Posted on

Top 10 IT careers and skills stories of 2025

Artificial intelligence (AI) played a significant role in the tech skills landscape in 2025, from helping teachers do their jobs to becoming a vital skill for people to learn.

On the other hand, hiring across the technology sector was less predictable, with fewer jobs advertised, though having the right skills was found to increase job security.

Skills will continue to be important going forward, regardless of where AI takes the sector.

Admin tasks are one of the useful ways AI can make jobs easier, and at the 2025 BETT Show, the UK’s education secretary, Bridget Phillipson, claimed using it for lesson planning would free up teachers’ time for other tasks.

The UK government’s plans for the future will have teachers using AI for marking, lesson planning and personalised student feedback to leave them time to give students “the best education possible”.

The plans came alongside the government’s Plan for Change and its AI Opportunities Action Plan.

The technology job market has seen many ups and downs in recent years, seeing a spike during the pandemic followed by widespread redundancies.

In 2024, research by the Recruitment and Employment Federation (REC) found a year-on-year drop in the number of advertised tech roles, possibly as firms let the hiring landscape settle before committing to increasing numbers again.

Interest in a future technology career is more prominent among young people in the UK with special educational needs and disabilities (SEND), research found.

EngineeringUK and The Royal Society found, as part of their Science education tracker, that of the 47% of students who said they would be interested in a tech role in the future, 43% were SEND students versus 37% non-SEND students.

Encouraging young people, particularly girls, into the technology sector has been an ongoing battle, and 2025 found fewer students were interested in taking a more technical educational route than anticipated.

A report by the National Audit Office (NAO) found the Department for Education (DfE) overestimated the number of people who would be likely to take T-levels. Originally, the DfE had aimed to have 100,000 students starting a T-level in September 2025, but had to revise this number due to slower-than-expected uptake, with its latest model showing around 50,000 to 60,000 students will be taking T-levels by September 2027.

Because technology skills are in high demand, roles that require a technical skillset offer more reliability than others, according to research.

Research from LiveCareer found employees in the UK change jobs every 2.6 years on average, whereas those in roles such as robotics engineering and Java programming stay in one place for longer than average, making these careers “highly stable”.

Practical lessons at school motivate children to continue to pursue subjects and contribute towards them possibly having science, technology, engineering and maths (STEM) careers in the future, according to research.

But EngineeringUK and The Royal Society’s Science education tracker found a decline in practical classes being delivered in recent years, with more needing to be done to deliver hands-on education in the future.

Digital skills are extremely important, not only for the future of work but also for modern life, so it was a surprise to find research suggesting many children aren’t taught how to code at school.

Research from the Raspberry Pi Foundation found 70% of parents claim their children aren’t being taught how to code as part of their normal school lessons.

Philip Colligan, CEO of the education charity, warned against this becoming the norm, stating that this trend risks forgetting what skills learning to code brings with it.

An investigation into how AI is being used in schools found that many education providers are using the technology to offer personalised assistance to children who may need extra help due to life circumstances.

The Office for Standards in Education, Children’s Services and Skills (Ofsted) looked into early adopters of the technology to find out how it’s being used and assess the positives and challenges of using AI in an educational setting.

While the overall number of students choosing A-level computing dropped in 2025, the number of girls taking the subject rose for the sixth year in a row.

Girls also achieved higher grades than their male counterparts, with grade attainment increasing across the board.

However, the number of girls taking GCSE computing dropped in 2025, along with the overall number of candidates.

As the year rounded out, motor parts retailer Halfords recommended people focus on hands-on skills going forward as AI changes the tech job landscape.

Research by Halfords found parents agree with this direction, with 89% of parents having changed the advice they give their children about careers in the wake of AI adoption.

The concern is that AI will make it more difficult for people to find jobs in the future, so differing skillsets will make them more desirable candidates.

Source

Posted on

Top 10 technology ethics stories of 2025

Throughout 2025, Computer Weekly’s technology and ethics coverage highlighted the human and socio-technical impacts of data-driven systems, particularly artificial intelligence (AI).

This included a number of reports on how the Home Office’s electronic visa (eVisa) system, which has been plagued by data quality and integrity issues from the outset, is affecting migrants in the UK; the progress of both domestic and international efforts to regulate AI; and debates around the ethics of autonomous weaponry.

A number of stories also covered the role major technology companies have played in Israel’s genocide against Palestinians, which includes providing key digital infrastructure and tools that have enabled mass killings.

In June 2025, Computer Weekly reported on ongoing technical difficulties with the Home Office’s electronic visa (eVisa) system, which has left scores of people living in the UK with no means to reliably prove their immigration status or “right” to be in the country.

Those affected by the eVisa system’s technical failings told Computer Weekly, on condition of anonymity, that the entire experience had been “anxiety-inducing” and described how their lives had been thrust into “uncertainty” by the transition to a digital, online-only immigration system.

Each also described how the “inordinate amount of stress” associated with not being able to reliably prove their immigration status had been made worse by a lack of responsiveness and help from the Home Office, which they accused of essentially leaving them in the lurch.

In one case that was reported to the Information Commissioner’s Office, the technical errors with data held by the Home Office were so severe that it found a breach of UK data protection law.

Following the initial AI Safety Summit at Bletchley Park in November 2023 and the follow-up AI Seoul Summit in May 2024, the third AI Action Summit in Paris saw dozens of governments and companies outline their commitments to making the technology open, sustainable and work for the “public interest”.

However, speaking with Computer Weekly, AI experts and summit attendees said there was a clear tension in the direction of travel, with the technology caught between competing rhetorical and developmental imperatives.

They noted, for example, that while the emphasis on AI as an open, public asset was promising, there was worryingly little in place to prevent further centralisations of power around the technology, which is still largely dominated by a handful of powerful corporations and countries.

They added that key political and industry figures – despite their apparent commitments to more positive, socially useful visions of AI – were making a worrying push towards deregulation, which could undermine public trust and create a race to the bottom in terms of safety and standards.

Despite the tensions present, there was consensus that the summit opened more room for competing visions of AI, even if there was no guarantee these would win out in the long run.

In February 2025, Google parent Alphabet dropped its pledge not to use AI in weapons systems or surveillance tools, citing a need to support the national security of “democracies”.

Despite previous commitments that made it explicit the company would “not pursue” the building of AI-powered weapons, Google – whose company motto ‘Don’t be Evil’ was replaced in 2015 with ‘Do the right thing’ – said it believed “democracies should lead in AI development, guided by core values like freedom, equality and respect for human rights”.

For military technology experts, however, the move represented a worrying change. They noted that while companies such as Google had already been supplying military technology to a range of actors, including the US and Israel, “it indicates a worrying acceptance of building out a war economy” and “signals that there is a significant market position in making AI for military purposes”.

Google’s decision was also roundly condemned by human rights organisations across the globe, which called it “shameful” and said it would set a “dangerous” precedent going forward.  

Speaking during an event hosted by the Alan Turing Institute, military planners and industry figures claimed that using AI in military contexts could unlock a range of benefits for defence organisations, and even went as far as claiming there was an ethical imperative to deploy AI in the military.

Despite being the lone voice not representing industry or military interests, Elke Schwarz, a professor of political theory at Queen Mary University London and author of Death machines: The ethics of violent technologies, warned there was a clear tension between speed and control baked into the technology.

