Our weekly picks of digital trust-related articles

I always appreciate this author's talent for breaking down her research for laypersons like me. This article gives an overview of the current state of evaluating the cognitive capabilities and the shortcomings of these methods. Most importantly, it also provides suggestions for improving them. Definitely a recommendation for enthusiasts, sceptics and everyone in-between!

Another shaky foundation of the internet: OpenSSL is an Open Source cryptographic library. It is used by most programs on the internet for cryptographic operations, including, for example, setting up a secure internet connection and encrypting emails. Like many other Open Source projects, the people behind the project are not paid, so there is a long list of bugs and inefficiencies, which is only growing over time. Alternatives exist, but they are not widely used.

This article highlights the vital role of governments and regulators in ensuring responsible digital innovation and protecting citizens—especially vulnerable groups—from AI-driven exploitation. It also raises the issue of digital sovereignty, showing that regulation is not just technical or legal but shaped by geopolitical pressures. For instance, action against the nudifier tool on Musk’s X platform is complicated by concerns over U.S. reactions, illustrating how global politics influence digital safety.

This article caught my attention for several reasons. Firstly, Russia's surprising absence from the AI race. Secondly, there is the strategic positioning of Middle Eastern players, such as the UAE, who are using their immense investment capabilities to manoeuvre between superpowers. Thirdly, this is not just about AI; it's also about broader digital sovereignty. Unlike the distinct blocs of the Cold War era, today's landscape comprises intertwined, overlapping networks in which countries pursue polycentric strategies.

OpenAI is asking third-party contractors to upload real work assignments from their jobs to create human performance baselines for evaluating its AI models. While this approach holds substantial technical promise, it also comes with major legal, ethical, and governance risks, including the risk that contractors may violate their previous employers’ nondisclosure agreements or expose trade secrets.

This article is interesting because it links digital trust to systemic AI dangers—not just small tech glitches. It predicts how in 2026 AI might spread lies, spy on people, or disrupt jobs and markets faster than today's content‑moderation and governance mechanisms can manage. This leaves us to question who should control key AI technology.

California's Privacy Protection Agency has launched its new  Delete Request and Opt-out Platform (DROP), which allows residents to demand all registered data brokers delete their personal information in a single request. This data— Social Security numbers, income, political preferences, and so on—is used to profile people for decisions about credit, employment, and housing. This incredible achievement builds upon years of advocacy and legislation. What's remarkable isn't just the data privacy right itself; it’s the accessibility of this tool, which puts citizens in control of their data with unprecedented ease. DROP's one-stop approach to exercising data rights serves as an important model for other jurisdictions worldwide—even those with stronger privacy laws on the books.

I find this article interesting because it puts a spotlight on how the technical limits and product decisions of LLMs can shape, and sometimes distort, people’s perception of real-world events. It’s striking to see the same news prompt produce authoritative, up-to-date answers from some models and a blunt, incorrect denial from others, simply because of their cutoff dates or whether they can search the web. Chatbots can sound confident while being wrong, and that confidence can mislead users unless models are transparent about sources and recency. This raises practical questions about platform design, moderation, and the need for public media literacy as AI becomes more embedded in how people get news.

I found this article particularly interesting because it highlights how major European companies like Airbus are now treating cloud sovereignty as a strategic criterion in their procurement processes. By explicitly requiring 'a European provider' in their tenders, they set an important precedent for other enterprises and even governments across Europe. This move reinforces the idea that sovereignty in digital infrastructure is not just a technical detail but a matter of economic and geopolitical resilience. What remains concerning, however, is that—as the article suggests—identifying a truly European provider is still not guaranteed, which shows how much work remains to build a robust sovereign cloud ecosystem

This technical talk points out several vulnerabilities in PGP implementations that are not caused by errors in the underlying cryptographic algorithms. It serves as a great reminder that software engineering is not just 'writing code.' To actually implement the entire stack correctly from algorithm to user interface, it is a craft that requires an understanding of the underlying theory and (a lot of) practical experience.

The DoD's post-quantum mandate sends a clear message: data protection against quantum threats requires urgent action. If the Pentagon, with all its resources, is treating 2030 as an urgent matter, then large organisations and administrations with sensitive data should follow suit immediately. Fortunately, the approach focuses on proven processes rather than exotic technologies: taking an inventory of cryptographic assets, designating responsible leads, and planning migration paths — standard governance applied to an emerging threat.

