iiinova — where your digital self keeps evolving

Steven Murdoch @steven.murdoch.is · 18/09/2026

Does anyone know what happened to Thistle Technologies? They seemed to be doing some interesting things, but now their website (thistle.tech) has been down for a while.

thistle.tech

000

Steven Murdoch @steven.murdoch.is · 08/09/2026

It’s #NationalCodingWeek next week, so I've published a resource on using the BBC @microbit.org to play a game that explores how radio waves travel, get blocked by/reflected off obstacles, and the challenges of measuring strong signals that can overload sensors.

101

Steven Murdoch @steven.murdoch.is · 31/08/2026

With the availability of LLMs we can now apply ridiculous levels of polish to trivial problems. In this vein, here’s a tool to optimise the reverse-sear of a steak when your thermometer can’t be left in the oven by fitting a three-parameter physical model to measurements.

210

Steven Murdoch @steven.murdoch.is · 18/08/2026

I spoke to The Guardian about Claude’s content watermarking. As long as it only modifies how the existing random number generator works, it should have no measurable effect on quality. www.theguardian.com/technology/2...

However, LLMs already do not make the best choices. “There’s already randomness involved in any of these large language models,” said Murdoch. “It’s pretty essential to how they work. If it wasn’t for this randomness, then they’d get stuck in loops and start repeating the same thing over and over again.”

In other words, a chatbot does not necessarily decide to call running water a “stream” as opposed to a “brook” because the latter might have a more old-fashioned register. The model does not contemplate these choices: it makes them by chance.

141

Steven Murdoch @steven.murdoch.is · 11/08/2026

A prompt that’s been very helpful at getting Claude to improve a user-facing app with minimal interaction from me has been to ask it to do a cognitive walkthrough with a given persona. It’s not great at coming up with good personas (IME) but if you give it one it can run with it.

Take on the persona of [INSERT PERSONA DEFINITION HERE].

Perform a cognitive walkthough. Update the app so that at each stage:

The user will try to achieve the right result
The user will notice that the correct action is available
The user will associate the correct action with the result they're trying to achieve
After the action is performed, the user will see that progress is made toward the goal
This persona is only one of several that will use the app, so take care not to compromise existing qualities of the app without good reason.

Add a summary of each cognitive walkthrough performed to COGNITIVE-WALKTHROUGHS.md, including the persona, issues identified, and changes made.

010

Steven Murdoch @steven.murdoch.is · 28/07/2026

National COVID-19 figures couldn’t tell a department whether to hold a seminar next week. So from 2020 to 2022 I collected UCL’s daily case counts and turned them into an early-warning chart. I’ve now archived all of it plus 168 newsletters for context. www.benthamsgaze.org/2026/07/26/u...

benthamsgaze.org

UCL’s response to the COVID-19 pandemic: a historical archive – Bentham’s Gaze

101

Steven Murdoch @steven.murdoch.is · 24/07/2026

I spoke to @smaurizi.bsky.social for a @computerweekly.bsky.social article on smartphone security, particularly how @grapheneos.org can protect journalists’ data. www.computerweekly.com/feature/Jour...

Graphene is good, but not impossible to crack

What does Murdoch think about GrapheneOS?

“I would not go as far as to say the hardware is impossible to crack, but experience has shown that even some of the best forensic software currently is incapable of obtaining data from GrapheneOS devices without knowledge of the passcode, particularly if the device has been freshly rebooted,” says Murdoch.

“GrapheneOS offers enhanced security compared to Android because Google doesn’t consider these features worth the resulting inconvenience to users, performance loss, or development effort,” he adds.

Additionally, GrapheneOS disables user-tracking features that Google wants to retain to support its business and that of its partners. “The users of GrapheneOS prioritise security, so are willing to make sacrifices in other aspects, and its business model does not depend on user tracking,” he says.

