Tag: hacking

AI and Cybersecurity: Why Trust Is the New Battleground 

Artificial intelligence is reshaping cybersecurity. Recent examples of AI behaving in unexpected ways have added urgency to the debate about how these systems should be controlled and where responsibility lies. The first such case involved ChatGPT-maker OpenAI acknowledging that its model had hacked the Hugging Face website. Anthropic and Meta have also reported similar cases. 

In a recent episode of the Guardians of Data podcast, host Ibrahim Hasan spoke with Caroline Wong, cybersecurity expert and author of The AI Cybersecurity Handbook, about how AI is impacting cyber security; from accelerating attacks and strengthening defences to changing the skills cyber professionals need.  

Lowering the barrier for attackers 

AI is making sophisticated cyber hacking capability available to people with far less training. Tasks once requiring extensive manual effort can now be automated or guided by readily available tools. Caroline explained that someone with only “ten to one hundred hours” of experience may now conduct activities that previously demanded “a thousand or ten thousand hours” of expertise. 

Reconnaissance is a good example of this. Attackers can rapidly gather public information about an individual or organisation, including writing style, vocabulary, voice and professional relationships. A task that once took an hour may now take minutes. This brings privacy, data protection and cybersecurity closer together: organisations must consider what information is public, who can access it and how easily AI can turn scattered data into actionable intelligence. 

Social engineering becomes more convincing 

Social engineering targets human behaviour rather than a technical flaw. AI enables criminals to generate fluent, personalised messages in any language and adopt a credible persona; perhaps a senior executive, a worried relativeor a hurried delivery worker. Old advice about spotting poor grammar or suspicious graphics is no longer enough. Deepfake audio and video can imitate familiar people so convincingly that seeing or hearing is no longer believing. 

Modern scams exploit excitement, pressure and trust, and their quality makes occasional mistakes increasingly understandable. Caroline’s practical test for spotting deepfakes and scams is simple: Did I expect this message? Is it asking me to act, disclose information or transfer money? If anything feels unusual or urgent, verify the request through a separate channel. A call apparently from a relative, for example, should be checked by sending a message using trusted contact details; not by relying on the communication that triggered suspicion. As Caroline says, “You’ve got to pay attention to your nervous system, and you’ve got to learn how to pause.” 

Malware at machine speed 

AI is also changing malware. Traditional cyber defences often rely on signatures: recognisable technical characteristics used to identify and block malicious code.
But attackers can now create many variants quickly, including malware that changes inside a system. As Caroline puts it, “Rule-based detection can’t keep pace with
AI-generated novelty.” 

Defenders therefore need to focus increasingly on behaviour rather than appearance. The challenge is to identify what software is doing, such as unusual access or suspicious movement across a network, rather than relying on a fixed fingerprint that may disappear with the next iteration. 

AI gives defenders an advantage too 

The discussion with Caroline was not all doom and gloom. AI can help defenders not just attackers. It can accelerate repetitive security work, including third-party vendor risk assessments, customer due-diligence questionnaires and information gathering. Automating coordination and routine analysis can free security professionals to spend more time on judgement, governance and strategic risk management. 

However, Caroline cautioned against seeing AI as a product that can simply be purchased to make problems disappear. “AI is not a silver bullet,” she stressed. It remains error-prone, requires experimentation and does not remove the need for human communication or sound security basics. Budget disparities also remain: a small organisation cannot deploy the same resources as a multinational. Even AI usage itself carries ongoing token, operational and environmental costs that leaders must assess over time. 

The vulnerability-fixing gap 

The podcast also explored advanced AI systems capable of finding and exploiting software vulnerabilities far faster than humans. Caroline’s key concern is an emerging imbalance: discovery can be compressed from months or days into minutes, while remediation has not accelerated at the same rate. “We now have a significantly improved approach for finding vulnerabilities, but we don’t yet have an equally speedy approach for fixing vulnerabilities,” she warned. 

She was sceptical that banning powerful AI tools, such as Mythos, would provide a durable solution. Equivalent models are likely to emerge elsewhere and prohibition may concentrate access among a privileged few rather than eliminate the capability. The stronger response is therefore governance, controlled access, coordinated disclosure and investment in faster remediation. 

Trust, judgement and the future workforce 

Ultimately, trust is the new battleground. AI-generated voices, faces and “digital twins” complicate how people establish authenticity. Yet Caroline does not foresee cybersecurity becoming a fully automated discipline. Her five-year vision is a blended workplace in which humans communicate with both human and agentic AI colleagues. The crucial question will be where human oversight is required and at what level of abstraction. 

