Reuters were accused of acting illegally in guessing the URL of an unreleased report in 2002. I didn’t hear anything after the initial reports so presume it was quietly dropped or settled. blog.citp.princeton.edu/2002/10/31/i...

UCL Computer Science are hiring Section Managers to support the development and delivery of teaching, research, and strategy within their section. I’ll be leading the Foundational Computer Science section, where the InfoSec group is based. www.ucl.ac.uk/work-at-ucl/...

“$5 Wrench Attacks: When Cryptocurrency Crime Get Physical”, a post on Bentham’s Gaze by Marilyne Ordekian discussing when XKCD comics become reality – www.benthamsgaze.org/2025/07/22/5...

I am recruiting mental-health experts (clinical psychologists and psychiatrists) for an in-person workshop in London to discuss a mobile app for mental health care. Participants will receive £500+expenses for their time. If you might be interested please email [email protected]

On our new paper published at IEEE Security and Privacy – “A Privacy Framework for Research Using Social Media Data”, a summary by Kyle Beadle. www.benthamsgaze.org/2025/05/15/a...

AI-based scam checkers are gaining popularity but I would be cautious in following their advice unless the company is willing to stand behind it. For example, Metro Bank makes bold claims but the fine print absolves them of any responsibility for errors. www.metrobankonline.co.uk/ways-to-bank...

I have an open PhD position at @sec.cs.ucl.ac.uk on applying traffic-analysis resistance techniques to protect industrial control systems. Full funding is available for home-fee status students (deadline 15 April). www.ucl.ac.uk/security-cri...

Whisper it, the showdown over Apple encryption is THIS WEEK ⏱️ 🤐 A secret tribunal will hear the appeal against the government’s order to carve a backdoor into Apple’s encrypted services. 🛑 Our cybersecurity and privacy shouldn’t be decided in the shadows. www.computerweekly.com/news/3666203...

Until now, the UK government recommended that individuals at high risk, like legal professionals, enable Apple Advanced Data Protection (ADP). Apple disabled ADP following government pressure, and now the NCSC quietly deleted their guidance recommending ADP.

The article refers to the Investigatory Powers Tribunal, but I can’t see any description of how this falls into the type of complaints the IPT handles. Can anyone more qualified work out what’s actually going on?

So here’s a simple request to Apple. Apple iMessage needs to enable “disappearing messages.” And they need to do it soon. blog.cryptographyengineering.com/2025/03/01/d...

🚨 APPLE WITHDRAWS ENCRYPTION TECH FROM UK 🚨 The Home Office’s actions have deprived millions of Britons from accessing a security feature. UK citizens will be at higher risk of their personal data and family photos falling into the hands of criminals and predators ‼️ www.bbc.co.uk/news/article...

Encryption IS online safety 💡 Keeping data secure is key when hackers are skilled at unpicking accounts. So why does the UK government want to make us unsafe by ordering a backdoor to Apple encrypted services? ✍️ Sign to save encryption this #SaferInternetDay. you.38degrees.org.uk/petitions/ke...

Now hiring in law & tech @ucllaws.bsky.social! Lecturer/Assoc Prof in IP & IT law: intersection of platform reg, emerging tech, copyright/designs. Join me @bernardkeenan.bsky.social Orla Lynskey @alinatrapova.bsky.social Ilanah Fhima, Matt Fisher, Robin Jacob & friends www.ucl.ac.uk/work-at-ucl/...

Why is it still possible to write a date where the day of the week doesn’t match the day of the month? This doesn’t need AI; a regular expression would do. I want a big red underline if I ever write “Thursday 5 February”. Has someone patented this and spoiled it for everyone?

Thinking about this classic recently, which is available free here: monoskop.org/images/d/df/...

The government is reviewing the legal presumption that electronic evidence is reliable. I was one of several experts to comment on this news. www.computerweekly.com/news/3666183...

It’s worth noting that the TikTok ban doesn’t itself target TikTok but instead makes app stores and hosting providers liable for distributing TikTok. I can understand why intermediaries are the focus, but this seems to set a different precedent that imposing liabilities on TikTok itself.

My take on the AI Action Plan – good: encouraging APIs and standardisation; bad: focus on dataset release rather than controlled access (anonymisation has a poor track record for rich data); concerning: prioritisation of novelty over doing the right thing. www.gov.uk/government/p...

I spoke to @fattoquotidiano.bsky.social on whether British police have the capability to extract data from a @grapheneos.org phone without the passcode. As far as is publicly disclosed, Cellebrite can’t break the protection but less is known about competing forensics tools.

Funded opportunity for a PhD studentship on Trustworthy Machine Learning in the UCL InfoSec Research Group. Further details are in the thread below (application deadline 28 January).

Tour of WebAuthn by Adam Langley: www.imperialviolet.org/tourofwebaut...

Open Rights Group is hiring 🚀 Our Operations Manager is going on maternity leave in March 2025. We're looking for someone who can ensure that ORG continues to run smoothly behind the scenes. Find out more and apply now. ⏰ Closes 17 December, 9am 🗓️ 14 months FT ➡️ app.beapplied.com/apply/xvezly...

Big privacy/digital tech policy event in London this Thurs - Scrambling for Safety (sign ups here: www.eventbrite.co.uk/e/scrambling... and online here: www.eventbrite.co.uk/e/scrambling...). Critical talks + panels on Chat Control, Online Safety Bill, and AI in govt. Pic of my sleepy dog unrelated.

