Security

Not Before Time is a public broadcast facility built on existing technology. Not Before Time gives three strong guarantees that information: will not be readable before a certain future time was not sealed before a certain past date and time was not electronically signed before a certain time These support human rights, democracy and business. The second guarantee is a lower bound on sealing, not a creation date. A released NBT private key cannot be inside a package sealed before its release, although it can be added to old material later. The claim cannot be checked until the package opens; a priority claim needs the ciphertext published or independently anchored at the relevant time. ...

The EU-US Data Privacy Framework (DPF) ↗ is intended to put limits on US surveillance of EU citizens (with UK citizens covered in a bolt-on called the “bridge”). It always was a kludge designed to allow US companies to continue holding vast amounts of EU/UK data regardless of US government spying, and now it is on is on life support. The US Privacy and Civil Liberties Oversight Board (PCLOB) was a mandatory requirement for the deal but it has only one term-expired member, and the equally essential FISA Section 702 ↗ expired in June 2026. The expiry does not stop the surveillance, just the oversight that was negotiated. EU/UK businesses want to store their data within US control, and so these laws and frameworks are designed to make it legal for them to do so. In practical terms there is no protection for EU/UK citizens, so the legalities are a kind of compliance dance, and a very expensive one too. ...

The detail of the GDPR and its implied computer science contain a solution for sharing secrets according to law. This continues to be true in 2026, as the Digital Omnibus Regulation ↗ takes shape. Executive Summary The GDPR sets up a conflict in trust between companies in particular circumstances, which can only be resolved by using the automation of a cryptographic audit trail with particular properties as described below. Problem Statement Under the EU’s GDPR ↗ law virtually every company is a Controller, and virtually all Controllers use at least one Processor. When a Processor is engaged, the GDPR requires that a contract is signed with the very specific contents spelled out in clause 3 of Article 28. The GDPR requires that Controllers and Processors cooperate together in order to deliver data protection, and this cooperation needs to be very carefully managed to maintain the security and other guarantees that the GDPR also requires. That’s what this mandatory contract is intended to achieve. ...

This is the second time ↗ the Court of Justice has decided the same question. After four years, in 2020 the Court concluded that the United States violates the privacy of EU citizens when the personal data of EU citizens is visible to the US government, and that the US has no intention of changing its behaviour. Therefore, US companies are not permitted to hold the personal data of EU citizens and residents. ...

The Fossil ↗ source code management system is the most fully-featured alternative to Git, and has decades of development and testing starting in 2007. After helping Fossil make some changes I now use Fossil for several projects. I also use Git extensively on various software forges (but not GitHub unless I must). Mercurial ↗ is actively maintained but has lost most of its mindshare since Mozilla ↗, Bitbucket and others migrated away, and is rarely chosen for new projects today. So it’s either Fossil or Git. ...

LumoSQL ↗ protects data on mobile phones and other computers using a new data storage technology which is highly compatible with most existing devices. The first part of this gives better robustness in the case of a powerloss or other crash, and at-rest encryption. Most apps have no encryption at all so this is a great improvement. With the second part of LumoSQL being developed now, the device owner decides who can read or change their data down to the level of individual rows if they choose. This decision continues to be enforced even after it has been copied off the phone to (for example) a bank or dating or insurance company for processing with their in-house database software. Today, device owners are rarely in control of the privacy of their own data, despite the many privacy laws. If a phone is separated from its owner, LumoSQL data rows cannot be read without the consent of either the phone owner or someone to whom the phone owner has granted access even if the phone has been unlocked. These controls are fine-grained, meaning different levels of permission can be granted. ...

I have been lead implementer of the main security and privacy standards several times each. These can seem intimidating, but properly used they improve security overall, and can help a business run more smoothly. From a pragmatic, business point of view: These standards are about writing down the actual rules of your business relevant to security and privacy, and then writing down how you improve these rules, and recording how well they work. All businesses can benefit from challenging their working habits and practices, and since privacy and security touch most parts of a business, this is an opportunity to review how the business works before something goes wrong. From the point of view of both Computer Science and Information Management Science: ...