The Proton Blog

Hacker tech tools: What they do and how to stay safe

Proton Team — Tue, 29 Sep 2026 18:07:00 GMT

A hacker does not always need sophisticated malware or a complicated exploit. Sometimes the hardware is the trick.

An ordinary looking USB cable can hide electronics. An HDMI device can capture what is on a screen. A small box can imitate a Wi-Fi network, while another can pretend to be a keyboard and send commands faster than a person could.

These tools have legitimate uses in security testing and research. They also show why cybersecurity is not only about passwords and software. Physical access, wireless networks, and the devices we connect to our computers can create opportunities for an attacker.

Here are some of the tools that illustrate those risks, along with practical ways to reduce your exposure.

O.MG cables can hide a second purpose

An O.MG Cable looks like an ordinary USB cable. Hidden inside, however, is hardware that gives it capabilities a normal cable does not have.

A modified cable can target a computer while the person using it thinks they have connected a normal accessory. However, a tiny Wi-Fi chip in the plug can receive a signal and activate the cable, after which it can present itself as a keyboard and send commands.

The hardware can also record what a person types and sends that information back to a bad actor over Wi-Fi. That could include passwords, messages, or other sensitive information. Security researchers have documented similar attacks using seemingly ordinary USB charging cables.

The risk is easy to overlook because the cable looks familiar. You may borrow one at an airport, office, or hotel without thinking twice. A USB data blocker can allow power through for charging while blocking data transfer.

Fake Wi-Fi networks can look completely real

The WiFi Pineapple is designed for wireless network auditing, but it also demonstrates a problem with public Wi-Fi: a network name does not prove that the network is trustworthy.

Imagine staying at a hotel called Proton Hotel and connecting to a network innocuously named “PROTON HOTEL GUEST WIFI.” The name looks convincing, so you connect. However, it could very well be that an attacker has created the network and designed it to resemble a legitimate one.

If your connection passes through infrastructure controlled by this attacker, they may be able to place themselves between you and the real network and attempt to observe or manipulate traffic that is not otherwise protected.

Treat unfamiliar networks with caution and use additional protection when connecting to them. A VPN can help protect your traffic when the network itself cannot be trusted.

Hardware keyloggers record what you type

A hardware keylogger can sit between a keyboard and a computer, recording keystrokes without requiring software to be installed.

The keyboard can continue working normally, which makes the device easy to overlook. If someone types a password, message, email, payment information, or anything else through the keyboard, a keylogger may be able to capture it.

These devices are small enough to look like ordinary computer hardware. If you found one attached to the back of a computer, you might assume it was installed by IT.

Check what is physically connected to your computer from time to time. An unfamiliar adapter or device deserves a closer look.

Flipper Zero can test many wireless systems

Flipper Zero is a portable multi-tool that can work with several types of wireless technology. Depending on the system, it can read, store, clone, or emulate signals used by RFID and NFC devices, infrared remotes, sub-GHz radios, and some Bluetooth devices. That makes it useful for security research. It also highlights how much older wireless technology can reveal.

Whether an attack works depends on the target. Newer car key fobs and access systems may use encryption and rolling codes designed to prevent replay or cloning. Older or poorly protected systems can be more exposed.

Replace outdated hardware where practical, especially when newer versions offer stronger security. Turning off Bluetooth when you are not using it can also reduce unnecessary wireless exposure.

A USB Rubber Ducky can type for an attacker

The USB Rubber Ducky looks like a normal USB drive, but a computer can recognize it as a keyboard. That lets it send a programmed sequence of keystrokes at high speed. To clarify, while a hardware keylogger records what you type, a Rubber Ducky can do the typing itself.

A device treated as a keyboard may be able to open a command window and execute actions with the privileges available to the logged-in user. Depending on the computer and payload, that could include downloading malicious software or accessing information stored on the machine.

The attack can happen quickly, so an unknown USB device should never be treated as a free storage drive. If you find a mystery USB stick, leave it alone.

HDMI capture devices can watch your screen

A Screen Crab is designed to sit between a device and its display over HDMI. The display can continue working normally while a capture device records what is being shown. A computer might display emails, documents, financial information, or passwords. A meeting room could show confidential presentations or internal documents.

Check the connections behind your computer, monitor, and shared AV equipment. An unfamiliar HDMI adapter deserves attention. In higher-security environments, physical port locks and tamper seals can make unauthorized devices harder to insert unnoticed.

RFID tools can target older access systems

Many offices, hotels, and other buildings use RFID or NFC cards and key fobs for access. RFID readers and writers can examine certain cards and tags and, with older or weaker systems, may potentially copy information needed to imitate them.

That does not mean every access badge can simply be copied. RFID covers many technologies, and newer systems can include protections designed to prevent this type of attack.

An RFID-blocking sleeve or wallet can prevent a compatible card from being read while stored. It also helps to avoid leaving an access badge unattended or visible when it is not being used.

The Bash Bunny can impersonate USB devices

The Bash Bunny can be configured to present itself to a computer as different types of USB hardware.

A computer has to determine what a connected device actually is. You may think you have plugged in a flash drive, keyboard, or cable, but the computer identifies the device based on what it reports itself to be. That is the weakness these devices can exploit. A configured Bash Bunny can behave differently depending on the target and intended task.

The simplest defense remains one of the most effective: do not connect unfamiliar USB devices to your computer. A device that looks harmless can behave very differently from what its appearance suggests.

The simplest security advice still matters

The tools in this list vary widely. Some are designed for security testing, while others can be used in attacks. What they have in common is that they take advantage of trust in a cable, USB device, Wi-Fi network, badge, or connection that looks ordinary.

You cannot eliminate every physical or wireless risk. You can, however, make it harder for an attacker to take advantage of the things your devices are designed to trust.

Sometimes that starts with a simple question: Do you actually know what you just plugged in?

