$ ls writing/ -lt
writing.
Notes from the desk, not thought leadership. Specifics over slogans. If a piece couldn't earn its keep at a kitchen table, it didn't make it here.
Total · 155 pieces
Latest · 2026·08·18 Page · 1 / 7 Locale · en_GB
License · CC BY 4.0
2026·08·18
Struck down before the start: France's court reads the argument back Part 10: eighteen days before launch, France's Constitutional Council struck the under-15 ban down — on the grounds this series pressed: disproportion, and age verification with no guarantees for private life. A reprieve, but the redraft is already commissioned. children · online safety · plain english · series
7 min
2026·08·06
Gaming and online communities in 2026: what changed Revisiting the 2023 post on gaming, voice chat, and the communities that look least like social media. Three years of platform safety overhauls, AI moderation, AI voice in games, and the new financial and AI-companion risks that did not exist last time. privacy · children · gaming · update
7 min
2026·07·25
The first hour Part 3: a child has just told you they are being extorted over an image. What to do, in what order, in the hour that follows. Why not to pay, why not to block before you capture, what Report Remove actually does, and why the image is not the emergency. children · online safety · exploitation · plain english · series
10 min
2026·07·25
The first message is always kind Part 2: how contact with a child actually starts. Not a stranger saying something obviously wrong, but attention, aimed at a child having a bad week. The pattern, the four things that stop them telling you, and the sentence to say before anything happens. children · online safety · exploitation · plain english · series
9 min
2026·07·25
The week in cyber — 20 to 24 July 2026 A zero-click Russian email campaign, a SharePoint patch trailing its own exploitation, an AI agent that escaped its sandbox, and a council insider nobody was watching — four containment failures and the board questions they leave behind. weekly · governance · ned · board
5 min
2026·07·25
They were never on the dark web Part 1 of a new series. Europol has just referred 4,340 URLs tied to The Com, a network that grooms and coerces children on the platforms they already use. Why the dark-web mental model fails parents, what the numbers say, and what follows. children · online safety · exploitation · plain english · series
10 min
2026·07·25
The trapdoor under the safe harbour A pornography company and a speed-camera app have just cost the internet its hosting defence. The Court of Justice says algorithmic ranking is control — and the protection against being made to monitor everything may go with it. Why the ruling I wanted worries me. platform liability · eu law · online safety · free expression · plain english
9 min
2026·07·24
The experiment comes home: Britain bans under-16s Part 10: the experiment comes home. Britain will ban under-16s from social media by spring 2027 — the ban the Commons rejected in March, revived by regulation in June. Held to the same standard as France and Australia, including the objection the government made itself. children · online safety · plain english · series
9 min
2026·07·22
Four days, 490 records: the insider breach nobody budgets for A new council worker opened ~490 sensitive safeguarding records and downloaded 94 over four days — then got a suspended sentence. The sentence is the least interesting part. Why insider snooping is the breach nobody budgets for, and why you can't rely on prosecution to stop it. data protection · insider risk · privacy
8 min
2026·07·22
The experiment goes live: France bans under-15s Part 9: France becomes the first country in Europe to ban under-15s from social media — and the first to make everyone verify their age. Braver than Australia's version, and it builds the identity honeypot at national scale. Scoring the law against the argument. children · online safety · plain english · series
7 min
2026·07·22
An AI broke containment and hacked Hugging Face to cheat a test An autonomous AI agent broke into Hugging Face's production systems — thousands of actions, stolen credentials, lateral movement. OpenAI admitted it was theirs: models in a cyber eval escaped their sandbox and hacked a real company to cheat the test. Not malice — optimisation. AI · agentic ai · assurance
14 min
2026·07·19
Buying the breach: cyber due diligence, a board read In a deal you don't just buy revenue — you buy the unpatched servers, the undisclosed incidents, and whoever is already inside the network. A board read on cyber due diligence: what's at stake, what to ask before signing, and why a court just put a PE sponsor on the hook. governance · ned · board · m&a · due diligence
10 min
2026·07·19
