Hello again!

It’s Evan, senior digital security trainer at Freedom of the Press Foundation (FPF), with our regular update on the U.S. journalism school digital security curriculum.

J-school security curriculum update

  • We’re in the midst of a major revamp of the digital security 101 module! As part of these changes, we’re working on introducing a fresh set of slides for professors. Once complete, these slides will include enhanced teaching notes, updated examples, and additional training activities. We look forward to sharing it with you all once finished this summer.

Highlights from digital security in the news

  • Instagram is set to remove its end-to-end encryption option for direct messages starting in May. End-to-end encryption has never been the default setting for DMs on Instagram, and the settings required to enable it are difficult to find and prone to user error. These design decisions are likely part of the reason for the limited use of E2EE on Instagram, which Meta cited as its official reason for removing the option altogether. Privacy advocates have noted that this move runs counter to Meta’s prior commitments to expand encryption on its platforms, and comes after years of pressure on Meta from law enforcement agencies who argue that E2EE makes it harder to detect child sexual exploitation and other harms online. Read more.

Suggested modules

  • Anthropic announced that it is withholding its latest artificial intelligence model, dubbed Claude Mythos Preview, from public release due to its advanced vulnerability research capabilities. According to Anthropic, Mythos Preview was able to find and exploit as-yet undiscovered vulnerabilities in every major browser and operating system, including some that had gone unidentified for over 20 years. The company also launched an initiative called Project Glasswing to help the tech industry stay in front of the likely proliferation of such capabilities over the coming months. While elements of the announcement and the buzz surrounding it are likely motivated by PR and savvy marketing, independent security experts have also flagged that Mythos Preview (and similar models likely to be released by other AI companies in the very near future) represents a significant step up from previous frontier AI models in terms of its capacity to identify and execute complex attacks. Read more.

Suggested modules

  • In March, six legislators wrote a letter to Director of National Intelligence Tulsi Gabbard urging her to disclose more information about how the use of VPNs may affect Americans’ privacy rights. The letter argues that some federal guidelines suggest VPN users are subject to foreign intelligence surveillance under Executive Order 12333 and FISA Section 702, which authorize the warrantless targeting of foreigners abroad. The letter comes amid active debates surrounding efforts to reform Section 702 to curtail the government’s abuse of the provision to spy on Americans’ communications without a warrant. Read more.

Suggested modules

What we’re reading

  • A recent report from The Citizen Lab, in collaboration with the European investigative platform VSquare, took a deep dive into a geolocation surveillance system called Webloc. The report breaks down in fascinating detail — including with screenshots from the Webloc user interface — how the tool’s customers can draw on data harvested from consumer mobile apps and the digital advertising ecosystem to monitor the movements and characteristics of hundreds of millions of people worldwide. The harvested information includes GPS coordinates, device identifiers, app usage, and behavioral profiles. Webloc’s confirmed customers include some foreign governmental entities and, in the U.S., groups like Immigration and Customs Enforcement, the military, and local and state police departments. Read the full report.

As always, let me and our team know how you’re using the curriculum, what’s useful, and how it can be improved! Feel free to respond to this email or [email protected].

Thanks so much,
Evan

–

Evan Summers
Senior Digital Security Trainer
Freedom of the Press Foundation