How to communicate a security incident to your team, customers, and regulators

Ben Wolford — Tue, 29 Sep 2026 12:44:05 GMT

In the first hours of a security incident, you can’t complete a technical picture of what happened. Your team may still be trying to understand which account was compromised, what data was accessed, how far the attacker got, or whether the incident is still active.

Alongside your investigation, the pressure to act starts immediately. Employees hear fragments and need to know what to do. Meanwhile, customers may notice service disruption, suspicious activity, or unusual password reset requests. Business partners may ask whether their systems or data are involved, and leadership needs to decide who speaks, what can be confirmed, and when silence becomes a risk of its own.

Security incident communication is difficult because a business has to be transparent before it has every answer, but informed enough not to guess. Communications sent too early can create confusion, but if they’re sent too late they can damage trust, slow down protective action, and raise regulatory questions.

It’s unlikely that small and mid-sized businesses have created or rehearsed their incident response plan, and this can cause additional chaos. Even for larger businesses with a plan, the technical steps may be documented: contain the incident, reset access, preserve evidence, restore systems. Communication may be left for later, until suddenly the incident escalates or changes.

Part of preparing for an incident means knowing who needs to hear from you, what they need to know, who approves the message, and how to communicate facts clearly while the investigation is still moving.

Communication planning belongs inside incident response

The two-track structure for your response

Start with the audience, not the announcement

What to communicate internally

How to notify customers of a breach

When to notify regulatory agencies

Prepare messages before you need them

How Proton Pass for Business can help

Communication planning belongs inside incident response

Incident response is often described as a technical process, but a real incident quickly becomes cross-functional. IT teams may contain the threat, but leadership, legal, customer support, HR, communications, and operations all need to know what is happening and what they are allowed to say.

The NCSC’s guidance on effective communications in a cyber incident — general best practice that applies well beyond the UK — makes this point clearly: organizations often prioritize technical response and push communication into the background, even though communication shapes how staff, customers, stakeholders, and the media perceive the organization during a crisis.

Not every incident needs a public statement. But the business should know in advance who decides what to communicate, who approves external messages, who speaks to customers, and who handles regulatory reporting.

A strong data breach response plan needs to include a communication layer. This should include practical details:

Contact lists
Draft templates
Approval routes
Legal review
Customer support talking points
Regulator notification responsibilities
Records of what was sent, when, and to whom.

The two-track structure for your response

Incident response needs two tracks: technical response and communication response. They run parallel to each other and the incident lead/ response owner connects them both.

Left track: Technical response	Right track: Communication response
Contain the incident	Update the internal team
Secure affected accounts	Notify affected customers or partners
Preserve evidence	Assess regulator notification
Restore systems	Keep messages consistent as facts change

This allows you to structure your response and ensure that collaboration continues as team members take on different tasks.

Start with the audience, not the announcement

Security incident communication fails when one message tries to serve everyone. Employees, customers, partners, and regulators need different levels of detail because they have different decisions to make.

Your internal team needs clarity first

They don’t need every detail — especially while the investigation is ongoing — but they do need clarity on what’s confirmed, what to do right now, and who’s leading the response. That means knowing which systems or accounts to avoid, what action to take immediately, and which questions are still open.

Employees also need to know what not to do. For example:

Do not discuss the incident publicly
Do not reset credentials outside the approved process
Do not contact customers with improvised explanations
Do not forward suspicious messages without guidance.

Customers and partners need to know how they’re affected

They want to know whether their data, access, payments, service, or operations are affected. A good customer notification should explain:

What is known
What type of data may be involved
What the business is doing
What customers should do now, if anything
Where they can get updates.

The tone should be plain and direct. A customer also doesn’t need forensic detail, they only need enough information to protect themselves.

Regulators need a factual record

A GDPR breach notification to the relevant supervisory authority (the ICO in the UK, the national data protection authority in each EU member state) is not a marketing message or a customer reassurance note. Instead, it needs to be a factual record of what happened, who is affected, and what you’re doing about it. We cover exactly what to include in the section on notifying regulators below.

What to communicate internally

Your employees are part of the response, even when they aren’t on the incident team. A confused team can accidentally create more noise, share inaccurate information, or slow down containment. On the other hand, a well-informed team can help protect accounts, direct customers to the right channel, and avoid speculation growing.

An internal security incident announcement should cover:

A clear summary of what has been confirmed so far, in plain language
Which systems, accounts, teams, or data are potentially affected
What the business is doing now
What employees should do immediately
Who is allowed to communicate externally
Where updates will be posted
How to report related suspicious activity

There are aspects that shouldn’t be included: attack vectors, root cause analysis, and specific vulnerabilities are generally not shared internally while an incident is live, and often not afterwards either, since those details can help other attackers, create legal exposure, or expose gaps that have not yet been closed.

The first internal message doesn’t need to answer every question, it needs to create order. For example, employees may need to reset passwords only through an approved process, avoid using a specific system, preserve suspicious emails, or stop using shared credentials until the response team finishes review.

Assessing your existing access controls against best practices for password management is also essential. During an incident, outdated or informal credential sharing can make it harder to understand what was exposed.

Proton’s guides to data breach protection and data breach prevention for businesses explains how layered controls reduce exposure before a breach occurs. Secure credential management is one of those layers because it helps the business know which accounts exist, who can access them, and what needs to be changed quickly.

How to notify customers of a breach

A data breach notification to customers is harder because it carries reputational and legal weight. People may be worried about identity theft, account takeover, financial fraud, or exposure of private information. They may also be frustrated that the company did not prevent the incident.

A good customer message should be honest without being alarming. It should avoid technical jargon, but be clear. Customers need to understand what data was involved, what risk that creates, and what they should do next.

A useful structure is:

What happened, at a level of detail appropriate for customers
When the business became aware
What information or services may be affected
What steps the business has taken
What customers should do now
How the business will provide updates
Who customers can contact with questions

Where the investigation is still active, this should be disclosed. Accuracy and transparency help restore trust. Being open about impact doesn’t require disclosing technical detail that would help someone repeat the attack.

