Tessera

Steven Murdoch

@steven.murdoch.is

Professor of Security Engineering; Head of UCL Information Security Research Group @sec.cs.ucl.ac.uk; Director Open Rights Group. 🐘 https://mastodon.social/@sjmurdoch 🐦 @sjmurdoch 🌍 https://murdoch.is/

113 Posts1268 Follower 220 Folgt

Steven Murdoch @steven.murdoch.is · last wk.

National COVID-19 figures couldn’t tell a department whether to hold a seminar next week. So from 2020 to 2022 I collected UCL’s daily case counts and turned them into an early-warning chart. I’ve now archived all of it plus 168 newsletters for context. www.benthamsgaze.org/2026/07/26/u...

UCL’s response to the COVID-19 pandemic: a historical archive – Bentham’s Gaze

benthamsgaze.org

Steven Murdoch @steven.murdoch.is · 2w ago

I spoke to @smaurizi.bsky.social for a @computerweekly.bsky.social article on smartphone security, particularly how @grapheneos.org can protect journalists’ data. www.computerweekly.com/feature/Jour...

Graphene is good, but not impossible to crack

What does Murdoch think about GrapheneOS?

“I would not go as far as to say the hardware is impossible to crack, but experience has shown that even some of the best forensic software currently is incapable of obtaining data from GrapheneOS devices without knowledge of the passcode, particularly if the device has been freshly rebooted,” says Murdoch.

“GrapheneOS offers enhanced security compared to Android because Google doesn’t consider these features worth the resulting inconvenience to users, performance loss, or development effort,” he adds.

Additionally, GrapheneOS disables user-tracking features that Google wants to retain to support its business and that of its partners. “The users of GrapheneOS prioritise security, so are willing to make sacrifices in other aspects, and its business model does not depend on user tracking,” he says.

Steven Murdoch @steven.murdoch.is · 3w ago

I was interviewed for Computerphile on my analysis of hidden messages within the GPS signals and what message they might carry (and to whom). youtu.be/2Q6OvYjOJi0

GPS Hidden Messages - Computerphile

YouTube video by Computerphile

youtu.be

Steven Murdoch @steven.murdoch.is · last mo.

The corrected and expanded article on my exploration of GPS special messages is available at sjmurdoch.github.io/gps-special-.... Additionally, this is now mobile-friendly and accompanied by detailed footnotes, allowing results to be verified against the published dataset. 5/

The Empty Field That Wasn't: GPS, OTAD and Two Decades of Encrypted Broadcasts

What 24 million GPS special messages reveal about military rekeying on a public channel.

sjmurdoch.github.io

Steven Murdoch @steven.murdoch.is · last mo.

Since the original publication of my Inside GNSS article on hidden messages within the GPS signal (The Empty Field That Wasn’t: GPS, OTAD and Two Decades of Encrypted Broadcasts), there have been a few developments and updates. 🧵 1/

Steven Murdoch @steven.murdoch.is · 2mo ago

My article on hidden messages within GPS signals was featured on @404media.co. www.404media.co/the-u-s-mili...

The U.S. Military Quietly Turned GPS Into a Global ‘Numbers Station,’ Evidence Suggests

A random sequence in an innocuous GPS message field is likely encrypted traffic from the U.S. military's system for remotely updating cryptographic keys around the world.

404media.co

Steven Murdoch @steven.murdoch.is · 2mo ago

I spoke to The Guardian about Anthropic’s call for mechanisms to slow the development of frontier AI capabilities. www.theguardian.com/technology/2...

If calling for a worldwide conversation on AI risk is in contradiction with supporting a US spy agency to – potentially – attack Iran and China with cyberweapons, neither development is “surprising” given the AI company’s past actions, said Steven Murdoch, a professor at University College London.

“Anthropic might give the impression of being warm and fuzzy, but their definition of AI safety is narrow. Supporting US authorities in the development of offensive capabilities has never been something they have spoken against,” he said.

Murdoch said that Anthropic’s post did not offer evidence of any step changes in the progress of AI capabilities.

“It is true that there’s some evidence that AI capabilities have increased and continue to increase with no limits becoming immediately clear,” he said, but he added: “I don’t think anything has fundamentally changed today that has caused Anthropic to publish this article.”

Steven Murdoch @steven.murdoch.is · 2mo ago

For the tl;dr, I wrote a summary of my analysis of the GPS Special Message “number station”, including entropy measurement, duplicated strings, a mysterious new “TEXT” prefix, and the system’s relationship with military key distribution. www.benthamsgaze.org/2026/06/02/t...