She especially argued this “intractable problem” with AI risks taking humans further out of the military decision-making loop, in turn reducing accountability and lowering the threshold for resorting to violence.

Highlighting the reality that many of today’s AI systems are simply not very good yet, she also warned against making “wildly optimistic” claims about the revolutionary impacts of the technology in every aspect of life, including warfare.

Workers in Kenya employed to train and maintain the AI systems of major technology companies formed the Data Labelers Association (DLA) this year to challenge the “systemic injustices” they face in the workplace, with 339 members joining the organisation in its first week.

While the popular perception of AI revolves around the idea of an autodidactic machine that can act and learn with complete autonomy, the reality is that the technology requires a significant amount of human labour to complete even the most basic functions.

Despite Kenya becoming a major hub for AI-related labour, the DLA said data workers were tremendously underpaid, often earning just cents for tasks that take a number of hours to complete, and yet still face frequent pay disputes over withheld wages that are never resolved.

During the launch, DLA secretary Michael Geoffrey Abuyabo Asia said weak labour laws in Kenya were being deliberately exploited by tech companies looking to cheaply outsource their data annotation work.

The Home Office is operating at least eight AI-powered surveillance towers along the south-east coast of England, which critics have said are contributing to migrant deaths in the English Channel, representing a physical marker of increasing border militarisation that is pushing people into taking ever more dangerous routes.

As part of a project to map the state of England’s coastal surveillance, the Migrants Rights Network (MRN) and researcher Samuel Story identified eight operational autonomous surveillance towers between Hastings and Margate where people seeking asylum via the Channel often land, as well as two more that had either been dismantled or relocated.

Responding to their freedom of information (FoI) requests, the Home Office itself also tacitly acknowledged that increased border surveillance would place migrants crossing the Channel in “even greater jeopardy”.

Created by US defence company Anduril – the Elvish name for Aragorn’s sword in The Lord of the Rings, which translates to “flame of the west” – the 5.5m-tall maritime sentry towers are fitted with radar, as well as thermal and electro-optical imaging sensors, enabling the detection of “small boats” and other water-borne objects in a nine-mile radius.

Underpinned by Lattice OS, an AI-powered operating system marketed primarily to defence organisations, the towers are capable of autonomously piecing together data collected from thousands of different sources, such as sensors or drones operated by Anduril, to create a “real-time understanding of the environment”.

The European Commission has been ignoring calls to reassess Israel’s data adequacy status for over a year, despite “urgent concerns” about the country’s data protection framework and “repressive” conduct in Gaza.

In April 2024, a coalition of 17 civil society groups coordinated by European Digital Rights signed an open letter voicing concerns about the commission’s January 2024 decision to uphold Israel’s adequacy status, which permits the continued free flow of data between the country and the European Union on the basis that each has “essentially equivalent” data protection standards.

Despite their calls for clarification from the commission on “six pivotal matters” – including the rule of law in Israel, the scope of its data protection frameworks, the role of intelligence agencies, and the onward transfer of data beyond Israel’s internationally recognised borders – the groups received no response, prompting them to author a second open letter in June 2025.

They said it was clear the commission is unwilling to uphold its own standards when politically inconvenient.

Given that Israel’s tech sector accounts for 20% of its overall economic output and 53% of total exports, according to a mid-2024 report published by the Israel Innovation Authority, losing adequacy could have a profound effect on the country’s overall economy.

The European Commission told Computer Weekly it was aware of the open letters, but did not answer questions about why it had not responded.

Francesca Albanese, the special rapporteur for the human rights situation in Palestine, said in July 2025 that technology firms globally were actively “aiding and abetting” Israel’s “crimes of apartheid and genocide” against Palestinians, and issued an urgent call for companies to cease their business activities in the region.

In particular, she highlighted how the “repression of Palestinians has become progressively automated” by the increasing supply of powerful military and surveillance technologies to Israel, including drones, AI-powered targeting systems, cloud computing infrastructure, data analytics tools, biometric databases and high-tech weaponry.

She said that if the companies supplying these technologies had conducted the proper human rights due diligence – including IBM, Microsoft, Alphabet, Amazon and Palantir – they would have divested “long ago” from involvement in Israel’s illegal occupation of Gaza and the West Bank.

“After October 2023, long-standing systems of control, exploitation and dispossession metamorphosed into economic, technological and political infrastructures mobilised to inflict mass violence and immense destruction,” she said. “Entities that previously enabled and profited from Palestinian elimination and erasure within the economy of occupation, instead of disengaging, are now involved in the economy of genocide.”

Under international law, however, Albanese pointed out that the mere fact that due diligence had been conducted did not absolve companies from legal liability over their role in abuses. Instead, the liability of companies is determined by both their actions and the ultimate human rights impact.

Later, in October 2025, human rights organisations jointly called for Microsoft to immediately end any involvement with the “Israeli authorities’ systemic repression of Palestinians” and work to prevent its products or services being used to commit further “atrocity crimes”.

This followed credible allegations that Microsoft Azure was being used to facilitate mass surveillance and lethal force against Palestinians, which prompted the company to suspend services to the Israeli military unit responsible.

As part of a joint Parliamentary inquiry set up to examine how human rights can be protected in “the age of artificial intelligence”, expert witnesses told MPs and Lords that the UK government’s “uncritical and deregulatory” approach to AI would ultimately fail to deal with the technology’s highly scalable harms, and could lead to further public disenfranchisement.

“AI is regulated in the UK, but only incidentally and not well … we’re looking at a system that has big gaps in [regulatory] coverage,” said Michael Birtwistle, the Ada Lovelace Institute’s associate director of law and policy, adding that that while the AI opportunities action plan published by the government in January 2025 outlined “significant ambitions to grow AI adoption”, it contained little on what actions could be taken to mitigate AI risks, and made “no mention of human rights”.

Experts also warned that the government’s current approach, which they said favours economic growth and the commercial interests of industry above all else, could further deepen public disenfranchisement if it failed to protect ordinary people’s rights and made them feel like technology was being imposed on them from above.

Witnesses also spoke about the risk of AI exacerbating many existing issues, particularly around discrimination in society, by automating processes in ways that project historical inequalities or injustices into the future.

In January 2025, Computer Weekly reported on how Black mothers from Birmingham had organised a community-led data initiative that aims to ensure their perinatal healthcare concerns are taken seriously by medical professionals.

Drawn from Maternity Engagement Action (MEA) – an organisation that provides safe spaces and leadership for black women throughout pregnancy, birth and early motherhood – the women came together over their shared concern about the significant challenges faced by black women when seeking reproductive healthcare.

Through a process of qualitative data gathering – entailing discussions, surveys, workshops, trainings and meetings – the women developed a participatory, community-focused approach to black perinatal healthcare, culminating in the launch of MEA’s See Me, Hear Me campaign.

Speaking with Computer Weekly, Tamanda Walker – a sociologist and founder of community-focused research organisation Roots & Rigour – explained how the initiative ultimately aims to shift from the current top-down approach that defines black perinatal healthcare, to one where community data and input drives systemic change in ways that better meet the needs of local women instead.

Source

Posted on

Top 10 surveillance, journalism and encryption stories of 2025

The tension between the rights of individuals to a private life and increasing demands from states to gain access to people’s private data increased in 2025.