For serious incidents, customers may need practical instructions: change a password, enable MFA, watch for phishing emails, contact their bank, and ignore messages claiming to be from the company unless they come through an official channel. The notification should make those steps easy to understand.

When and how to notify regulatory agencies

Not every security incident needs to be reported to the supervisory authorities. A reportable breach under UK and EU GDPR depends on whether a personal data breach is likely to result in a risk to people’s rights and freedoms.

The ICO’s personal data breach guidance reflects a requirement common to both UK and EU GDPR: organizations must report a notifiable breach without undue delay and no later than 72 hours after becoming aware of it. A late report needs reasons for the delay.

That 72-hour window can create pressure, especially when the investigation is still incomplete. The GDPR recognizes that organizations may not have every detail within the first 72 hours, so information can be provided in phases, as long as further updates are given without undue delay.

A notification to the relevant supervisory authority (the ICO in the UK, or the national data protection authority in the EU) should usually include:

The nature of the personal data breach
The categories and approximate number of individuals affected
The categories and approximate number of personal data records affected
The name and contact details of the DPO or another contact point
The likely consequences of the breach
The measures taken or proposed to address it

The ICO also provides a central page to report a breach and route organizations to the appropriate reporting process.

For affected individuals, the threshold is different. Where a personal data breach is likely to result in a high risk to people’s rights and freedoms, they must be informed without undue delay. This is a situation in which legal, privacy, and leadership teams should be involved early, even in a small business.

Prepare messages before you need them

The worst time to design a communication process is during an incident. It’s not helpful to issue statements or guidance that need to be updated and changed.

That is why it’s helpful to prepare the structure of your messages before you need them. Not the final wording, because every incident will be different, but the structure: who needs to approve the message, which details must be included, where updates will be recorded, and who is responsible for each audience.

A simple communication kit is enough to make the first hour less chaotic. It can include:

An internal incident announcement template
A customer notification template
A partner or vendor update template
Customer support talking points
Supervisory authority notification checklist
Approved spokesperson list
Escalation contacts for legal, IT, privacy, leadership, and communications
A place to record all updates and decisions

Preparation gives a team a safe starting point when speed and accuracy are both important. A prepared template leaves more attention for the facts of the incident: what happened, who is affected, what has already been done, and what people need to do next.

How Proton Pass for Business can help

Security incident communication depends on facts. The more clearly a business manages access before an incident, the easier it is to explain what happened, what may be affected, and what has been changed.

A business password manager like Proton Pass for Business helps teams reduce credential-related exposure. Employees can generate strong passwords, store them in encrypted password vaults, use autofill, share credentials securely, manage passkeys, and use built-in two-factor authentication. Admins can apply password policies, review activity logs, manage access with role-based controls, and support provisioning through SCIM and SSO integrations.

During an incident, these features can help businesses act with more confidence. If an employee account is compromised, admins can review access, identify shared credentials that may need rotation, enforce stronger authentication, and reduce reliance on passwords copied through chat or spreadsheets.

Be ready to respond before a breach happens with a business password manager.

Your OSINT business security strategy: how attackers research companies

Kate Menzies — Tue, 29 Sep 2026 12:09:55 GMT

A targeted attack often begins with a search. Hackers look for information like an employee’s job title, a hiring post that names your business tools, an exposed email address, or an old subdomain. In isolation, these details don’t seem dangerous. But attackers purposefully collect many small clues and pieces of information to build a phishing email campaign, fake login page, or impersonation call that feels believable.

Open source intelligence (OSINT) turns public information into preparation for a more targeted attack. Your OSINT business security strategy is how your business protects itself. For businesses, the challenge is twofold: auditing what is already out there and knowing what exists in the first place, then judging which public details help customers, candidates, and partners, and which ones quietly help attackers map your people, tools, credentials, and access points.

What OSINT means in cybersecurity

In a cybersecurity context, OSINT is the use of publicly available information to identify possible attack paths. The information may come from search engines, social media, company websites, job boards, public code repositories, and other sources that do not require breaking into a system.

Attackers use OSINT to answer practical questions about a business, like:

Who works here?
Who approves payments?
What tools does the company use?
What does the email format look like?
Which suppliers or customers might be trusted?
Which accounts may already be exposed?
Which systems face the internet?

OSINT gives hackers details that make their attacks believable. A generic scam simply asks for action, but a researched scam is targeted at a specific person, sent from a person they know or have reason to trust, and mentions a real work project or non-public information.

The UK’s Cyber Security Breaches Survey 2024⁠ found that half of UK businesses reported identifying a cyber security breach or attack in the previous 12 months. Phishing remained the most common type of breach or attack among affected businesses. OSINT isn’t the same as phishing, but it is an asset hackers can use to make phishing more convincing and harder for employees to dismiss.

What attackers can learn about your business

Hackers use a variety of different methods to collect information. Here are some of the most common and effective paths.

People

LinkedIn, company bio pages, conference agendas, podcasts, webinars, and press mentions can reveal names, job titles, reporting lines, seniority, locations, and areas of responsibility. That helps attackers choose who to impersonate and who to pressure.

For example, an attacker who knows a CFO’s name, the company’s email format, and the finance team’s current software can build a message that feels much less generic than ordinary spam. The request may mention a real supplier, refer to a payment process that exists inside the business, or arrive at a moment when the team is already expecting invoice-related communication. None of this information requires access to a private system.

Tools

Job listings often mention the platforms candidates are expected to know: CRMs, payroll tools, helpdesk software, analytics platforms, collaboration tools, and developer environments. Public reviews, case studies, integrations, and employee profiles can reveal even more.

Tool exposure helps attackers tailor their phishing pretext. A phishing email that says “your account has been flagged” isn’t convincing, but a message that names the exact CRM, HR system, or collaboration tool the team uses is.

