Posted on

4 Electronics You Should Only Buy From Amazon

Mijansk786/Shutterstock

We may receive a commission on purchases made from links.

Purchasing electronics online requires shopping blind at times, which can make the purchase process uncomfortable when it comes time to check out. Big-ticket items like televisions and laptops may warrant some in-person use before making a long-term commitment, and even less-expensive electronics are worth researching prior to making a purchase. Of course, just about every online electronics retailer will provide you with all the stats and specs you’ll want to know for various pieces of tech, but shopping for electronics at Amazon comes with some additional benefits.

Free shipping isn’t exclusive to Amazon, but if you’re an Amazon Prime Member you can almost always count on free fast shipping. At no additional cost to Prime Members, two-day, overnight, and even same-day shipping are speedy options available on many Amazon products. Amazon’s return policy is also favorable. Many items are available to return for up to 365 days, which gives you a chance to test the product before committing to it. And while Amazon makes the delivery and return process one of its major pros over other online retailers, its deep inventory and wide range of electronics offers far more convenience than the traffic, noise, and sometimes unhelpful staff attached to brick and mortar retailers.

Smart TVs

DIA TV/Shutterstock

Whether you’re looking for a small television to fill out a corner space or a much larger television (perhaps even a 116-inch model) for your own in-home theater experience, Amazon is a great place to purchase your next smart TV. It carries models made by some of the most reliable TV brands, including widely recognized names like Sony, LG, Samsung, and Hisense. You’ll also be able to find TVs that range in size from under 32 inches to more than 70 inches.

But Amazon also has its own lineup of smart TVs, the Amazon Fire TV. The Fire TV lineup helps Amazon stand out among other retailers. The TVs offer tremendous value at their regular prices, and they frequently see discounts exclusive to Amazon shoppers. Deals on Fire TVs are available to shop throughout the year, and during the holidays and major sales events Amazon is known to drop Fire TVs to their lowest prices ever.

The inclusion of free shipping on a large piece of tech like a TV is a nice throw-in, but for Prime Members it also means you could have a new TV up and running within a day or two. Amazon’s return policy also makes the online purchase of a TV more convenient, as it gives you a chance to test out the TV and return it at no cost if it’s not the right size or otherwise is the wrong fit for you.

Kindles

bigwa11/Shutterstock

The Amazon Kindle is one of the most recognized names among dedicated e-readers. The entry-level model starts at just $110, while more premium options like the Kindle Paperwhite and Kindle Colorsoft are also available. One thing that sets Kindle devices apart from tablets is the lineup’s e-ink display technology, which is intended to eliminate eye strain during long reading sessions. In fact, the entire Kindle experience is designed to mimic the experience of reading a physical book — and through the Amazon Kindle Store, readers will get access to millions of e-books.

Because Amazon is the manufacturer of Kindles, it’s the natural place to turn to when purchasing one. The retailer discounts each of its Kindle models throughout the year, with massive discounts often available on Prime Day and during major annual sales events. But in many regards you could look at the entire Kindle lineup as always on sale when you shop at Amazon, as a 20% discount is included if you have an eligible device to trade-in. Amazon’s standard return policy applies to Kindles, meaning you can try one out for 30 days and return it with no additional charge.

Laptops

DenPhotos/Shutterstock

As electronics go, laptops are a somewhat high-stakes purchase. Because a new laptop can get quite expensive, it’s the kind of device that’s meant to be used for several years before needing replacement. If you’re shopping on a budget, Amazon has a wide range of well-reviewed Chromebooks to choose from, sometimes offering discounts on models from top brands such as ASUS, HP, and Acer. More powerful laptop options are also available at Amazon, with brands like Dell, Lenovo, Samsung, and Microsoft always in the mix.

But Amazon is also a great place to shop for Apple laptops. Apple doesn’t often discount its products through its own online store, but Amazon frequently drops the price of the MacBook Air. The base model regularly goes for $999, but you can find it on Amazon for as low as $799 at various points throughout the year. Even more powerful MacBook options, such as the new MacBook Pro M5, show up on Amazon with a price drop from time to time. Most laptops you’ll find on Amazon are subject to its standard 30-day return policy, though Apple products have a shorter 15-day return window.

Amazon Basics electronics

Tigarto/Shutterstock

Despite the convenience and cost-effectiveness of shopping for larger and more expensive products at Amazon, where the retail giant can really stand out is with everyday electronics. Amazon Basics is its private-label inventory lineup. Through it, Amazon offers a wide range of products that are often cheaper than those of its competitors, and electronics is one category that showcases the brand’s extensive and inexpensive assortment.

These are the kinds of products you may simply tuck away in utility drawers, but there’s also plenty to choose from that can be put to immediate use. Amazon Basics offers eight-packs of rechargeable AA batteries for about $12, for example, and everything from AAA to 9-volt alkaline batteries are available as well. HDMI cables, power strips, smartphone tripods, smart lights bulbs, cordless drills, battery chargers, and smart trackers are just some of the other everyday electronics Amazon Basics sells at affordable prices.

Source

Posted on

How police live facial recognition subtly reconfigures suspicion

Police use of live facial recognition (LFR) technology reconfigures suspicion in subtle yet important ways, undermining so-called human-in-the-loop safeguards.

Despite the long-standing controversies surrounding police use of LFR, the technology is now used in the UK to scan millions of people’s faces every year. While initial deployments were sparse, happening only every few months, they are now run-of-the-mill, with facial recognition-linked cameras regularly deployed to events and busy areas in places like London and Cardiff.

Given the potential for erroneous alerts, police forces deploying the technology claim that a human will always make the final decision over whether to engage someone flagged by an LFR system. This measure is intended to ensure accuracy and reduce the potential of unnecessary police interactions.

However, a growing body of research highlighting the socio-technical nature of LFR systems suggests the technology is undermining these human-in-the-loop safeguards, by essentially reshaping (and reinforcing) police perceptions of who is deemed suspicious and how police interact with them on the street as a result.

A growing body of research

According to one paper from March 2021 – written by sociologists Pete Fussey, Bethan Davies and Martin Innes – the use of LFR “constitutes a socio-technical assemblage that both shapes police practices yet is also profoundly shaped by forms of police suspicion and discretion”.

The authors argue that while under current police powers, officers recognising someone may constitute grounds for a stop and search, this changes when LFR is inserted into the process, because the “initial recognition” does not result from an officer exercising discretion.

“Instead, officers act more akin to intermediaries, interpreting and then acting upon a (computer-instigated) suggestion originating outside of, and prior to, their own intuition,” the sociologists wrote. “The technology thus performs a framing and priming role in how suspicion is generated.”

More recently, academics Karen Yeung and Wenlong Li argued in a September 2025 research paper that, given the potential for erroneous matches, the mere generation of an LFR match alert is not in itself enough to constitute “reasonable suspicion”, which UK police are required to demonstrate to legally stop and detain people.

“Although police officers in England and Wales are entitled to stop individuals and ask them questions about who they are and what they are doing, individuals are not obliged to answer these questions in the absence of reasonable suspicion that they have been involved in the commission of a crime,” they wrote.