During the year, Computer Weekly was the first to break several stories about the Home Office’s attempts to order Apple to give the British government access to encrypted data stored on Apple’s iCloud Advanced Data Protection (ADP) service.

Computer Weekly joined with other news publications and broadcasters to file legal submissions to successfully argue that the hearings should be held in open court after learning that the Investigatory Powers Tribunal (IPT) had cryptically listed a hearing into the case.

The UK’s intervention sparked an international row between US politicians, who were outraged that the UK’s technical capability notice (TCN) would give the UK government access to the private data of US citizens, ultimately forcing the UK to narrow its demands. Further legal hearings are likely to be brought next year by civil society groups without Apple.

An attempt by the European Union (EU) to require tech companies that provide encrypted chat and messaging services to install technology that scans messages before they are encrypted caused a backlash from technology and security experts, who warned that it would weaken security. Further attempts by the EU to reintroduce a version of Chat Control are expected in 2026.

We also reported on Europol’s attempts to develop artificial intelligence (AI) systems to analyse huge quantities of data covertly seized during international police operations against cryptophone networks EncroChat and Sky ECC. Our report highlighted Europol’s uneasy relationship with the European data protection supervisor and raised concerns about the lack of transparency by the policy agency.

Computer Weekly also interviewed GCHQ historian Dave Abrutat and Dame Muffy Calder, head of the surveillance regulator (IPCO)’s Technical Advisory Panel (TAP), shedding light on previously unreported aspects of intelligence gathering and oversight, both current and historic.

It is described by critics as a data grab and surveillance creep strategy. Europol calls it Strategic Objective 1: to become the EU’s “criminal information hub” through a strategy of mass data acquisitions.

Since 2021, the Hague-based EU law enforcement agency has embarked on an increasingly ambitious, yet largely secretive, mission to develop automated models that will affect how policing is carried out across Europe.

Based on internal documents obtained from Europol and analysed by data protection and AI experts, this investigation raises serious questions about the implications of the agency’s AI programme for people’s privacy. It also raises questions about the impact of integrating automated technologies into everyday policing across Europe without adequate oversight.

In November, London court heard that The Security Service, MI5, made “multiple” unlawful applications for phone data in an attempt to identify the confidential sources of a former BBC journalist.

The Investigatory Powers Tribunal heard that MI5 unlawfully sought the phone records of reporter Vincent Kearney on “at least” four occasions between 2006 and 2009 when he worked for the BBC in Northern Ireland.

Jude Bunting KC, representing the BBC and Kearney, told the tribunal that MI5 should disclose whether it had carried out further surveillance against Kearney and other BBC journalists for what it regards as lawful reasons.

In March, the IPT took the unusual step of publishing a notification of a closed-door hearing, days after leaks revealed that Apple was intending to appeal against the secret order.

Press and civil society groups later petitioned the tribunal, which rules on matters of national security, to hold the hearings in open court, given the important public interest surrounding the case and the fact that the government’s order had been widely leaked.

The decision by home secretary Yvette Cooper to issue a TCN requiring Apple to give UK law enforcement and intelligence services “backdoor” access to data stored by Apple’s customers on the encrypted version of its iCloud service raised tensions between the UK and the US.

In September, we reported that a lawyer representing Hamas in a legal case in the UK is seeking a judicial review to challenge North Wales Police after he was stopped and questioned, and his mobile phone seized.

The solicitor, Fahad Ansari, an Irish citizen, was detained for nearly three hours after being stopped under Schedule 7 of the Terrorism Act 2000, which allows police to seize and copy electronic devices at UK borders without reason for suspicion.

The case is understood to be the first time police have used Schedule 7 of the Terrorism Act to seize a phone belonging to a solicitor in the UK.

Ansari has filed a claim for a judicial review against the chief constable of North Wales Police and the Home Office.

US lawmakers have hit out at the UK Home Office for “attempting to gag” US companies by preventing them from telling Congress whether they have been subject to secret UK orders requiring them to hand over their users’ data.

In an unprecedented intervention, five lawmakers from both sides of the US political divide, led by senator Ron Wyden, wrote to the IPT in March, accusing the British government of undermining Congressional oversight and restricting the free speech of US companies.

Their letter came as the IPT was preparing to hear closed-door arguments from Apple, which challenged a notice requiring it to extend UK law enforcement’s existing access to encrypted data stored by customers on the Apple iCloud service anywhere in the world to users of its ADP who choose to hold encryption keys privately on their own devices.

An obscure British government committee was asked in February to advise home secretary Yvette Cooper on whether to go ahead with government demands that Apple provide British agents with a secret backdoor to break into the company’s iCloud ADP system, enabling British spies to secretly copy and read users’ private data.   

The government committee, called the Technical Advisory Board (TAB), is charged with reviewing secret legal orders given to internet communications companies to arrange surveillance of their users, and to copy their emails and files, or monitor their calls and videos. Enquiries by Computer Weekly revealed, astonishingly, that the Home Office had failed to renew the contracts for TAB members.

For Dame Muffy Calder and the small group of academics, former spies and technical experts that advise Britain’s oversight body for intelligence agencies and police on developments in technology, their work is all about “trust”.

Calder, a distinguished computer scientist whose research interests include artificial intelligence, computational modelling and automated reasoning, is the chair of the Technical Advisory Panel, a group of six experts charged with advising Britain’s surveillance oversight body.

The role of the TAP is to advise the Investigatory Powers Commissioner’s Office (IPCO), overseen by Brian Leveson in his role as investigatory powers commissioner, and nine judicial commissioners who provide independent oversight of the police and intelligence services’ use of intrusive surveillance powers.

Can this small group of experts act as an effective counterbalance to organisations such as GCHQ, MI5 and MI6, which had a combined budget of £4.5bn in 2024-2025?

The European Commission has been accused of rigging the selection process for Europe’s next data protection watchdog in favour of its own candidate, according to a complaint submitted to the European Ombudsman and shared with Computer Weekly.

Submitted by privacy experts Maria Farrell, Douwe Korff and Ian Brown, the complaint alleged “procedural irregularities” with the commission-led process, including a lack of transparency around the selection criteria for shortlisted candidates, the identities of the selection committee and why certain decisions had been made.

Canadian businessman Thomas Herdman is awaiting trial in France for his alleged role in the distribution of modified smartphones installed with the Sky ECC app.

The 63-year-old was arrested in June 2021, despite cooperating with US investigators over his involvement with the encrypted communications firm Sky ECC. He has spent 45 months in pre-trial detention since.

Computer Weekly spoke to Herdman’s daughter, Julie Kawai Herdman, who says her father is innocent, citing inaccuracies in the evidence and flawed legal processes. 

During the Second World War, there were an estimated 250 signals intelligence sites across the UK, from as far south as Cornwall to as far north as the Orkneys.

Many important sites are now in danger of disappearing, either being demolished for housing or simply being left to decay, and their significance is being lost to history.

Dave Abrutat, the official historian at GCHQ, is on a mission to preserve this history before it is lost and the folk memories are forgotten.

Abrutat estimates that since the First World War, tens of thousands of people have worked in signals intelligence and communications security in organisations as diverse as the Post Office, the Admiralty, the Royal Signals and the Foreign Office, and US Airforce sites such as Chicksands in Bedfordshire, known for its “elephant cage” radio receiver.

