Our weekly picks of digital trust-related articles

How does trust translate to social media use by children? Does it mean a ban on their access? Australia decided that children under the age of 16 are not allowed on social media. Companies are complying and installing age verification mechanisms to avoid fines. I'm looking forward to seeing how this large-scale experiment turns out.

Leading IT projects is a very difficult task, and the difficulty only increases with the size of the project. Sometimes it feels like most of the failures involve government projects, but this article also presents business cases that went awry. There is a lot of evidence on how to do better; unfortunately this requires competent people at the right places.

AI is often anthropomorphized, with terms like 'hallucinations' having entered technical jargon. All the more striking that when the capabilities of popular models today are discussed, 'intelligence' is reduced to one set of benchmarks or another, but seldom considered in a holistic way. I liked this article for putting the human, and not the machine, back into the center of the discussion of what 'intelligence' in AI actually is (or isn't).

Improvements in agentic AI and increasing competency of hackers are driving more sophisticated cyber attacks, from mere AI-augmented intrusions to ever more autonomous operations. While this is deeply concerning, such efforts can only succeed when infrastructure is vulnerable. Investing in the cybersecurity of our infrastructures has never been more pressing.

Software developers and users share vulnerability information through standardized formats and processes (e.g., CVEs) to alert affected parties. Users can check their Software Bills of Materials to identify and fix vulnerabilities. I wonder whether the same will eventually happen with governance vulnerabilities such as this one. How can affected parties be notified of such trust vulnerabilities? This may be crucial as ecosystems grow more complex with increasing dependencies between services.

Last month’s outage of Amazon's AWS US-East-1 barely became yesterday's news when another outage, this time chez Cloudflare, took down major parts of the internet again. Not only do these incidents show just how brittle the Internet's underlying infrastructure is becoming, they also serve as a stark reminder of how much it relies on only a handful of providers. While this in itself is worrisome, it also gives a taste of our collective exposure should these - mostly American - companies become less friendly. Those calling for increased digital sovereignty would do well to remember that any genuine move towards more digital sovereignty must start by breaking the market hold of these companies and moving the Internet back to its roots as a decentralised network.

Cet article d'AlgorithmWatch/CH est très intéressant non seulement parce qu'il détaille la consommation de ressources des centres de données, mais aussi parce qu'il essaie de présenter le thématique sous tous ses angles. La conclusion est cependant explicite: dans ce secteur aussi, la politique ne s’intéresse qu’aux développements, et par conséquent la population doit se défendre seule face aux grandes entreprises.

Are LLMs helping discover new bugs, or are they merely making the life of Open Source developers more difficult? Currently it looks more like the latter, with many Open Source projects being overwhelmed by bad quality bug reports created automatically by LLMs. This is a problem that won't go away quickly, and adding a fix to the bug will also take away time from the maintainers. If we consider Open Source as a kind of public service, it might make sense to introduce a tax on big companies to help support these projects.

Voici un bon exemple de comment créer de la confiance grâce aux nouveaux outils comme les LLMs. Au CHUV, prof. Marie-Ann Hartley de l'EPFL, dirige un projet pour soutenir les médecins dans la prise en charge des patients aux urgences. J'aime l’approche très élaborée de ce projet qui implique des médecins dans toutes les étapes. Cela permet de tester l'outil pour des cas précis, avec une implication constante des personnes qui vont l'utiliser.

The number of AI-generated images of child sex abuses is rapidly increasing. But thanks to a new UK law, tech companies and child safety agencies are joining forces and being given legal testing permission, allowing experts or audit models to proactively screen for CSAM risk rather than wait for illegal content to appear. The law aims to help developers build and verify safety controls and to enable regulators and child-protection groups to evaluate models under strict conditions. Still, many questions remain, including who gets designated testing access, what conditions and oversight will apply, how illegal material will be securely handled or destroyed or used for testing or audit transparency, and what assurances will be made that testing doesn’t enable misuse.

The 'hacker paragraph' in Germany is a law saying that you are not allowed to break into foreign IT systems, not even for research, nor as a white hat hacker who discloses their findings responsibly. The development or distribution of such software is also prohibited. For researchers and white hat hackers alike, this is of course not acceptable, as it makes their work illegal. Luckily, traction is gaining in the German parliament to change this paragraph. Here in Switzerland, however, it is still possible to be sued for discovering a weakness in the system.

A love letter to the craft, this article is a reminder that it is by combining human expertise and GenAI that we can truly harness the potential of these tools.

Although written from the point of view of the U.S. healthcare system, quite a few of the issues raised in this essay are universal. I appreciated this in-depth discussion of the impact of AI on the healthcare system because it not only points out the detrimental consequences these technologies have, but also puts these consequences into a broader context, and concludes with a more optimistic alternative view on how AI can be used to support a truly human-centered health care system.