“Accordingly, any initial attempt by police officers to stop and question an individual whose face is matched to the watchlist must be undertaken on the basis that the individual is not legally obliged to cooperate for that reason alone.”

Despite being legally required to have reasonable suspicion, a July 2019 paper from the Human Rights, Big Data & Technology Project based at the University of Essex Human Rights Centre, which marked the first independent review into trials of LFR technology by the Metropolitan Police, observed a discernible “presumption to intervene” among police officers using the technology.

According to authors Fussey and Daragh Murray, who is a reader in international law and human rights at Queen Mary’s School of Law, this means the officers involved tended to act on the outcomes of the system and engage individuals that it said matched the watchlist in use, even when they did not.

As a form of automation bias, the “presumption to intervene” is important in a socio-technical sense, because in practice it risks opening up random members of the public to unwarranted or unnecessary police interactions.

Priming suspicion

Although Yeung and Li noted that individuals are not legally obliged to cooperate with police in the absence of reasonable suspicion, there have been instances where failing to comply with officers after an LFR alert has affected people negatively.

In February 2025, for example, anti-knife crime campaigner Shaun Thompson, who was returning home from a volunteer shift in Croydon with the Street Fathers youth outreach group, was stopped by officers after being wrongly identified as a suspect by the Met’s LFR system.

Thompson was then held for almost 30 minutes by officers, who repeatedly demanded scans of his fingerprints and threatened him with arrest, despite being provided with multiple identity documents showing he was not the individual on the database.

Thompson has publicly described the system as “stop and search on steroids” and said it felt like he was being treated as “guilty until proven innocent”. Following the incident, Thompson launched a judicial review into the Met’s use of LFR to stop others ending up in similar situations, which is due to be heard in January 2026.

Even when no alert has been generated, there are instances where the use of LFR has prompted negative interactions between citizens and the police.

During the Met’s February 2019 deployment in Romford, for example, Computer Weekly was present when two members of the public were stopped for covering their faces near the LFR van because they did not want their biometric information to be processed.

Writing to the Lords Justice and Home Affairs Committee (JHAC) in September 2021 as part of its investigation into policing algorithms, Fussey, Murray and criminologist Amy Stevens noted that while most surveillance in the UK is designed to target individuals once a certain threshold of suspicion has been reached, LFR inverts this by considering everyone that passes through the camera’s gaze as suspicious in the first instance.

This means although people can be subsequently eliminated from police inquiries, the technology itself affects how officers see suspicion, by essentially “priming” them to engage with people flagged by the system. 

“Any potential tendency to defer or over-rely on automated outputs over other available information has the ability to transform what is still considered to be a human-led decision to de facto an automated one,” they wrote.

“Robust monitoring should therefore be in place to provide an understanding of the level of deference to tools intended as advisory, and how often and in which circumstances human users make an alternative decision to the one advised by the tool.”

Watchlist creation and bureaucratic suspicion

A key aspect mediating the relationship between LFR and the concept of “reasonable suspicion” is the creation of watchlists.

Socio-technically, researchers investigating LFR use by police have expressed a number of concerns around watchlist creation, including how it “structures the police gaze” to focus on particular people and social groups.

In their 2021 paper, for example, Fussey, Davies and Innes noted that creating watchlists from police-held custody images naturally means police attention will be targeted toward “the usual suspects”, inducing “a technologically framed bureaucratic suspicion in digital policing”.

This means that, rather than linking specific evidence from a crime to a particular individual (known as ‘incidental suspicion’), LFR instead relies on the use of general, standardised criteria (such as a person’s prior police record or location) to identify potential suspects, which is known in sociology as “bureaucratic suspicion”.

“Individuals listed on watchlists and databases are cast as warranting suspicion, and the AFR [automated facial recognition] surveillant gaze is specifically oriented towards them,” they wrote.

“But, in so doing, the social biases of police activity that disproportionately focuses on young people and members of African Caribbean and other minority ethnic groups (inter alia The Lammy Review 2017) are further inflected by alleged technological biases deriving from how technical accuracy recedes for subjects who are older, female and for some people of colour.”

Others have also raised separate concerns about the vague criteria around watchlist creation and the importance of needing “quality” data to feed into the system.

Yeung and Li, for example, have highlighted “unresolved questions” about the legality of watchlist composition, including the “significance and seriousness” of the underlying offence used to justify a person’s inclusion, and the “legitimacy of the reason why that person is ‘wanted’ by the police” in the first place.

As an example, while police repeatedly claim that LFR is being used solely on the most serious or violent offenders, watchlists regularly contain images of people for drug, shoplifting or traffic offences, which legally do not meet this definition.

Writing in their September 2025 paper, Yeung and Li also noted that while the Met’s watchlists were populated by individuals wanted on outstanding arrest warrants, they also included “images of a much broader, amorphous category of persons” who did not meet the definition of serious offenders.

This included “individuals not allowed to attend the Notting Hill Carnival”, “individuals whose attendance would pose a risk to the security and safety of the event”, “wanted missing” individuals and children, and even individuals who “present a risk of harm to themselves and to others” and those who “may be at risk or vulnerable”.

In December 2023, senior officers from the Met and South Wales Police confirmed that LFR operates on a “bureaucratic suspicion” model, telling a Lords committee that facial recognition watchlist image selection is based on generic crime categories attached to people’s photos, rather than a context-specific assessment of the threat presented by a given individual.

The Met Police’s then-director of intelligence, Lindsey Chiswick, further told Lords that whether or not something is “serious” depends on the context, and that, for example, retailers suffering from prolific shoplifting would be “serious for them”.

While the vague and amorphous nature of police LFR watchlist creation has been highlighted by other academics – including Fussey et al, who argued that “broad categories offer significant latitude for interpretation, creating a space for officer discretion with regards to who was enrolled and excluded from such databases” – the issue has also been highlighted by the courts.

In August 2020, for example, the Court of Appeal ruled that the use of LFR by South Wales Police was unlawful, in part because the vagueness of the watchlist criteria – which used “other persons where intelligence is required” as an inclusion category – left excessive discretion in the hands of the police.

“It is not clear who can be placed on the watchlist, nor is it clear that there are any criteria for determining where AFR can be deployed,” said the judgment, adding that, “in effect, it could cover anyone who is of interest to the police.”

During the December 2023 Lords session, watchlist size was also highlighted by Yeung – who was called to give evidence given her expertise – as an important socio-technical factor.

“There is a divergence between the claims that they only put pictures of those wanted for serious crimes on the watchlist, and the fact that in the Oxford Circus deployment alone, there were over 9,700 images,” she said.

Unlawful custody images retention

Further underpinning concerns about the socio-technical impacts of watchlist creation, there are ongoing issues with the unlawful retention of custody images in the Police National Database (PND). This represents the primary source of images used to populate police watchlists.

In 2012, a High Court ruling found the retention of custody images in the PND to be unlawful on the basis that information about unconvicted people was being treated in the same way as information about people who were ultimately convicted, and that the six-year retention period was disproportionate.

Despite the 2012 ruling, millions of custody images are still being unlawfully retained.

