Our weekly picks of digital trust-related articles

I like the idea behind this tool because it tackles a serious online societal problem. I'm curious if and how it will pass the test of time. The key challenge will be to link subjective criteria to objective metrics - a problem we've seen with privacy, which still lacks objective benchmarks despite substantial research. But unlike privacy, where platforms have hidden behind consent mechanisms to avoid accountability, hate speech tracking involves no such button for users - and no excuse for platforms.

This article caught my attention because it exposes the threat of de-anonymization that AI agents pose and its consequences for online privacy. The author writes that 'the implications stretch far beyond embarrassing social media reveals' and points out that whistleblowers who reveal corporate misconduct and government corruption, journalists who shield their informants, and political dissidents in repressive states all risk retaliation. It remains to be seen how platform companies, having built their communities partly on anonymity pledges, will address this challenge.

This analysis of India's technological dependence reveals patterns that are also applicable to Europe. Attracting foreign tech companies to invest locally ultimately results in profits being exported abroad, exemplifying a kind of digital colonialism. In my opinion, the solution lies in a demand-side strategy that favors local and open-source products over monopolies such as Microsoft Office and Windows. Although this approach would incur higher costs initially, it would stimulate local solutions and generate revenue through taxes, job creation and increased consumer spending. Implementation should begin now as a long-term initiative.

This article points out that the 'real digital sovereigns' are the tech companies, who control all 'vectors' of sovereignty, from infrastructure, to data, AI models, and services. Beyond the US and China (and North Korea), the only realistic strategy for countries to gain control over their digital sovereignty will be to work together, whether through joining or creating regional blocs or participating in international standards bodies, to coordinate on regulations, trade agreements, procurement rules, and other policy mechanisms. In other words, digital sovereignty for most countries is not a national project. It’s a regional project.

Sogar für eine Firma, die die Privatsphäre als Aushängeschild verwendet, ist es nicht immer einfach, ihre Benutzer zu beschützen: Obwohl die E-Mails selbst verschlüsselt sind, gibt es viele Metadaten. In diesem Fall war es die Zahlung mit einer VISA-Karte, die den Benutzer einer E-Mail-Adresse verriet. Ich finde es interessant, dass Proton laut einem eigenen Bericht von 2024 insgesamt in über 10.000 Fällen Nutzerdaten an die Behörden herausgab.

Je trouve cet article intéressant, car il apporte, par un professeur de droit reconnu, une clarification juridique précise sur le cloud en Suisse, distinguant clairement ce qui relève du droit de ce qui relève de la stratégie. Le Prof. Métille démontre qu'aucun obstacle juridique n'empêche l'utilisation de clouds américains certifiés DPF. Cette distinction est cruciale pour les décideurs informatiques : la conformité légale ne dispense pas d'évaluer la souveraineté numérique et les dépendances technologiques, qui restent des choix politiques et non des contraintes juridiques strictes.

As someone who is a passionate reader since first opening a book, I thoroughly enjoyed this article by an aspiring English teacher reflecting on how to pass on this passion to the next generation in the age of AI. I particularly liked its message on how technology in the classroom is not an end in itself but supposed to support teaching, and that why we are teaching something to young people might hold the key to how to use it to this end.

This article illustrates the brutal economics of modern conflict and the fragility of digital infrastructures. Relatively inexpensive drones can render billion-dollar data centers ineffective, calling into question their placement in supposedly "stable" regions. For me, a question remains: What explains the apparent lack of cyberattacks by Iran? Have the U.S. and Israel blocked such attempts directly in the digital realm, or have strikes on Iran's physical infrastructure prevented its ability to perpetrate them?

Unsurprisingly, the cyberspace reflects the geopolitical conflicts of the real world. We see western democracies criticising authoritarian regimes for cutting off their populations from the Internet for fear of external interference and fuelling demonstrations. Similarly, within the western democracies, the current US administration criticises the EU for its regulations and censorship of hate speeches, fake news etc. calling it censorship of free speech, and offering portals to bypass the censorship. Closing the loop, the same "free speech" is called "external interferences" when operated by authoritarian regimes during US elections. The disconnect between John Perry Barlow's 1996 Davos vision of government-free cyberspace and current reality is unambiguous. The trajectory and timeframe for resolving these geopolitical tensions in cyberspace, however, remain ambiguous.

En tant que supporteur des logiciels libres et de la souveraineté qui les accompagne, voici un sujet qui m’inquiète : Google veut fermer sa plate-forme Android à toute application qui n'est pas signée par un développeur agréé par Google. Le sujet fait débat surtout en Europe, où Apple a dû ouvrir ses iPhones aux applications étrangères. Maintenant c'est au tour de Google d'essayer de fermer son écosystème, ce qui enlèvera le peu de liberté qu'on avait avec Android.

Even 3 years into the current AI hype, it is still difficult to differentiate between its true capabilities and salestalk. Hopefully military leaders have a more clear-eyed view of the technology, as it is clearly not ready to be deployed in high-stakes decision-making processes.

I always liked Anthropic's stance of doing the right thing and setting standards with regards to security and ethics in LLMs. Unfortunately, they budged and will now only define 'goals that we will openly grade our progress towards'. These goals will be non-binding, and future LLMs from Anthropic will blaze ahead even if they get bad grades. At least they stuck by their rules of 'no AI controlled weapons' and 'no mass domestic surveillance', although this has gotten them declared a 'supply chain risk' by the Department of War.