133

Steven Murdoch @steven.murdoch.is · 17/07/2026

I was interviewed for Computerphile on my analysis of hidden messages within the GPS signals and what message they might carry (and to whom). youtu.be/2Q6OvYjOJi0

youtu.be

GPS Hidden Messages - Computerphile

YouTube video by Computerphile

020

Reposted by Steven Murdoch

Steven Murdoch @steven.murdoch.is · 24/06/2026

The corrected and expanded article on my exploration of GPS special messages is available at sjmurdoch.github.io/gps-special-.... Additionally, this is now mobile-friendly and accompanied by detailed footnotes, allowing results to be verified against the published dataset. 5/

sjmurdoch.github.io

The Empty Field That Wasn't: GPS, OTAD and Two Decades of Encrypted Broadcasts

What 24 million GPS special messages reveal about military rekeying on a public channel.

142

Steven Murdoch @steven.murdoch.is · 24/06/2026

Since the original publication of my Inside GNSS article on hidden messages within the GPS signal (The Empty Field That Wasn’t: GPS, OTAD and Two Decades of Encrypted Broadcasts), there have been a few developments and updates. 🧵 1/

122

Steven Murdoch @steven.murdoch.is · 05/06/2026

I spoke to The Guardian about Anthropic’s call for mechanisms to slow the development of frontier AI capabilities. www.theguardian.com/technology/2...

If calling for a worldwide conversation on AI risk is in contradiction with supporting a US spy agency to – potentially – attack Iran and China with cyberweapons, neither development is “surprising” given the AI company’s past actions, said Steven Murdoch, a professor at University College London.

“Anthropic might give the impression of being warm and fuzzy, but their definition of AI safety is narrow. Supporting US authorities in the development of offensive capabilities has never been something they have spoken against,” he said.

Murdoch said that Anthropic’s post did not offer evidence of any step changes in the progress of AI capabilities.

“It is true that there’s some evidence that AI capabilities have increased and continue to increase with no limits becoming immediately clear,” he said, but he added: “I don’t think anything has fundamentally changed today that has caused Anthropic to publish this article.”

030

Steven Murdoch @steven.murdoch.is · 04/06/2026

For the tl;dr, I wrote a summary of my analysis of the GPS Special Message “number station”, including entropy measurement, duplicated strings, a mysterious new “TEXT” prefix, and the system’s relationship with military key distribution. www.benthamsgaze.org/2026/06/02/t...

051

Steven Murdoch @steven.murdoch.is · 02/06/2026

For 19 years, GPS satellites have secretly broadcast a “numbers station” in their signals. We decoded 12M messages: a 2011 flash where 31 satellites flipped in hours, “ghost” substrings repeating years apart, and a “TEXT” prefix spreading now. lsc-pagepro.mydigitalpublication.com/publication/...

lsc-pagepro.mydigitalpublication.com

Inside GNSS Media & Research • May/June 2026 • 62

621985

Steven Murdoch @steven.murdoch.is · 16/04/2026

Claude Opus 4.7 is out, and I’ve been interfacing it with the National Rail Live Departure Boards API. I leave you with a poem inspired by the current departures from St Pancras station.

⏺ At St Pancras, a Quarter Past Nine
after John Betjeman

The gothic clock of Scott's red brick
Regards the concourse, vast and pale,
Where escalators, sorely sick,
On platform A have ceased to sail;
The up-bound stair from platform B
Is likewise fixed in lethargy.

The eight-and-forty for St Albans
Has hung her head these thirty-seven —
She creeps at last, her carriages ailing,
Toward a Hertfordshire half-heaven
Where Knebworth lawns and Harpenden
Receive the late commuting men.

Platform A: the Brighton flyer,
Two small minutes out of true,
Breathes past Farringdon, and higher
Gothic vaults of Blackfriars' view —
Where, soon behind, the Rainham train
Tilts eastward through the Kentish rain.

