Cyber Ethos

Ben Hermann
  • 0.0 (0)
  • Technology

Weekly insights on online privacy, cybersecurity, and AI ethics. Clear, honest, no jargon. New episodes every Thursday. 

Episodes

  1. 2d ago

    The Agent That Wouldn't Take No

    Send us Fan Mail A minor breach with major lessons. An OpenAI agent got around the blocks on a Medicare statistics portal in June, and Australia only found out 84 days later, by email. We unpack what the agent reached, why Services Australia never detected it, and who answers for an intrusion nobody intended. Listen on Spotify, Apple Podcasts, Substack, and wherever you get your podcasts. Check out Cyber Ethos on cyberethos.substack.com (English) or cyberethosde.substack.com (Deutsch)

  2. 4d ago

    No Password, No Rulebook

    Send us Fan Mail What a hacked BYD Shark shows, and what it cannot. A researcher took over parts of a BYD Shark 6 through access with no password, then used its microphone and speakers to make an unlocked iPhone reveal personal details. We unpack what the ABC Four Corners test showed, what it cannot show, and why Australia has no minimum cybersecurity standards for cars. Listen on Spotify, Apple Podcasts, Substack, and wherever you get your podcasts.Check out Cyber Ethos on cyberethos.substack.com (English) or cyberethosde.substack.com (Deutsch)

  3. Sep 16

    Pace the Frontier, Skip the Accountability

    Send us Fan Mail What Amodei's slowdown letter leaves out, and what a Grok CSAM lawsuit tests. Anthropic CEO Dario Amodei published a letter asking AI companies to pace themselves: independent evaluators, shared speed limits, eventual coordination with China. Days earlier, a child sexual abuse survivor sued Elon Musk's xAI, alleging Grok generated new CSAM from real images of her. We unpack what the letter actually proposes and why a live lawsuit against a signatory's own company is the real test of self-policing. Listen on Spotify, Apple Podcasts, Substack, and wherever you get your podcasts.Check out Cyber Ethos on cyberethos.substack.com (English) or cyberethosde.substack.com (Deutsch)

  4. Sep 9

    GDPR Fines Meet a State Mega-Breach

    Send us Fan Mail What two hospital fines and a 6TB ransomware leak say about Article 32. France's CNIL fined Hôpital Privé de la Loire EUR 500,000 over missing MFA, missing VPN protection, and a failure to notify over 200,000 trusted contacts. Ireland's DPC fined the HSE EUR 645,000 over unsecured paper records. Then Berlin's state administration lost 1.4 million files to the Rhysida ransomware group, including chemical, biological, radiological and nuclear threat-planning documents, after refusing a ransom demand. We unpack what these three stories say about where GDPR enforcement is actually landing in 2026.Check out Cyber Ethos on cyberethos.substack.com (English) or cyberethosde.substack.com (Deutsch)

  5. Sep 2

    Uber's €824.99 Million Fine Sets a New Bar for Automated Decision Accountability

    Send us Fan Mail The Dutch Data Protection Authority's record penalty turns GDPR's automated-decision rules from theory into enforcement. This week, the Dutch Data Protection Authority fined Uber B.V. and Uber Technologies Inc. €824.99 million after finding that driver accounts were deactivated through fully automated decisions with no human intervention, and that drivers were not adequately informed about the basis for those decisions. France's CNIL took part through the GDPR's cross-border cooperation procedure. This is a GDPR Article 22 enforcement action, not AI Act guidance, and it sets a clear precedent for any platform using automated, consequential decision-making.Check out Cyber Ethos on cyberethos.substack.com (English) or cyberethosde.substack.com (Deutsch)

  6. Aug 26

    AI Transparency Becomes Law: Finland, France, and the FTC Respond

    Send us Fan Mail Three regulators, one week, and the first real test of AI Act transparency This week, three regulators moved on AI transparency and pricing fairness within days of each other. Finland's Traficom activated supervision of most EU AI Act transparency duties on 20 August, covering direct AI interaction disclosure, machine detectable synthetic content and mandatory biometric notice. Most duties have applied since 2 August 2026, with a transition for legacy system marking running to 2 December 2026. France's CNIL updated its AI Act guidance on 17 August to confirm GDPR obligations run independently of AI Act compliance, even where documentation overlaps, following the AI Omnibus that entered into force on 27 July. In the United States, the FTC opened consultation on 19 August on a policy statement that would require disclosure whenever a price is personalized using personal data, rather than banning the practice outright. Comments close 18 September 2026. Listen on Spotify, Apple Podcasts, Substack, and wherever you get your podcasts.Check out Cyber Ethos on cyberethos.substack.com (English) or cyberethosde.substack.com (Deutsch)

  7. Aug 19

    S1E20: Can You Spot the AI?