I found this article interesting because it highlights the tension between protecting children online — not just on social media, but also on shopping, gambling and adult sites — and preserving privacy. The challenge of enforcing age laws without collecting sensitive data remains, regardless of whether the burden is placed on users or platforms. eID could be a solution, but only if it is truly privacy-preserving and only minimal data is shared and no logs are retained. How it is implemented by the authorities is crucial here.

This article is quite unnerving: a twenty‑minute hack shows how data‑poisoning can make LLMs tell tall tales, turning sci‑fi fears into real business risk. It’s a wake‑up call to demand provenance, adversarial robustness assessment and scepticism—because trusting chatbots without checking is like relying on a smooth-talking oracle with a hidden agenda. Critical thinking remains your best plugin.

The Swiss eID audit highlights a trade‑off: release on schedule with fewer security features, or delay to strengthen protection. Christopher Allen, from his work on the TLS protocol, offers three lessons for eID: bugs expected to be fixed in 3–5 years can take 20; the mindset for designing a 20‑year architecture differs from the startup mindset of building a 2‑year product; and once shipped, “good enough” often becomes permanent.

This case is striking in that, while we usually focus on the risks of data theft and profiling from Big Tech, the core threat here is addiction and its devastating long-term impact on the mental health of young people, such as depression, anxiety and body dysmorphia. Internal documents prove that Meta was aware of the harm. Guardrails exist, and countries such as China enforce them; yet Zuckerberg overruled 18 experts. The only logical explanation beyond the rhetoric of 'free expression' is the desire to expand the captive audience and prioritize profit over children's well-being. Just as we had the tobacco industry in the 1980s, now it's big tech's turn.

Since ChatGPT crashed onto the scene in late 2022, attacks involving LLMs have kept pace with the breakneck speed at which they are being integrated into every aspect of our digital lives. This paper is the first that I'm aware of that takes a step back and not only catalogues the attacks by type, but also creates a taxonomy to guide security research into this new world of attacks on and by LLMs. Definitely a must-read for anyone working in security!

Eine Studie über Open-Source Passwort-Managern, die die Passwörter in der Cloud speichern. Da die Programme öffentlich einsehbar sind, hat ein Student von der ETHZ nach Schwachstellen gesucht, und einige gefunden. Alle Fehler waren nur durch einen bösartigen Betreiber ausnutzbar, hatten aber zur Folge, dass Passwörter veränderbar oder sogar einsehbar waren. Die drei Passwort-Manager haben die 90 Tage 'responsible disclosure' genutzt, um die Schwachstellen zu beheben.

Let us celebrate a milestone in digital safety. The European Commission has found TikTok in breach of the EU Digital Services Act for its algorithms designed to hook users. This follows another recent win, with Australia’s social media ban on minors under the age of 16. While the wheels of governance move achingly slow in comparison to the pace of technological change, and we can expect strong pushback from the company, we can at least take comfort in the knowledge that research, dialogue, awareness-raising and advocacy do move the needle.

Bien qu’on nous assène que nos communications sont chiffrées de bout-en-bout, et que même WhatsApp/Meta ne peut pas les lire... il s’avère que ceci est faux et qu’elles sont bel et bien accessibles. Ceci n'impacte pas que la crédibilité de Meta, mais aussi celle de n'importe quel système numérique, quel qu’en soit l’opérateur (petit rappel du référendum sur le eID). D'autre part, malgré la 'suprématie' des lois de protection des données de l’Union Européenne – Suisse incluse- par rapport à celles des Etats-Unis, ce sont ces derniers qui agissent en premier. Je suis curieux de voir comment le RGPD sera appliqué dans ce cas précis.

Europe’s economy now largely runs on digital payments, making reliance on U.S. card rails a systemic exposure. Sanctions, policy shifts, outages, and data-access demands can all cause economic shocks. This is precisely why Wero is both interesting and timely: it is a bank-led, pan-European layer that can reduce strategic dependency. I’m eager to see transparent comparisons of merchant and user fees, dispute models, and information on what data is collected, retained, shared, and protected.

OpenClaw is just the latest in a series of AI-powered tools that turn out to be an absolute security nightmare. It is easy (and up to a certain point justified) to blame individual developers for lowering their guard and abandoning good security practices. On the other hand, there is an enormous pressure on developers nowadays to adopt these tools and integrate them in their daily workflows. What these incidents show is the importance of an environment that fosters security not only through educating users, but also through giving them the space to take a step back and ask the right questions.

Est-ce la faute aux utilisateurs qui n'ont pas bien respecté les règles ou au choix controversé, par les autorités, de l'infrastructure où la moindre erreur peut s’avérer grave et vraisemblablement répétitive? Tant que la réponse n'est pas claire, il n'y a pas de responsabilisation, et le problème risque de persister.

This article is interesting because it shifts the Moltbook debate away from sci‑fi “bot consciousness” and toward concrete security architecture risks. What could possibly go wrong when thousands of OpenClaw‑like agents —with full root access to their owners’ machines— are frolicking in a shared, untrusted environment, swapping prompts, payloads, and jailbreak tricks? His advice is gold: use OpenClaw locally if you must, but never, ever connect it to Moltbook. Spot on—hype doesn’t patch vulnerabilities.