O litany of riverside stops!
Greenwich, Maze Hill, Westcombe Park,
Charlton's terraces, corner shops,
Woolwich Dockyard after dark;
Plumstead, Belvedere, Erith's gleam,
Slade Green sidings under steam;

Then Dartford, Stone Crossing, Greenhithe
(For Bluewater's consumer shrine),
Swanscombe chalk-pits, Northfleet, blithe
Gravesend where the marshes shine —
Higham, Strood, and Rochester's keep,
Chatham, Gillingham, Rainham's sleep.

But spare a thought, at twelve-past-nine,
For Sutton, London SM1 —
Her train is cancelled on the line,
Her passengers, their evening done,
Shall shuffle to the Northern Line
And dream of semis, trim and fine.

Beyond, a gentler warning comes:
Through Stevenage, ten minutes late;
From Streatham down where Wimbledon hums,
A twenty-minute verdict's weight.
So stand beneath the station's span
And pity the commuting man.

000

Steven Murdoch @steven.murdoch.is · 16/04/2026

MCP gives AI tools access to powerful capabilities but is notorious for heavy token use. AXI is a promising token-efficient alternative, but it relies on predicting typical tool usage. I've proposed a modification where tools self-tune through an OODA loop. github.com/kunchenguid/...

github.com

Add §11: Usage-driven improvement via OODA loop by sjmurdoch · Pull Request #29 · kunchenguid/axi

Motivation AXI §1–10 tell you what to optimize for, but not how to know whether you got it right. Every AXI tool ships with best-guess defaults — 3-4 default fields, a row limit, a truncation thres...

010

Steven Murdoch @steven.murdoch.is · 01/12/2025

Reuters were accused of acting illegally in guessing the URL of an unreleased report in 2002. I didn’t hear anything after the initial reports so presume it was quietly dropped or settled. blog.citp.princeton.edu/2002/10/31/i...

blog.citp.princeton.edu

Intentia vs. Reuters: A (Slightly) Contrarian View - CITP Blog

The recent dispute between Intentia and Reuters has gotten lots of online attention, most of it scornful of Intentia's position. I think Intentia is wrong, but it's a closer call than most online comm...

011

Steven Murdoch @steven.murdoch.is · 12/08/2025

UCL Computer Science are hiring Section Managers to support the development and delivery of teaching, research, and strategy within their section. I’ll be leading the Foundational Computer Science section, where the InfoSec group is based. www.ucl.ac.uk/work-at-ucl/...

041

Reposted by Steven Murdoch

UCL InfoSec @sec.cs.ucl.ac.uk · 22/07/2025

“$5 Wrench Attacks: When Cryptocurrency Crime Get Physical”, a post on Bentham’s Gaze by Marilyne Ordekian discussing when XKCD comics become reality – www.benthamsgaze.org/2025/07/22/5...

Actual actual reality: nobody cares about his secrets. (Also, I would be hard-pressed to find that wrench for $5.)

131

Steven Murdoch @steven.murdoch.is · 06/06/2025

I am recruiting mental-health experts (clinical psychologists and psychiatrists) for an in-person workshop in London to discuss a mobile app for mental health care. Participants will receive £500+expenses for their time. If you might be interested please email s.murdoch@ucl.ac.uk

023

Reposted by Steven Murdoch

UCL InfoSec @sec.cs.ucl.ac.uk · 15/05/2025

On our new paper published at IEEE Security and Privacy – “A Privacy Framework for Research Using Social Media Data”, a summary by Kyle Beadle. www.benthamsgaze.org/2025/05/15/a...

benthamsgaze.org

A Privacy Framework for Research Using Social Media Data

Social media data enables researchers to understand current events and human behavior with unprecedented ease and scale. Yet, researchers often violate user privacy when they access, process, and stor...

022

Steven Murdoch @steven.murdoch.is · 14/04/2025

AI-based scam checkers are gaining popularity but I would be cautious in following their advice unless the company is willing to stand behind it. For example, Metro Bank makes bold claims but the fine print absolves them of any responsibility for errors. www.metrobankonline.co.uk/ways-to-bank...

