Our weekly picks of digital trust-related articles

Interesting research, as Chinese open-weight models become default building blocks of open AI. It shows the limits of the self-hosting argument: running a model locally normally keeps data in, but the weaknesses in the code it writes still ship to production. If political alignment can change how securely a model codes, it is a supply-chain property to test, not a setting to trust. How Hirundo removed the alignment is unclear, and its fix is the evidence.

La justice électorale brésilienne a donné 24 heures à Meta pour prouver qu'elle traite de façon égale Lula et Flávio Bolsonaro, à égalité avant le second tour, sous peine d'une amende d'un million de reais par jour. Lula accuse la plateforme de brider ses contenus et son IA de favoriser son rival, ce que Meta nie en invoquant des « incidents » techniques. L'affaire illustre l'opacité des algorithmes : il est aussi difficile de prouver l'absence de biais que de réfuter un « incident technique », ce qui nourrit à la fois la manipulation possible et le soupçon de manipulation, y compris à des fins politiques. Elle pose aussi la question de la neutralité des IA conversationnelles et des limites du contrôle judiciaire sur les algorithmes.

Switzerland is taking a step further to try and protect its digital sovereignty. The Federal Office of Information Technology, Systems and Telecommunication recently published an invitation to tender for its new “Swiss Government Cloud". With a hybrid multi-cloud approach, it will combine three coordinated cloud levels, based on data sensitivity (from global public cloud to fully on-premises federal infrastructure).While the numbers are staggering (7 billion over the next 14 years), the entry barriers appear tough for domestic players. Bidding consortia seem restricted and a high revenue threshold (500 millions CHF) is required for two of the three lots.What remains interesting is the convergence of policy logic with the European Union's proposed Cloud and AI Development Act (CADA), which likewise tiers sovereignty requirements to data sensitivity.

Although it is light on actual proposals, this article is a nice conversation starter about what we want the internet of tomorrow to be. Unintentionally it is also a reminder of how today's internet has been taken over by commercial interests and big companies, a far cry from where it all started. Maybe the radical transformation ahead is also an opportunity to think back to the internet's origins.

We talk a lot about the global race for semiconductor manufacturing and the associated export controls concerning cutting-edge AI chips. We talk less about raw materials, even though they are a prerequisite for any IT system nowadays. China increased its share of rare earth production from under 20% in 1985 to almost 100% in 2005. Since then, however, this figure has been in constant decline. The USA are quietly but seriously working on this. The sums involved are huge and the timeframe is very long. Whoever controls the metals will dominate the digital race.

Ich freue mich immer über die Erklärartikel von dnip. Dieser Artikel ist nicht nur eine einsteigerfreundliche Einführung in TLS-Zertifikate und ihre Rolle bei der Sicherung von Internetverbindungen , sondern auch gleich eine praktische Anleitung für den Umstieg auf souveränere Alternativen.

Au-delà de l'inquiétude que ces retraits institutionnels à la conférence de EU DisinfoLab suscitent, c'est surtout le risque d'autocensure qui doit alerter ici. Si traiter certains sujets coûte le soutien des institutions, d'autres organisateurs de conférence pourraient restreindre les thématiques de leurs programmes avant même d'être officialisés. Reste que, cette fois, la manœuvre a produit l'effet inverse de celui recherché. Un véritable effet Streisand s’est produit (pour le phénomène par lequel une tentative d’empêcher la diffusion d'une information produit l'effet inverse) : jamais la conférence Dinsinfo n’a attiré autant d’attention que cette année. Cette affaire révèle surtout un décalage structurel entre deux rives de l’Atlantique en matière de liberté d'expression : les États-Unis brandissent la liberté d'expression comme un principe absolu, tout en s'en servant comme instrument diplomatique.

This article gives an interesting take on how autocratic rulers might become entrapped by the very technologies they use to control their populace, and points to concrete examples where AI is doing actual harm to societies today rather than the doomsday narratives Big Tech currently paddles. However, I feel it misses an opportunity to discuss how democratic societies have to resist the siren song of the same or similar technologies to avoid becoming more autocratic as a result of deploying them.

Very interesting article about government requests to block illegal websites. The first blocks of this kind changed the DNS entries at the ISPs, but it very quickly turned out that you can change the DNS on your own computer. Cloudflare, which handles most of our internet traffic and also offers an uncensored DNS service, took an interesting stance: it will not block illegal websites in its DNS, but it will do so when routing traffic through its CDN. This shows yet another dependency on a US provider that most of us know nothing about: Cloudflare can decide which pages we see, as even illegal websites use its services!

I find this text both interesting and scary. The threat is twofold. Firstly, malicious actors contaminate the data that LLMs learn from. Secondly, they use AI to create content designed to persuade us. Filters should be able to identify and remove such propaganda. However, the second threat should hopefully have a positive side effect: people may become more discerning about what they read (critical thinking education is vital). The article does not mention whether Western states are doing the same to Russian or Chinese models. Do authoritarian regimes de facto protect against such "threats"?

The "Superintelligence Summit" held at the White House last week may inspire many things, but trust isn't one of them. The resulting "morally binding" document amounts to self-regulation and lacks any real accountability. We have seen how self-regulation fails: Boeing and the 737 MAX crashes; Facebook and the Cambridge Analytica scandal; S&P and the 2008 financial crisis; OxyContin and in melamine-tainted milk; The early tobacco industry etc. Finally, consider who gains financially from rebranding AI as "superintelligence" and selling the .si domain names. It says a lot about what is driving the hype.