For professionals in cybersecurity, privacy and data protection, Caroline’s advice is to remain curious, learn quickly and gain hands-on experience with AI. Technical knowledge matters, but so do communication, judgement and the ability to work across organisational boundaries 

The enduring takeaway from this podcast is that AI will amplify capability, not abolish human responsibility. Organisations that combine useful automation with strong governance, verification and experienced judgement will be best placed to manage what comes next. As Caroline observed, “Judgment and opinion and experience are things that the machines cannot take away from us.” 

Listen to the full episode with Caroline Wong here.  

We have two workshops coming up (How to Increase Cyber Security in your Organisation and Cyber Security for DPOs) which are ideal for organisations who wish to upskill their employees about cyber security.

Filming Strangers in Public for Social Media: Are UK Privacy Laws Keeping Pace? 

The growth of social media platforms such as YouTube, TikTok, Instagram and Snapchat has fundamentally changed the way people are photographed and filmed in public. What was once the preserve of professional photographers, journalists and documentary makers has become an everyday activity undertaken by millions of smartphone users. Increasingly, concerns are being raised about people filming strangers without consent and uploading those videos online for entertainment, influence and profit. 

In Episode 6 of the Guardians of Data podcast Ibrahim Hasan spoke with Naomi Mathews  about the legal, ethical and societal issues arising from this trend. The conversation highlighted a difficult reality: while many people feel uncomfortable about being filmed and uploaded to social media without their consent, there is no single law in the UK that directly prohibits such conduct. Instead, individuals (and content creators) must navigate a complex legal framework involving human rights law, data protection, criminal law and platform policies. 

The following is a summary of the podcast:

From the 1970s to TikTok: How Society Has Changed 

For those who grew up in the 1970s and 1980s, photography was a relatively deliberate activity. Cameras were expensive, photographs were limited and normally only shared with family and friends. If a photograph appeared in a newspaper, it would usually have been taken by a professional photographer or journalist. 

Today, nearly everyone carries a high-definition camera in their pocket. Videos can be recorded instantly and uploaded to a global audience within seconds. Social media platforms reward engagement, views and shares, creating powerful incentives for content creators to film members of the public, often without their knowledge. 

The emergence of so-called “street content”, “prank videos” and “nightlife content” has intensified concerns about privacy, dignity and consent. Individuals who have done nothing more than walk down a street, visit a restaurant or enjoy a night out can find themselves the subject of viral videos viewed by millions. 

Do People Have a Right to Privacy in Public? 

One of the most common misconceptions is that people have no privacy rights once they enter a public place; but the law is more nuanced than that. 

Article 8 of the European Convention on Human Rights, incorporated into UK law through the Human Rights Act 1998, protects the right to respect for private and family life. Although public spaces are generally considered less private than homes, the courts have repeatedly recognised that privacy rights can still exist in public settings. 

The leading case is Campbell v MGN Ltd [2004], involving the model Naomi Campbell. She was photographed in a public street while leaving a Narcotics Anonymous meeting. Despite being in a public place, the House of Lords held that she had a reasonable expectation of privacy regarding the sensitive information revealed by the photographs. Similarly, in Murray v Express Newspapers plc [2008], J.K. Rowling successfully argued that photographs of her young child taken in a public street engaged privacy rights. These cases confirmed that privacy is not solely determined by location but also by context. 

Through these cases and others, the courts have developed the tort of misuse of private information, allowing individuals to bring civil claims where private information has been disclosed without justification. However, each case requires a careful balancing exercise between privacy rights under Article 8 and freedom of expression under Article 10. 

Data Protection Law 

Many people are surprised to learn that filming an identifiable individual may engage the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Images and videos of identifiable people constitute personal data. Recording, storing, uploading and sharing such footage can amount to the processing of personal data. Where the UK GDPR applies, those carrying out the processing must have a lawful basis, comply with the data protection principles and respect individuals’ rights. 

However, the law contains important exemptions. The domestic purposes exemption means that filming for purely personal or household activities is generally outside the scope of the UK GDPR. The difficulty lies in determining where personal activity ends and commercial activity starts. A video shared with close family members is very different from content uploaded to a monetised YouTube channel with hundreds of thousands of subscribers. Once filming moves beyond personal use, data protection obligations will arise. 

The law also provides a journalism exemption. This exemption can apply not only to traditional media organisations but also to bloggers, citizen journalists and some social media creators, provided the material is published for journalistic purposes and in the public interest. However, the exemption is not unlimited and must be assessed on a case-by-case basis. 