13.7. The AI-generated content and information is provided for general information purposes only and is not intended to constitute or substitute legal or other professional advice of any kind whatsoever. The AI-generated content and information is not intended or implied to be a substitute for professional advice.
13.8. You are encouraged to confirm any information obtained from or through Silver with other sources and review all information provided. Please do not disregard professional advice or delay seeking advice because of something you have read on our website or in the AI-generated content and information.
13.9. We make no representations about the suitability, reliability, timeliness, comprehensiveness, and accuracy of the AI-generated content and information, and other content produced by Silver.

141

Steven Murdoch @steven.murdoch.is · 07/04/2025

I have an open PhD position at @sec.cs.ucl.ac.uk on applying traffic-analysis resistance techniques to protect industrial control systems. Full funding is available for home-fee status students (deadline 15 April). www.ucl.ac.uk/security-cri...

078

Reposted by Steven Murdoch

Open Rights Group @openrightsgroup.org · 11/03/2025

Whisper it, the showdown over Apple encryption is THIS WEEK ⏱️ 🤐 A secret tribunal will hear the appeal against the government’s order to carve a backdoor into Apple’s encrypted services. 🛑 Our cybersecurity and privacy shouldn’t be decided in the shadows. www.computerweekly.com/news/3666203...

computerweekly.com

Secret London tribunal to hear appeal in Apple vs government battle over encryption | Computer Weekly

The decision by home secretary Yvette Cooper to issue a Technical Capability Notice requiring Apple to give UK law enforcement and intelligence services “backdoor” access to data stored by Apple’s cus...

11218

Steven Murdoch @steven.murdoch.is · 06/03/2025

Until now, the UK government recommended that individuals at high risk, like legal professionals, enable Apple Advanced Data Protection (ADP). Apple disabled ADP following government pressure, and now the NCSC quietly deleted their guidance recommending ADP.

02211

Steven Murdoch @steven.murdoch.is · 04/03/2025

The article refers to the Investigatory Powers Tribunal, but I can’t see any description of how this falls into the type of complaints the IPT handles. Can anyone more qualified work out what’s actually going on?

151

Reposted by Steven Murdoch

Open Rights Group @openrightsgroup.org · 21/02/2025

🚨 APPLE WITHDRAWS ENCRYPTION TECH FROM UK 🚨 The Home Office’s actions have deprived millions of Britons from accessing a security feature. UK citizens will be at higher risk of their personal data and family photos falling into the hands of criminals and predators ‼️ www.bbc.co.uk/news/article...

bbc.co.uk

Apple pulls data protection tool after UK government security row

Customers' photos and documents stored online will no longer be protected by end to end encryption.

33741

Reposted by Steven Murdoch

Open Rights Group @openrightsgroup.org · 11/02/2025

Encryption IS online safety 💡 Keeping data secure is key when hackers are skilled at unpicking accounts. So why does the UK government want to make us unsafe by ordering a backdoor to Apple encrypted services? ✍️ Sign to save encryption this #SaferInternetDay. you.38degrees.org.uk/petitions/ke...

you.38degrees.org.uk

Keep our Apple data encrypted

It is reported that the Home Office has ordered Apple to build a backdoor into its encrypted services so that they can get hold of content that any Apple user has upload to the cloud. Encryption keeps...

1129

Reposted by Steven Murdoch

michael veale @michae.lv · 10/02/2025

Now hiring in law & tech @ucllaws.bsky.social! Lecturer/Assoc Prof in IP & IT law: intersection of platform reg, emerging tech, copyright/designs. Join me @bernardkeenan.bsky.social Orla Lynskey @alinatrapova.bsky.social Ilanah Fhima, Matt Fisher, Robin Jacob & friends www.ucl.ac.uk/work-at-ucl/...

We are looking to appoint to one or more posts in IP/IT Law, as Associate Professor or Lecturer in Law. Applications from colleagues who can also teach in other subject areas, including French Law, are most welcome.