Steven Murdoch@steven.murdoch.is · 2mo ago

For 19 years, GPS satellites have secretly broadcast a “numbers station” in their signals. We decoded 12M messages: a 2011 flash where 31 satellites flipped in hours, “ghost” substrings repeating years apart, and a “TEXT” prefix spreading now. lsc-pagepro.mydigitalpublication.com/publication/...

Steven Murdoch @steven.murdoch.is · 2mo ago

Inside GNSS Media & Research • May/June 2026 • 62

lsc-pagepro.mydigitalpublication.com

Steven Murdoch @steven.murdoch.is · 4mo ago

Claude Opus 4.7 is out, and I’ve been interfacing it with the National Rail Live Departure Boards API. I leave you with a poem inspired by the current departures from St Pancras station.

⏺ At St Pancras, a Quarter Past Nine
after John Betjeman

The gothic clock of Scott's red brick
Regards the concourse, vast and pale,
Where escalators, sorely sick,
On platform A have ceased to sail;
The up-bound stair from platform B
Is likewise fixed in lethargy.

The eight-and-forty for St Albans
Has hung her head these thirty-seven —
She creeps at last, her carriages ailing,
Toward a Hertfordshire half-heaven
Where Knebworth lawns and Harpenden
Receive the late commuting men.

Platform A: the Brighton flyer,
Two small minutes out of true,
Breathes past Farringdon, and higher
Gothic vaults of Blackfriars' view —
Where, soon behind, the Rainham train
Tilts eastward through the Kentish rain.

O litany of riverside stops!
Greenwich, Maze Hill, Westcombe Park,
Charlton's terraces, corner shops,
Woolwich Dockyard after dark;
Plumstead, Belvedere, Erith's gleam,
Slade Green sidings under steam;

Then Dartford, Stone Crossing, Greenhithe
(For Bluewater's consumer shrine),
Swanscombe chalk-pits, Northfleet, blithe
Gravesend where the marshes shine —
Higham, Strood, and Rochester's keep,
Chatham, Gillingham, Rainham's sleep.

But spare a thought, at twelve-past-nine,
For Sutton, London SM1 —
Her train is cancelled on the line,
Her passengers, their evening done,
Shall shuffle to the Northern Line
And dream of semis, trim and fine.

Beyond, a gentler warning comes:
Through Stevenage, ten minutes late;
From Streatham down where Wimbledon hums,
A twenty-minute verdict's weight.
So stand beneath the station's span
And pity the commuting man.

Steven Murdoch @steven.murdoch.is · 4mo ago

MCP gives AI tools access to powerful capabilities but is notorious for heavy token use. AXI is a promising token-efficient alternative, but it relies on predicting typical tool usage. I've proposed a modification where tools self-tune through an OODA loop. github.com/kunchenguid/...

Add §11: Usage-driven improvement via OODA loop by sjmurdoch · Pull Request #29 · kunchenguid/axi

Motivation AXI §1–10 tell you what to optimize for, but not how to know whether you got it right. Every AXI tool ships with best-guess defaults — 3-4 default fields, a row limit, a truncation thres...

github.com

Steven Murdoch @steven.murdoch.is · 8mo ago

Reuters were accused of acting illegally in guessing the URL of an unreleased report in 2002. I didn’t hear anything after the initial reports so presume it was quietly dropped or settled. blog.citp.princeton.edu/2002/10/31/i...

Intentia vs. Reuters: A (Slightly) Contrarian View - CITP Blog

The recent dispute between Intentia and Reuters has gotten lots of online attention, most of it scornful of Intentia's position. I think Intentia is wrong, but it's a closer call than most online comm...

blog.citp.princeton.edu

James Chalmers@jameschalmers.bsky.social · 8mo ago

I realise there are questions about internal processes etc that are worth asking, but on the face of it this looks like the most straightforward “how did this happen?” inquiry you could possibly imagine. www.theguardian.com/business/202...

Reuters, the agency that first published excerpts of the outlook on its news wire, revealed on Thursday how it had obtained the document.

It said: “The document, which is usually published after the finance minister’s speech has ended, was uploaded to the OBR website and available to download on an unprotected link.

“The link was not advertised on the website but the OBR has used the same web address, or URL, for previous budget documents, changing only the date. A Reuters reporter, in preparation for covering the budget, went to the publicly available URL shortly after 1130 GMT on Wednesday.”

Hughes said Ciaran Martin, the former chief executive of the National Cyber Security Centre, would provide expert input to the investigation into how the report was accidentally published. It will be overseen by the independent members of the OBR’s oversight board, Sarah Hogg and Dame Susan Rice.

Steven Murdoch @steven.murdoch.is · 12mo ago

UCL Computer Science are hiring Section Managers to support the development and delivery of teaching, research, and strategy within their section. I’ll be leading the Foundational Computer Science section, where the InfoSec group is based. www.ucl.ac.uk/work-at-ucl/...

