Our weekly picks of digital trust-related articles

The Swiss eID audit highlights a trade‑off: release on schedule with fewer security features, or delay to strengthen protection. Christopher Allen, from his work on the TLS protocol, offers three lessons for eID: bugs expected to be fixed in 3–5 years can take 20; the mindset for designing a 20‑year architecture differs from the startup mindset of building a 2‑year product; and once shipped, “good enough” often becomes permanent.

This case is striking in that, while we usually focus on the risks of data theft and profiling from Big Tech, the core threat here is addiction and its devastating long-term impact on the mental health of young people, such as depression, anxiety and body dysmorphia. Internal documents prove that Meta was aware of the harm. Guardrails exist, and countries such as China enforce them; yet Zuckerberg overruled 18 experts. The only logical explanation beyond the rhetoric of 'free expression' is the desire to expand the captive audience and prioritize profit over children's well-being. Just as we had the tobacco industry in the 1980s, now it's big tech's turn.

Since ChatGPT crashed onto the scene in late 2022, attacks involving LLMs have kept pace with the breakneck speed at which they are being integrated into every aspect of our digital lives. This paper is the first that I'm aware of that takes a step back and not only catalogues the attacks by type, but also creates a taxonomy to guide security research into this new world of attacks on and by LLMs. Definitely a must-read for anyone working in security!

Eine Studie über Open-Source Passwort-Managern, die die Passwörter in der Cloud speichern. Da die Programme öffentlich einsehbar sind, hat ein Student von der ETHZ nach Schwachstellen gesucht, und einige gefunden. Alle Fehler waren nur durch einen bösartigen Betreiber ausnutzbar, hatten aber zur Folge, dass Passwörter veränderbar oder sogar einsehbar waren. Die drei Passwort-Manager haben die 90 Tage 'responsible disclosure' genutzt, um die Schwachstellen zu beheben.

Let us celebrate a milestone in digital safety. The European Commission has found TikTok in breach of the EU Digital Services Act for its algorithms designed to hook users. This follows another recent win, with Australia’s social media ban on minors under the age of 16. While the wheels of governance move achingly slow in comparison to the pace of technological change, and we can expect strong pushback from the company, we can at least take comfort in the knowledge that research, dialogue, awareness-raising and advocacy do move the needle.

Bien qu’on nous assène que nos communications sont chiffrées de bout-en-bout, et que même WhatsApp/Meta ne peut pas les lire... il s’avère que ceci est faux et qu’elles sont bel et bien accessibles. Ceci n'impacte pas que la crédibilité de Meta, mais aussi celle de n'importe quel système numérique, quel qu’en soit l’opérateur (petit rappel du référendum sur le eID). D'autre part, malgré la 'suprématie' des lois de protection des données de l’Union Européenne – Suisse incluse- par rapport à celles des Etats-Unis, ce sont ces derniers qui agissent en premier. Je suis curieux de voir comment le RGPD sera appliqué dans ce cas précis.

Europe’s economy now largely runs on digital payments, making reliance on U.S. card rails a systemic exposure. Sanctions, policy shifts, outages, and data-access demands can all cause economic shocks. This is precisely why Wero is both interesting and timely: it is a bank-led, pan-European layer that can reduce strategic dependency. I’m eager to see transparent comparisons of merchant and user fees, dispute models, and information on what data is collected, retained, shared, and protected.

OpenClaw is just the latest in a series of AI-powered tools that turn out to be an absolute security nightmare. It is easy (and up to a certain point justified) to blame individual developers for lowering their guard and abandoning good security practices. On the other hand, there is an enormous pressure on developers nowadays to adopt these tools and integrate them in their daily workflows. What these incidents show is the importance of an environment that fosters security not only through educating users, but also through giving them the space to take a step back and ask the right questions.

Est-ce la faute aux utilisateurs qui n'ont pas bien respecté les règles ou au choix controversé, par les autorités, de l'infrastructure où la moindre erreur peut s’avérer grave et vraisemblablement répétitive? Tant que la réponse n'est pas claire, il n'y a pas de responsabilisation, et le problème risque de persister.

This article is interesting because it shifts the Moltbook debate away from sci‑fi “bot consciousness” and toward concrete security architecture risks. What could possibly go wrong when thousands of OpenClaw‑like agents —with full root access to their owners’ machines— are frolicking in a shared, untrusted environment, swapping prompts, payloads, and jailbreak tricks? His advice is gold: use OpenClaw locally if you must, but never, ever connect it to Moltbook. Spot on—hype doesn’t patch vulnerabilities.

Apparently, it happens even to the best of us — even seasoned professionals with over 24 years of IT experience and a 'deep understanding of both the complexities and practical realities of infrastructure security!' Jokes aside, this incident is fascinating: it exposes elite-level lapses in AI tool governance despite regulatory warnings, underscoring the enduring risks to data sovereignty when sensitive information is fed into public AI chatbots.