Open Rights Group fights to protect digital rights 🦾 Becoming a member helps us to campaign, lobby, go to court – whatever it takes to challenge restrictions to our human rights. Join the movement today ⬇️ #DigitalRightsAreHumanRights www.openrightsgroup.org/join/

3rd edition of Ross Anderson’s Security Engineering now freely available for download | Light Blue Touchpaper https://alecmuffett.com/article/110651 #RossAnderson #SecurityEngineering

Foundation for Information Policy Research event 'Scrambling for Safety' on Nov 28th Panels with excellent speakers on chat control, online safety, and government decision-making & AI (this panel chaired by me) Friends House London or online - sign up here: www.eventbrite.co.uk/e/scrambling...

Along with Sir Peter Fraser, I'll be speaking at the Inner Temple on the reliability of electronic evidence. The event is open to the public, so if you're interested in the topic, you can join in person or online. www.innertemple.org.uk/events/?id=E...

I've written about how the legal system might better handle electronic evidence, but computer systems could also be designed to facilitate the production of reliable evidence. I discussed these ideas at the CANS Workshop murdoch.is/talks/#talk-...

There are divergences developing in the liability for push payment fraud. The UK is moving from sender bank to 50:50 sender/receiver. US proposals went from receiver to the same 50:50 model as the UK. The EU is the sending bank, but social network websites might have to pay, too.

Awesome to see journalists exposing the dangers of kernel mode to a general audience, and even using the words “kernel mode”!

While a failure in CrowdStrike Falcon took down critical infrastructure in July, the widescale harm was due to Microsoft’s market share and design choices in Windows. I spoke to CBC News about kernel-mode software and competition law’s role in the fiasco. youtu.be/s4hoEjRh1Eo?...

Both the UK and EU are putting in place measures to protect victims of Authorised Push Payment fraud. This time last year, the UK had the stronger proposals, but now they have switched as the EU expands protections and the UK waters them down 🧵

Deep neural networks outperform traditional methods in a wide range of applications, but their opacity can hide malicious behaviour. Vasilis writes about his work at the Turing Institute on efficiently detecting backdoors in deep reinforcement learning. www.benthamsgaze.org/2024/08/07/m...

The views of security experts on Pavel Durov’s arrest seem contradictory: criticising Telegram but tentatively defending Durov. The underlying reason is concern of what precedent the arrest might set for how secure messaging platforms work 🧵

At Stansted Airport, notorious for an unpleasant experience (long queues, too few seats, routes forcing passengers through shops, …) someone decided that the real problem is the signs saying “Wait for gate” and should instead be “Relax”.

Magnetic stripe payment cards are being phased out, however more secure (but complex) technologies are not necessarily better for fraud victims. I spoke to CBC Radio about why this might be. www.cbc.ca/listen/live-...

I spoke to @chrisbaraniuk.com for a BBC News article on the uncertain future of the magnetic stripe, featuring how I managed to lock myself out of my hotel room (!). www.bbc.com/news/article...

Today’s a good day to be extra-nice to your sysadmins. If your organisation uses Crowdstrike, they will have to visit, in person, every single Windows PC. Automation doesn’t work if your computers won’t boot. Maybe get them something nice for Sysadmin Day next week.

I spoke to @karlfl.bsky.social from #ComputerWeekly about Gareth Jenkins’ extraordinary statement at the #postofficeinquiry – “I don't think I was in a position to say that Horizon was working correctly at the time” – despite declaring records were accurate. www.computerweekly.com/news/3665903...

Interested in what we’ve been working on at UCL InfoSec? There’s now a list of group publications available on our website. sec.cs.ucl.ac.uk/publications/

I spoke to the Naked Scientists about cybercrime, discussing what new attacks are out there, as well as what seems to be staying the same (with a bonus debunking of the supposed toothbrush botnet). www.thenakedscientists.com/podcasts/nak...

Very sorry to hear that Professor Ross Anderson passed away last night. Aside from his (numerous) contributions to Information Security, he was a mentor to and advocate for many researchers in the field. He will be sadly missed but leaves behind a strong legacy.

On Bentham’s Gaze, Arthur Gervais writes about his work with the Financial Conduct Authority, studying Maximal Extractable Value (MEV) and blockchain oracles in the context of Decentralised Finance (DeFi). www.benthamsgaze.org/2024/02/06/e...

I find it strange that governments are focused on identity verification for accessing the Internet while rejecting even the most basic technical controls to address the worldwide leading cause of death for children – traffic accidents. 1/2 🧵 english.elpais.com/technology/2...

I spoke to Nikkei Asia about Fujitsu’s role in the #PostOffceScandal. So far, the company hasn’t said much in the public inquiry, but that will change next week. There will also be more examination of technology issues in the summer. asia.nikkei.com/Business/Tec...

Computer Weekly, 3 January 2024 A summary of the whole sorry saga, with links to dozens of previous stories www.computerweekly.com/feature/Post... #r4today

The submission portal is now available for the open faculty position in the UCL Information Security Research Group (permanent position, all grades). Applications close on 31 January 2024. The link and further details are at: sec.cs.ucl.ac.uk/hiring-2024/

As my colleagues have had to move their content from LiveJournal, to Facebook, Twitter, Medium, Substack and onto whatever comes next I’m pleased that the POSSE approach of blogs has stood the test of time. @adamshostack.bsky.social writes about this (on his blog). shostack.org/blog/take-co...

A little known part of the Digital Millennium Copyright Act is to cover boat hull designs. It replaced a state law struck down by the Supreme Court. It’s a reminder that copyright law can change and regardless of the NY Times case outcome there will be powerful lobbying to do so.