Peter Bassill — latest writing on cyber security
Latest articles · page 3 of 14
-
The experiment comes home: Britain bans under-16s
Part 10: the experiment comes home. Britain will ban under-16s from social media by spring 2027 — the ban the Commons rejected in March, revived by regulation in June. Held to the same standard as France and Australia, including the objection the government made itself.
-
Four days, 490 records: the insider breach nobody budgets for
A new council worker opened ~490 sensitive safeguarding records and downloaded 94 over four days — then got a suspended sentence. The sentence is the least interesting part. Why insider snooping is the breach nobody budgets for, and why you can't rely on prosecution to stop it.
-
The experiment goes live: France bans under-15s
Part 9: France becomes the first country in Europe to ban under-15s from social media — and the first to make everyone verify their age. Braver than Australia's version, and it builds the identity honeypot at national scale. Scoring the law against the argument.
-
An AI broke containment and hacked Hugging Face to cheat a test
An autonomous AI agent broke into Hugging Face's production systems — thousands of actions, stolen credentials, lateral movement. OpenAI admitted it was theirs: models in a cyber eval escaped their sandbox and hacked a real company to cheat the test. Not malice — optimisation.
-
Buying the breach: cyber due diligence, a board read
In a deal you don't just buy revenue — you buy the unpatched servers, the undisclosed incidents, and whoever is already inside the network. A board read on cyber due diligence: what's at stake, what to ask before signing, and why a court just put a PE sponsor on the hook.
-
DORA, a board read: the rulebook that followed you home
The UK left the EU. DORA did not leave the UK. A plain-English board read on the Digital Operational Resilience Act — who it reaches on this side of the Channel, why Article 5 puts it on your desk personally, and what a director should be able to evidence.
-
So what do I actually do?
Seven parts on why the government's plan to protect children online will leak. So here is the other side of the ledger: the evidence-based, do-it-this-weekend guide to protecting your own child — ordered by what genuinely works, not what merely feels reassuring.
-
A curfew you can switch off
The government's midnight social media curfew for 16 and 17-year-olds is a default, not a control — and after 29 years of telling boards the difference, I can't un-see it. Part 1 of a series on what happens when good intentions meet the technical reality of the teenage internet.
-
The AI security starter kit for small business
Seven free documents that take a small firm from "people are quietly using ChatGPT" to governed, defended and drilled in ninety days. A roadmap, a wall chart, a two-page policy, an agents & MCP guide, a board briefing, a self-assessment and a DPIA guide. No email gate.
-
Lessons from the age gate we already built
We don't have to predict how a national age-verification scheme performs. We switched one on last July for pornography, and a year of data is in. Part 6: what the porn age gate actually did — who it stopped, where the traffic went, and the identity honeypot it built along the way
-
The browser in the browser
An age check inspects the visitor in front of it. But what if the visitor is a data centre in Frankfurt, streaming the real site back as video to a child in Fife? Part 5: browser-as-a-service, the school-proxy underground, and the bypass I sell as enterprise security.
-
The dark routes
Every enforcement idea so far has needed a server to find and block. Tor and i2p are built specifically so there isn't one. Part 4: what "just block the dark web" actually asks for, why it fails, and — the twist parents don't expect — why this is the route I worry about least.
-
The federation problem
Enforcement law assumes someone to enforce against — an office, a legal team, revenue to fine. Then there's Mastodon: thousands of servers, many run by one volunteer, in someone else's country. Part 3: what happens to the teen internet rules when there is no company to write to.
-
The week in cyber — 13 to 17 July 2026
Allied agencies named the FSB unit scanning UK routers, Microsoft shipped its largest patch on record with two flaws already exploited, the Cyber Security and Resilience Bill reached the Lords, and a poisoned npm package walked around this year's install-time defences.
-
What counts as social media?
The ban list names the platforms parents can already spell. But grooming happens in a chat window inside a children's game. Part 2: why the law regulates brands while the harm follows a function — and how to audit your household by the function instead.