    Send us Fan Mail Inside the Industry's New Transparency Push This week Anthropic, Spotify, Suno and Substack all rolled out new AI-content labelling. Anthropic now automatically watermarks everything Claude generates, citing EU AI Act Article 50. Spotify is badging AI artist profiles. Suno added watermarking and fingerprinting. Substack built in the AI detector Pangram. A Deezer study found 97 percent of listeners cannot tell AI-generated music from the real thing. We look at whether watermarking actually holds up, and what happens once someone builds a way around it.Check out Cyber Ethos on cyberethos.substack.com (English) or cyberethosde.substack.com (Deutsch)

  8. Aug 15

    S1E19: When Your Car Reports You

    Send us Fan Mail The EU's Plan to Auto-Limit Speed A new EU proposal could let your car's engine decide when you've gone too fast.    This week on Cyber Ethos, we look at the European Commission's early-stage investigation into a satellite- and camera-based system that would automatically restrict engine power when a vehicle exceeds the speed limit, no warning, no easy override. We unpack why this shifts a well-understood advisory system, ISA, into a safety-critical actuator with a much larger attack surface, and what that means for drivers, regulators and anyone thinking about the security of connected vehicles.    Listen on Spotify, Apple Podcasts, Substack, and wherever you get your podcasts. Check out Cyber Ethos on cyberethos.substack.com (English) or cyberethosde.substack.com (Deutsch)

  9. Aug 9

    AI Regulation: Delays, Hurdles, and NeEurope Rewrites Its AI Rules: Delayed Deadlines, Tougher Bansw Prohibitions

    Send us Fan Mail  | S1E18 – The EU’s Digital Omnibus delays high-risk AI deadlines but adds new bans and mandatory marking of all synthetic content  | The EU’s Digital Omnibus on AI entered into force on 27 July 2026, rewriting the AI Act’s implementation timeline. High-risk AI deadlines are pushed to December 2027, but new prohibitions on CSAM and non-consensual intimate imagery, plus mandatory machine-readable marking of all synthetic outputs, make the rules tougher where it matters most.  This episode covers: the 16-month deadline extension for high-risk systems. New prohibited practices not in the original Act. Transparency obligations starting 2 August 2026. Italy’s enforcement against Character Technologies over minors. EDPB guidelines on web scraping for generative AI. The stakeholder consultation risk for democratic governance.  Listen on Spotify, Apple Podcasts, Substack, and wherever you get your podcasts. Check out Cyber Ethos on cyberethos.substack.com (English) or cyberethosde.substack.com (Deutsch)

  10. Jul 29

    Scanned First, Regulated Later: Western Australia's Live Facial Recognition Trial

    Send us Fan Mail S1E17 - Western Australia's live facial recognition trial, the real error rate behind the headline figures, and the privacy law that arrived nine days too late Western Australia Police became the first police force in Australia to deploy live facial recognition in public spaces. In five weeks, the system scanned more than 131,000 faces, generated 33 alerts, and led to 19 arrests - all before the state's new privacy law had fully come into force, and without the state's own privacy watchdog being consulted on the trial's design. This episode covers: how live facial recognition differs from a normal camera, the real false-alert rate hiding behind the headline scan count, the regulatory gap that let the trial begin before the law caught up, and why Australia has no equivalent to the EU's restrictions on real-time biometric surveillance. Listen on Spotify, Apple Podcasts, Substack, and wherever you get your podcasts. Check out Cyber Ethos on cyberethos.substack.com (English) or cyberethosde.substack.com (Deutsch)

  11. Jul 22

    How Old Are You, Really? Inside the EU's Privacy-First Bet on Child Safety

    Send us Fan Mail S1E16 – Inside the EU's zero-knowledge push to verify age online without collecting identity The EU's new age verification app promises to confirm you're old enough for a platform without ever learning who you are. This episode unpacks the Commission's Recommendation, the DSA enforcement actions against Meta and Snapchat that made it necessary, the zero-knowledge proof design behind it, and its surprising new reach into AI companions and chatbots.  This episode covers: the enforcement gap in self-declared ages; zero-knowledge proof verification and the EU Digital Identity Wallet; the patchwork of national minimum ages; AI chatbots and companions entering the scope; and the circumvention risks the Commission openly acknowledges.  Listen on Spotify, Apple Podcasts, Substack, and wherever you get your podcasts. Check out Cyber Ethos on cyberethos.substack.com (English) or cyberethosde.substack.com (Deutsch)

  • 11 Episodes

About

Weekly insights on online privacy, cybersecurity, and AI ethics. Clear, honest, no jargon. New episodes every Thursday. 

Information

  • Creator
    Ben Hermann
  • Years Active
    2026
  • Episodes
    11
  • Rating
    Clean
  • Copyright
    © 2026 Ben Hermann (Cyber Ethos)