Technical footprint

Subdomains, exposed services, certificate records, old staging environments, and misconfigured login pages can reveal where a business has online systems. Attackers may also look for public repositories that include old credentials, API keys, internal URLs, or configuration files accidentally committed during development.

Breach data

Email addresses, usernames, passwords, phone numbers, and other personal or business details exposed in previous breaches can become raw material for a later attack. Proton’s Data Breach Observatory⁠ shows how leaked data can continue to create risk after the original incident, especially when credentials, contact details, and employee information can be linked back to a business.

How OSINT powers targeted attacks

OSINT becomes dangerous when attackers use collected data to build a believable story. Consider a business that publishes staff profiles, lists customer logos, mentions a recent CRM migration in job ads, and uses a predictable email format. A finance employee then receives a message that appears to come from a senior leader, references a real supplier, and asks for urgent payment support. The email only needs to contain enough familiar details to lower suspicion.

The same pattern applies to credential attacks. An attacker finds an employee’s business email in breach data, sees on LinkedIn that the person works in operations, and learns from job listings that the company uses a specific SaaS platform. The next phishing message can imitate that platform and arrive with language that matches the employee’s role.

Phone scams can be shaped by OSINT too. A caller who knows the company’s IT provider, the name of a department head, or the timing of a project sounds legitimate. This is why OSINT and social engineering are intertwined: public information gives attackers the confidence and detail needed to manipulate people in real time.

The business may experience the final attack as phishing, vishing, account takeover, invoice fraud, or credential theft. The groundwork may have been OSINT all along.

Leaked credentials are OSINT too

Breach data is often discussed as a direct account takeover risk: when a password leaks, attackers can try it across multiple entry points. That is still a serious problem, especially when employees reuse passwords across services.

But leaked credentials can also help attackers understand the business behind the account. An exposed email address may confirm which services an employee has used, while old passwords, phone numbers, and repeated company domains can add context for future phishing, vishing, or account takeover attempts. The breach may have happened somewhere else, but the information can still help an attacker build a more accurate picture of your team.

Proton’s Data Breach Observatory highlights how exposed data can support phishing, credential attacks, and broader social engineering. It also highlights that leaked data does not stop being useful to attackers after the first breach is reported. That data can be reused, combined, and reshaped for future targeting.

Monitoring exposed business emails and credentials helps organizations see more than the password that needs to be changed. It can reveal where employees have used work addresses, which services may be connected to the business, and whether the same identity appears across multiple leaks.

This is essential because attackers can reuse information, not only to try old passwords, but to make future phishing, vishing, or impersonation attempts feel more specific. A leaked credential is rarely just an isolated credential. It can become part of the background research that makes the next attack more effective.

Reduce what attackers can learn from public sources

No business can remove itself from public view, and that should not be anyone’s aim. Customers, candidates, and partners still need enough information to understand who you are and how to work with you.

The risk is in publishing details that go beyond that purpose: internal tool names, direct contact patterns, approval workflows, or technical clues that give attackers a sharper picture of how the business operates.

Start with your public-facing information. Review company pages, team bios, press releases, case studies, help center articles, job listings, social media posts, and public documents. Look for details that reveal internal systems, approval processes, access routes, or sensitive workflows.
Job listings deserve special attention. Candidates may need to know the broad categories of tools they will use, but public ads don’t always need to name every SaaS platform, security product, CRM, payment tool, cloud provider, or internal workflow. The more specific the tool list, the easier it becomes to craft a fake login prompt, support message, or vendor request.
Employee information also needs balance. Seniority, role, and expertise may be appropriate to share, but direct phone numbers, personal details, travel patterns, internal project names, or unnecessary reporting structure details can give attackers more to work with.
Public code repositories should be reviewed regularly. Old projects, test files, documentation, or configuration examples may contain secrets that were not meant to be public. Even when credentials have expired, internal URLs, naming conventions, and service references can still help attackers understand the environment.

Reduce the value of what attackers find

OSINT will always exist because businesses need to be visible. The goal is to reduce the amount of unnecessary information available and limit what attackers can do with the details they find.

Public information is the first place to reduce unnecessary exposure. Job ads, company profiles, employee pages, repositories, subdomains, and old documents should give people enough context to trust and understand the business, not a detailed view of how it operates behind the scenes. When internal tool names, technical clues, or process details are not needed publicly, they are better kept out of view.

Credential controls are just as important. Exposed email addresses and leaked passwords are some of the easiest OSINT signals to turn into action. Unique passwords, MFA, passkeys, secure sharing, breach monitoring, and controlled access all make reconnaissance less useful.

Review your technical footprint without publishing a roadmap

Technical exposure is part of OSINT, too. Domains, subdomains, login portals, cloud services, development environments, API endpoints, and public repositories can all help attackers understand how a business is structured online.

A regular review helps separate what is intentionally public from what has been published and forgotten. Old staging pages, unused subdomains, default service screens, outdated documentation, exposed configuration notes, and public repositories with internal references may not seem urgent, but they can make reconnaissance easier.

Many fixes are simple: remove old pages, restrict access, update documentation, rotate exposed secrets, or move internal details out of public repositories. Other findings may only need a clear owner and a reason to remain visible. Public exposure becomes a decision, rather than an omission.

Build OSINT checks into security routines

OSINT exposure isn’t static. It grows every time a business publishes something new, changes a workflow, hires for a role, launches a project, appears on a supplier page, or has employee data exposed in a breach. Each update seems harmless in isolation, but over time it can give attackers a clearer view of the company’s people, tools, relationships, and access points.

A simple set of checks and reviews can help:

Review public-facing business information quarterly
Check job listings before publication for unnecessary tool or workflow details
Monitor breach exposure for business email addresses
Review public repositories and exposed services
Ask department leads whether any public information reveals sensitive processes or access patterns.

Before information goes public, someone should always ask: could this help an attacker create a more convincing message, call, or login attempt?

