Our weekly picks of digital trust-related articles

En tant que supporteur des logiciels libres et de la souveraineté qui les accompagne, voici un sujet qui m’inquiète : Google veut fermer sa plate-forme Android à toute application qui n'est pas signée par un développeur agréé par Google. Le sujet fait débat surtout en Europe, où Apple a dû ouvrir ses iPhones aux applications étrangères. Maintenant c'est au tour de Google d'essayer de fermer son écosystème, ce qui enlèvera le peu de liberté qu'on avait avec Android.

Even 3 years into the current AI hype, it is still difficult to differentiate between its true capabilities and salestalk. Hopefully military leaders have a more clear-eyed view of the technology, as it is clearly not ready to be deployed in high-stakes decision-making processes.

I always liked Anthropic's stance of doing the right thing and setting standards with regards to security and ethics in LLMs. Unfortunately, they budged and will now only define 'goals that we will openly grade our progress towards'. These goals will be non-binding, and future LLMs from Anthropic will blaze ahead even if they get bad grades. At least they stuck by their rules of 'no AI controlled weapons' and 'no mass domestic surveillance', although this has gotten them declared a 'supply chain risk' by the Department of War.

I found this article interesting because it highlights the tension between protecting children online — not just on social media, but also on shopping, gambling and adult sites — and preserving privacy. The challenge of enforcing age laws without collecting sensitive data remains, regardless of whether the burden is placed on users or platforms. eID could be a solution, but only if it is truly privacy-preserving and only minimal data is shared and no logs are retained. How it is implemented by the authorities is crucial here.

This article is quite unnerving: a twenty‑minute hack shows how data‑poisoning can make LLMs tell tall tales, turning sci‑fi fears into real business risk. It’s a wake‑up call to demand provenance, adversarial robustness assessment and scepticism—because trusting chatbots without checking is like relying on a smooth-talking oracle with a hidden agenda. Critical thinking remains your best plugin.

The Swiss eID audit highlights a trade‑off: release on schedule with fewer security features, or delay to strengthen protection. Christopher Allen, from his work on the TLS protocol, offers three lessons for eID: bugs expected to be fixed in 3–5 years can take 20; the mindset for designing a 20‑year architecture differs from the startup mindset of building a 2‑year product; and once shipped, “good enough” often becomes permanent.

This case is striking in that, while we usually focus on the risks of data theft and profiling from Big Tech, the core threat here is addiction and its devastating long-term impact on the mental health of young people, such as depression, anxiety and body dysmorphia. Internal documents prove that Meta was aware of the harm. Guardrails exist, and countries such as China enforce them; yet Zuckerberg overruled 18 experts. The only logical explanation beyond the rhetoric of 'free expression' is the desire to expand the captive audience and prioritize profit over children's well-being. Just as we had the tobacco industry in the 1980s, now it's big tech's turn.

Since ChatGPT crashed onto the scene in late 2022, attacks involving LLMs have kept pace with the breakneck speed at which they are being integrated into every aspect of our digital lives. This paper is the first that I'm aware of that takes a step back and not only catalogues the attacks by type, but also creates a taxonomy to guide security research into this new world of attacks on and by LLMs. Definitely a must-read for anyone working in security!

Eine Studie über Open-Source Passwort-Managern, die die Passwörter in der Cloud speichern. Da die Programme öffentlich einsehbar sind, hat ein Student von der ETHZ nach Schwachstellen gesucht, und einige gefunden. Alle Fehler waren nur durch einen bösartigen Betreiber ausnutzbar, hatten aber zur Folge, dass Passwörter veränderbar oder sogar einsehbar waren. Die drei Passwort-Manager haben die 90 Tage 'responsible disclosure' genutzt, um die Schwachstellen zu beheben.

Let us celebrate a milestone in digital safety. The European Commission has found TikTok in breach of the EU Digital Services Act for its algorithms designed to hook users. This follows another recent win, with Australia’s social media ban on minors under the age of 16. While the wheels of governance move achingly slow in comparison to the pace of technological change, and we can expect strong pushback from the company, we can at least take comfort in the knowledge that research, dialogue, awareness-raising and advocacy do move the needle.

Bien qu’on nous assène que nos communications sont chiffrées de bout-en-bout, et que même WhatsApp/Meta ne peut pas les lire... il s’avère que ceci est faux et qu’elles sont bel et bien accessibles. Ceci n'impacte pas que la crédibilité de Meta, mais aussi celle de n'importe quel système numérique, quel qu’en soit l’opérateur (petit rappel du référendum sur le eID). D'autre part, malgré la 'suprématie' des lois de protection des données de l’Union Européenne – Suisse incluse- par rapport à celles des Etats-Unis, ce sont ces derniers qui agissent en premier. Je suis curieux de voir comment le RGPD sera appliqué dans ce cas précis.