Source

Posted on

Top 10 women in tech and diversity in tech stories

The past year has brought uncertainty for diversity in the tech sector as the landscape in the US turned sour, with President Donald Trump ordering the termination of diversity, equity and inclusion (DEI) projects and roles.

There were concerns that UK companies would follow suit, but as the year went on, it became clear that many are still leading the charge to improve diversity in the sector.

But research also found the number of women in tech is still growing very slowly, and women are leaving the sector in larger numbers, so as the year bows out, many questions remain about how the diversity landscape will look next year in the UK tech sector.

The write-up from the 2024 Computer Weekly and Harvey Nash Diversity in Tech event shone a light on the overlapping experiences of some underrepresented groups and how organisations can cater to these individuals.

While there has been an increasing focus on hiring specific groups of people, such as women or people of colour, this can overlook how having more than one of these characteristics can affect employee experience in the technology sector.

Firms need to better understand people’s individual experiences and make the work environment safe for everyone to better take advantage of the positives a diverse workforce can bring.

There are many reasons women avoid the technology sector, and a survey from recruitment firm Lorien found that a lack of work-life balance is a big barrier for women in tech.

Women are more likely than men to shoulder the burden of caregiving, whether for children or older family members, and without flexibility at work, this can be difficult to maintain.

Lorien’s research found that 45% of women have had difficulties with work-life balance in their role, making it the biggest barrier they have faced in their careers.

With artificial intelligence (AI) becoming increasingly embedded in everyday life, there has been a focus on ensuring the teams developing the technology reflect its diverse user base.

To this end, the UK government announced plans this year to increase the number of girls taking maths at A-level in a bid to encourage more girls into careers in AI.

As the year went on, more evidence emerged that a lack of flexibility is standing in the way of increased diversity in the tech sector.

Research conducted on behalf of the Department for Science, Innovation and Technology (DSIT) found that a lack of access to flexible working and unconscious bias are among the barriers preventing underrepresented groups from going into technology roles.

The hiring process, a lack of representation across job levels and a lack of flexible working arrangements were identified among the challenges DSIT flagged as needing “considered and sustained efforts” to address.

Further solidifying the dire state of affairs when it comes to the lack of women in the technology industry, the release of the Oliver Wyman and WeAreTechWomen Lovelace report confirmed that women are leaving the technology sector in large numbers.

Between 40,000 and 60,000 women are leaving digital roles each year, some for new roles and some to exit the sector, in many cases because of a lack of development opportunities in their careers.

Sadly, the technology sector lost a great in August, with the passing of Dame Stephanie Shirley at the age of 91.

A serial founder, entrepreneur and philanthropist, Shirley was part of the technology sector for more than 50 years, and was famously known for adopting her family nickname, Steve, to be taken seriously after efforts to start her own company fell on deaf ears once it was clear she was a woman.

Shirley was a pioneer in flexible working, founding a technology company called Freelance Programmers in 1962, where the staff of predominantly women worked from home selling software and programming.

She will be missed.

Research from The Adaptavist Group found that unequal access to AI is preventing women and people from underrepresented backgrounds from learning how to use the technology properly.

This is causing an “opportunity gap”, whereby AI training is more available to some than others – 84% of those from higher income households believe they’ve received good guidance on how to use AI compared with only 59% in the lower income bracket.

In November, Naomi Timperley, co-founder of Tech North Advocates, became the 14th person to be named Computer Weekly’s most influential woman in UK tech.

The announcement was made alongside the rest of the top 50, as well as Computer Weekly’s 2025 Rising Stars, and the list of women in tech Hall of Famers.

Throughout 2025, Beckie Taylor, public speaker and founder of Tech Returners, created a six-part documentary series called Breaking the sound barrier – voices unleashed, following the journeys of 10 women in technology as they learned skills in public speaking.

Aiming to help women at all stages in their careers build confidence, the documentary sought to show the progression of role models in the technology sector as they learn to take advantage of their influence in the sector.

While the technology sector claims it understands the need for diverse groups in senior positions, there remains a lack of women and underrepresented groups at the top.

The year rounded out with research from consultancy Think & Grow finding the UK’s fastest-growing technology startups and scaleups lack women in top positions.

According to the research, only 12% of the fastest-growing startups in the UK have a female CEO, chair or founder, and 36% have no women on their boards.

Source

Posted on

Top 10 police technology stories of 2025

In 2025, Computer Weekly’s police technology coverage focused extensively on developments in the use of data-driven technologies such as facial recognition and predictive policing.

This included stories on the Met’s decision to deploy permanent live facial recognition (LFR) cameras in Croydon and the Home Office launching a formal consultation on laws to regulate its use, as well as reports highlighting the lawfulness, necessity and proportionality of how UK police are using the technology.

Further stories continued Computer Weekly’s ongoing coverage of police hyperscale cloud use, after documents obtained from Scottish policing bodies revealed that Microsoft is refusing to hand them critical information about its data flows.

Computer Weekly also reported on efforts to change police data protection rules, which essentially legalise previously unlawful practices and pose a risk to the UK’s law enforcement data adequacy with the European Union (EU).

One investigation by freelance journalists Apostolis Fotiadis, Giacomo Zandonini and Luděk Stavinoha also revealed how the EU’s law enforcement agency has been quietly amassing data to feed an ambitious-but-secretive artificial intelligence (AI) development programme.

The Home Office formally opened a consultation on the use of facial recognition by UK police at the start of December 2025, saying the government is committed to introducing a legal framework that sets out clear rules for the technology.

The move – initially announced by policing minister Sarah Jones in early October 2025 after then home secretary Yvette Cooper told a Lords Committee in July that the UK government will create “a proper, clear governance framework” to regulate police use of the tech – marks a distinct shift in Home Office policy, which for years has claimed there is already “comprehensive” legal framework in place.

The Home Office has now said that although a “patchwork” legal framework for police facial recognition exists (including for the increasing use of the retrospective and “operator-initiated” versions of the technology), it does not give police themselves the confidence to “use it at significantly greater scale … nor does it consistently give the public the confidence that it will be used responsibly”.

It added that the current rules governing police LFR use are “complicated and difficult to understand”, and that an ordinary member of the public would be required to read four pieces of legislation, police national guidance documents and a range of detailed legal or data protection documentation from individual forces to fully understand the basis for LFR use on their high streets.

While the use of LFR by police – beginning with the Met’s deployment at Notting Hill Carnival in August 2016 – has ramped up massively in recent years, there has so far been minimal public debate or consultation.

UK police forces are “supercharging racism” through their use of automated “predictive policing” systems, as they are based on profiling people or groups before they have committed a crime, according to a 120-page report published by Amnesty International.

While proponents claim these systems can help more efficiently direct resources, Amnesty highlighted how predictive policing tools are used to repeatedly target poor and racialised communities, as these groups have historically been “over-policed” and are therefore massively over-represented in police data sets.

This then creates a negative feedback loop, where these so-called “predictions” lead to further over-policing of certain groups and areas; reinforcing and exacerbating the pre-existing discrimination as increasing amounts of data are collected.

“The use of predictive policing tools violates human rights. The evidence that this technology keeps us safe just isn’t there, the evidence that it violates our fundamental rights is clear as day. We are all much more than computer-generated risk scores,” said Sacha Deshmukh, chief executive at Amnesty International UK, adding that these systems are deciding who is a criminal based “purely” on the colour of their skin or their socio-economic background.