Make credentials harder to connect with aliases

Email aliases can help reduce the amount of information attackers can connect across services. When the same email address is used for every service, it becomes easier to link accounts, search breach data, guess login portals, and build a profile of the employee or business.

For some business workflows, a standard email address is necessary. Employees need stable identities for work, customers, and collaboration. But aliases can be useful for signups, newsletters, trials, vendor testing, events, or services that don’t require a person’s primary business address.

Email aliases are useful because they separate accounts that attackers would otherwise connect to the same employee, team, or business address. They can also make exposure easier to trace. When an alias created for one vendor starts receiving unrelated login attempts or phishing messages, the business has a clearer signal of where that address may have been exposed.

Aliases work best when they are paired with a business password manager such as Proton Pass for Business. Each account still needs a unique password, controlled storage, and clear ownership. Without that structure, aliases can become another manual habit for employees to manage on their own.

Manage OSINT with Proton Pass for Business

A business password manager like Proton Pass for Business can help you monitor for breaches and protect your network with credential health features. With Proton Pass for Business⁠, teams can create unique passwords, store them in encrypted password vaults, use autofill, share credentials securely, manage passkeys, and use built-in two-factor authentication (2FA).

Admin features such as policies, reporting, logs, role-based access control, SCIM provisioning, and SSO integration help businesses keep credential access more controlled as they grow.

A business password manager doesn’t eliminate OSINT exposure, but it can make the information attackers find less useful. When credentials are unique, stored in encrypted vaults, shared through approved spaces, and protected with 2FA or passkeys, a leaked password or convincing fake login page has less room to turn into wider access. It also gives employees a clearer rule to follow: business credentials should stay inside the password manager, not in emails, chats, spreadsheets, or phone conversations.

Attackers will still research your business. The question is how much they can learn, how accurate that picture is, and how far they can go with it.

Reduce your business’s credential exposure with a business password manager⁠.

How the CLOUD Act gives the US access to foreign data

Ben Wolford — Mon, 28 Sep 2026 16:19:02 GMT

If your cloud provider is based in the US, a valid US court order can compel that company to retrieve your company’s data on servers anywhere in the world.

Companies including Google, Microsoft, and Amazon are vulnerable to this intrusion, made possible by the CLOUD Act, a 2018 law that gives American law enforcement officials global tentacles.

It’s especially a problem for EU businesses. If your US provider hands over your emails or files, that could constitute a violation of the GDPR for leaking personal data, which can impose penalties of up to €20 million or 4% of global annual revenue, whichever is higher.

That’s the reality that American companies obscure when they say “GDPR-compliant” and “European sovereign cloud” in their marketing. A US provider’s EU data center is still run by a company under US jurisdiction. For your business, this means that procurement decisions carry a compliance liability you may not have priced in. For your customers, it means the personal data they entrusted to you may end up in a legal process they have no say in (and may never even learn about).

Here’s a plain explanation of the CLOUD Act, why this invasive legislation matters for businesses, and how to limit your exposure. your data sits no longer decides who can reach it.

What is the CLOUD Act?

The Clarifying Lawful Overseas Use of Data Act (CLOUD Act) is a US federal law that came into force in 2018. It allows federal law enforcement — primarily the Department of Justice and FBI, but also federal, state, and local police — to obtain a warrant, court order, or subpoena compelling technology companies under US jurisdiction to hand over data, regardless of where in the world that data is physically stored.

For example, if the FBI obtains a warrant compelling Microsoft to hand over a European business’s emails, Microsoft must comply — even if a European court disagrees with the request.

The CLOUD Act has a legitimate policing purpose. It’s designed to help federal law enforcement to investigate serious crimes such as terrorism, child exploitation, and cybercrime. It’s not designed for intelligence-gathering, which runs through a separate US authority (FISA Section 702), often confused with it.

That legitimate purpose doesn’t, however, remove the structural problem for businesses: The CLOUD Act can put a US-jurisdiction provider in a position where fulfilling a lawful US order means breaching EU law. It leaves businesses caught between two compliance regimes with no way to satisfy both.

What’s the origin of the CLOUD Act?

The CLOUD Act was passed in 2018 by the US government to amend the Stored Communications Act (SCA) of 1986. This amendment was, in large part, a response to an ongoing court case, the ‘Microsoft-Ireland’ case.

In 2013, Microsoft challenged a federal warrant demanding the emails of a customer under investigation for drug trafficking — emails stored by Microsoft on servers in Ireland. This case hinged on a thorny legal question: Could a US warrant issued under the SCA reach digital communications controlled by a US-based company, but stored on a data server outside the US?

In 2018, the case was pending appeal in the Supreme Court when the US Congress passed the CLOUD Act. This both mooted the ‘Microsoft-Ireland’ case and resolved the question of the US government’s extraterritorial powers over data stored on foreign soil, at least on paper.

What powers does the CLOUD Act give the US government?

The CLOUD Act empowered the US government to request targeted data, wherever it was stored, by strengthening extraterritorial SCA orders to US providers. The Act clarified that US law enforcement can use warrants, subpoenas, and court orders to access electronically stored communications data located outside the US, if the storage provider is subject to US jurisdiction, and the requested data is relevant and material to an ongoing criminal investigation. A CLOUD Act request goes straight to the provider, bypassing the much slower MLAT (Mutual Legal Assistance Treaty) process that the US government relied on previously.

The CLOUD Act also empowered governments who were willing to sign up to a bilateral executive agreement with the US government, which would let law enforcement in partner countries make direct, cross-border, case-specific requests for data from US-based service providers.

Executive agreements speed up evidence-gathering in serious criminal cases like terrorism and child exploitation, where the MLAT process could take months. At time of writing, only two executive agreements exist: between the US and the UK (entered into force in October 2022), and between the US and Australia (entered into force January 2024). Negotiations between the US government and the EU and Canada have been initiated but are not yet concluded.