It seems that LLMs are hitting a wall where new models don't improve capabilities anymore. At the same time, attacks and cautious tales of what is wrong with current models increase and make us weary of using them without enough supervision. In fact, little is known about all the quirks these models have when they are specialized (fine-tuned). This article shows how innocent looking training can have very adverse effects.

While protecting citizens is crucial, this VPN ban proposal exemplifies the consequences of non-technical politicians legislating technology. The goal of child safety is valid, but the proposed measures are technically impossible and would harm businesses, students and vulnerable groups. To avoid such issues, impact assessments and structured dialogue between IT experts and lawmakers should be implemented.

This thought-provoking article challenges the rationale behind the increased integration of large language models (LLMs) into our daily workflows. Is it the result of a thorough risk-benefit analysis, or rather because of us steadily normalising the inherent problems of these systems to the point of becoming complacent to their potentially disastrous consequences?

Although the target audience of this legal analysis from noyb of the European Commission's 'Digital Omnibus' proposal is clearly lawyers, it still gives the layperson a good overview of the proposed changes to the GDPR and their practical implications.

How does trust translate to social media use by children? Does it mean a ban on their access? Australia decided that children under the age of 16 are not allowed on social media. Companies are complying and installing age verification mechanisms to avoid fines. I'm looking forward to seeing how this large-scale experiment turns out.

Leading IT projects is a very difficult task, and the difficulty only increases with the size of the project. Sometimes it feels like most of the failures involve government projects, but this article also presents business cases that went awry. There is a lot of evidence on how to do better; unfortunately this requires competent people at the right places.

AI is often anthropomorphized, with terms like 'hallucinations' having entered technical jargon. All the more striking that when the capabilities of popular models today are discussed, 'intelligence' is reduced to one set of benchmarks or another, but seldom considered in a holistic way. I liked this article for putting the human, and not the machine, back into the center of the discussion of what 'intelligence' in AI actually is (or isn't).

Improvements in agentic AI and increasing competency of hackers are driving more sophisticated cyber attacks, from mere AI-augmented intrusions to ever more autonomous operations. While this is deeply concerning, such efforts can only succeed when infrastructure is vulnerable. Investing in the cybersecurity of our infrastructures has never been more pressing.

Software developers and users share vulnerability information through standardized formats and processes (e.g., CVEs) to alert affected parties. Users can check their Software Bills of Materials to identify and fix vulnerabilities. I wonder whether the same will eventually happen with governance vulnerabilities such as this one. How can affected parties be notified of such trust vulnerabilities? This may be crucial as ecosystems grow more complex with increasing dependencies between services.

Last month’s outage of Amazon's AWS US-East-1 barely became yesterday's news when another outage, this time chez Cloudflare, took down major parts of the internet again. Not only do these incidents show just how brittle the Internet's underlying infrastructure is becoming, they also serve as a stark reminder of how much it relies on only a handful of providers. While this in itself is worrisome, it also gives a taste of our collective exposure should these - mostly American - companies become less friendly. Those calling for increased digital sovereignty would do well to remember that any genuine move towards more digital sovereignty must start by breaking the market hold of these companies and moving the Internet back to its roots as a decentralised network.

Cet article d'AlgorithmWatch/CH est très intéressant non seulement parce qu'il détaille la consommation de ressources des centres de données, mais aussi parce qu'il essaie de présenter le thématique sous tous ses angles. La conclusion est cependant explicite: dans ce secteur aussi, la politique ne s’intéresse qu’aux développements, et par conséquent la population doit se défendre seule face aux grandes entreprises.

Are LLMs helping discover new bugs, or are they merely making the life of Open Source developers more difficult? Currently it looks more like the latter, with many Open Source projects being overwhelmed by bad quality bug reports created automatically by LLMs. This is a problem that won't go away quickly, and adding a fix to the bug will also take away time from the maintainers. If we consider Open Source as a kind of public service, it might make sense to introduce a tax on big companies to help support these projects.

Voici un bon exemple de comment créer de la confiance grâce aux nouveaux outils comme les LLMs. Au CHUV, prof. Marie-Ann Hartley de l'EPFL, dirige un projet pour soutenir les médecins dans la prise en charge des patients aux urgences. J'aime l’approche très élaborée de ce projet qui implique des médecins dans toutes les étapes. Cela permet de tester l'outil pour des cas précis, avec une implication constante des personnes qui vont l'utiliser.