Europe’s economy now largely runs on digital payments, making reliance on U.S. card rails a systemic exposure. Sanctions, policy shifts, outages, and data-access demands can all cause economic shocks. This is precisely why Wero is both interesting and timely: it is a bank-led, pan-European layer that can reduce strategic dependency. I’m eager to see transparent comparisons of merchant and user fees, dispute models, and information on what data is collected, retained, shared, and protected.

OpenClaw is just the latest in a series of AI-powered tools that turn out to be an absolute security nightmare. It is easy (and up to a certain point justified) to blame individual developers for lowering their guard and abandoning good security practices. On the other hand, there is an enormous pressure on developers nowadays to adopt these tools and integrate them in their daily workflows. What these incidents show is the importance of an environment that fosters security not only through educating users, but also through giving them the space to take a step back and ask the right questions.

Est-ce la faute aux utilisateurs qui n'ont pas bien respecté les règles ou au choix controversé, par les autorités, de l'infrastructure où la moindre erreur peut s’avérer grave et vraisemblablement répétitive? Tant que la réponse n'est pas claire, il n'y a pas de responsabilisation, et le problème risque de persister.

This article is interesting because it shifts the Moltbook debate away from sci‑fi “bot consciousness” and toward concrete security architecture risks. What could possibly go wrong when thousands of OpenClaw‑like agents —with full root access to their owners’ machines— are frolicking in a shared, untrusted environment, swapping prompts, payloads, and jailbreak tricks? His advice is gold: use OpenClaw locally if you must, but never, ever connect it to Moltbook. Spot on—hype doesn’t patch vulnerabilities.

Apparently, it happens even to the best of us — even seasoned professionals with over 24 years of IT experience and a 'deep understanding of both the complexities and practical realities of infrastructure security!' Jokes aside, this incident is fascinating: it exposes elite-level lapses in AI tool governance despite regulatory warnings, underscoring the enduring risks to data sovereignty when sensitive information is fed into public AI chatbots.

The volatile start to 2026 has shaken the foundation of global digital trust. Digital sovereignty has always been a running theme in the background of European conversations around tech, but this year, it is likely to be front and center, as governments and businesses scramble to seek digital solutions that provide reliable data security and privacy protection for its citizens, clients, and users, regardless of the geopolitical drama of the week. Virkunnen’s specific calling out of chips is somewhat surprising, given how far away Europe is from chip autonomy, but developing more control over selected parts of the semiconductor value chain could be a feasible strategic move.

This article highlights a crucial reality: basic connectivity must exist before any digital transformation can take place. With only 38% of the population online, Africa's digital divide represents both a massive challenge and an opportunity. It is fascinating to observe the competition between space-based solutions (Starlink, Amazon Leo) and submarine cables (Meta's 2Africa, Google's Equiano). Notably absent: China. Given Beijing's substantial infrastructure investments across Africa, their absence from this connectivity race is worthy of monitoring for its potential geopolitical implications.

Researchers at KU Leuven disclosed flaws in Google’s Fast Pair Bluetooth protocol that let attackers within Bluetooth range silently pair with seventeen different models of headphones or speakers made by ten different vendors, including Sony, Xiaomi, and even Google itself. This set of vulnerabilities enables cheap, practical hijacking, eavesdropping, and tracking of millions of earbuds and speakers—even of non-Android users, and exposes weak ownership/authentication, failed certification checks, and slow, uneven patching for IoT devices.

The inclusion of copyrighted materials in LLMs' training data has been a hot-button issue from the get-go. In the beginning, Big Tech's reassurances that their models' inner workings prevented such material to be stored, let alone accessible, were convincing enough. But new research is painting a different picture, landing the companies in hot legal waters. This article traces the history of related court cases in the U.S. and puts them into context of the latest research on the matter.

Parler de souveraineté numérique en Europe devient de plus en plus courant. Même si ça va prendre beaucoup d'années d'avoir un contre-poids aux grandes entreprises américaines, les solutions émergent et s'organisent. Une fois qu'il y aura de l'argent qui alimente ces solutions alternatives, open source ou pas, l'utilité de ces solutions va augmenter drastiquement.

Beyond the author's predictions for the AI bubble's aftermath, what struck me most was his explanation of 'accountability sinks'—people who take the blame for AI's mistakes. Understanding this concept, which emerges from examining AI companies' business model, leads to a crucial insight: it's not just white-collar workers whose jobs will be eliminated, but specifically those of senior, experienced workers, the very people most qualified to catch AI's mistakes but who cost the most. This is an important distinction I haven't seen emphasized before.

Encrypted messaging app Threema, which is used by the Swiss army and cantonal polices, got acquired by a German private company. Two questions come to mind. First, what kind of implications could a private acquisition such as this have on a country's sovereignty and critical operations, and how does it deal with them? Second, and more specific to Switzerland, how to avoid another Crypto AG scandal and another hard blow to the Swiss tech reputation?

Here's a rather amusing article that exposes the troubling flaws of this year's Consumer Electronics Show (CES) innovations. Particularly noteworthy is Merach's smart treadmill, which collects biometric data. The company boldly admits in its privacy policy that it 'cannot guarantee the security of your personal information.' Don't complain you weren't warned!