Security

The practical design document NotBeforeTime v2.6 explains how existing technologies can be assembled to create a universal way to time-lock information accessed by everyday software most people already use. Underpinned by tried-and-true mathematics, this is a pragmatic tool that anyone will be able to use. The design document explains in mostly non-technical language how: Not Before Time combines existing technology to give three strong guarantees that particular information: will not be readable before a certain future time was not created before a certain past date and time was not electronically signed before a certain past time These support human rights, democracy, health and business. ...

The background The immediate urgency of the software patent issue has changed character, although as Panos Alevropoulos observed, battles were won, but the war is not over 12. For ordinary users, the threat has shifted from product suppression to invisible royalty stacking. For developers, the battlefield has fragmented across the Atlantic. And for EU governments pursuing digital sovereignty, the old “sword of Damocles”—the failed Software Patent Directive of 2005—has been replaced by a sharper blade: the Unitary Patent Court. ...

The detail of the GDPR and its implied computer science contain a solution for sharing secrets according to law. This continues to be true in 2026, as the Digital Omnibus Regulation takes shape. Executive Summary The GDPR sets up a conflict in trust between companies in particular circumstances, which can only be resolved by using the automation of a cryptographic audit trail with particular properties as described below. Problem Statement Under the EU’s GDPR law virtually every company is a Controller, and virtually all Controllers use at least one Processor. When a Processor is engaged, the GDPR requires that a contract is signed with the very specific contents spelled out in clause 3 of Article 28. The GDPR requires that Controllers and Processors cooperate together in order to deliver data protection, and this cooperation needs to be very carefully managed to maintain the security and other guarantees that the GDPR also requires. That’s what this mandatory contract is intended to achieve. ...

The immense Privacy Shield was a 2016 self-certification scheme for US companies to hold themselves to the strict EU privacy rules. In 2020 Privacy Shield was struck down by the EU Court of Justice. In non-technical terms, the Court said: There is no way Privacy Shield can work. So don’t use US-controlled cloud companies such as Google or Amazon. In late 2021 this decision started rippling out across Europe, as one place and then another moves away from these giant US companies, starting with government users. We all like familiarity and wish to avoid change, so this decision seems astonishing to many people. Once organisations get over their surprise, it is not so difficult to do. In 2023 I wrote It remains to be seen what these US companies will do in 2023. Some of them are wealthier than several smaller EU nations combined. By 2026 we had the answer - they used coercion by political, economic and legal means to prevent EU citizens using their own IP to build their own services. ...

LumoSQL protects data on mobile phones using a new data storage technology which is highly compatible with most existing devices. With LunmoSQL, the device owner has ultimate right to decide who can read or change their data… and this decision continues to be enforced even after it has been copied off the phone to (for example) a bank or insurance company for processing with their in-house database software. In contrast, the situation at present is that device owners are rarely in control of the privacy of their own data, despite many laws relating to privacy. ...