Writing to other chief constables to outline some of the issues around custody image retention in February 2022, the National Police Chiefs Council (NPCC) lead for records management, Lee Freeman, said the potentially unlawful retention of an estimated 19 million images “poses a significant risk in terms of potential litigation, police legitimacy, and wider support and challenge in our use of these images for technologies such as facial recognition”.

In November 2023, the NPCC confirmed to Computer Weekly that it had launched a programme that would seek to establish a management regime for custody images, alongside a review of all currently held data by police forces in the UK.

The issue was again flagged by the biometric commissioner of England and Wales, Tony Eastaugh, in December 2024, when he noted in his annual report that “forces continue to retain and use images of people who, while having been arrested, have never subsequently been charged or summonsed”.

Eastaugh added that while work was already “underway” to ensure the retention of images is proportionate and lawful, “the use of custody images of unconvicted individuals may include for facial recognition purposes”.

Source

Posted on

NCSC warns of confusion over true nature of AI prompt

The UK’s National Cyber Security Centre (NCSC) has highlighted a potentially dangerous misunderstanding surrounding emergent prompt injection attacks against generative artificial intelligence (GenAI) applications, warning that many users are comparing them to more classical structured query language (SQL) injection attacks, and in doing so, putting their IT systems at risk of compromise.

While they share similar terminology, prompt injection attacks are categorically not the same as SQL injection attacks, said the NCSC in an advisory blog published on 8 December. Indeed, said the GCHQ-backed agency, prompt injection attacks may be much worse, and harder to counteract.

“Contrary to first impressions, prompt injection attacks against generative artificial intelligence applications may never be totally mitigated in the way SQL injection attacks can be,” wrote the NCSC’s research team.

In their most basic form, prompt injection attacks are cyber attacks against large language models (LLMs) in which threat actors take advantage of the ability of such models to respond to natural language queries and manipulate them into producing undesirable outcomes – for example, leaking confidential data, creating disinformation, or potentially guiding the creation of malicious phishing emails or malware.

SQL injection attacks, on the other hand, are a class of vulnerability that enable threat actors to mess with an application’s database queries by inserting their own SQL code into an entry field, giving them the ability to execute malicious commands to, for example, steal or destroy data, conduct denial of service (DoS) attacks and, in some cases, even enable arbitrary code execution.

SQL injection attacks have been around for a long time and are very well understood. They are also relatively simple to address, with most mitigations enforcing a separation between instructions and sensitive data. The use of parameterised queries in SQL, for example, means that whatever the input may be, the database engine cannot interpret it as an instruction.

While prompt injection is conceptually similar, the NCSC believes defenders may be at risk of slipping up because LLMs are not able to distinguish between what is an instruction and what is data.

“When you provide an LLM prompt, it doesn’t understand the text in the way a person does. It is simply predicting the most likely next token from the text so far,” explained the NCSC team.

“As there is no inherent distinction between ‘data’ and ‘instruction’, it’s very possible that prompt injection attacks may never be totally mitigated in the way that SQL injection attacks can be.”

The agency is warning that unless this spreading misconception is addressed in short order, organisations risk becoming data breach victims at a scale unseen since SQL injection attacks were widespread 10 to 15 years ago, and probably exceeding that.

It further warned that many attempts to mitigate prompt injection – although well-intentioned – in reality do little more than try to overlay the concepts of instructions and data on a technology that can’t tell them apart.

Should we stop using LLMs?

Most objective authorities on the subject concur that the only way to avoid prompt injection attacks is to stop using LLMs altogether, but since this is now no longer really possible, the NCSC is calling for efforts to turn to reducing the risk and impact of prompt injection within the AI supply chain.

It called for AI system designers, builders and operators to acknowledge that LLM systems are “inherently confusable” and account for manageable variables during the design and build process.

It laid out four steps that, taken together, may help alleviate some of the risks associated with prompt injection attacks.

  1. First, and most fundamentally, developers building LLMs need to be aware of prompt injection as an attack vector, as it is not yet well-understood. Awareness also needs to be spread across organisations adopting or working with LLMs, while security professionals and risk owners need to incorporate prompt injection attacks in their risk management strategies.
  2. It goes without saying that LLMs should be secure by design, but particular attention should be paid to hammering home the fact that LLMs are inherently confusable, especially if systems are calling tools or using application programming interfaces (APIs) based on their output. A securely designed LLM should focus on deterministic safeguards to constrain an LLM’s actions rather than just trying to stop malicious content from reaching it. The NCSC also highlighted the need to apply principles of least privilege to LLMs – they cannot have any more privileges than the party/ies interacting with them does.
  3. It is possible to make it somewhat harder for LLMs to act on instructions that may be included within data fed to them. Researchers at Microsoft, for example, found that using different techniques to mark data as separate from instructions can make prompt injection harder. However, at the same time it is important to be wary of approaches such as deny-listing or blocking phrases such as “ignoring previous instructions, do Y”, which are completely ineffective because there are so many possible ways for a human to rephrase that prompt, and to be extremely sceptical of any technology supplier that claims it can stop prompt injection outright.
  4. Finally, as part of the design process, organisations should understand both how their LLMs might be corrupted and the goals an attacker might try to achieve, and what normal operations look like. This means organisations should be logging plenty of data – up to and even including saving the full input and output of the LLM – and any tool use or API calls. Live monitoring to respond to failed tool or API calls is essential, as detecting these could, said the NCSC, be a sign that a threat actor is honing their cyber attack.

Source

Posted on

8 Smart Home Upgrades That Can Actually Save You Money

Halfpoint/Shutterstock

We may receive a commission on purchases made from links.

“Smart home” is a term that’s thrown around pretty loosely in 2025, and it carries a different meaning for everyone. To some, a smart home is just a normal house with a fancy security system. To others, it’s about buying every internet-connected device for the most convenience. Whichever camp you’re in, it’s no secret that the market is filled with all sorts of tech that promises to make your life easier and save on monthly running costs. 

Of course, there are lots of choices. Couple that with the fact that some smart home companies have been caught spying on users through cameras (specifically the Amazon brand Ring) rather than cutting costs, and picking the right gear becomes ever so difficult. This is exactly why we scoured the internet to find the eight best smart home upgrades that will save you money without jeopardizing home security.

Smart bulbs

Rosshelen/Getty Images

When smart bulbs first came around in 2012, they were expensive, often costing at least $200 for a small kit. Thankfully, with advancements in tech (and more competition), smart bulbs today are arguably the best home upgrade that saves cash. These devices replace regular incandescent models and can change the whole vibe of a room from a sterile hospital look to something straight out of a ’90s disco. Your imagination is truly the limit since most of these bulbs can display over 1 million colors.

It’s not just about aesthetics, though, because such bulbs have Wi-Fi connectivity and integrate directly with a smart home system, letting you control them from anywhere in the world. You can create a routine that dictates when the lights should be turned on, or you can even configure them to work in tandem with a motion sensor, lighting up only when someone is passing down the hall. All these features translate to approximately 75% lower energy consumption.