In June 2025, Green Party MP Siân Berry argued in the Commons that “predictive” policing technologies infringe human rights “at their heart” and should be prohibited in the UK, after tabling an amendment to the government’s forthcoming Crime and Policing Bill.

Highlighting the dangers of using predictive policing technologies to assess the likelihood of individuals or groups committing criminal offences in the future, Berry said that “such technologies, however cleverly sold, will always need to be built on existing, flawed police data … That means that communities that have historically been over-policed will be more likely to be identified as being ‘at risk’ of future criminal behaviour.”

Berry’s amendment would also prohibit the use of certain information by UK police to “predict” people’s behaviour: “Police forces in England and Wales shall be prohibited from … Predicting the occurrence or reoccurrence of an actual or potential criminal offence based on profiling of a natural person or on assessing personality traits and characteristics, including the person’s location, or past criminal behaviour of natural persons or groups of natural persons.”

In April, the Met Police announced it was planning to install the UK’s first permanent LFR cameras in Croydon, but critics raised concerns that this continues the force’s pattern of deploying the technology in areas where the Black population is much higher than the London average.

Local councillors also complained that the decision to set up facial recognition cameras permanently has taken place without any community engagement from the force with local residents, echoing situations that have happened in boroughs such as Newham and Lewisham.

According to data gathered by Green Party London Assembly member Zoë Garbett, over half of the 180 LFR deployments that took place during 2024 were in areas where the proportion of Black residents is higher than the city’s average, including Lewisham and Haringey.

While Black people comprise 13.5% of London’s total population, the proportion is much higher in the Met’s deployment areas, with Black people making up 36% of the Haringey population, 34% of the Lewisham population, and 40.1% of the Croydon population.

“The Met’s decision to roll out facial recognition in areas of London with higher Black populations reinforces the troubling assumption that certain communities … are more likely to be criminals,” she said, adding that while nearly two million people in total had their faces scanned across the Met’s 2024 deployments, only 804 arrests were made – a rate of just 0.04%.

In March 2025, Computer Weekly reported that proposed reforms to police data protection rules could undermine law enforcement data adequacy with the European Union (EU).

During the committee stage of Parliamentary scrutiny, the government’s Data Use and Access Bill (DUAB) – now an act – sought to amend the UK’s implementation of the EU Law Enforcement Directive (LED), which is transposed into UK law via the current Data Protection Act (DPA) 2018 and represented in Part Three of the DPA, specifically.

In combination with the current data handling practices of UK law enforcement bodies, the bill’s proposed amendments to Part Three – which include allowing the routine transfer of data to offshore cloud providers, removing the need for police to log justifications when accessing data, and enabling police and intelligence services to share data outside of the LED rules – could present a challenge for UK data adequacy.

In June 2021, the European Commission granted “data adequacy” to the UK following its exit from the EU, allowing the free flow of personal data to and from the bloc to continue, but warned the decision may yet be revoked if future data protection laws diverge significantly from those in Europe.

While Computer Weekly’s previous reporting on police hyperscale cloud use has identified major problems with the ability of these services to comply with Part Three, the government’s DUAB changes are seeking to solve the issue by simply removing the requirements that are not being complied with.

To circumvent the lack of compliance with these transfer requirements, the government has simply dropped them from the DUAB, meaning policing bodies will no longer be required to assess the suitability of the transfer or report it to the data regulator.

In August, Computer Weekly reported on documents obtained from the Scottish Police Authority (SPA), which showed that Microsoft is refusing to tell Scottish policing bodies where and how the sensitive law enforcement data uploaded to its cloud services will be processed.

Citing “commercial confidentiality”, the tech giant’s refusal to hand over crucial information about its international data flows to the SPA and Police Scotland means the policing bodies are unable to satisfy the law enforcement-specific data protection rules laid out in Part Three of the Data Protection Act 2018 (DPA18), which places strict limits on the transfer of policing data outside the UK.

“MS is unable to specify what data originating from SPA will be processed outside the UK for support functions,” said the SPA in a detailed data protection impact assessment (DPIA) created for its use of O365. “To try and mitigate this risk, SPA asked to see … [the transfer risk assessments] for the countries used by MS where there is no [data] adequacy. MS declined to provide the assessments.”

The SPA DPIA also confirms that, on top of refusing to provide key information, Microsoft itself has told the police watchdog it is unable to guarantee the sovereignty of policing data held and processed within its O365 infrastructure.

Further revelations published by Computer Weekly a month later showed that policing data hosted in Microsoft’s hyperscale cloud infrastructure could be processed in more than 100 countries.

This information was not provided to the policing bodies by Microsoft, and only came to light because of an analysis conducted by independent security consultant Owen Sayers, who identified from the tech giant’s own distributed online documentation that Microsoft personnel or contractors can remotely access the data from 105 different countries, using 148 different sub-processors.

Although the documentation – which is buried in non-indexed, difficult-to-find web pages – has come to light in the context of Computer Weekly investigating police cloud use, the issue of routine data transfers in Microsoft’s cloud architecture affects the whole of the UK government and public sector, which are obliged by the G-Cloud and Tepas frameworks to ensure data remains in the UK by default.

According to multiple data protection litigation experts, the reality of Microsoft’s global data processing here, on top of its failure to meet key Part Three obligations, means data subjects could have grounds to successfully claim compensation from Police Scotland or any other force using hyperscale cloud infrastructure.

In November 2025, freelance journalists Apostolis Fotiadis, Giacomo Zandonini and Luděk Stavinoha published an extensive investigation into how the EU’s law enforcement agency has been quietly amassing data to feed an ambitious-but-secretive AI development programme.

Based on internal documents obtained from Europol, and analysed by data protection and AI experts, the investigation raised serious questions about the implications of the agency’s AI programme for people’s privacy across the bloc. 

It also raised questions about the impact of integrating automated technologies into everyday policing across Europe without adequate oversight.

In May 2025, Computer Weekly reported on an equality impact assessment that Essex Police had created for its use of live facial recognition, but the document itself – obtained under Freedom of Information rules by privacy group Big Brother Watch and shared exclusively with Computer Weekly – was plagued with inconsistencies and poor methodology.

The campaigners told Computer Weekly that, given the issues with the document, the force had likely failed to fulfil its public sector equality duty (PSED) to consider how its policies and practices could be discriminatory.

They also highlighted how the force is relying on false comparisons to other algorithms and “parroting misleading claims” from the supplier about the LFR system’s lack of bias.

Other experts noted the assessment was “clearly inadequate”, failed to look at the systemic equalities impacts of the technology, and relied exclusively on testing of entirely different software algorithms used by other police forces trained on different populations to justify its conclusions.

After being granted permission to intervene in a judicial review of the Met’s LFR use – brought by anti-knife campaigner Shaun Thompson, wrongly stopped by officers after a false LFR identification – the UK’s equality watchdog said the forces’ use of the tech is unlawful.

Highlighting how the Met is failing to meet key legal standards with its deployments – particularly around Articles 8 (right to privacy), 10 (freedom of expression) and 11 (freedom of assembly and association) of the European Convention on Human Rights – the UK’s the Equality and Human Rights Commission (EHRC) said LFR should only be used where necessary, proportionate and constrained by appropriate safeguards.