One of the problems with LLMs is that you can never be sure whether they're inventing things, I call it "walking off a cliff", or whether they're still on solid ground. For programming, we have formal verification, and tools like TLA+, which allow you to model programs and reason about their state. LLMs are now trained to use those tools when reasoning about complex subjects, and this greatly improves their reliability, giving them a way to catch an error if they walk off a cliff. But of course, it's not a panacea, since TLA+ cannot model or prove everything!

This article reveals that OpenAI employees had warned about the risk of agents breaking out of their shells months before the recent Hugging Face incident. It offers insight into how security is handled at OpenAI, or rather how it is now handled: newer, better, faster, stronger models are prioritized over security concerns. This really highlights the need for regulation to ensure that these companies are held accountable for their rogue agents

Last week I picked the Anthropic misuse report, on outside actors abusing frontier models. This week I chose an article exploring a different angle: who is accountable for AI corporations? Cal Newport urges Congress to investigate which systems cause problems, why agent hacking wasn't stopped after the first incident, and how doomsday beliefs shape research. I doubt an inquiry is the right tool, but I liked that it raises a question: who oversees AI corporations?

Digital, but as usual, requiring massive infrastructure investments. The USA is making its biggest ever economic bet on AI. The projected $10.3 trillion far exceeds the GDP percentages invested in previous infrastructure projects, such as railways, motorways and electricity grids, and the timescale is much shorter. The hope is that it will boost growth in the same way that past infrastructures did. However, the environmental impacts and 'too big to fail' risks remain unanswered questions.

While much recent attention has focused on Anthropic's and OpenAI's own security incidents - for which they should rightly be held accountable - it's worth not losing sight of the other side of the story: how threat actors attempt to weaponize these frontier models in the first place. Anthropic's latest threat intelligence report is valuable precisely because it sheds light on this dynamic, documenting real-world attempts by state-linked groups, commercial surveillance vendors, and criminal networks to misuse Claude for espionage, mass surveillance, and data exfiltration.

Les récents événements autour des LLM montrent que les entreprises ne veulent pas, ou ne peuvent pas, contenir le génie qu'elles ont libéré. Face à cela, je compte sur un véritable contre-poids de la part de nos gouvernements. On observe une tendance à tout autoriser au nom du profit, alors que l'expérience a montré à maintes reprises que cela ne mène pas à un usage responsable de la technologie. J'espère donc que le prochain sommet mondial sur l'IA ne se contentera pas de vanter les progrès de la Suisse, mais permettra aussi une réelle collaboration entre gouvernements pour s'accorder sur une régulation efficace de ces nouvelles technologies.

The Trump administration continues its crusade against European sovereignty and the rule of law. By intervening before the EU's General Court to support X Corp. and Elon Musk's bid to annul the first fine ever imposed under the DSA (€120 million), the US government has crossed a new threshold. By doing so, it seems that Washington not only implicitly questions the Commission’s jurisdiction over U.S.-headquartered digital services companies (a question long settled in the jurisprudence) but also tries to apply American corporate-law principles (corporate veil, territoriality…) in European enforcement actions.

This marks the third security incident involving OpenAI - that is known to the public - and we urgently need to stop getting distracted by the AI companies' narrative about "rogue AI" and hold them responsible, not only legally but also morally. Each time, it is their experiment that goes wrong, it is their security infrastructure that fails to contain it, and - worse of all - it is their poor and unprofessional handling of disclosure of the incident. This is not a problem of "rogue AI", this is a company that is obviously incapable of handling the security implications of their own products, and this is what we really should be concerned about.

Unfortunately, there's nothing new under the sun, but it's worth repeating. Advertising profiling may now seem normal to us. However, profiling that affects credit ratings or insurance premiums is unacceptable. Companies infer sensitive information, sometimes even coding for ethnic origin or health status, and mask medical and health data to avoid legal action. Once the data is sold, it becomes untraceable, errors cannot be rectified and deletion is impossible. Our data is valuable, but consent is meaningless, oversight is inadequate, and lobbying ensures this remains the case.

I like the example given in this article because it made me reconsider whether "more data = a better life." The usual answer is "it depends" on what we do with that data. If it means replacing human contact with streams of bits, forgetting how to cope when there's a glitch in the cloud, or delegating child-rearing to big tech because "they know better," then it's definitely bad. On the other hand, making well-informed decisions based on actual data is surely better than handwaving or trial and error, especially when it can be a matter of life or death. Finding the right balance between these extremes would be wise. I also wonder how much attachment a baby would form to these surrounding cameras, and how much it would miss them if one day they weren't there.

This makes a refreshing change from the usual LLM apocalypse: your data is still valuable, especially when there is so much of it! Once again it shows that collecting and storing data long-term is a bad idea. There needs to be strict control on how long personally identifiable information (PII) can be retained, after which it must be deleted. Compared to the publicly available data on LinkedIn, this data source is of much higher value: it is verified, includes complete addresses, and captures people who have never been online at all.

Yet another push to ban social media for minors under 15, this time EU-wide, via the forthcoming EU Kids Act. What is striking is how little the announcement engages with the framework that already exists. The EU GDPR already requires parental consent before minors' data can be processed, with the age threshold set between 13 and 16 depending on the member state. And the EU DSA already obliges platforms to put child-protection measures in place. In other words, the legal scaffolding for protecting minors online is already here. The gap is enforcement, not legislation.

Barely registering above the din of AI doomsayers are the voices reminding the public that legal and regulatory mechanisms, like consumer protection laws and anti-competition regimes, already exist to address many of the damages and harms caused by AI. The article offers hypotheses for why this line of conversation isn’t more front and center. But the more important question is how do we create the political will in citizens and their representatives to come together and use these legal instruments to hold frontier labs accountable.