Opinion.

2026·09·06 The unmarkable exam: the child-safety law no one is allowed to grade The Children's Commissioner told a Lords committee that children say the Online Safety Act has made "absolutely no difference" — and that she can't judge it, because Ofcom won't release the platforms' risk assessments. A law built to be unmarkable has already told you something. 6 min 2026·09·04 The week in cyber — 31 August to 4 September 2026 Parliament writes a 24-hour clock into law while attackers work through the appliances at your network edge — four things from the week, each with a decision attached. 6 min 2026·09·01 The consent nobody sought: Britain says no to the keys Someone finally asked the public — and across every party, Britain said it would not trust the state with the keys to its private life. A sidebar to the series that goes to the foundation the whole age-verification project rests on: a consent never sought, and never given. 12 min 2026·08·30 The honeypot changes address Part 11: Meta settles the US child-safety case for up to $18bn and the UN comes out against outright bans — the week the ban model lost the argument. But the age check just moved from the platform to the app store, and the identity honeypot moved with it. 6 min 2026·08·18 Struck down before the start: France's court reads the argument back Part 10: eighteen days before launch, France's Constitutional Council struck the under-15 ban down — on the grounds this series pressed: disproportion, and age verification with no guarantees for private life. A reprieve, but the redraft is already commissioned. 7 min 2026·07·25 The first hour Part 3: a child has just told you they are being extorted over an image. What to do, in what order, in the hour that follows. Why not to pay, why not to block before you capture, what Report Remove actually does, and why the image is not the emergency. 10 min 2026·07·25 The first message is always kind Part 2: how contact with a child actually starts. Not a stranger saying something obviously wrong, but attention, aimed at a child having a bad week. The pattern, the four things that stop them telling you, and the sentence to say before anything happens. 9 min 2026·07·25 The week in cyber — 20 to 24 July 2026 A zero-click Russian email campaign, a SharePoint patch trailing its own exploitation, an AI agent that escaped its sandbox, and a council insider nobody was watching — four containment failures and the board questions they leave behind. 5 min 2026·07·25 They were never on the dark web Part 1 of a new series. Europol has just referred 4,340 URLs tied to The Com, a network that grooms and coerces children on the platforms they already use. Why the dark-web mental model fails parents, what the numbers say, and what follows. 10 min 2026·07·25 The trapdoor under the safe harbour A pornography company and a speed-camera app have just cost the internet its hosting defence. The Court of Justice says algorithmic ranking is control — and the protection against being made to monitor everything may go with it. Why the ruling I wanted worries me. 9 min 2026·07·24 The experiment comes home: Britain bans under-16s Part 10: the experiment comes home. Britain will ban under-16s from social media by spring 2027 — the ban the Commons rejected in March, revived by regulation in June. Held to the same standard as France and Australia, including the objection the government made itself. 9 min 2026·07·22 Four days, 490 records: the insider breach nobody budgets for A new council worker opened ~490 sensitive safeguarding records and downloaded 94 over four days — then got a suspended sentence. The sentence is the least interesting part. Why insider snooping is the breach nobody budgets for, and why you can't rely on prosecution to stop it. 8 min 2026·07·22 The experiment goes live: France bans under-15s Part 9: France becomes the first country in Europe to ban under-15s from social media — and the first to make everyone verify their age. Braver than Australia's version, and it builds the identity honeypot at national scale. Scoring the law against the argument. 7 min 2026·07·22 An AI broke containment and hacked Hugging Face to cheat a test An autonomous AI agent broke into Hugging Face's production systems — thousands of actions, stolen credentials, lateral movement. OpenAI admitted it was theirs: models in a cyber eval escaped their sandbox and hacked a real company to cheat the test. Not malice — optimisation. 14 min 2026·07·19 Buying the breach: cyber due diligence, a board read In a deal you don't just buy revenue — you buy the unpatched servers, the undisclosed incidents, and whoever is already inside the network. A board read on cyber due diligence: what's at stake, what to ask before signing, and why a court just put a PE sponsor on the hook. 10 min 2026·07·19 DORA, a board read: the rulebook that followed you home The UK left the EU. DORA did not leave the UK. A plain-English board read on the Digital Operational Resilience Act — who it reaches on this side of the Channel, why Article 5 puts it on your desk personally, and what a director should be able to evidence. 10 min 2026·07·19 So what do I actually do? Seven parts on why the government's plan to protect children online will leak. So here is the other side of the ledger: the evidence-based, do-it-this-weekend guide to protecting your own child — ordered by what genuinely works, not what merely feels reassuring. 15 min 2026·07·18 A curfew you can switch off The government's midnight social media curfew for 16 and 17-year-olds is a default, not a control — and after 29 years of telling boards the difference, I can't un-see it. Part 1 of a series on what happens when good intentions meet the technical reality of the teenage internet. 7 min 2026·07·18 The AI security starter kit for small business Seven free documents that take a small firm from "people are quietly using ChatGPT" to governed, defended and drilled in ninety days. A roadmap, a wall chart, a two-page policy, an agents & MCP guide, a board briefing, a self-assessment and a DPIA guide. No email gate. 5 min 2026·07·18 Lessons from the age gate we already built We don't have to predict how a national age-verification scheme performs. We switched one on last July for pornography, and a year of data is in. Part 6: what the porn age gate actually did — who it stopped, where the traffic went, and the identity honeypot it built along the way 9 min 2026·07·18 The browser in the browser An age check inspects the visitor in front of it. But what if the visitor is a data centre in Frankfurt, streaming the real site back as video to a child in Fife? Part 5: browser-as-a-service, the school-proxy underground, and the bypass I sell as enterprise security. 8 min 2026·07·18 The dark routes Every enforcement idea so far has needed a server to find and block. Tor and i2p are built specifically so there isn't one. Part 4: what "just block the dark web" actually asks for, why it fails, and — the twist parents don't expect — why this is the route I worry about least. 8 min 2026·07·18 The federation problem Enforcement law assumes someone to enforce against — an office, a legal team, revenue to fine. Then there's Mastodon: thousands of servers, many run by one volunteer, in someone else's country. Part 3: what happens to the teen internet rules when there is no company to write to. 8 min 2026·07·18 The week in cyber — 13 to 17 July 2026 Allied agencies named the FSB unit scanning UK routers, Microsoft shipped its largest patch on record with two flaws already exploited, the Cyber Security and Resilience Bill reached the Lords, and a poisoned npm package walked around this year's install-time defences. 5 min 2026·07·18 What counts as social media? The ban list names the platforms parents can already spell. But grooming happens in a chat window inside a children's game. Part 2: why the law regulates brands while the harm follows a function — and how to audit your household by the function instead. 8 min