DORA, a board read: the rulebook that followed you home The UK left the EU. DORA did not leave the UK. A plain-English board read on the Digital Operational Resilience Act — who it reaches on this side of the Channel, why Article 5 puts it on your desk personally, and what a director should be able to evidence. regulation · governance · ned · board · resilience
10 min
2026·07·19
So what do I actually do? Seven parts on why the government's plan to protect children online will leak. So here is the other side of the ledger: the evidence-based, do-it-this-weekend guide to protecting your own child — ordered by what genuinely works, not what merely feels reassuring. children · online safety · plain english · series
15 min
2026·07·18
A curfew you can switch off The government's midnight social media curfew for 16 and 17-year-olds is a default, not a control — and after 29 years of telling boards the difference, I can't un-see it. Part 1 of a series on what happens when good intentions meet the technical reality of the teenage internet. children · online safety · plain english · series
7 min
2026·07·18
The AI security starter kit for small business Seven free documents that take a small firm from "people are quietly using ChatGPT" to governed, defended and drilled in ninety days. A roadmap, a wall chart, a two-page policy, an agents & MCP guide, a board briefing, a self-assessment and a DPIA guide. No email gate. small business · ai · policy · plain english
5 min
2026·07·18
Lessons from the age gate we already built We don't have to predict how a national age-verification scheme performs. We switched one on last July for pornography, and a year of data is in. Part 6: what the porn age gate actually did — who it stopped, where the traffic went, and the identity honeypot it built along the way children · online safety · plain english · series
9 min
2026·07·18
The browser in the browser An age check inspects the visitor in front of it. But what if the visitor is a data centre in Frankfurt, streaming the real site back as video to a child in Fife? Part 5: browser-as-a-service, the school-proxy underground, and the bypass I sell as enterprise security. children · online safety · gaming · plain english · series
8 min
2026·07·18
The dark routes Every enforcement idea so far has needed a server to find and block. Tor and i2p are built specifically so there isn't one. Part 4: what "just block the dark web" actually asks for, why it fails, and — the twist parents don't expect — why this is the route I worry about least. children · online safety · plain english · series
8 min
2026·07·18
The federation problem Enforcement law assumes someone to enforce against — an office, a legal team, revenue to fine. Then there's Mastodon: thousands of servers, many run by one volunteer, in someone else's country. Part 3: what happens to the teen internet rules when there is no company to write to. children · online safety · plain english · series
8 min
2026·07·18
The week in cyber — 13 to 17 July 2026 Allied agencies named the FSB unit scanning UK routers, Microsoft shipped its largest patch on record with two flaws already exploited, the Cyber Security and Resilience Bill reached the Lords, and a poisoned npm package walked around this year's install-time defences. weekly · governance · ned · board
5 min
2026·07·18
What counts as social media? The ban list names the platforms parents can already spell. But grooming happens in a chat window inside a children's game. Part 2: why the law regulates brands while the harm follows a function — and how to audit your household by the function instead. children · online safety · gaming · plain english · series
8 min
2026·07·18
What would actually work Six parts on why the plan fails earns one obligation: say what I'd build instead. The finale — a blanket under-18 rule, enforced at the device, attached to the function, with the exceptions designed in. Not perfect; just honest about where the line can actually be held. children · online safety · plain english · series
9 min
2026·07·18
wp2shell: WordPress core has an unauthenticated RCE. Patch now. wp2shell (CVE-2026-63030) is an unauthenticated remote code execution flaw in WordPress core — not a plugin — patched on 17 July in 6.9.5 and 7.0.2. No public exploit yet, but one is coming fast. Why a core flaw is different, and why you should patch every site now. wordpress · web security · patching
8 min
2026·07·17
Cyber security for the non-executive director: the NED's real job Cyber is now a tier-one board risk, but most non-executive directors were never trained for it. What the cyber security NED role actually demands — the questions to ask, the frameworks that matter, and how to hold a board to account without being technical. cyber security · ned · board · governance
10 min
$ grep -l tag:* | sort | uniq
Browse by tag — filtering applies to the list above.