Tech providers do have one safety mechanism: They can challenge or ask to modify a US order under “comity” — the legal principle that courts defer to other jurisdictions’ laws — if complying would mean breaking a foreign law, particularly one covered by an executive agreement. Outside the UK and Australia, this common-law comity challenge is the only option on the table.

However, as The Electronic Privacy Information Center (EPIC) argues, even with comity, the CLOUD Act leaves customers, businesses included, with little real recourse. Providers aren’t required to notify a customer whose data was accessed, customers have no independent right to challenge a request (that depends entirely on the provider choosing to object), and executive agreements explicitly rule out creating any new remedy for the people affected.

The CLOUD Act vs GDPR

In Europe, where Proton’s own research shows over 74% of all publicly listed companies depend on US-based tech services, the CLOUD Act is of particular concern because it clashes with the EU’s General Data Protection Regulation (GDPR).

Under Article 48 of the GDPR, a foreign court order or decision of an administrative authority (including an SCA order) to transfer or disclose personal data will not be automatically recognized or enforced in the EU, unless made under an international agreement, such as an MLAT.

While there hasn’t been a case of GDPR fining a company in connection with a CLOUD Act order, there is precedent for regulators acting on this category of risk: In 2023, Ireland’s Data Protection Commission fined Meta a record €1.2 billion for EU-US transfers exposed to US surveillance law — specifically FISA Section 702, not the CLOUD Act.

For US-based cloud providers, this means that if the US government requests data that they process but that’s controlled by European businesses, to comply with the CLOUD Act might mean breaching GDPR. Under Article 28, the provider (processor) may only act on the controller’s documented instructions, and “disclosing data to a foreign government” isn’t among those instructions.

The exposure isn’t limited to the provider. If the provider discloses a customer’s data in response to a compelled order without the international-agreement basis Article 48 requires (which, since no CLOUD Act executive agreement exists between the US and the EU at present, means an MLAT) the business that owns that data carries its own liability, not just the vendor it hired to store it.

Why data location doesn’t mean data sovereignty

In June 2025, Microsoft France’s own director of public and legal affairs, Anton Carniaux, was asked under oath in the French Senate whether he could guarantee French citizens’ data would never be handed to US authorities without French consent.

His answer: “No. I cannot guarantee that.” He added that “it has never happened before”, which doesn’t, of course, mean it couldn’t happen in the future.

The message was clear: Data sovereignty is no longer about where data is stored, but who controls that data. The location of your data servers and the governments which have authority over them are no longer necessarily the same thing.

This fact sits uncomfortably next to the “GDPR compliant” cloud offerings US cloud giants (or ‘hyperscalers’) are marketing to European businesses. These “European sovereign cloud” products are run by companies headquartered in the US, or controlled by a US parent company, and GDPR’s protections only extend as far as US law allows.

How zero-access encryption architecture mitigates exposure to the CLOUD Act

If your cloud storage provider is subject to US jurisdiction and US law enforcement demands access to your data (with legitimate legal reasons), neither you nor your provider can stop it from happening. At this point, your data’s only defense is encryption.

Encryption makes data unreadable and unusable by cybercriminals and governments alike, scrambling it into ‘cipher text’ that only someone with the right key can read.

However, the encryption offered by most US cloud providers comes with a fatal caveat: They retain the decryption keys themselves. That means they can read your data, or be compelled to hand over a readable copy to a third party such as US law enforcement.

For real protection against file and message data exposure, either to cybercriminals or governments, you need end-to-end encryption or zero-access encryption, which prevents the provider from accessing the data.

A provider that uses zero-access encryption doesn’t have the key to decrypt files it handles and stores on its servers. It may still be forced to disclose data when law enforcement demands it, even if data is stored in a jurisdiction that enforces a strict standard of data protection, such as Switzerland. But the files handed over would be encrypted and unreadable.

How Proton protects businesses from the CLOUD Act

Proton is shielded from the CLOUD Act in two key ways:

Swiss jurisdiction, which limits who can compel Proton to hand over data
And strong encryption, which limits what they can do with whatever Proton hands over

Proton is headquartered in Geneva, Switzerland, outside of US jurisdiction and the reach of CLOUD Act orders. US authorities can’t resort to a bilateral shortcut, either: Switzerland isn’t party to any CLOUD Act executive agreement.

This doesn’t remove legal process altogether. Switzerland has its own mutual legal assistance framework, which lets Swiss authorities cooperate with foreign investigations. But any request has to clear Swiss law first, under Swiss courts — it can’t be a warrant served directly on the provider.

Proton’s legal history shows that we’re willing and able to challenge Swiss law. In 2020, we challenged a Swiss data retention law that we believed to be an improper attempt to use telecommunications laws to undermine privacy. In 2021, the Federal Administrative Court ruled that email services aren’t telecommunications providers, and therefore aren’t subject to the law’s retention requirements.

And even a successful Swiss order has limits on what it can get. Proton’s end-to-end and zero-access encryption means message content and files are unreadable to Proton itself, and there’s no key to hand over, regardless of who’s asking. The content of your emails, docs, files, and other data stays out of reach.

Try Proton for Business

Frequently asked questions about the CLOUD Act

Does the CLOUD Act override GDPR?

The CLOUD Act doesn’t override GDPR, but it does conflict with it. A CLOUD Act order can put a US provider in a position where complying breaches GDPR Article 48 (no automatic recognition of a foreign order without an international agreement). Neither law defers to the other, and the provider — and any European company they serve — is caught between them.

Is the CLOUD Act only for US companies?

The CLOUD Act doesn’t only apply to businesses headquartered in the US, or controlled by a US parent company. It also reaches any provider with sufficient US legal presence or business nexus. A US subsidiary, US-based staff or offices, or businesses purposefully directed at US customers can be enough to bring an organization headquartered outside the US within reach of the CLOUD Act.

Can I refuse a CLOUD Act request?

The customer (controller) generally isn’t the one served — the provider is. The provider can raise a comity challenge if complying breaks foreign law, or push back if a request is legally deficient. But if legal remedies are exhausted and the order remains valid, a provider would be forced to comply.