While the type of bulb you need will vary depending on your home, one great option is the Wiz 60W A19 Color Smart LED Bulb. It’s rated 4.3 stars and costs just $11 on Amazon. Users who spent their hard-earned money highlighted the bulb’s easy setup process and its even light distribution throughout the room. The model comes with a range of customization options, including a circadian-rhythm mode that adjusts the white balance based on the time of day. For people looking to cover a larger area, the Wyze Smart Bulb, which costs $23.99 for a two-pack on Amazon, is a decent option, as it reaches up to 1,100 lumens and supports both Amazon Alexa and Google Assistant.

Smart plugs

Использую только собственные снимки, сделанные на фотоаппараты разных производителей/Getty Images

Since changing all the appliances at home to smarter alternatives is an expensive endeavor, smart plugs are the way to go. They’re cheap, hook right into the existing socket, and transform your “dumb” devices into smart ones by connecting to the internet and letting you remotely control power from anywhere in the world. So now, if you forget to turn off the lamp before leaving home in the morning, you can turn it off so it won’t keep drawing power. Certain plugs even connect with digital assistants and examine how much energy an appliance is drawing. This can be especially useful for identifying devices that consume vampire power. For the uninitiated, the term “vampire power” refers to the extra energy some older appliances continue to draw even when not in use.

Choosing which plug to buy, though, is not that simple. The market is filled with all sorts of smart plugs that cater to different needs. One great option is the Kasa Ultra Mini, which costs $9.99 on Amazon. It was our top pick on the best smart plugs list because its app is simple to use and offers different modes for scheduling power and configuring automations. If buying smart plugs doesn’t match your aesthetics, smart home outlets are also an option. For context, devices like the Eve Energy outlet replace your existing outlet, let you control any connected device, know how much power each device is consuming, and schedule power. Although the outlet is pricey at $54.95 on Amazon, it connects with all smart home ecosystems thanks to Matter and Thread support.

Smart thermostats

Saklakova/Getty Images

Normal thermostats work strictly on user settings, either heating or cooling the room without question. While this technique is effective, it’s not entirely energy-efficient. According to a report from the U.S. Energy Information Administration, over half of U.S. households’ energy consumption goes into managing temperatures. Sure, this data will vary by location, but given the recent threat of AI increasing your power bill, investing in a smart thermostat can help you save money. 

The Ecobee Smart Thermostat Premium is a great option that lets you control the house’s temperature from anywhere in the world, so the heater you forgot to turn off won’t keep wasting energy for no one. Beyond that, the thermostat monitors air quality and automatically pauses heating or cooling if any door is left open for more than five minutes. The device is compatible with almost all smart home ecosystems, including Amazon Alexa, Apple HomeKit, Google Assistant, IFTTT, and Samsung SmartThings. Plus, it also doubles as a smart speaker. Unfortunately, the Ecobee Smart Thermostat Premium does cost a pretty penny, and that number is $243.99 on Amazon. If you’re on a budget, Ecobee’s Essential Thermostat is a great alternative that costs just $139.99 on Amazon. It keeps the necessary features like the ability to control home temperatures, the touchscreen, and support for digital assistants, but omits the air quality monitoring system and speaker capabilities.

Smart leak sensors

Tap water, at least in the U.S., costs money, and the price varies by the city you live in. Keeping this in mind, preventing leaks could be a great way to save cash. Unfortunately, while big leaks are generally noticeable, it’s the smaller ones that do the most damage and are the hardest to find. As a result, U.S. households waste nearly 1 trillion gallons of water every year, according to the Environmental Protection Agency. Smart leak sensors, some of the most overlooked smart home accessories, solve this exact problem. These devices are installed in water-consuming appliances (such as dishwashers, toilets, and heaters) to monitor water usage and detect leaks. They can even send alerts to your phone, allowing for quick fixes.

On the market today, there are plenty of leak sensors that do the job. One such option is the First Alert L1 Wi-Fi Water Leak Sensor, which costs $72.69 on Home Depot. Real users and experts have highlighted the sensor’s ability to detect the smallest of leaks quickly. It can cover up to 500 feet using the extension cables (sold separately) and monitors when the water in your pipes is about to freeze. While the sensor does not work with any smart home platforms, users say its app is pretty simple to use. For people looking to monitor their home’s total water usage, the Flo by Moen system is the next best bet. The device generates reports on consumption for each device and alerts you to potential leaks by continuously tracking pipe pressure. Just note that the system requires professional installation and is a bit pricey, costing $581.99 on Amazon.

Smart sprinkler system

Having a lawn outside your house is great — it gives you an open space to sit back in the sunshine or let the kids play. Of course, part of owning a lawn is also doing maintenance. You need to constantly water the grass to keep it fresh, and for most people, the easiest way to do so is with a sprinkler system. While these networks water the lawn at specific time intervals, they offer little flexibility in response to weather changes. After all, nobody wants their sprinklers working just after a full day of rain. That’s where a smart sprinkler system comes in. It can monitor weather data and use in-ground moisture sensors to determine when to spray water and how much. Most also sync with a mobile device, allowing you to keep an eye on weather reports and schedule the sprinkler to run — even at off-peak electricity hours — to save cash.

Regarding specific recommendations, experts in the field have been pleased with the Rachio 3 Smart Sprinkler Controller, which costs $199 on Amazon and comes with a slew of features, including the ability to schedule the sprinkler for specific times of day, in accordance with different seasons and weather conditions. The setup process, according to real users, is pretty easy. The app can configure multiple zones, and the system works with voice assistants like Siri, Amazon Alexa, and Google Assistant. If you’re on a tight budget, then the Orbit Smart Indoor Sprinkler Controller, which costs $111.79 on Amazon, is really good too. It can also water your lawn automatically by keeping an eye on the weather reports and integrates with Amazon Alexa and Google Home.

Smart home security systems

Demaerre/Getty Images

On paper, smart home security systems protect your home from theft and vandalism by continuously monitoring the surroundings for any unwanted things or people. While saving your belongings is a great way to save money, there is another way in which these systems can reduce your bills, and that’s through insurance. Because security systems decrease the risk of robbery, insurance providers often offer discounts to encourage people to install them. Some have even been offered reduced premiums, often in the range of 2% to 9%. It’s important to note that to qualify for these rebates, different insurance providers typically recommend different systems and require professional installation.

Keeping that in mind, the SimpliSafe Smart Security System, which also topped our list of the best home security systems, is a really good choice thanks to its easy setup (no professional help required) and optional monitoring plan. The starter package costs $239.99 on Amazon and comes with a base station, one outdoor security camera, a keypad, three entry sensors, and another motion sensor. There’s cellular and Wi-Fi connectivity as well. Unfortunately, the SimpliSafe system has limited integration with other smart home platforms (only Amazon Alexa and Google Assistant). If that’s a priority for you, the Abode Iota All-In-One Security Kit is the next best bet. It’s priced at $249 on Amazon and comes with a security hub that houses a 1080p camera, along with one key fob and a door/window sensor. Most importantly, it’s compatible with up to 160 other smart devices and supports Amazon Alexa, Google Assistant, Apple HomeKit, and IFTTT.