“We believe that the Metropolitan Police’s current policy falls short of this standard,” said EHRC chief John Kirkpatrick.

The EHRC further highlighted how, when used on a large scale, even low-error rates can affect a significant number of people by brining unnecessary and unwanted police attention, and warned that its use at protests could have a “chilling effect” on people’s freedom of expression and assembly.

Senior police officers from both the Met and South Wales Police have previously argued that a major benefit of facial-recognition technology is its “deterrence effect.”

A comparative study of LFR trials by law enforcement agencies in London, Wales, Berlin and Nice found that although “in-the-wild” testing is an important opportunity to collect information about how AI-based systems like LFR perform in real-world deployment environments, the police trials conducted so far have failed to take into account the socio-technical impacts of the systems in use, or to generate clear evidence of the operational benefits.

Highlighting how real-world testing of LFR systems by UK and European police is a largely ungoverned “Wild West”, the authors expressed concern that “such tests will be little more than ‘show trials’ – public performances used to legitimise the use of powerful and invasive digital technologies in support of controversial political agendas for which public debate and deliberation is lacking, while deepening governmental reliance on commercially developed technologies which fall far short of the legal and constitutional standards which public authorities are required to uphold”.

Given the scope for interference with people’s rights, the authors – Karen Yeung, an interdisciplinary professorial fellow in law, ethics and informatics at Birmingham Law School, and Wenlong Li, a research professor at Guanghua Law School, Zhejiang University – said that evidence of the technology’s effectiveness in producing its desired benefits “must pass an exceptionally high threshold” if police want to justify its use.

They added that without a rigorous and full accounting of the technology’s effects – which is currently not taking place in either the UK or Europe – it could lead to the “incremental and insidious removal” of the conditions that underpin our rights and freedoms.

Source

Posted on

Fortinet vulnerabilities prompt pre-holiday warnings

Two recently disclosed vulnerabilities discovered in Fortinet’s product portfolio have prompted a pre-holiday warning for defenders after being added to the Known Exploited Vulnerabilities (KEV) catalogue run by the US’ national cyber agency this week.

The two flaws, tracked as CVE-2025-59718 and CVE-2025-59719, enable a threat actor to bypass FortiCloud single sign-on (SSO) authentication via a maliciously crafted security assertion markup language (SAML) message. According to Fortinet, they are present in multiple versions of FortiOS, FortiWeb, FortiProxy and FortiSwitchManager.

It should be noted that while the vulnerable feature is not enabled by default in factory settings, it does activate automatically if and when a device is registered to the FortiCare tech service via the GUI unless the customer admin has explicitly opted out of this.

In a statement, the US Cybersecurity and Infrastructure Security Agency (CISA) said: “This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise.”

Initially reported by Fortinet on 9 December, multiple third parties are now reporting exploitation activity in progress against CVE-2025-59718 and CVE-2025-59719.

According to Rapid7 analysts – who have been trapping multiple exploit attempts against its honeypots after a proof-of-concept exploit was posted to GitHub, many of the observed attacks have seen attackers authenticate as the admin user and immediately download the target’s system configuration file – these can often hold hashed credentials.

“As a result, any organisation with indicators of compromise [IOCs] must assume credential exposure and respond accordingly. A vendor patch is available, and organisations can also take immediate defensive action by disabling FortiCloud SSO administrative login while remediation efforts are underway,” said the Rapid7 team.

Arctic Wolf researchers said that besides applying the available updates from Fortinet, organisations finding that they are affected should reset their firewall credentials as a precaution, on the basis that they may have been compromised and exfiltrated, and limit access to firewall and virtual private network (VPN) appliances to trusted internal users.

As its products are deeply embedded in many networks Fortinet is frequently targeted by threat actors as an initial access point to their victims’ wider IT environments, so further attempts against the latest pair of flaws are considered highly likely.

Christmas presents

Besides the Fortinet authentication bypass issues, CISA has added a few more high-profile flaws to the KEV catalogue in the run-up to the festive break.

These include CVE-2025-69374, an embedded malicious code vulnerability that has arisen in ASUS Live Update after unauthorised modifications were made in a supply chain cyber attack.

Multiple Cisco products, including AsyncOS software, Cisco Secure Email Gateway and Secure Email, and Web Manager appliances are at risk from an input validation vulnerability, tracked as CVE-2025-20393, via which a threat actor may be able to execute arbitrary commands with root privileges.

Finally, SonicWall users should address CVE-2025-40602, a missing authorisation flaw enabling privilege escalation on the appliance management console of SMA1000 series secure access gateways.

At the time of writing, none of the above-listed vulnerabilities have been observed being used in ransomware attacks.

Source

Posted on

Cyberhackers Just Turned 150 Browser Extensions Into Viruses

Ilexx/Getty Images

While some consumers spend hours researching must-add Google Chrome extensions, most don’t consider which ones they need to delete. Following a seven-year cyberhacking campaign that infected roughly 4.3 million Chrome and Edge browsers with spyware, it might be time to do just that. Dubbed ShadyPanda by the cybersecurity research firm Koi Security, which first reported the scheme in December 2025, the group operated several legitimate browser extensions for years before weaponizing them to collect its users web browsing data. According to Koi Security, the Chinese hacking group is a quintessential example of how malicious actors attack popular marketplaces like Google and Microsoft Edge, accumulating customers before pushing through software updates that infect victims with dangerous malware. Following the report, several additional extensions involved in the project were publicly identified by the Hacker News:

  • Clean Master: the best Chrome Cache Cleaner
  • Speedtest Pro-Free Online Internet Speed Test
  • BlockSite
  • Address bar search engine switcher
  • SafeSwift New Tab
  • Infinity V+ New Tab
  • OneTab Plus:Tab Manage & Productivity
  • WeTab 新标签页
  • Infinity New Tab for Mobile
  • Infinity New Tab (Pro)
  • Infinity New Tab
  • Dream Afar New Tab
  • Download Manager Pro
  • Galaxy Theme Wallpaper HD 4k HomePage
  • Halo 4K Wallpaper HD HomePage

When Koi broke the story, many of these applications were still active in both Google Chrome and Microsoft Edge browser stores. However, according to a statement given to The Hacker News, Microsoft stated that it had removed all the extensions identified in the scam. Following the scheme, experts suggest users remove any unrecognized browser extensions, review privacy permissions, and focus only on trusted developers. For the industry writ large, the case is a fascinating look into an ever-evolving threat landscape, providing key lessons for preventing future attacks.

Shadypanda’s early hacking operations

Greggory Disalvo/Getty Images

ShadyPanda published the first of its 150+ web browser extensions in 2018, garnering nearly 4.3 million users over six years. These applications operated legitimately for seven years, gaining the trust of an expanding user base. The first attack occurred in early 2024, converting 145 wallpaper and productivity applications into vectors for mass affiliate fraud, in which hackers injected tracking codes whenever users made purchases on popular webstores to secretly steal commissions from marketplaces like Amazon and Booking.com. The group also used Google Analytics to track, log, and sell users’ browsing data.

The group initiated a bolder, second crime wave in 2024, where applications like Infinity V+ used search redirection, cookies, exfiltration, and search query harvesting techniques to log and monetize users’ browser activity without their consent. Although these attacks were easily identified and disrupted by security professionals, with several applications removed within weeks of their orchestration, they set the table for the organization’s longer, more prolific attacks. Taking five of the organization’s most popular browser extensions, many of which were uploaded as early as 2018 and garnered Featured and Verified status, the group uploaded malicious software updates that infected over 300,000 Chrome and Edge users with malware.

