World Ethical Data Foundation

A piece about the @OpenAI/@huggingface incident, by our Principal Threat Intelligence Specialist for @CSOonline: The OpenAI “rogue AI” incident highlights how weak oversight, rushed development and limited regulation are creating new cybersecurity risks. csoonline.com/article/420571…

For the last year, WEDF has been closely working with TACo / NuCypher to explore what threshold and conditional cryptography can do at scale -- from citizen and consumer protections, to investigative journalism, to the transnational human rights advocacy networks to whom the world owes the freedoms and justice it has gained (and sometimes retained) over the last century. Today we are announcing that the World Ethical Data Foundation is taking over stewardship of the TACo / NuCypher technologies, and we will soon be seeking to collaborate with as many aligned organisations as we can, to deliver on what they make possible. The gap between what cryptography is able to do and what is deployed has never mattered more than it does now. And open, global, public-interest cryptographic infrastructure must reach the people who need it. Our thanks and salute to the @buildwithtaco team that has designed and built this E2EE and access control substrate over the last nine years, and who will remain with the project as volunteers to help guide its redeployment later this year. Here's to what will come!

Vercel is reporting a security incident. Given the surface Vercel represents for many projects, rotate and reset all secrets, passwords and APIs. It's always good to act rather than wait to find out. All best.

Our good friends at @session_app have long been doing vital work in freedoms technology... If you have a few pennies a month spare to help them make their way to sustainability, please do consider lending them your your support. Donations can be made using the link below getsession.org/donation

This isn't just a bad idea... it is several dreadful ideas in one package.

Sometimes, substance and style coincide @mullvadnet. Well played!

It really does appear that the West is forgetting the only things that underwrite any claim it has - could have - to moral and political superiority. You literally can't have a liberal democracy, fundamental freedoms and civil liberty, and rights advancement, while *also enjoying authortiarian controls.* Surely, the trouncing of rights and freedoms feels pragmatic and convenient ...yet the creating and sustaining of justice and freedoms always will be the apparently inconvenient, apparently more difficult path. How *could* it be otherwise? But if our path is to lead anywhere that isn't hell on earth, we need values and rights to be more than aspirational poetry. They need to be protected as the most critical of all our critical infrastructure. They are the postulate. @mer__edith @PalantirTech

Chaos Communications Congress #CCC #39C3 this year featured dozens of crucial security talks, touching all aspects of culture and computational space. @udbhav_tiwari and @mer__edith's "AI Agent, AI Spy" was arguably one of the most consequential, addressing the entry of agentic 'AI' into operating systems. media.ccc.de/v/39c3-ai-agent… This architectural shift in the OS is not merely prone to catastrophic failure but is a de facto violation of the resistance technologies we depend upon to preserve and advance our fundamental freedoms - particularly privacy. Applications like @signalapp build privacy protections at the application layer through end-to-end encryption and minimal data retention. But these protections assume the relative neutrality of the OS foundation. If the OS itself can capture messages before and after encryption, all application-layer privacy collapses. The protection model and its assumptions break at a structural level. In light of this, they present what they describe as a four-point "tourniquet" framework, calling for: • Developer agency: Official APIs allowing developers to designate applications as "sensitive" with default opt-out from agentic access • Granular user control: App-by-app permission systems, beyond binary all-or-nothing models • Radical transparency: Mandatory, human-readable disclosure of data access, usage, and protection, enforceable through regulation • Adversarial research: Sustained technical scrutiny. They note that only collective, technically-grounded pressure forced Microsoft to re-architect Recall This is a problem that must be tackled immediately because once agentic-OS becomes normalised infrastructure, reversal will become exponentially harder. The question isn't whether this threatens freedoms such as privacy or not. It very clearly does. The question is whether we can act to build sufficient resistance before it becomes embedded and inescapable. *Spoiler: we 100% can and should. #Privacy #Security #AI #Surveillance #DigitalRights