The volatile start to 2026 has shaken the foundation of global digital trust. Digital sovereignty has always been a running theme in the background of European conversations around tech, but this year, it is likely to be front and center, as governments and businesses scramble to seek digital solutions that provide reliable data security and privacy protection for its citizens, clients, and users, regardless of the geopolitical drama of the week. Virkunnen’s specific calling out of chips is somewhat surprising, given how far away Europe is from chip autonomy, but developing more control over selected parts of the semiconductor value chain could be a feasible strategic move.

This article highlights a crucial reality: basic connectivity must exist before any digital transformation can take place. With only 38% of the population online, Africa's digital divide represents both a massive challenge and an opportunity. It is fascinating to observe the competition between space-based solutions (Starlink, Amazon Leo) and submarine cables (Meta's 2Africa, Google's Equiano). Notably absent: China. Given Beijing's substantial infrastructure investments across Africa, their absence from this connectivity race is worthy of monitoring for its potential geopolitical implications.

Researchers at KU Leuven disclosed flaws in Google’s Fast Pair Bluetooth protocol that let attackers within Bluetooth range silently pair with seventeen different models of headphones or speakers made by ten different vendors, including Sony, Xiaomi, and even Google itself. This set of vulnerabilities enables cheap, practical hijacking, eavesdropping, and tracking of millions of earbuds and speakers—even of non-Android users, and exposes weak ownership/authentication, failed certification checks, and slow, uneven patching for IoT devices.

The inclusion of copyrighted materials in LLMs' training data has been a hot-button issue from the get-go. In the beginning, Big Tech's reassurances that their models' inner workings prevented such material to be stored, let alone accessible, were convincing enough. But new research is painting a different picture, landing the companies in hot legal waters. This article traces the history of related court cases in the U.S. and puts them into context of the latest research on the matter.

Parler de souveraineté numérique en Europe devient de plus en plus courant. Même si ça va prendre beaucoup d'années d'avoir un contre-poids aux grandes entreprises américaines, les solutions émergent et s'organisent. Une fois qu'il y aura de l'argent qui alimente ces solutions alternatives, open source ou pas, l'utilité de ces solutions va augmenter drastiquement.

Beyond the author's predictions for the AI bubble's aftermath, what struck me most was his explanation of 'accountability sinks'—people who take the blame for AI's mistakes. Understanding this concept, which emerges from examining AI companies' business model, leads to a crucial insight: it's not just white-collar workers whose jobs will be eliminated, but specifically those of senior, experienced workers, the very people most qualified to catch AI's mistakes but who cost the most. This is an important distinction I haven't seen emphasized before.

Encrypted messaging app Threema, which is used by the Swiss army and cantonal polices, got acquired by a German private company. Two questions come to mind. First, what kind of implications could a private acquisition such as this have on a country's sovereignty and critical operations, and how does it deal with them? Second, and more specific to Switzerland, how to avoid another Crypto AG scandal and another hard blow to the Swiss tech reputation?

Here's a rather amusing article that exposes the troubling flaws of this year's Consumer Electronics Show (CES) innovations. Particularly noteworthy is Merach's smart treadmill, which collects biometric data. The company boldly admits in its privacy policy that it 'cannot guarantee the security of your personal information.' Don't complain you weren't warned!

I always appreciate this author's talent for breaking down her research for laypersons like me. This article gives an overview of the current state of evaluating the cognitive capabilities and the shortcomings of these methods. Most importantly, it also provides suggestions for improving them. Definitely a recommendation for enthusiasts, sceptics and everyone in-between!

Another shaky foundation of the internet: OpenSSL is an Open Source cryptographic library. It is used by most programs on the internet for cryptographic operations, including, for example, setting up a secure internet connection and encrypting emails. Like many other Open Source projects, the people behind the project are not paid, so there is a long list of bugs and inefficiencies, which is only growing over time. Alternatives exist, but they are not widely used.

This article highlights the vital role of governments and regulators in ensuring responsible digital innovation and protecting citizens—especially vulnerable groups—from AI-driven exploitation. It also raises the issue of digital sovereignty, showing that regulation is not just technical or legal but shaped by geopolitical pressures. For instance, action against the nudifier tool on Musk’s X platform is complicated by concerns over U.S. reactions, illustrating how global politics influence digital safety.

This article caught my attention for several reasons. Firstly, Russia's surprising absence from the AI race. Secondly, there is the strategic positioning of Middle Eastern players, such as the UAE, who are using their immense investment capabilities to manoeuvre between superpowers. Thirdly, this is not just about AI; it's also about broader digital sovereignty. Unlike the distinct blocs of the Cold War era, today's landscape comprises intertwined, overlapping networks in which countries pursue polycentric strategies.

OpenAI is asking third-party contractors to upload real work assignments from their jobs to create human performance baselines for evaluating its AI models. While this approach holds substantial technical promise, it also comes with major legal, ethical, and governance risks, including the risk that contractors may violate their previous employers’ nondisclosure agreements or expose trade secrets.