Following the malicious updates, which took advantage of users’ automated update settings, these five extensions, including Speedtest Pro-Free Online Internet Speed Test and Clean Master, created a backdoor through which ShadyPanda could deliver ransomware, execute credential theft, steal browsing data, and conduct corporate espionage. The success of these attacks set the groundwork for what would become a four million+ victim spyware scam.

Beware of spyware

Bankmini/Getty Images

Shadypanda’s next scam attracted four million Microsoft Edge users through extensions like WeTab. Published by StarLab Technology, WeTab garnered over three million users alone. Disguised as productivity tools, these spyware extensions operated legitimately for two years before quietly collecting the entirety of their users’ browsing data, ranging from search queries, keystrokes, mouse movements, and scroll behavior to browser fingerprints like screen resolution, language, and viewing time. Extensions like WeTab then exfiltrated this information to 15 Chinese domains.

Although less invasive than the group’s previous scam, it was much more prolific and exhibited the same ability to push RCE backdoors into users’ systems. Together, Shadypanda’s operations offer several lessons for users, developers, and browser marketplaces. Critically, it points to a major security flaw within the broader extension and app marketplace, where due diligence processes end at the approval stage, thus allowing hackers to attack victims through malicious software updates, often manipulating security-minded auto-update settings. As Koi Security points out, however, these problems go far beyond ShadyPanda and their over four million users.

Instead, they reflect broader vulnerabilities in online marketplaces, setting the stage for prolonged hacking operations by criminal networks and state-sponsored groups. As such, marketplaces must adjust their security apparatuses accordingly. For users, it highlights a key vulnerability: trust. Whether it’s an abundance of faith in download numbers, online reviews, or verification badges, users must be vigilant in researching everyone they allow to access their data, as dangerous malware can lurk in everything from video games to iPhone applications. Even AI browsers have been found to spy on their users, underscoring the need for consumers to better assess the security of their data.

Source

Posted on

Virgin Media O2 reveals record-breaking year of UK data use

Growing customer use of artificial intelligence (AI) alongside the continued draw of live sports and major gaming releases has resulted in record levels of data consumption across the networks of Virgin Media O2, including an 8% rise in broadband usage and an 18% rise in mobile traffic.

The analysis of traffic on the leading UK operator’s infrastructure 2025 year in review is based on combining broadband, mobile and movement data, with national polling findings to reveal the human behavioural insights behind the network data.

From an enterprise perspective, the data revealed that office attendance remained steady in 2025, with insights from AI-enabled mobile data and insights provider O2 Motion, which uses anonymised and aggregated data from O2’s mobile network, showing commuter levels falling just 1% from 2024. Despite this, the study said there was clear evidence of a generational divide, with early career workers returning in greater numbers while mid-and-late career groups continue to step back. 

Tuesday was the most popular day for workers to head to the office, with Wednesday leapfrogging Thursday as the second busiest. O2 Motion data showed that Friday is the most popular day for Brits to work from home, which the company said was no surprise as broadband data reveals a drop in traffic on Friday afternoons during the summer months as many remote workers clock off early. 

In a year that saw more than 20 days of strikes across Britain’s travel network, three-quarters of people (75%) were affected by travel disruptions. During September’s London Tube strike, O2 Motion data found that footfall across the capital was down 16%. For those that did brave the commute, 30% walked to work, 24% drove and 9% jumped on a rental e-bike.

In the realm of fixed broadband, the research found that live music and gaming releases continue to drive data spikes. Broadband data usage continued to rise and was up by 8% in 2025 compared with a year earlier. The biggest spikes were driven by football and gaming releases, with Liverpool’s Champions League football win against Real Madrid in early November and the release of Call of Duty: Black Ops 7 coming out on top.

As drama-fuelled TV sparked online conversations and offline watercooler moments – from Adolescence, to Traitors and Stranger Things – and Celebrity Traitors created a cultural moment of its own, Thursday broadband spikes were the norm as Brits bundled episodes to watch together.

The key theme of mobile traffic on the O2 network was that people in the UK were scrolling, chatting and embracing AI more than ever, despite nearly three-fifths of Brits (58%) saying that they began the year with a plan to reduce the time they spent on their phone.

The usage data showed that instead it was another record-breaking year for mobile data usage, which was up 18% on an annual basis. Despite their intentions, many people admit that they used their phone more frequently to stay in touch with friends and family (55%), scroll on social media (44%), and use AI tools (41%). Overall use of AI was becoming increasingly normalised, with 47% agreeing that it is totally accepted in most areas of life now.

Commenting on the trends revealed by the survey, Virgin Media O2 chief technology officer Jeanie York said: “It is clear that this demand has been driven by the continued excitement surrounding gaming and sports, with several significant game releases and many exciting Champions League matches causing large spikes across our networks. We are investing and innovating to ensure we continue to provide the connectivity that is underpinning the lives of our customers, including AI, which customers are using more than ever before.”

Source

Posted on

IT Sustainability Think Tank: How IT sustainability entered the mandate

As the calendar turns the final pages on 2025, the information technology sector stands at a critical juncture regarding its environmental commitments. This year was not marked by technological breakthroughs solving decarbonisation, but by the decisive maturation of sustainability from a strategic differentiator into an operational and regulatory imperative.

This transition involved a painful reckoning with data complexity, supply chain reality, and the sheer energy appetite of modern computing, driven primarily by the rapid proliferation of artificial intelligence (AI).

We entered 2025 with goals framed by aspiration; we exit under the binding mandate of actuality. The central shift is profound: IT sustainability is no longer a parallel environmental, social and governance (ESG) initiative.

It has become deeply intertwined with core business continuity, geopolitical supply chain risk, and mandatory financial disclosure. While this shift signals progress, momentum is driven more by necessity and the threat of liability than by shared ethical commitment.

The conversation evolves from aspirational to accountable

The most profound shift over the past year has been the forced elevation of the sustainability dialogue directly onto the executive committee’s core risk portfolio. This movement is not voluntary; it is driven by impending regulation and the sobering realisation that environmental failure now carries direct, auditable financial penalties and board-level liability.

Only a year ago, discussions circled around unquantifiable reputational benefits. Today, the lexicon is dominated by acronyms signalling mandatory compliance: CSDDD, CSRD, and the tightening of the SBTi Net-Zero Standard V2. These frameworks compel executives to move past narratives and confront the granular, auditable data attached to every asset, vendor, and cloud usage.

For the CIO, this manifests in two critical areas. First, energy efficiency is decisively reframed as a cost of doing business, crucial for operational expenditure control amid volatile global energy markets. Second, the sudden energy demand of generative AI has triggered a rapid, internal debate on responsible compute architecture.

Leaders are increasingly compelled to justify AI investment not solely on traditional ROI, but via a nascent “return on compute” model that necessarily integrates and accounts for carbon expenditure. This makes the environmental cost of IT an integrated input in the total cost of ownership calculation, rather than a polite footnote.

Despite this high-level engagement, progress remains complicated. The IT function often lacks the authority to enforce change across complex internal silos, and the necessary budget and risk tolerance for truly transformative shifts remain stubbornly limited.