Smart smoke detectors

It’s no secret that smoke detectors are essential for alerting people about potential fires and saving lives. And according to many experts, if there is one thing you should invest in to make your home smart, it’s a smart smoke detector. These devices work essentially the same way but add the convenience of alerting your phone in case of an emergency, which is really important when you’re not home. Some detectors can even work in tandem with other smart devices to call for faster rescue services and adjust the ventilation system.

Fortunately, smart smoke detectors aren’t very expensive, and the best one, according to experts, is the Kidde Smart Smoke detector, which costs $74.97 on Amazon. It’s capable of detecting both slow- and fast-burning fires and also monitors carbon monoxide levels. Reviews say the alarm does a decent job of differentiating between cooking smoke and the real deal. If you have a Ring smart home system, Kidde also offers a $74 Ring-compatible version that, when activated, automatically connects to professional monitors who can notify your local fire department in case of a fire. For all the Nest Protect users, there’s the First Alert SC5 Smoke Detector system, which costs $129.99 on Amazon. It tracks both smoke and carbon monoxide and has a reliable alerting system, according to the reviews.

Smart appliances

RSplaneta/Shutterstock

Smart appliances like a fridge or washing machine seem like a really costly upgrade on paper. After all, your old models might work just fine for years to come. However, investing in newer appliances can also save you money down the road, for a few key reasons. First, newer models have better energy ratings (represented by stars) and can save on electricity costs every month. Beyond that, appliances like smart fridges keep track of inventory, notify you when supplies are running low, and some even alert you when produce is about to expire. With these perks, you can prevent food spoilage and reduce waste, which is always a plus for your wallet.

Similarly, smart washing machines track energy and water usage, generate regular reports, and can even configure themselves to run during off-peak electricity hours. There are many washing machine brands in the market today, but the best ones are Samsung and LG. Their washing machines consistently rank at the top for reliability, cleaning experience, and integration with smart home ecosystems.

Source

Posted on

Ethical hackers can be heroes: It’s time for the law

The last year has seen some of the costliest cyber attacks on UK businesses to date. Attacks on Marks & Spencer cost the supermarket chain hundreds of millions in lost profits and led to empty shelves. The Jaguar Land Rover attack sent shockwaves throughout its supply chain, which ultimately dragged down UK GDP in the third quarter.

While the perpetrators of cyber crime often operate across international borders, and beyond the reach of law enforcement, the M&S attack has resulted in several arrests in the UK, under the Computer Misuse Act [CMA] of 1990. With a new Cyber Security and Resilience Act on the way, it might seem UK authorities will soon have greater powers to force organisations to build better defences.

But while the UK government continues to pursue cyber criminals, it also needs to be much clearer about the crucial role of cyber security researchers and ethical hackers in defending against them.

Last week, UK security minister Dan Jarvis told a conference that the government was looking at changes to the CMA to introduce a “statutory defence” for cyber security experts who spot and share vulnerabilities.

It would mean that, as long they meet “certain safeguards”, researchers would be protected from prosecution.

To understand why this is so significant it’s worth recalling the background to the CMA. In the mid-1980s, IT journalist Steve Gold and fellow hacker Robert Schifreen were accused of accessing the Duke of Edinburgh’s BT Prestel email account.

They were prosecuted and convicted under the Forgery and Counterfeiting Act, but this was overturned on appeal, because that act didn’t specifically cover computer crimes.

This led to the CMA which set prison sentences for gaining unauthorised access to computer material.

The date is significant. At that time, most computer systems were tightly-controlled and effectively inaccessible to the majority of the population.

Very few people had a (BT-approved) modem at the time. The web had been developed just a year before. The dot com boom was years in the future, the term cyber war had yet to be coined, and the prospect of industrial level cyber crime barely considered.

The legislators who crafted the CMA can be forgiven for not anticipating the transformation of today’s digital environment, from mobile to cloud to AI. So, it’s perhaps understandable that the act didn’t anticipate the emergence of cyber security researchers, who would look for vulnerabilities and misconfigurations and share that information with the organisations concerned.

Less understandable is why this hasn’t been addressed since. As cyber crime transformed from a small niche into a worldwide epidemic over the last two decades, white hat hackers have been key to exposing and mitigating the methods and technologies cyber criminals have exploited. This has necessarily meant thinking and acting like a hacker.

Yet the CMA, and similar legislation in other countries, have proven to be a blunt instrument when it comes to deterring cyber crime.

It’s fair to point out that the number of prosecutions under the CMA and similar laws has been fairly low. But that is more because of the asymmetric nature of cyber crime: Most threats are coming from individuals beyond the reach of the UK and its allies, who are unlikely to be deterred by the CMA.

This imbalance has only become more stark as vulnerabilities and flaws have been exploited indiscriminately and at internet scale not just by criminals but by nation states willing to compromise critical national infrastructure, foreign businesses and consumers for strategic gains.

It has left researchers, and their potential clients, in a legal grey area. It has, on occasion, led to prosecutions of legitimate good guys.

Meanwhile, that ongoing threat of prosecution has an effect on another group of individuals – the next generation we need to encourage to join the industry. We are already suffering a chronic skills crisis, and the prospect of a criminal record hardly represents a golden hello.

None of this is new. The Criminal Law Reform Network highlighted in 2020 how “the CMA 1990 requires significant reform to make it fit for the 21st century.”  and recommended the addition of required harms. The Home Office began a review of the act in 2021, which concluded in 2023, and did consider the question of a defence for researchers. the addition of required harms.

When the Cyber security and Resiliency Act becomes law in the UK, many more organisations will be obliged to report breaches, and be under more pressure to manage their security posture, including vulnerabilities.

They’re not going to be able to do that without the help of ethical hackers and cyber security researchers, who should be able to operate without fear of prosecution. It’s certainly do-able. Portugal has just announced built in defences for researchers in its implementation of NIS2.

Jarvis’ statement is welcome. But now we need action. We can’t wait another five years for the government to act to give cyber researchers and ethical hackers the cover they need. And we definitely can’t wait another 35.

Ed Parsons is chief operating officer at bug bounty, vulnerability disclosure and penetration testing services provider Intigriti, and a former vice president and cyber professional member association ISC2. A career risk and cyber expert, Parsons is a is a Certified Information Systems Security Professional (CISSP) and a UK Chartered Cyber Security Professional.

Source

Posted on

The Best Way To Keep Your Laptop’s Trackpad Clean

Nicolas Ospina/Getty Images

Keeping your laptop clean isn’t the most challenging task. It doesn’t take much more than a microfiber cloth to safely clean your MacBook’s screen and surfaces, but there’s one area that tends to prove a bit more troublesome when it comes time to remove dirt and muck: The trackpad.

If you’re not pairing your machine with an external mouse, that tiny little square is putting in overtime. It collects fingerprints, absorbs every trace of skin oil your hands can muster, and eventually turns into a grimy hotspot you’d rather pretend isn’t there. In extreme cases, all that buildup may even confuse your laptop’s haptics or gesture controls, tricking it into thinking you’re swiping or clicking when you’re not.