What’s the difference between the CLOUD Act and an MLAT?

When digital evidence is requested via a Mutual Legal Assistance Treaty (MLAT), this request is judicially reviewed, a thorough and slow process. The executive agreements enabled by the CLOUD Act let law enforcement bypass the MLAT process if requesting data from a partner country. So far, only the UK and Australia have executive agreements with the US.

Does encryption stop CLOUD Act requests?

Encryption doesn’t stop a legal order, but if a provider stores customer data with end-to-end encryption or zero-access encryption then they will not have any readable data to give to the authorities because they don’t have the decryption keys. They would thus hand over only encrypted files.

Survey: People don’t trust AI, but they tell it everything

Risa Tang — Thu, 24 Sep 2026 11:55:56 GMT

Money worries at 2 a.m.. A medical symptom too embarrassing to see a doctor about. The best way to ask someone on a date.

People discuss their most private thoughts with AI chatbots. But their revelations to the apps doesn’t mean they trust the Big Tech companies behind them, according to new research from Proton.

Roughly two-thirds of AI chatbot users have discussed at least one sensitive topic. But at the same time, fewer than one in five say they have a high level of trust in AI companies to protect their private information.

“AI is learning far more about us than a search engine ever could. Search knows what you looked for. AI gets the hesitation, the follow-up questions, and the personal context between the lines,” said Eamonn Maguire, director of AI engineering at Proton. “We’re handing over more than questions now. And when technology knows that much about us, privacy can’t be an afterthought.”

To understand more about how people use and perceive AI, we surveyed 4,014 current AI chatbot users across France, Germany, the UK, and the US. We asked what they’ve shared, why they chose to do so, and what would make them more or less willing to share it.

Key findings

66% of AI chatbot users have discussed at least one sensitive topic with a chatbot, including personal finances, sexual health, and relationships.
42% of users have little or no trust in AI companies to protect sensitive information shared with chatbots.
Money, mental health, and career problems are the three most commonly discussed sensitive topics.
AI users would still rather discuss sensitive topics with friends and family, ahead of AI chatbots and therapists.
Convenience and freedom from judgment are the most commonly cited reasons for choosing AI over a person.
48% of users say they would be more willing to share sensitive information if their conversations were guaranteed to not be used to train AI models.
Eight in 10 users express interest in an AI chatbot specifically designed for privacy.

Most chatbot users have already shared something sensitive

66% of respondents said they discussed at least one sensitive topic with an AI chatbot. The eight topics covered personal finances, relationships, mental health, sex, secrets, romantic attraction, work, and family conflict.

Of the surveyed countries, Americans reported the highest rate of disclosing sensitive information to chatbots at 68.4%, with France being the lowest at 60.3%. This gap suggests openness to confiding in AI isn’t just a personal choice, but could be influenced by broader cultural attitudes toward privacy and technology.

Money, mental health, and work dominate sensitive topics

Personal finances, mental health, and career problems were the three sensitive topics respondents most commonly reported discussing with AI.

The most commonly discussed topic varied by country. Mental health ranked first in Germany, while career problems ranked first in the US, and personal finances ranked first in France and the UK.

These results show which sensitive topics respondents have discussed with AI, but not why they chose to discuss them.

Friends and family are the top choice, even as AI use grows

Friends and family were the preferred choice for discussing every sensitive topic surveyed, ahead of AI chatbots, therapists, and religious advisors. But AI is already competing with traditional sources of support in some areas — particularly money and work.

The gap between AI and human advice is smallest when it comes to money. In France, AI came within just 2 percentage points of friends and family as the preferred choice for discussing personal finances.

And AI’s influence doesn’t stop at conversation. People are using it to make decisions about their money, health, relationships, careers, and purchases.

Convenience and freedom from judgment are biggest draws for using AI

Convenience and freedom from judgment were the most commonly cited reasons for choosing an AI chatbot over a person to discuss a sensitive topic. Privacy was also a common reason, but ranked lower.

Reasons generally varied by country and topic. Of the top three most-discussed sensitive topics, work and career problems was the only one where all four countries agreed on the same top reason: convenience. Personal finances came close, with every country except the UK favoring convenience too. Mental health was split down the middle: France and Germany both chose convenience as the top reason, while the US and UK valued freedom from judgment more highly. Meanwhile, romantic attraction had trust and privacy as the top choice across Germany, the UK, and the US, while sexual health had judgment-free as the top reason across France, the US, and the UK.

Together, this suggests convenience wins out for practical topics, while privacy and freedom from judgment matter more for personal conversations.

Ad profiling raises more concern than AI model training

Respondents expressed more concern about their conversations being used for advertising profiles than being used to train AI models.

The difference was largest in the US, where 65.3% were more worried about ad profiling compared with 57.6% for model training. The results suggest that how conversation data is used matters, with key concerns being less about having conversations saved and remembered than having that data turned into a commercial asset used for monetary profit.

Trust in AI companies stays low across the board

Despite widespread sharing of sensitive topics with AI chatbots, only 11% to 20% of respondents reported a high level of trust in AI companies with their private information. Low trust was most common in France at 47.7%, with 41.6% in the UK, 40.5% in Germany, and 38.8 in the US.

Privacy commitment increases willingness to share

A guarantee that conversations wouldn’t be used to train AI models would make 44% of respondents more likely to share sensitive information. This was highest in the US at 47.7%, followed by the UK at 44.3%, Germany at 43.9%, and France at 40.7%.

Interest was also high in AI chatbots designed around privacy. Over 70% of people said they would be more likely to use one, ranging from 71.1% in Germany to 82% in the UK.

These findings suggest that a commitment to privacy is still highly regarded for AI chatbot users, even if it wasn’t the initial reason that a user would choose to use AI.