The closing date for applications is 28 February 2025. Interviews will likely take place in the week(s) commencing 05 and 12 May 2025.

About you

Successful candidates will be expected to engage in world leading research, and to contribute to the Faculty’s development and advancement of both intellectual property and information technology law and policy, and other areas of law falling within their subject matter expertise. It is also expected that the post-holders will contribute to all aspects of the academic life of the Faculty and University.

The Faculty has a particular interest in recruiting scholars with research interests in copyright law, platform regulation, enforcement with and through technology, and the intersection of emerging technologies with other IP rights such as designs. UCL Laws faces growing demand for teaching and engagement on IP and IT issues from other parts of the university, as well as in executive education, and we particularly welcome applicants with interest and experience of teaching contested legal topics to technologists, creatives and other non-lawyers.

Reflecting the broad strength of the Faculty, we welcome scholars from a wide array of approaches to these issues — socio-legal, comparative, doctrinal, empirical, historical and/or theoretical and interdisciplinary approaches. Applicants should, however, pay particular attention to how their work illustrates their capacity for depth and rigour in a fast-moving field prone to superficial analysis.

12724

Steven Murdoch @steven.murdoch.is · 05/02/2025

Why is it still possible to write a date where the day of the week doesn’t match the day of the month? This doesn’t need AI; a regular expression would do. I want a big red underline if I ever write “Thursday 5 February”. Has someone patented this and spoiled it for everyone?

110

Reposted by Steven Murdoch

Meredith Whittaker @meredithmeredith.bsky.social · 04/02/2025

Thinking about this classic recently, which is available free here: monoskop.org/images/d/df/...

Cover of Electronic Civil Disobedience and Other Unpopular Ideas by Critical Art Ensemble.

1035489

Steven Murdoch @steven.murdoch.is · 17/01/2025

It’s worth noting that the TikTok ban doesn’t itself target TikTok but instead makes app stores and hosting providers liable for distributing TikTok. I can understand why intermediaries are the focus, but this seems to set a different precedent that imposing liabilities on TikTok itself.

122

Steven Murdoch @steven.murdoch.is · 13/01/2025

My take on the AI Action Plan – good: encouraging APIs and standardisation; bad: focus on dataset release rather than controlled access (anonymisation has a poor track record for rich data); concerning: prioritisation of novelty over doing the right thing. www.gov.uk/government/p...

gov.uk

AI Opportunities Action Plan

Recommendations for the government to capture the opportunities of AI to enhance growth and productivity and create tangible benefits for UK citizens.

1115

Steven Murdoch @steven.murdoch.is · 10/01/2025

I spoke to @fattoquotidiano.bsky.social on whether British police have the capability to extract data from a @grapheneos.org phone without the passcode. As far as is publicly disclosed, Cellebrite can’t break the protection but less is known about competing forensics tools.

282

Reposted by Steven Murdoch

UCL InfoSec @sec.cs.ucl.ac.uk · 06/01/2025

Funded opportunity for a PhD studentship on Trustworthy Machine Learning in the UCL InfoSec Research Group. Further details are in the thread below (application deadline 28 January).

025

Reposted by Steven Murdoch

Steve Weis @handle.invalid · 23/12/2024

Tour of WebAuthn by Adam Langley: www.imperialviolet.org/tourofwebaut...

imperialviolet.org

A Tour of WebAuthn

055

Reposted by Steven Murdoch

Open Rights Group @openrightsgroup.org · 04/12/2024

Open Rights Group is hiring 🚀 Our Operations Manager is going on maternity leave in March 2025. We're looking for someone who can ensure that ORG continues to run smoothly behind the scenes. Find out more and apply now. ⏰ Closes 17 December, 9am 🗓️ 14 months FT ➡️ app.beapplied.com/apply/xvezly...

