high-risk AI systems expected in the next 2-3 years. With security risks from AI systems surfacing and misinformation spreading in our daily lives, the pressing question remains: when will regulatory timelines align with their intended societal goals?

Following in the footsteps of OpenAI, Anthropic and Meta, Google is the latest Big Tech giant to lift restrictions on their AI technologies, in this case with regards to, amongst others, weapons and surveillance. These companies reassuring us over and over again that they were committed to safe and ethical use of AI was a big reason why no meaningful regulatory safeguards were put in place. Now that they are walking back on their end of the deal, what do we do next?

'Quantum computing applications may become practical within the next 5 years', according to recent claims by Microsoft and Google, both of which released statements within days of each other. The fact that these two rival tech giants made the same prediction at the same time lends credibility to the statement, especially given the ongoing global competition to develop quantum computing technology. It is important to recognize that this claim should serve as a reminder to prioritize the adoption of quantum-resistant cryptography. [Editing this take was completed within 91 seconds by DeepSeek_LLM_7B_chat installed locally on a laptop with an Intel i7 CPU with 32 GB of RAM without a dedicated GPU.]