The Manchester Nightlife Videos 

The legal and ethical tensions surrounding public filming became particularly visible following widespread media coverage of the “Manchester nightlife” videos. 

These videos involved women being filmed during nights out in Manchester city centre, with the footage subsequently uploaded to social media platforms where it attracted substantial audiences. Critics argued that the content objectified women, encouraged online harassment and generated profit from individuals who had never consented to being filmed. 

The controversy prompted police investigations and widespread public debate about whether existing laws adequately protect people from becoming unwilling participants in online content. 

Greater Manchester Police initially arrested an individual on suspicion of stalking and harassment. However, the investigation was later discontinued, with the police citing limitations within the current legislative framework. The outcome highlighted the gap between conduct that many regard as morally objectionable and conduct that is clearly unlawful. 

Criminal Law: Significant Gaps Remain 

While some forms of filming can constitute criminal offences, the criminal law remains limited in scope. The Protection from Harassment Act 1997 can apply where there is a course of conduct that causes alarm or distress. However, a single act of filming is unlikely to satisfy this threshold. 

Similarly, offences under the Sexual Offences Act 2003, including voyeurism, generally require specific elements to be proved. Historically, these provisions have been criticised for failing to keep pace with modern technology. 

Recent reforms have expanded protections against the sharing of intimate images without consent and introduced new offences targeting image-based abuse. Nevertheless, many forms of public filming remain outside the reach of criminal law. 

The challenge for lawmakers is identifying where legitimate filming ends and harmful conduct begins. Few would support criminalising all photography in public places. Equally, many people are uncomfortable with a world in which anyone can be filmed, uploaded and monetised without their knowledge.  

What Can Victims Do? 

Individuals who find themselves featured in unwanted online content have several options available. 

They can complain directly to the platform hosting the content and request removal. They may also raise complaints with the Information Commissioner’s Office where data protection concerns arise. 

In some cases, civil claims for misuse of private information or breaches of data protection law may be available. However, these remedies are often costly and time-consuming. Legal aid is generally unavailable, meaning individuals must fund litigation themselves. 

Law Reform 

The discussion ultimately highlighted a broader concern: the law has struggled to keep pace with technological change. This is particularly where women and girls are targeted. See for example, the Grok AI controversy and its impact on equality for women and girls. (This is covered in Episode 2 of the Guardians of Data podcast.) 

Whether a new law is needed remains controversial. Any reform would need to balance two fundamental rights: freedom of expression and the right to privacy. Neither automatically overrides the other. 

Listen to the full Episode 6 with Naomi. 

Previous episodes of the Guardians of Data podcast have featured Jen Persson, a privacy campaigner, explaining the privacy implications of the Government’s new plans for children’s data and Tahir Latif discussing how to build responsible and ethical AI systems.  

What Recent Cyber Attacks Can Teach Us About Cyber Resilience

Cyber security incidents have become a regular feature of the news cycle.
From attacks on major retailers to breaches affecting public bodies and critical infrastructure, organisations of all sizes are facing increasing threats from cyber criminals. 

In Episode 4 of the Guardians of Data podcast  Ibrahim Hasan spoke with Olu Odeniyi about cyber security through the lens of the recent cyberattacks on major UK retailers. They explored how businesses can build resilience and trust in the face of growing threats, the future of cyber security and practical tips for all of us to stay ahead of the hackers.  The following is an abridged transcript of the podcast: 

Cyber threats are becoming more sophisticated

Cyber criminals are constantly adapting their methods. While ransomware remains a major threat, organisations are also facing attacks involving artificial intelligence, supply chain vulnerabilities, compromised Internet of Things devices and even
state-sponsored actors.  

One of the most significant developments is the increasing use of AI by criminals. Generative AI can create convincing phishing emails, impersonate trusted individuals and help less skilled attackers launch sophisticated campaigns. In the past, poorly written emails were often a warning sign of fraud. Today, AI can produce polished and convincing communications that are much harder to identify as malicious. At the same time, defenders are using AI to improve detection, automate routine tasks and strengthen security monitoring.  

The growing risk of social engineering 

Many recent cyber attacks have not relied on advanced technical exploits.
Instead, attackers have targeted people. Social engineering remains one of the most effective methods of gaining access to systems. Criminals impersonate trusted individuals, helpdesk staff or suppliers to persuade employees to reveal information, reset passwords or approve access requests. 

The attack on Marks & Spencer reportedly involved attackers posing as IT support personnel to trick individuals into resetting credentials and disabling security controls. Once inside the network, attackers were able to move through systems and cause significant disruption. 