This case highlights the conflict between platform profitability and user safety, as TikTok's algorithm prioritises engagement over the welfare of its teenage users. Notably, the Chinese version of the app shows that technical solutions exist — stricter moderation is feasible when providers choose to implement it. This divergence reveals that while China enforces protective measures, platforms operating in our regions resist, citing difficulty of implementation as an excuse. Without strict oversight, it is clear that commercial interests supersede user protection.

Bubble or no bubble? In this interview, the president of Signal shares her analysis: dominant AI is not just a neutral technological advance, but the result of an economic model of platforms that concentrate data and computing power among a few giants, creating monopolies, geopolitical and security risks—and requiring strict regulation (e.g., enforcement of the GDPR) to break up this concentration. In any case, the issue will continue to stir debate and hopefully raise attention.

I really appreciate Jimmy Wales's insistence that sticking to Wikipedia's core principals of neutrality, factuality and fostering a diverse community around the globe will eventually prevail in today's polarized digital landscape. As a nerd myself I also relate very strongly to his enthusiasm of working on Wikipedia for the sake of doing something interesting over something potentially more lucrative.

I found Simon Willison’s blog post interesting because he self-critically builds on his lethal trifecta concept. He clearly explains why prompt injection remains an unsolved risk for AI agents and highlights the practical “Rule of Two” for safer design (proposed by Meta AI). He also discusses new research showing that technical defenses consistently fail. His perspective is essential for anyone building or using AI agents today.

Switzerland's military faces a critical dilemma: 90% of its data seems to be too sensitive for Microsoft's US cloud, highlighting the tension between the efficiency of a cloud solution and digital sovereignty. This raises questions about whether open-source alternatives can match proprietary solutions, how to balance interoperability with protection from foreign legal jurisdiction (e.g. the CLOUD Act), and whether migration is technically and financially feasible. From a geopolitical perspective, this dilemma highlights Europe's strategic reliance on US technology and raises questions about whether smaller nations can truly achieve digital autonomy in the context of great power competition.

I do not agree with the article's conclusion that the "days of the know-nothing consumer are well and truly over". The article does discuss potential shortfalls, such as both sides of a negotiation relying on specialised chatbots to conduct it, but fails to point out the root issue, namely the reliability of the information. As long as we do not have full insight into the training data, we cannot be sure whether the chatbots are truly negotiating in our favour, or whether they only make us believe so. One could for example imagine chatbots being trained to favour certain brands over others, or to promote services associated with their provider.

If real-life applications of quantum computing emerge, it could revolutionize chemistry, physics, computer sciences and more. Despite the apparent progress achieved by Google here, I am cautious about placing full trust in the advances claimed by commercial companies, as their competitive approach may prioritize hype or market value. Given the extent to which scientific research is funded by large corporations, I would really like to see more reviews from academic experts, who can hopefully provide unbiased assessments.

Here is another post-quantum implementation of a popular protocol: Signal announced the addition of a quantum-safe algorithm to increase the protection of the messages sent between two Signal users. Like other quantum-safe algorithms, it doesn't replace the currently used cryptographic base, but rather enhances it. Interestingly, the biggest hurdle was the size of the new keys: instead of 32 bytes, these new keys take up to 1000 bytes. This means you cannot send them along with every message, as with the old keys.

Die Kampagne der Bahnhofsmission in Essen um die Privatsphäre von Obdachlosen zu schützen, ist eine wichtige Erinnerung daran, dass auch im sogenannten 'öffentlichen' Raum Personen durchaus ein Recht auf Privatsphäre haben. Aber um dieses Problem tatsächlich zu lösen, müssten die Plattformen auf denen Content, der von Voyeurismus lebt, publiziert wird, diesem Geschäftsmodell den Hahn abdrehen.

Damit die Regierung das Vertrauen der Bevölkerung behalten kann, ist es wichtig, so transparent als möglich zu sein. Deshalb begrüsse ich es sehr, dass vier von fünf Verträgen von 2023 mit den offiziell anerkannten Cloud-Providern offengelegt wurde. Für mich ist es interessant zu sehen, dass in den Verträgen das Offenlegungsprinzip klar erwähnt wird. Weshalb haben die Cloud Provider sich denn so gewehrt?

The author provides a timely perspective on how "sovereign AI"—the ability of countries to control and customize foundational AI—has become central to global strategy. I particularly appreciated the argument that genuine sovereignty can only be achieved through truly open, transparent, and adaptable models. Switzerland’s Apertus exemplifies this approach, and it remains to be seen how we can build upon it to strengthen the country’s digital sovereignty.