Our weekly picks of digital trust-related articles

In their article, the authors draw attention to the notion of data integrity and how integrity controls will take center stage in a world increasingly populated by AI agents, requiring verifiable, trustworthy personal data and computation. I found their layered perspective on understanding integrity failures particularly helpful, as it provides a comprehensive framework for identifying vulnerabilities and implementing defensive strategies across different levels of AI systems.

Dès le 1er avril, la Suisse instaure l'obligation d'annonce pour les cyberattaques, au moins pour certains types d'entreprises. L'obligation d'annonce est bien définie et doit être faite dans les 24h à l'OFCS via un formulaire à disposition sur leur site. Si l'annonce est faite tardivement, on rencontre le même problème que pour le nLPD: c'est 'la personne physique en charge de l'obligation de signalement' qui peut être sanctionnée, au lieu de mettre l'entreprise en cause.

I found this short paper by John Kelsey and Bruce Schneier an insightful take on common fallacies in security - and how, despite not actually increasing security per se, they can still have beneficial side-effects, such making users feel more secure. Nonetheless, the people responsible for the security of their systems should have a clear-eyed view of the actual state of security. Consequently, this text can serve as a basis for re-evaluating your approach to security measures.

This acquisition, for the astronomical sum of $32 billion, clearly demonstrates the importance of cloud AND cybersecurity services. With access to a large customer base and a world-class multi-cloud security platform, Google aims to better compete with AWS and Azure in an area where it is still struggling to catch up with its rivals.

Phishing campaigns aren't limited to scammers being out for your money. This article depicts what is likely a state-affiliated phishing campaign, or at the very least one that is sympathetic towards the state’s interest, that targets Russian citizens looking to join Ukrainian paramilitary groups. It is noteworthy that the phishing sites appear to be spread not via e-mail, but through search results. This is a rather grave reminder that search engine optimization, or SEO, is commonly abused to push phony websites to the top of search results, and that users should always double-check that the URL leads to the legitimate page before clicking on it.

If you're into vibe-coding (programming entirely through interactions with an LLM) or are looking to use LLMs for your coding, here is a list of the latest projects, including both paid and free tools. However, when using these tools, it's essential to consider the potential security and privacy risks. LLMs may generate code with vulnerabilities or store sensitive data used during the interaction. As an example, an LLM-assisted tool might inadvertently create a login system with weak password requirements, introducing security risks.

Während es sehr begrüßenswert ist, dass der Bund sich augenscheinlich dafür entschieden hat, eine lokale in-house Lösung für die KI-Anwendung “Gov-GPT“ zu nutzen, ist es problematisch, dass das sogenannte “Open Source Large Language Model“ Llama von Meta ist. Von dem oft angebrachten Kritikpunkt, dass diese Modelle nur dem Namen nach “Open Source“ sind, da die zugrunde liegenden Trainingsdaten eben nicht veröffentlicht werden, mal abgesehen, ist es fraglich in der aktuellen politischen Lage noch auf eine amerikanische Lösung zurückzugreifen, während es durchaus europäische Lösungen gibt - und eigene schweizerische entwickelt werden.

We all heard that big AI companies need petabytes of data for training their new models. And we all heard that they don't really care where they get their data from. Besides potential copyright infringement, this crawling takes another toll on some Open Source projects: Continuously requesting data over and over is similar to a denial of service attack. So some of the Open Source projects fight back and create 'tarpits' and 'labyrinths' for these crawlers!

This article is interesting because it explains the reasons for Google's change of position on Android OS development. The company is moving away from public contributions to the Android Open Source Project (AOSP) to streamline development and reduce merge conflicts. While Google commits to releasing source code post-release, reduced transparency remains a concern, as it complicates developers’ ability to track changes and contribute.

If the revelation that Trump administration officials accidentally added journalist Jeffrey Goldberg to a Signal group chat about sensitive military plans for airstrikes in Yemen wasn’t alarming enough, new reports now show that multiple Venmo accounts linked to former Trump officials were left publicly accessible, exposing sensitive connections and financial transactions. While the data leaked may seem minor, it gives adversaries a way to track relationships and exploit officials for intelligence, posing a national security risk. This stems from Venmo’s "contact syncing" feature, still active for older accounts, reminding us all to review and disable contact syncing in payment apps' privacy settings.

23andMe has filed for bankruptcy, raising concerns about data privacy. This article offers tips to the 15 million users of this direct-to-consumer service on how to delete their accounts. The research community proposed robust solutions to protect genetic data, yet it is unclear whether the company implemented any, given the massive hack it suffered last year, which cost it much of its credibility. A useful cautionary tale.

AI plays a vital role in the digitalization of the public sector. The strategy for integrating AI systems within the Swiss Federal Administration highlights the need for a multipronged approach. While I agree that developing skills and building trust are essential initial steps and likely top priorities, the true challenge lies in addressing the lack of high-quality data and the development of necessary infrastructure to operate AI applications on-premises—an indispensable requirement considering the growing discourse on digital dependencies and data privacy concerns. Addressing this aspect will demand significantly more upfront investment than what the current strategy suggests.