This highlights an important point. Technology alone cannot prevent cyber attacks. Security depends on people, processes and technology working together. 

Supply chain attacks are a growing concern

Modern organisations rely heavily on suppliers, contractors and service providers. While this brings efficiency and specialist expertise, it also creates additional cyber risk. Supply chain attacks occur when criminals compromise a third party in order to gain access to their target. Rather than attacking a large organisation directly, attackers often look for weaker points elsewhere in the supply chain. 

The recent retail attacks demonstrate how interconnected organisations have become. Even businesses with mature security programmes can be affected if a trusted supplier is compromised. This means organisations must look beyond their own systems and assess the security of the wider ecosystem they depend upon. 

Why resilience matters

One of the key themes from the discussion was resilience. No organisation can eliminate cyber risk completely. The question is not whether an attack will occur, but how well prepared an organisation is to respond. 

The Co-op’s response to a recent attack illustrates this point. Having experienced previous incidents, the organisation had invested in preparation and incident response planning. This enabled it to detect suspicious activity quickly and take action to limit the damage. 

Early detection is critical. The sooner an attack is identified, the sooner organisations can activate response plans and contain the threat. Cyber resilience means understanding risks, preparing for incidents and ensuring the business can continue operating when problems occur.

Multi-factor authentication is essential but not enough

Multi-factor authentication (MFA) remains one of the most effective security controls available. However, not all forms of MFA provide the same level of protection. 
Many organisations rely on simple push notifications sent to mobile devices.
Attackers have learned how to exploit this through what is known as MFA fatigue.
In these attacks, criminals repeatedly trigger authentication requests in the hope that a user will eventually approve one by mistake. 

Organisations should therefore consider stronger authentication methods, particularly for privileged accounts. Hardware security keys and passkeys offer significantly greater protection and are more resistant to phishing attacks. 

Security controls should be based on risk, with the strongest protections applied to accounts that could cause the most damage if compromised. 

Privileged accounts remain a prime target

Attackers often focus on obtaining privileged or administrator-level access. 
Once criminals gain control of these accounts, they can access sensitive information, disable security tools and move freely through systems. This was highlighted in the discussion of recent retail breaches, where attackers reportedly sought to obtain elevated access after gaining an initial foothold. 

Organisations should ensure privileged access is tightly controlled, regularly reviewed and granted only when necessary. The principle of least privilege remains one of the most effective ways of reducing risk. 

Observability and monitoring are becoming critical

A recurring challenge in cyber security is that many organisations do not realise they have been compromised until weeks or even months after the initial breach. During that time, attackers can explore systems, steal information and establish persistence. Improved monitoring and observability can help organisation identify unusual behaviour more quickly. Understanding what normal activity looks like makes it easier to spot anomalies that could indicate an attack. The ability to detect threats early can significantly reduce the impact of an incident. 

What can individuals do?

Cyber security is not solely an organisational responsibility. Individuals also play an important role in protecting their personal information. Some practical steps include: 

* Using strong and unique passwords for every account. 

* Using a password manager to store credentials securely. 

* Enabling multi-factor authentication wherever possible. 

* Using passkeys where supported. 

* Avoiding the reuse of passwords across different services. 

* Being cautious about the information shared online. 

* Monitoring accounts following any reported data breach. 

Criminals frequently combine information gathered from different sources to make scams appear more convincing. Limiting the amount of personal information available online can reduce this risk. 

The recent wave of cyber-attacks offers several important lessons: 

1. Treat cyber security as a board-level responsibility. 

2. Strengthen supply chain security and vendor oversight. 

3. Invest in incident response planning and regular testing. 

4. Adopt stronger forms of multi-factor authentication. 

5. Limit privileged access and apply the principle of least privilege. 

6. Improve monitoring and threat detection capabilities. 

7. Provide regular staff awareness training focused on social engineering. 

8. Build resilience so the organisation can continue operating during an incident. 

The cyber threat landscape is unlikely to become simpler. The combination of increasing digitalisation, AI-driven attacks, global interconnectivity and geopolitical tensions means organisations will continue to face growing challenges. At the same time, regulation and governance requirements are likely to increase as governments seek to improve cyber resilience across both the public and private sectors. The organisations that succeed will be those that treat cyber security as a business issue rather than simply an IT issue. 

Listen to the full Episode 4 with Olu.  

Previous episodes of the Guardians of Data podcast have featured Jen Persson, a privacy campaigner, explaining the privacy implications of the Government’s new plans for children’s data and Tahir Latif discussing how to build responsible and ethical AI systems.