038

Reposted by Steven Murdoch

Ben Collier @susansegfault.bsky.social · 25/11/2024

Big privacy/digital tech policy event in London this Thurs - Scrambling for Safety (sign ups here: www.eventbrite.co.uk/e/scrambling... and online here: www.eventbrite.co.uk/e/scrambling...). Critical talks + panels on Chat Control, Online Safety Bill, and AI in govt. Pic of my sleepy dog unrelated.

12012

Reposted by Steven Murdoch

Open Rights Group @openrightsgroup.org · 17/11/2024

Open Rights Group fights to protect digital rights 🦾 Becoming a member helps us to campaign, lobby, go to court – whatever it takes to challenge restrictions to our human rights. Join the movement today ⬇️ #DigitalRightsAreHumanRights www.openrightsgroup.org/join/

openrightsgroup.org

Become a member

Open Rights Group is the UK’s largest grassroots digital rights campaigning organisation, fighting to protect everyone’s rights to privacy and free speech online.

0910

Reposted by Steven Murdoch

Jennifer Cobbe @jennifercobbe.bsky.social · 13/11/2024

Foundation for Information Policy Research event 'Scrambling for Safety' on Nov 28th Panels with excellent speakers on chat control, online safety, and government decision-making & AI (this panel chaired by me) Friends House London or online - sign up here: www.eventbrite.co.uk/e/scrambling...

eventbrite.co.uk

Scrambling for Safety

FIPR: Helping policy makers understand what technology can and can't do.

167

Steven Murdoch @steven.murdoch.is · 07/10/2024

Along with Sir Peter Fraser, I'll be speaking at the Inner Temple on the reliability of electronic evidence. The event is open to the public, so if you're interested in the topic, you can join in person or online. www.innertemple.org.uk/events/?id=E...

The Use of Electronic Evidence in the Law

021

Steven Murdoch @steven.murdoch.is · 02/10/2024

I've written about how the legal system might better handle electronic evidence, but computer systems could also be designed to facilitate the production of reliable evidence. I discussed these ideas at the CANS Workshop murdoch.is/talks/#talk-...

murdoch.is

Talks // Professor Steven J. Murdoch

Professor Steven J. Murdoch

010

Steven Murdoch @steven.murdoch.is · 18/09/2024

There are divergences developing in the liability for push payment fraud. The UK is moving from sender bank to 50:50 sender/receiver. US proposals went from receiver to the same 50:50 model as the UK. The EU is the sending bank, but social network websites might have to pay, too.

020

Reposted by Steven Murdoch

Jonathan Anderson @trombonehero.bsky.social · 17/09/2024

Awesome to see journalists exposing the dangers of kernel mode to a general audience, and even using the words “kernel mode”!

101

Steven Murdoch @steven.murdoch.is · 17/09/2024

While a failure in CrowdStrike Falcon took down critical infrastructure in July, the widescale harm was due to Microsoft’s market share and design choices in Windows. I spoke to CBC News about kernel-mode software and competition law’s role in the fiasco. youtu.be/s4hoEjRh1Eo?...

youtu.be

Are we too dependent on Microsoft? | About That

YouTube video by CBC News

010

Steven Murdoch @steven.murdoch.is · 11/09/2024

Both the UK and EU are putting in place measures to protect victims of Authorised Push Payment fraud. This time last year, the UK had the stronger proposals, but now they have switched as the EU expands protections and the UK waters them down 🧵

101

Steven Murdoch @steven.murdoch.is · 10/09/2024

Deep neural networks outperform traditional methods in a wide range of applications, but their opacity can hide malicious behaviour. Vasilis writes about his work at the Turing Institute on efficiently detecting backdoors in deep reinforcement learning. www.benthamsgaze.org/2024/08/07/m...

benthamsgaze.org

Mitigating Deep Reinforcement Learning Backdoors

This post introduces the problem of backdoors embedded in deep reinforcement learning agents and discusses our proposed defence. For more technical details please see our paper and the project's repo....

000