UCL InfoSec @sec.cs.ucl.ac.uk · last yr.

“$5 Wrench Attacks: When Cryptocurrency Crime Get Physical”, a post on Bentham’s Gaze by Marilyne Ordekian discussing when XKCD comics become reality – www.benthamsgaze.org/2025/07/22/5...

Actual actual reality: nobody cares about his secrets. (Also, I would be hard-pressed to find that wrench for $5.)

Steven Murdoch @steven.murdoch.is · last yr.

I am recruiting mental-health experts (clinical psychologists and psychiatrists) for an in-person workshop in London to discuss a mobile app for mental health care. Participants will receive £500+expenses for their time. If you might be interested please email s.murdoch@ucl.ac.uk

UCL InfoSec @sec.cs.ucl.ac.uk · last yr.

On our new paper published at IEEE Security and Privacy – “A Privacy Framework for Research Using Social Media Data”, a summary by Kyle Beadle. www.benthamsgaze.org/2025/05/15/a...

A Privacy Framework for Research Using Social Media Data

Social media data enables researchers to understand current events and human behavior with unprecedented ease and scale. Yet, researchers often violate user privacy when they access, process, and stor...

benthamsgaze.org

Steven Murdoch @steven.murdoch.is · last yr.

AI-based scam checkers are gaining popularity but I would be cautious in following their advice unless the company is willing to stand behind it. For example, Metro Bank makes bold claims but the fine print absolves them of any responsibility for errors. www.metrobankonline.co.uk/ways-to-bank...

13.7. The AI-generated content and information is provided for general information purposes only and is not intended to constitute or substitute legal or other professional advice of any kind whatsoever. The AI-generated content and information is not intended or implied to be a substitute for professional advice.
13.8. You are encouraged to confirm any information obtained from or through Silver with other sources and review all information provided. Please do not disregard professional advice or delay seeking advice because of something you have read on our website or in the AI-generated content and information.
13.9. We make no representations about the suitability, reliability, timeliness, comprehensiveness, and accuracy of the AI-generated content and information, and other content produced by Silver.

Steven Murdoch @steven.murdoch.is · last yr.

I have an open PhD position at @sec.cs.ucl.ac.uk on applying traffic-analysis resistance techniques to protect industrial control systems. Full funding is available for home-fee status students (deadline 15 April). www.ucl.ac.uk/security-cri...

Open Rights Group @openrightsgroup.org · last yr.

Whisper it, the showdown over Apple encryption is THIS WEEK ⏱️ 🤐 A secret tribunal will hear the appeal against the government’s order to carve a backdoor into Apple’s encrypted services. 🛑 Our cybersecurity and privacy shouldn’t be decided in the shadows. www.computerweekly.com/news/3666203...

Secret London tribunal to hear appeal in Apple vs government battle over encryption | Computer Weekly

The decision by home secretary Yvette Cooper to issue a Technical Capability Notice requiring Apple to give UK law enforcement and intelligence services “backdoor” access to data stored by Apple’s cus...

computerweekly.com

Steven Murdoch @steven.murdoch.is · last yr.

Until now, the UK government recommended that individuals at high risk, like legal professionals, enable Apple Advanced Data Protection (ADP). Apple disabled ADP following government pressure, and now the NCSC quietly deleted their guidance recommending ADP.

Alec Muffett@alecmuffett.bsky.social · last yr.

UK quietly scrubs encryption advice from government websites | TechCrunch | it’s nice to get coverage… https://alecmuffett.com/article/112602 #EndToEndEncryption #HomeOffice #apple #surveillance #tcn

Steven Murdoch @steven.murdoch.is · last yr.

The article refers to the Investigatory Powers Tribunal, but I can’t see any description of how this falls into the type of complaints the IPT handles. Can anyone more qualified work out what’s actually going on?

Open Rights Group@openrightsgroup.org · last yr.

🚨 BREAKING 🚨 Apple appeals the UK government’s order to backdoor its encrypted services. The fight to save encryption continues. Why? Backdoors are a gift for criminals and predators. We must keep our personal data and family photos secure. We need encryption. www.theverge.com/news/623977/...

Matthew Green @matthewdgreen.bsky.social · last yr.

So here’s a simple request to Apple. Apple iMessage needs to enable “disappearing messages.” And they need to do it soon. blog.cryptographyengineering.com/2025/03/01/d...

Dear Apple: add “Disappearing Messages” to iMessage right now

This is a cryptography blog and I always feel the need to apologize for any post that isn’t “straight cryptography.” I’m actually getting a little tired of apologizing for i…

blog.cryptographyengineering.com

Open Rights Group @openrightsgroup.org · last yr.