The good news? Cleaning your trackpad doesn’t require a specialty kit or a trip to the Apple Store. All you really need is a microfiber cloth and a small bottle of 70% isopropyl alcohol. You can also use 70% isopropyl alcohol wipes, 75% ethyl alcohol wipes, or Clorox Disinfecting Wipes. Just make sure you never use bleach, aerosol spray, or abrasives.

Cleaning your trackpad isn’t difficult

Amnaj Khetsamtip/Shutterstock

Before you start cleaning your trackpad, unplug your laptop. If you’re using a hard-shell case, now’s the perfect time to pop it off. You want full access to as much trackpad real estate as possible. If you’re using a bottle of isopropyl alcohol or ethyl alcohol instead of wipes, never apply these liquids directly to the trackpad surface. You always want to apply to a soft, microfiber cloth first, and avoid getting moisture into any laptop openings. 

Use gentle motions and pressure, and avoid excessive wiping when possible. Most pads also have a tiny seam around the edge where grime loves to hide. You can gently run something thin — a business card, an index card, even a folded piece of printer paper — along the trackpad’s border to lift out whatever grit is wedged in there. If you’re dealing with serious, stubborn debris that won’t budge no matter what you try, don’t force it. At that point, it’s worth reaching out to the manufacturer or a repair shop. 

A professional cleaning is far cheaper than damaging the trackpad or other parts of the laptop by digging too aggressively. One quick reality check: If your laptop’s trackpad has been through years of scrolling, tapping, and palm-dragging, some of the original finish may have worn down. That’s totally normal. Even after a proper cleaning, it might not look factory-fresh — but you are getting rid of the new junk that’s built up on top.

Even the best laptops need spa days

Naked King/Getty Images

Cleaning your trackpad isn’t rocket science — it’s just a simple bit of laptop TLC that deserves a spot in your regular routine. We’ve talked before about how often you should clean your computer, and our “every six months” rule holds up nicely for your trackpad, too. If you want to clean it more frequently — every couple of months, or whenever it starts looking a little too glossy for comfort, that’s totally fine. Your trackpad will thank you, and your gestures will feel sharper for it. 

It also pays to clean your computer’s USB ports every so often — a process that doesn’t require much more than a toothpick and some patience. And seriously, don’t beat yourself up if your machine doesn’t look like a showroom model. Laptops get hauled around, stuffed into bags, used at coffee shops, airplanes, couches, and countertops. What matters is the upkeep. As long as you’re staying on top of intermittent cleaning and dealing with bigger spills and crumb explosions the moment they occur, you’re doing everything you can to keep that trackpad looking sharp and performing nicely.

Source

Posted on

Alcatel-Lucent, Nokia team to deliver end-to-end enterprise network services

Looking to help modernise and future-proof campus networks across a range of use cases and industries, Alcatel-Lucent Enterprise (ALE) and Nokia have strengthened their strategic partnership to deliver an end-to-end portfolio of network services designed to support the digital transformation of critical industries such as transportation, smart cities, energy and utilities, healthcare, and hospitality.

The joint networking services have been deployed by Ikos Resorts in Greece, Pantai Jerudong Hospital in Brunei and Wembley Park in the UK in deployments designed to help establish campus-wide fibre-based LAN networks capable of delivering multi-gigabit data speeds to customers.

Nokia and ALE say the wins mark a significant milestone in the five-year partnership, and add to a long list of successful deployments at some of the world’s most demanding projects, such as Grand Paris Express, Montreal Railways and Okada Manila Resort. 

By integrating their respective networking portfolios, the two companies say that they are “uniquely positioned” to meet the evolving demands of complex environments such as hospitality segments where resorts like Ikos are using their combined offering to connect hundreds of bedrooms across their luxury all-inclusive sites. With Nokia and ALE, Ikos was able to run its guest services, CCTV, voice, Wi-Fi and building safety sensors through a single, high-availability network architecture.

The fibre infrastructure also helped to save space and reduce the number of network layers. Boasting a legacy in delivering optical fibre services and being a trusted integrator in enterprise communications, Nokia and ALE have deployed their joint offering into more than 100 enterprises globally.

At the heart of the infrastructures is Nokia’s Optical LAN, which is designed to provide enterprises and campuses with a high-capacity fibre-based network capable of supporting the growing bandwidth needs for all in-campus devices and applications.

The optical LAN includes network performance with 10 gigabit speeds; “significantly” reduced power consumption, making operations more sustainable and cost-effective; and a light infrastructure in which the network can be simplified with minimal hardware requirements, reducing complexity and enhancing reliability. It is also attributed with lower total cost of ownership through efficient design and reduced maintenance, maximising return on investment.

Integrated into ALE’s network offering for enterprise in-building and campus connectivity, the technology is said to offer significant advantages, including lower energy consumption and total cost of ownership. ALE’s LAN and Wi-Fi also see use in providing an automated service that is claimed to be able to onboard devices efficiently while securing the network thanks to asset discovery and classification, virtual segmentation and continuous monitoring. Features include Layer 2 services, HPOE and optional redundant uplinks. 

“By combining ALE’s agile enterprise networking solutions with Nokia’s carrier-grade infrastructure, we offer a comprehensive portfolio that addresses the unique needs of critical industries,” said Sandrine El Khodry, Alcatel-Lucent Enterprise’s executive vice-president of global sales and marketing. “Our partnership is built on trust, innovation and a shared commitment to customer success.”

Matthieu Bourguignon, senior vice-president and head of Europe at Nokia, added: “Our collaboration with Alcatel-Lucent Enterprise allows us to deliver end-to-end, mission-critical solutions that go beyond traditional boundaries. We are proud of the joint successes we’ve achieved and look forward to enabling even more transformative projects together.”

Source

Posted on

Why bug bounty schemes have not led to secure software

Governments should make software companies liable for developing insecure computer code. So says Katie Moussouris, the white hat hacker and security expert who first persuaded Microsoft and the Pentagon to offer financial rewards to security researchers who found and reported serious security vulnerabilities.

Bug bounty schemes have since proliferated and have now become the norm for software companies, with some, such as Apple, offering awards of $2m or more to those who find critical security vulnerabilities.

Moussouris likens security vulnerability research to working for Uber, only with lower pay and less job security. The catch is that people only get paid if they are the first to find and report a vulnerability. Those who put in the work but get results second or third get nothing.

“Intrinsically, it is exploitative of the labour market. You are asking them to do speculative labour, and you are getting something quite valuable out of them,” she says.

Some white hat hackers, motivated by helping people fix security problems, have managed to make a living by specialising in finding medium-risk vulnerabilities that may not pay as well as the high-risk bugs, but are easier to find.

But most security researchers struggle to make a living as bug bounty hunters.

“Very few researchers are capable of finding those elite-level vulnerabilities, and very few of the ones that are capable think it is worth their while to chase a bug bounty. They would rather have a nice contract or a full-time role,” she says.

Ethical hacking comes with legal risks

Its not just the lack of a steady income. Security researchers also face legal risks from anti-hacking laws, such as the UK’s Computer Misuse Act and the US’s draconian Computer Fraud and Abuse Act.

