In the US alone, there are tens of thousands of small organizations that are responsible for critical infrastructure and vital community services. Most of them don’t have an IT department let alone a cyber security expert on staff. And yet these organizations are being attacked by cyber criminal gangs with ransomware and are also being targeted by foreign adversaries who would like the ability to disrupt our very civilization. While the US federal cyber agencies have not properly responded to these threats, a handful of volunteer organizations have emerged, organized under the Cyber Resilience Corps, to address these needs. Today I’ll speak with Michael Razeeq, Grace Menna, Adrien Ogee and Eric Franco about their much-needed efforts.

Today we’ll wrap up my series of tips for enumerating all your old online accounts and deciding whether to delete them or just dumb down the personal data they have on you. There are several things to consider – we’ll go through them all!

In other news: a study ranks the most private AI chatbots; LinkedIn is set to use your personal data to train their AI; ChatGPT has released an AI browser; new phishing scam for password manager creds; Gmail did not leak 183M passwords; man discovers his robot vacuum sharing lots of personal data; more info on Cellebrite’s mobile hacking abilities; Flock expanded its surveillance with Ring and drones; and group finds that half of our satellite communications are not encrypted.

AI chatbots like ChatGPT have made quiet a splash. Companies are tripping all over themselves in a rush to add “AI” to everything, heedless of the security risks. But perhaps more insidious are the privacy risks. Most AI processing is done in the cloud, meaning that your queries and chats are subject to inspection, sharing, storing and monetizing. These AI systems are incredibly expensive to train and operate. And AI companies are desperate to feed them every scrap of data they can find. It’s a recipe for privacy disaster. But there are ways to make it more private and today we’ll discuss these approaches with Proton’s head of AI, Eamonn Maguire.

Now that we’ve tracked down all our old online accounts, it’s time to make them more secure and review the data they contain. We should download a copy of that data for safe keeping before we ultimately delete or suspend the accounts. We’ll discuss this next step in our journey of reducing our online data footprint – our Data Diet.

In the news: Windows 10 support has officially ended; seniors targeted with malware from Facebook groups; Tile trackers can also track you; massive Salesforce data leaked after refusing to pay ransom; dangerous Discord breach; Apple, Google to reluctantly comply with new Texas age law; California enacts age-verification law; EU Chat Control defeated; California makes GPC universally available;
largest CCPA fine to date levied against TSC.

Our critical infrastructure is vulnerable and under attack by nation state actors, either for profit or perhaps even to establish a beachhead for future cyber conflict. During the pandemic, many of our core systems were automated and connected to the internet for remote administration, but this just created a larger attack surface. The federal government hasn’t done nearly enough to protect these systems. Groups like DEF CON Franklin are working to find cyber volunteers to bring our national critical utilities above the ‘cyber poverty line’. Today we’ll explore the problems and solutions with Franklin co-founder Jake Braun, including what we can all do to help.

There are literally billions of devices connected to the internet today – many of them cheap, insecure IoT devices… smart thermostats, doorbell cameras, webcams, cheap WiFi routers and other smart appliances. As we like to say, the “S” in “IoT” is for security. And when insecure devices are no longer supported, the security bugs will never be fixed. We’ll discuss the implications of this growing problem and potential solutions with a passionate right-to-repair advocate and the founder of the Secure Resilient Future Foundation, Paul Roberts.

It’s rare these days to find a well-designed and useful application that was made to be private from the get-go. Too many apps today view your personal data as a cash cow to be mercilessly milked, claiming to value your privacy when they really value the extra revenue they can make off of your private data. When I find useful apps that are private by design, especially ones that can replace more popular apps that harvest our data, I like to call attention to them: in this case, Ente Photos. Today I’ll ask the founder and CEO why privacy is important to him and how it influenced his design approach.

In our quest to clean up and secure our data, today I will give you several clever and useful techniques for uncovering old, forgotten online accounts. We’ll scrape the bottom of the barrel to complete our list of accounts so that we can upgrade their security, see what data they have, and remove anything we no longer want floating around out there, waiting to be stolen or abused.

In the news: Chat Control is up for a vote in the EU (time to contact your MEPs); Samsung to show ads on their smart refrigerators; new automated sextortion spyware; a third of UK firms spying on employees; airlines sells 5B flight records for warrantless searching; ICE signs $3M contract for phone hacking tool; ChatGPT to guess your age or require ID; Swiss government looks to enable mass surveillance; Google Pixel 10 adds C2PA support; Apple iPhone 17 includes killer hardware security feature.

Artificial Intelligence (AI) is the Big Tech buzzword of the day. Every company who wants investment (public or private) is scrambling to have an “AI story”, adding chatbots and ‘agentic’ features in their products wherever possible. The AI companies themselves are constantly expanding their models, ingesting as much data (including highly personal information) as possible. In this AI gold rush, companies are making flawed and often harmful products. Companies are firing workers and trying to replace them with AI bots. And it’s forcing us all to question what’s real, what has actual value, and what the impacts could and should be on society as a whole. Discussing deep questions like this is the purview of philosophers – and today I’ll be welcoming back someone uniquely and supremely qualified to address them, Carissa Véliz.

The next step in reducing our digital footprint is to identify all of our online accounts, including the long forgotten and unused ones. The easiest place to start is by using the tool we should already have: our password manager. By its very nature, it contains a list of all our accounts. You may have used your browser to remember your passwords, or you may have some other method… but it’s time to move to a real password manager.

In other news: update your Android devices ASAP; Android malware spreading via Facebook ads; Google to make it harder to sideload Android apps; dashcam company cloud storage hacked; Anthropic to train model based on your chats; OpenAI sharing some GPT chats with law enforcement; ChatGPT getting parental controls after teen suicide; Microsoft Word will auto-save to OneDrive; Chrome VPN extension caught taking screenshots of sites you visit; US tells BigTech not to comply with DSA; and Flock pauses work with federal agencies.