🚨 APPLE WITHDRAWS ENCRYPTION TECH FROM UK 🚨 The Home Office’s actions have deprived millions of Britons from accessing a security feature. UK citizens will be at higher risk of their personal data and family photos falling into the hands of criminals and predators ‼️ www.bbc.co.uk/news/article...

Apple pulls data protection tool after UK government security row

Customers' photos and documents stored online will no longer be protected by end to end encryption.

bbc.co.uk

Open Rights Group @openrightsgroup.org · last yr.

Encryption IS online safety 💡 Keeping data secure is key when hackers are skilled at unpicking accounts. So why does the UK government want to make us unsafe by ordering a backdoor to Apple encrypted services? ✍️ Sign to save encryption this #SaferInternetDay. you.38degrees.org.uk/petitions/ke...

Keep our Apple data encrypted

It is reported that the Home Office has ordered Apple to build a backdoor into its encrypted services so that they can get hold of content that any Apple user has upload to the cloud. Encryption keeps...

you.38degrees.org.uk

michael veale @michae.lv · last yr.

Now hiring in law & tech @ucllaws.bsky.social! Lecturer/Assoc Prof in IP & IT law: intersection of platform reg, emerging tech, copyright/designs. Join me @bernardkeenan.bsky.social Orla Lynskey @alinatrapova.bsky.social Ilanah Fhima, Matt Fisher, Robin Jacob & friends www.ucl.ac.uk/work-at-ucl/...

We are looking to appoint to one or more posts in IP/IT Law, as Associate Professor or Lecturer in Law. Applications from colleagues who can also teach in other subject areas, including French Law, are most welcome.

The closing date for applications is 28 February 2025. Interviews will likely take place in the week(s) commencing 05 and 12 May 2025.

About you

Successful candidates will be expected to engage in world leading research, and to contribute to the Faculty’s development and advancement of both intellectual property and information technology law and policy, and other areas of law falling within their subject matter expertise. It is also expected that the post-holders will contribute to all aspects of the academic life of the Faculty and University.

The Faculty has a particular interest in recruiting scholars with research interests in copyright law, platform regulation, enforcement with and through technology, and the intersection of emerging technologies with other IP rights such as designs. UCL Laws faces growing demand for teaching and engagement on IP and IT issues from other parts of the university, as well as in executive education, and we particularly welcome applicants with interest and experience of teaching contested legal topics to technologists, creatives and other non-lawyers.

Reflecting the broad strength of the Faculty, we welcome scholars from a wide array of approaches to these issues — socio-legal, comparative, doctrinal, empirical, historical and/or theoretical and interdisciplinary approaches. Applicants should, however, pay particular attention to how their work illustrates their capacity for depth and rigour in a fast-moving field prone to superficial analysis.

Steven Murdoch @steven.murdoch.is · last yr.

Why is it still possible to write a date where the day of the week doesn’t match the day of the month? This doesn’t need AI; a regular expression would do. I want a big red underline if I ever write “Thursday 5 February”. Has someone patented this and spoiled it for everyone?

Meredith Whittaker @meredithmeredith.bsky.social · last yr.

Thinking about this classic recently, which is available free here: monoskop.org/images/d/df/...

Cover of Electronic Civil Disobedience and Other Unpopular Ideas by Critical Art Ensemble.

Steven Murdoch @steven.murdoch.is · 2y ago

The government is reviewing the legal presumption that electronic evidence is reliable. I was one of several experts to comment on this news. www.computerweekly.com/news/3666183...

Review of legal rule on computer evidence long overdue, say Post Office scandal victims | Computer Weekly

Computer Weekly talks to people who suffered miscarriages of justice at the hands of flawed computer evidence as well as experts in law and IT, as the government commits to review the legal presumptio...

computerweekly.com

Steven Murdoch @steven.murdoch.is · 2y ago

It’s worth noting that the TikTok ban doesn’t itself target TikTok but instead makes app stores and hosting providers liable for distributing TikTok. I can understand why intermediaries are the focus, but this seems to set a different precedent that imposing liabilities on TikTok itself.

Steven Murdoch @steven.murdoch.is · 2y ago

My take on the AI Action Plan – good: encouraging APIs and standardisation; bad: focus on dataset release rather than controlled access (anonymisation has a poor track record for rich data); concerning: prioritisation of novelty over doing the right thing. www.gov.uk/government/p...

AI Opportunities Action Plan

Recommendations for the government to capture the opportunities of AI to enhance growth and productivity and create tangible benefits for UK citizens.

gov.uk