Genuine progress where the green shoots are taking hold

Despite systemic inertia, 2025 delivered solid, tangible progress in certain operational domains, offering a partial blueprint for future net-zero efforts. Our confidence is bolstered by three examples, though it is crucial to understand that wide-scale adoption across the average enterprise remains nascent and often confined to pilot programs:

1. Decoupling cloud growth from carbon: Hyperscale cloud providers have largely won the battle for renewable energy procurement. The next frontier — optimising physical operations — has seen enterprise engagement. We saw accelerated adoption of advanced liquid cooling technologies (still primarily concentrated in hyperscale environments, but critical for future AI scaling). Enterprises optimising workloads for low-carbon regions and utilising serverless architectures successfully decoupled rapid cloud expansion from a proportional rise in emissions. This success belongs predominantly to the hyperscalers, and enterprise optimisation remains an ongoing campaign.

2. Maturing the circular IT model (As-a-Service): The year 2025 saw the Managed Device-as-a-Service (MDaaS) model transition into a critical environmental enabler. By outsourcing the entire device lifecycle, enterprises commit practically to refurbishment and robust reverse logistics. Successful enterprises leverage these contracts to guarantee asset re-entry into the value chain via certified refurbishment, drastically reducing e-waste. The caveats are two-fold: MDaaS adoption is far from universal, and the verification of these circular chains still lacks necessary, robust third-party scrutiny.

3. The nascent rise of green software engineering: The formal emergence of green software engineering (GSE) is perhaps the most encouraging development. For too long, the environmental focus was only on hardware. This year, organisations began measuring code energy consumption — optimising algorithms and refactoring applications to reduce reliance on resource-intensive computing.

An important development this year was the publication of the W3C Web Sustainability Guidelines (WSG) Draft Note. Developed through a global, collaborative effort — in which I was pleased to participate — the guidelines offer a structured and internationally relevant set of best practices for reducing the environmental footprint of web products and services. While the scope focuses specifically on the web rather than the full breadth of enterprise IT, the Draft Note nonetheless represents a significant step forward for the industry.

The persistent gaps undermining net-zero momentum

For all the genuine acceleration, 2025 was equally defined by two persistent, critical gaps that threaten to derail net-zero pathways and demand urgent attention.

1. The Scope 3 emissions chasm: The most pervasive and frustrating gap remains the measurement and meaningful reduction of Scope 3 emissions, particularly from purchased goods and downstream asset end-of-life.

Despite regulatory urgency, the vast majority of enterprises still rely on highly aggregated, industry-average supplier data (spend-based or activity-based), which is neither auditable nor sufficient for mandatory disclosure. The necessary mechanism — detailed, granular product carbon footprints (PCF) provided by every vendor — is simply not available at scale or with sufficient fidelity.

The problem persists because it requires collaboration across complex, often proprietary global supply chains. Suppliers are reticent to disclose granular data, citing competitive concerns, while buyers lack the leverage to mandate it. The result is a ‘Scope 3 plateau’: targets are set, but underlying emissions remain stubbornly high, creating a significant credibility risk. We are still largely measuring a reflection, not the reality.

2. The generative AI energy debt: While AI is a powerful tool for sustainability optimisation, the immediate, unmanaged energy demand of Large Language Models (LLMs) represents a profound and growing gap. The speed of AI adoption, combined with the inherently expensive High-Performance Computing (HPC) required, creates an “energy debt” that offsets hard-won gains elsewhere.

The challenge is governance. Enterprises are deploying AI solutions without robust, mandatory policies on model selection, inference efficiency, or resource decommissioning. Crucially, most organisations remain focused on achieving initial ROI metrics, relegating energy efficiency to an optional performance tweak. Failure to enforce a framework for ‘responsible compute’ risks the transformative power of AI being negated by its own expanding environmental impact. This is the single greatest risk to the IT sector’s net-zero journey.

Strategic priorities for 2026 and beyond

As the IT Sustainability Think Tank looks towards 2026, the focus must shift from identifying the problem to systematically closing the remaining gaps with institutional discipline. We must treat these priorities as non-negotiable elements of future business resilience:

  1. Mandate data granularity for Scope 3: Leverage procurement influence to force supplier compliance on verifiable Product Carbon Footprints (PCF). The mandate must be non-negotiable, enforced with clear vendor scorecards and contractual requirements.
  2. Institutionalise green software engineering: Invest heavily in training and tooling to embed energy efficiency into the software development lifecycle (SDLC). Software architecture must be treated with the same environmental scrutiny as data centre cooling, making efficiency an audited requirement.
  3. Govern the AI energy cost: Implement a Responsible AI framework that includes mandatory energy consumption metrics and resource allocation policies for all Generative AI deployments.

The year 2025 was when IT sustainability moved into the board’s audit file. Next year must be the year we finally gather the granular data, enforce the necessary discipline, and manage the rapidly growing energy appetite of our own invention. The time for aspirational statements is definitively over; the urgent task now is to move these nascent efforts into full, verifiable accountability.

Source

Posted on

Experts Recommend You Update Your Android Phone ASAP

wisely/Shutterstock

Google’s December 2025 security update patched 107 vulnerabilities for Android devices. For a complete catalog of all the issues, you can refer to the update notes hosted on the the Android Security Bulletin; including the two high-severity flaws listed at “critical” and “severe” levels. According to the bulletin, the patch will fix a critical security vulnerability in the Android Framework. It will also include patching vulnerabilities at the system and kernel levels, along with listed vulnerabilities for MediaTek, Qualcomm, Arm, and Unisoc components.

For example, two vulnerabilities listed on the bulletin were CVE-2025-48572, an Android Framework privilege escalation vulnerability; and CVE-2025-48633, an Android Framework information disclosure vulnerability. Both vulnerabilities, if left unfixed, could leave your Android device open to attackers who can modify system settings and take control of it.

This most recent security patch was released on December 5, 2025, for devices running Android 13, 14, 15, and 16. The bulletin also notes that within 48 hours of publication, the corresponding source code patches will be available in the Android Open Source Project (AOSP) repository. You can also find the AOSP links in the bulletin. Though, if you are eager to keep your device protected, Android phones should have the update ready to download and install via settings.

Update your Android phone’s security regularly

Primakov/Shutterstock

It’s already recommended not to skip out on Android updates if you have them. Updates are designed to fix bugs, vulnerabilities, optimize system performance, and bring new features. Some manufacturers will have scheduled updates you can customize or push through manually via Software update settings. Google releases major security patches to address software flaws. If these flaws are not addressed, you risk exposing your device to major cybersecurity threats. Bad actors can target these vulnerabilities to inject malware, remotely hack (denial-of-service and remote execution), as well as commit data theft.

Exploits at the Framework level are dangerous and are often considered the scariest. The Android Framework is composed of prebuilt classes, interfaces, and services that provide higher‑level access to the operating system. This is responsible for managing core functionalities, including the user interface, hardware interactions (such as sensors), and background services. It’s also the foundation used for building Android applications, which is done through the Framework’s API. 

Apps access the API to perform their primary operations, such as managing contacts, accessing the camera, and using location services. Any compromises to the Framework could grant unauthorized users system-level access, leaving your device and information completely open and making attacks difficult to defend against; like with zero click exploits potentially infecting devices without any user input.

Source