Here is Cory @doctorow's absolute stormer of a talk from the 39th Chaos Communication Congress yesterday (28-12-2025). #CCC #39C3 : media.ccc.de/v/39c3-a-post-a… "Trump has staged an unscheduled, midair rapid disassembly of the global system of trade. Ironically, it is this system that prevented all of America's trading partners from disenshittifying their internet: the US trade representative threatened the world with tariffs unless they passed laws that criminalized reverse-engineering and modding. By banning "adversarial interoperability," America handcuffed the world's technologists, banning them from creating the mods, hacks, alt clients, scrapers, and other tools needed to liberate their neighbours from the enshittificatory predations of the ketamine-addled zuckermuskian tyrants of US Big Tech. Well, when life gives you SARS, you make sarsaparilla. The Trump tariffs are here, and it's time to pick the locks on the those handcuffs and set the world's hackers loose on Big Tech. Happy Liberation Day, everyone! Enshittification wasn't an accident. It also wasn't inevitable. This isn't the iron laws of economics at work, nor is it the great forces of history. Enshittification was a choice: named individuals, in living memory, enacted policies that created the enshittogenic environment. They created a world that encouraged tech companies to merge to monopoly, transforming the internet into "five giant websites, each filled with screenshots of the other four." They let these monopolists rip us off and spy on us. And they banned us from fighting back, claiming that anyone who modified a technology without permission from its maker was a pirate (or worse, a terrorist). They created a system of "felony contempt of business-model," where it's literally a crime to change how your own devices work. They declared war on the general-purpose computer and demanded a computer that would do what the manufacturer told it to do (even if the owner of the computer didn't want that). We are at a turning point in the decades-long war on general-purpose computing. Geopolitics are up for grabs. The future is ours to seize. In my 24 years with EFF, I have seen many strange moments, but never one quite like this. There's plenty of terrifying things going on right now, but there's also a massive, amazing, incredibly opportunity to seize the means of computation. Let's take it. " Licensed to the public under creativecommons.org/licenses…

Come say hello to @_jdmarshall, @helveticade and @WEDF_foundation if you're at the 39th Chaos Communication Congress #39C3 #CCC from December 27th-30th. Launched in 1984 (yes, really), CCC one of the world's most engaged (and engaging) gatherings of creative engineers / hackers. We're seriously looking forward to this one. Four days of outstanding stuff, including @doctorow on a "post-American, enshittification-resistant internet" to hands on introductions to soldering and mesh networks. As always, there are loads of excellent walk-throughs of exploits (one in particular re. the spyware attack targeting WhatsApp that was disclosed in August, and another re. a WinRE bypass for BitLocker, enabling the extraction of protected data), which we'll be sure to attend. Take a look at the sessions here fahrplan.events.ccc.de/congr… and remember that you can always always watch online if you can't make the congress itself! Very Merry Christmas everyone. Here is to a far saner, juster, and more peaceful year to come. Please treat one another as well as you can - always. 💚

For years, the public has known @WEDF_foundation mainly through our research, policy work, and the World Ethical Data Forum — our paywall free, open, privacy-advancing meeting ground for those who build, study, govern, and live inside digital systems. What’s been less visible is the work we’ve done quietly at the intersection of digital rights, networked infrastructure, and security. Much of that has involved pro bono defence for NGOs, human-rights organisations, and civil-society groups facing surveillance, censorship, infrastructure compromise, and targeted attack. We spoke little about this because the work demanded discretion. That background is why, during @EFDevcon in Buenos Aires, @_jdmarshall was invited by @ethereumfndn to join security engineers from across Ethereum — @TheRedGuild, @mattaereal, @samczsun, @fredrik0x, @_SEAL_Org, @0xRajeev and others — at @TheTrustX by @TheSecureum to examine Ethereum's security posture and the responsibilities that come with its maturation into critical open digital infrastructure. Matta’s excellent recap of the 1TS technical working groups captures the day's substance — and explores not only the outcomes but also the many paradoxes and challenges involved in the defence of public goods. And in defence *as* a public good. For anyone interested in @ethereum's future, its security assumptions, public-goods coordination, or the broader landscape of freedoms-tech, this is essential reading from one of Ethereum’s hardest-working whitehats: blog.theredguild.org/off-cha… As 2026 approaches, we’ll be sharing more about the public-goods work we’ve been doing off-radar. This feels like the right place to begin.

Truly a pleasure to partner when alignement is so very clear. @web3privacy's doing excellent work to help advance privacy across Web3 as well as rights & freedoms more broadly. A lot in store for this collaboration over the months & years ahead. Keep an eye out for announcements!

Really looking forward to this resistance & freedoms tech collaboration-sprint by @web3privacy & @protocollabs on the 21st-23rd. Some good friends in attendance, too. See you anon @torproject @session_app @ethereumfndn @_jdmarshall @helveticade @OpenObservatory @internetarchive

Really looking forward to this cypherpunk camp for builders at the frontier of freedoms and resistance technologies. ...See you in Berlin, punks! @helveticade @_jdmarshall @WEDF_foundation @web3privacy