When Moussouris joined Microsoft in 2007, she persuaded the company to announce that it would not prosecute bounty hunters if they found online vulnerabilities in Microsoft products and reported them responsibly. Other software companies have since followed suit.

The UK government has now recognised the problem and promised to introduce a statutory defence for cyber security researchers who spot and share vulnerabilities to protect them from prosecution.

Another issue is that many software companies insist on security researchers signing a non-disclosure agreement (NDA) before paying them for their vulnerability disclosures.

This flies against the best practices for security disclosures, which Moussouris has championed through the International Standards Organisation (ISO).

When software companies pay the first person to discover a vulnerability a bounty in return for signing an NDA, that creates an incentive for those who find the same vulnerability to publicly disclose it, increasing the risk that a bad actor will exploit it for criminal purposes.

Worse, some companies use NDAs to keep vulnerabilities hidden but don’t take steps to fix them, says Moussouris, whose company, Luta Security, manages and advises on bug bounty and vulnerability disclosure programmes.

“We often see a big pile of unfixed bugs,” she says. “And some of these programmes are well funded by publicly traded companies that have plenty of cyber security employees, application security engineers and funding.”

Some companies appear to regard bug bounties as a replacement for secure coding and proper investment in software testing.

“We are using bug bounties as a stop-gap, as a way to potentially control the public disclosure of bugs, and we are not using them to identify symptoms that can diagnose our deeper lack of security controls,” she adds.

Ultimately, Moussouris says, governments will have to step in and change laws to make software companies liable for errors in their software, in much the same way car manufacturers are responsible for safety flaws in their vehicles.

“All governments have pretty much held off on holding software companies responsible and legally liable, because they wanted to encourage the growth of their industry,” she says. “But that has to change at a certain point, like automobiles were not highly regulated, and then seatbelts were required by law.”

AI could lead to less secure code

The rise of artificial intelligence (AI) could make white hat hackers redundant altogether, but perhaps not in a way that leads to better software security.

All of the major bug bounty platforms in the US are using AI to help with the triage of vulnerabilities and to augment penetration testing.

An AI-powered penetration testing platform, XBow, recently topped the bug bounty leaderboard by using AI to focus on relatively easy-to-find vulnerabilities and testing likely candidates in a systematic way to harvest security bugs.

“Once we create the tools to train AI to make it appear to be as good, or better in a lot of cases, than humans, you are pulling the rug out of the market. And then where are we going to get the next bug bounty expert?” she asks.

The current generation of experts with the skills to spot when AI systems are missing something important is in danger of disappearing.

“Bug bounty platforms are moving towards an automated, driverless version of bug bounties, where AI agents are going to take the place of human bug hunters,” she says.

Unfortunately, it’s far easier for AI to find software bugs than it is to use AI to fix them. And companies are not investing as much as they should in using AI to mitigate security risks.

“We have to figure out how to change that equation very quickly. It is easier to find and report a bug than it is for AI to write and test a patch,” she says.

Bug bounties have failed

Moussouris, a passionate and enthusiastic advocate of bug bounty schemes, is the first to acknowledge that bug bounty schemes have, in one sense, failed.

Some things have improved. Software developers have shifted to better programming languages and frameworks that make it harder to introduce particular classes of vulnerability, such as cross-site scripting errors.

But there is, she suggests, too much security theatre. Companies still address faults because they are visible, but hold off fixing things that the public can’t see, or use non-disclosure agreements to buy silence from researchers to keep vulnerabilities from the public.

Moussouris believes that AI will ultimately take over from human bug researchers, but says the loss of expertise will damage security.

The world is on the verge of another industrial revolution, but it will be bigger and faster than the last industrial revolution. In the 19th century, people left agriculture to work long hours in factories, often in dangerous conditions for poor wages.

As AI takes over more tasks currently carried out by people, unemployment will rise, incomes will fall and economies risk stagnation, Moussouris predicts.

The only answer, she believes, is for governments to tax AI companies and use the proceeds to provide the population with a universal basic income (UBI). “I think it has to, or literally there will be no way for capitalism to survive,” she says. “The good news is that human engineering ingenuity is still intact for now. I still believe in our ability to hack our way out of this problem.”

Growing tensions between governments and bug bounty hunters

The work of bug bounty hunters has also been impacted by moves to require software technology companies to report vulnerabilities to governments before they fix them.

It began with China in 2021, which required tech companies to disclose new vulnerabilities within 48 hours of discovery.

“It was very clear that they were going to evaluate whether or not they were going to use vulnerabilities for offensive purposes,” says Moussouris.

In 2020, the European Union (EU) introduced the Cyber Resilience Act (CRA), which introduced similar disclosure obligations, ostensibly to allow European government to prepare their cyber defences.

Moussouris is a co-author of the ISO standard on vulnerability disclosure. One of its principles is to limit the knowledge of security bugs to the smallest number of people before they are fixed.

The EU argues that its approach will be safe because it is not asking for a deep technical explanation of the vulnerabilities, nor is it asking for proof-of-concept code to show how vulnerabilities can be exploited.

But that misses the point, says Moussouris. Widening the pool of people with access to information about vulnerabilities will make leaks more likely and raises the risk that criminal hackers or hostile nation-states will exploit them for crime or espionage.

Risk from hostile nations

Moussouris does not doubt that hostile nations will exploit the weakest links in government bug notification schemes to learn new security exploits. If they are already using those vulnerabilities for offensive hacking, they will be able to cover their tracks.

“I anticipate there will be an upheaval in the threat intelligence landscape because our adversaries absolutely know this law is going to take effect. They are certainly positioning themselves to learn about these things through the leakiest party that gets notified,” she says.

“And they will either start targeting that particular software, if they weren’t already, or start pulling back their operations or hiding their tracks if they were the ones using it. It’s counterproductive,” she adds.

Moussouris is concerned that the US will likely follow the EU by introducing its own bug reporting scheme. “I am just holding my breath, anticipating that the US is going to follow, but I have been warning them against it.”

The UK’s equities programme

In the UK, GCHQ regulates government use of security vulnerabilities for spying through a process known as the equities scheme.

That involves security experts weighing up whether the UK would place its own critical systems at risk if it failed to notify software suppliers of potential exploits against the potential value of the exploit for gathering intelligence.

The process has a veneer of rationality, but it falls down because, in practice, government experts can have no idea how widespread vulnerabilities are in the critical national infrastructure. Even large suppliers like Microsoft have trouble tracking where their own products are used.

“When I was working at Microsoft, it was very clear that while Microsoft had a lot of visibility into what was deployed in the world, there were tonnes of things out there that they wouldn’t know about until they were exploited,” she says.

“The fact that Microsoft, with all its telemetry ability to know where its customers are, struggled means there is absolutely no way to gauge in a reliable way how vulnerable we are,” she adds.

Kate Moussouris spoke to Computer Weekly at the SANS CyberThreat Summit.

Source

Posted on

Can You Wear Headphones While Driving?

Freemixer/Getty Images

The logical assumption about wearing headphones while driving is that it’s a big no-no. Not only might they distract you from what’s happening on the road, but covering your ears also makes it challenging to hear things around you, which is crucial while driving.