This news illustrates how quantum technologies require forward planning in cybersecurity on unprecedented timescales (2035!), to protect against threats that exist in theory before they materialize in practice. What makes this particularly interesting is the proactive approach: the NCSC is implementing a ten-year strategic roadmap to prevent future breaches. The three-phase timeline recognizes both the inevitability of advances in quantum computing and the complexity of cryptographic transitions.

Supply chain attacks will continue to hit the news in an increasingly interconnected development ecosystem as organizations rely on third-party components and actions. This seems inevitable. What I find interesting about this case is the threat actors' approach to compromise software while it is still under development, which sets itself apart from attacks such as SolarWinds (2020) and Log4J (2021) in that it specifically targets the CI/CD pipeline infrastructure itself rather than the final software products.

Ein schöner Überblicksartikel über wichtige Projekte der Digitalpolitik der EU in den letzten Jahren und ob und wie sie sich auf die Schweiz auswirken. Besonders interessant fand ich, dass gerade beim Konsumentenschutz die Schweiz eben nicht automatisch mitprofitiert wenn die EU eine härtere Gangart gegen Big Tech einschlägt.

Restarting USAID and putting all payments on a blockchain? Why not? Well, for one, as one expert in the sector is quoted as saying: 'I don’t think we were ever able to find an instance where people were using blockchain where they couldn’t use existing tools'. The Trump administration says that the move to blockchain will help to increase transparency, but that depends a lot on the type of data you put on the blockchain. Then there's the issue of finding a good trade-off between transparency and privacy.

This investigation highlights a crucial cybersecurity reality: while we often focus on sophisticated zero-day exploits, the greater threat comes from known vulnerabilities and misplaced trust. One million Android devices weren't compromised through cutting-edge techniques but through traditional means - preinstalled backdoors and users installing unvetted apps outside official stores. The victims were vulnerable because they trusted suspiciously cheap devices or downloaded apps from unofficial sources. As noted, 'if the device is too cheap to be true,' there's likely a hidden cost. This demonstrates that basic security hygiene and cautious trust remain our most effective defenses.

Whether it is part of the global AI-wars or simply an effort to adapt the education system to the rise of Generative AI, AI is making its way into schools. I see immense potential in personalized learning experiences and the profound disruption AI can bring to education systems. This article explores how nations have started the AI race in education. However, it lacks the crucial concept of 'Digital Trust by Design,' which should be at the core of any AI-driven transformation. It is essential to address key concerns such as AI bias, privacy, data security, accountability, and ethics. 'Digital Trust by Design' is fundamental for a healthy transformation. Without it, children could be exposed to significant dangers.

Surveillance of children's activities is being practiced by schools not only for security reasons but also with the intention of ensuring children's well-being. On top of that, this article suggests that AI has unencrypted access to students' activities and discussions. I like this article because it raises important concerns, poses open-ended questions, and sheds light on digital trust issues related to the digital transformation of schools. In particular, I wonder what message schools are sending to students when they promote a culture of surveillance and what harm this may cause to democracy.

Interesting to see y-combinator, an incubator for early-stage startups, supporting an EU directive. They say that the European Digital Markets Act actually allows smaller companies to grow, by limiting what the behemoths of the market are allowed to do. Who would've thought that at least one of the regulations gets supported by the US Startup scene?

A brief reminder that in an era of a destabilising security context in Europe and the resulting growing threat of cyber attacks on day-to-day infrastructure, having a stash of cash sufficient for basic groceries at home is a simple precaution everyone should take.

We often hear or talk about 'IT for good' and 'responsible behaviour' in the digital world, assuming a single universal common understanding of what's good and what's responsible. Things start to get confusing when we think about for whom a service or action is good or responsible: for all humanity, including the 'bad guys'? for one's own nation? for a given majority? This article shows that the universal principles of 'good' and 'responsible' are relative. It challenges all the efforts made so far in the name of ethics and 'common good' and questions what they actually mean on the ground. For instance, will we have conformity checks, like for cars, when we import and use an AI from another country? Will we have to choose between fast, strong, unsafe and polluting AI vs. slower and more 'responsible' ones?

My colleague Melanie’s pick last week about Swiss supermarket chain Coop using AI-supported video surveillance in its stores for security purposes reminded me of the recent revelation that American supermarket chain Kroger may be engaging in surveillance pricing, i.e., using algorithms and data collected on customers (including through facial recognition technology) to determine the highest price they are willing to pay for a good or service. This growing practice allows retailers from Amazon to Uber to extract the maximum profit out of a transaction at the expense of consumer privacy and general fairness. What's more, customer data can then be sold to third parties for further ad targeting and other purposes. This article provides a good overview of what surveillance pricing is and where policymakers and regulators should train their efforts to better understand and mitigate this practice.

I find China's attempt to treat data as a formal business asset quite interesting, especially given the massive amount of data the country generates. Companies seem reluctant to adopt this policy though, with only 283 out of 60 million companies participating. But it is still early days, and the months and years to come will bring clarity to key questions, such as how to accurately value and standardize data for accounting purposes, and how to create a functioning data marketplace while maintaining security.