You can have a conversation with someone via Bluetooth speakerphone using the car’s speakers while you enjoy the open road. Is it really that much different as compared to wearing an earbud for sound clarity, or for private conversations while others are in the car? According to the laws in some states, there’s no difference between the two. But that’s not true for every jurisdiction.

What’s more, in any situation, paying attention to the road ahead — and your surroundings — is the most important factor in the equation, regardless of the law. Hearing aids necessary for improving your hearing are always permitted in the U.S., since they are medical devices designed to enhance hearing, not impede it. However, concerning the wearing of a pair of earbuds, or single earbuds, laws differ from state to state.

What different laws say about driving with earbuds in

Jacoblund/Getty Images

When it comes to permissibility for wearing a single headset or earbud while driving, California, Alaska, Louisiana, Maryland, Massachusetts, Minnesota, Virginia, and Washington have outright bans. All but Washington note specifically that headphones or earbuds cannot cover both ears. Washington doesn’t permit any headset or earphones that are connected to an electronic device while driving, either in both ears or a single ear.

There are partial restrictions in other states that explicitly note that you can drive with a single earbud in, even if the others above (Washington excepted) imply it. These include Florida, Illinois, New York, Georgia (allowable for communication purposes), Rhode Island, Ohio, and most recently, Colorado. As long as both ears aren’t covered and the driver can still hear surrounding traffic, it’s okay to pop in a single bud.

All other remaining states don’t explicitly have laws pertaining to wearing earbuds or headphones while driving. But this is always subject to change as legislation and rules pass. Further, if you are stopped, an officer could still issue a fine pertinent to other rules, like distracted driving or unsafe operation of a motor vehicle, with the earbuds being a contributing factor.

Err on the side of caution

Eyeem Mobile Gmbh/Getty Images

Whenever possible, use the vehicle’s built-in Bluetooth speaker and platforms like the latest Apple CarPlay or Android Auto. But if you must use an earbud, where permitted, pop in a single one and look for on-ear buds that still provide some situational awareness versus completely plugging your ear canal. This way, you’ll still hear things like emergency vehicle sirens, horns, railroad crossing signals, approaching cars, screeching tires, and pedestrians.

It’s worth noting that having a conversation alone in a vehicle can be distracting, in general. If you need to pick up a quick call, do it. But pull over for longer, more intense chats. This will help you avoid something called inattention blindness, which is when you might see — and even hear — a hazard on the road but aren’t able to mentally process it because your attention is elsewhere. This is possible whether you’re wearing earbuds or not.

Source

Posted on

Are we mistaking regulation for resilience?

As security leaders in the UK, we often feel squeezed between an increasingly aggressive threat landscape and a sprawling legislative framework. A new assessment of the UK’s cyber security legislative framework confirms what many of us discuss over drinks at industry conferences: we are drowning in compliance obligations, yet the nation’s cyber resilience remains alarmingly fragile. For my peers across the UK, this report offers five critical takeaways that should shape our future strategies.

While the UK General Data Protection Regulation (GDPR) theoretically threatens UK businesses with massive penalties, the Information Commissioner’s Office (ICO) issued only three fines in 2024, often favouring reprimands instead. Even more striking is the enforcement void regarding the Network and Information Systems (NIS) Regulations.

Despite a significant rise in incident notifications, freedom of information data indicates a near-total absence of formal sanctions by key competent authorities between 2021 and 2024 (see “Situation Snapshot” table below). While this might sound like a reprieve, it undermines our internal business cases for security investment. If the regulator won’t bite, the board won’t listen.

This leads to the second – and perhaps most worrying – trend: the disengagement of the board. The UK has seen a measurable decline in executive ownership. The percentage of businesses with a board member holding explicit responsibility for cyber security has dropped from 38% in 2021 to just 27% in 2025. This knowledge will significantly impact how seriously our executives treat privacy and security moving forward.

As chief information security officers (CISO), we cannot allow cyber risk responsibilities to be relegated to the IT department. The Cyber Security and Resilience Bill (CSRB) missed a key opportunity to place accountability with boards and executives as a statutory duty. This would not include making the CISO into the “chief information scapegoat officer” by assigning liability without the resources or authority to address the risks.

Decline in businesses with a board member holding explicit cyber responsibility (2021 vs 2025)  

High Risk: Executive ownership is shrinking just as liability is increasing. 

Percentage of large businesses that continue to suffer breaches  

Ineffectiveness: Current compliance spending is not lowering the success rate of attacks for large firms. 

Increase in ransomware attack numbers between 2024 and 2025

Escalating Threat: Attackers are outpacing defensive controls despite passing audits. 

Total fines issued by the ICO in 2024, with a preference for reprimands

Enforcement Void: The regulator is currently ineffective, undermining the business case for security investment based solely on fines. 

Lack of formal sanctions by competent authorities under NIS Regulations (2021-2025)

False Security: Reliance on regulatory pressure to drive improvements is a failed strategy. 

Third, we must recognise that compliance does not equal resilience. The UK’s cybersecurity and privacy legislative framework: Effectiveness, enforcement and complexity report highlights a “tick-box mentality” where resources are diverted toward navigating complex legal requirements rather than effective security controls. The result is a sobering statistic: cyber security breach rates for large businesses persist at 74%.

Companies are passing audits, yet are still falling victim to phishing and increasingly sophisticated ransomware attacks, the latter of which saw numbers double between 2024 and 2025. Our focus must shift from generating documentation to validating operational resilience through rigorous testing of incident response plans.

Fourth, the complexity of the legislative landscape has reached a point of diminishing returns. We are navigating a patchwork of the UK GDPR, NIS Regulations, the Computer Misuse Act and the Online Safety Act, with the new CSRB. This cumulative volume creates a “compliance tax” that drains our finite resources.

For those of us managing supply chains, this is critical. The burden on our small to medium-sized enterprise (SME) partners is crushing, potentially stifling the very innovation we rely on. We must audit our supply chains not just for security, but for their ability to survive this regulatory attrition.

Finally, we must prepare for the expanded scope of the CSRB. The employed strategy is shifting towards a “whole of society” approach, bringing managed service providers (MSPs) and datacentres directly into the regulatory fold. If you rely on third parties, as many of us do, the regulatory spotlight is about to widen.

Ultimately, this report serves as a wake-up call. We cannot rely on legislation to solve the problem, nor can we rely on regulators to enforce it consistently. We must move beyond the “compliance trap” and build cultures and controls that survive contact with our adversaries.

A response to The UK’s cybersecurity and privacy legislative framework report, from William Dutton, Oxford Martin Fellow, Global Cyber Security Capacity Centre, Oxford University:

“Debate on governmental policy on information technologies too often hovers around broad generalities, such as whether to regulate. This insightful report digs deeper. The WCIT [Worshipful Company of Information Technologists] Security Panel addresses issues such as the regulatory paradox across key aspects of major governmental, legislative and regulatory choices, providing valuable insights for policymakers, regulators, and a range of business organisations, including small enterprises. This report is a concise and valuable reference for those with a serious interest in issues tied to cyber security and privacy.”

Source