Conclusion: AI must earn the trust of its users

Personal conversations with AI chatbots are already common. More than two-thirds of respondents across the four countries surveyed had discussed at least one sensitive topic with an an AI chatbot, from money worries to personal secrets. Yet only one in five reported a high level of trust in AI companies with their private information.

People are confiding in AI much faster than they trust it, but not because AI has replaced human connection — friends and family remain the first choice for every sensitive topic. Rather, AI is the option that people reach for when convenience and freedom from judgment matter more.

While convenience opens the door for someone to use AI, it’s trust that decides how far they’ll go with it. A no-training guarantee was enough to make 44% of users more willing to share, and eight in 10 said they’d be more likely to choose private AI. People have already decided AI is useful enough to hear their money troubles, doubts, and everyday concerns. The providers who prove, not just promise, that they can keep this information safe will be the ones people trust with the rest.

Methodology

This survey included 4,014 respondents across France, Germany, the UK, and the US. All respondents were screened to confirm they currently use an AI chatbot or assistant.

The survey was administered online and consisted of approximately 12 questions on AI chatbot usage. Respondents were not told which company commissioned the research. This unbranded design was intended to reduce the influence shaped by any company’s reputation.

Limitations

This survey captures self-reported attitudes, preferences, and past behaviors. It doesn’t observe respondents’ actual chatbot conversations or independently verify what they have shared. The survey covers current chatbot users in four countries, and shouldn’t be interpreted as representative of other countries nor of people who don’t currently use AI chatbots.

Are Meta’s smart glasses training AI for robots?

Edward Komenda — Tue, 22 Sep 2026 17:56:14 GMT

Smart glasses can look like a simple consumer gadget: a camera on your face, speakers in your ears, and an AI assistant that can answer questions about what you see. But the same device can give an AI system something it has always lacked: a first-person view of everyday human life.

That matters because teaching AI to write or generate images is very different from teaching a machine to move through the physical world. A robot needs to understand where objects are, what happens when they move, and how hands interact with things that bend, break, spill, or change shape.

Meta has spent years researching wearable devices that capture this kind of information. Its Ray-Ban Meta glasses put some of that technology into a consumer product, giving the company access to data generated during ordinary activities.

A 72-hour test of the glasses, using their AI features throughout the day and requesting the associated data, offered a glimpse into why first-person recordings could be valuable for training AI, and why privacy becomes harder to separate from the technology itself.

How AI learns from the real world

Large language models learn from enormous collections of written material. That works well for systems built around language, but text can’t fully describe how people might do things like move through a kitchen, pick up a bottle, crack an egg, or find their keys.

Human beings learn those things through years of sensory experience. Meta’s former chief AI scientist Yann LeCun has argued that by age four, a child has seen 50 times more data than even the largest language models. His broader point is that machines need richer sensory input if they are going to understand the physical world.

For a robot, that means learning from more than instructions. It needs data on what people actually do, including the small variations that are difficult to describe in words. So for example, someone doing the dishes may look mundane. But once that footage is labeled and annotated, it can show an AI system where objects are, how hands move, and what happens when something unexpected occurs.

That kind of training data is difficult to collect at scale. A wearable camera offers one possible solution because it can capture the world from the same perspective as the person performing the task. As LeCun’s argument puts it, “It needs eyes.”

Why Meta is using smart glasses

Meta has been working on this problem for years through Project Aria, a research program built around wearable computers in a glasses form factor. The research devices use cameras and other sensors to study how people interact with the world.

Project Aria also shows how different the privacy expectations can be between research and consumer use. Meta’s published guidelines say research participants are trained on appropriate recording practices, people in private homes must consent, and a visible light indicates when audio and video are being collected.

Consumer smart glasses operate in a much less controlled environment. A person can wear them while walking down a street, shopping, making coffee, or doing household chores. That creates a useful source of first-person data. It also means people around the wearer may appear in recordings without knowing that a camera is active.

The distinction matters because the value of this data comes from its ordinary nature. Its value comes from capturing the small details of everyday life.

What robots need to learn

Researchers are working on several problems that look simple to humans but are difficult for machines. One is episodic memory. Asking an AI where you left your keys sounds easy, but the system has to recognize the object, understand when it was last seen, and keep track of what happened between then and now.

Another is intuitive physics. If you roll a ball toward a table, you already have an expectation about what will happen. Humans develop these predictions through years of observing the physical world.

The third involves hand-object interactions. Tying shoelaces, buttoning a shirt, picking something up, or handling a piece of cloth all require a machine to deal with objects that can bend and deform. Those are the kinds of situations that first-person recordings can capture.

During the 72-hour test, ordinary activities mapped surprisingly well onto these research problems. Driving involved predicting how objects move through space. Picking up a bottle or cracking an egg involved hand-object interaction. Watching an egg roll off a counter involved intuitive physics. Asking where the keys had been left was an episodic-memory task.

The point is not that every mundane recording immediately becomes useful training data. It is that ordinary human activity contains the examples that embodied AI needs.

What Meta’s glasses can capture

Meta says Ray-Ban Meta glasses do not continuously record everything around the wearer for AI training. According to the company, the data used to train its AI and potentially reviewed by humans includes the vocal commands and video captured when a user asks the AI to do something.

When the AI needs to analyze what the camera sees, the relevant footage can be sent to Meta’s servers for processing. The company can then use that information to improve its AI systems. A person can ask the glasses about an object, a location, a task, or something happening in front of them, creating a record of those interactions from a first-person perspective.

Meta has also introduced Live AI, which makes the assistant available without requiring the usual wake phrase. That makes the glasses more useful as a real-time assistant, while also increasing the amount of time in which their camera and microphone can be active.

There is another privacy problem that is harder to solve through settings. The wearer controls the device, but everyone around them does not. During the test, faces were blurred in the material that was reviewed, but people around the wearer did not know they were being recorded. That is different from Meta’s Project Aria research process, where participants and people in certain private environments are subject to explicit consent requirements.

What points to Meta’s robotics plans

The idea that Meta could use wearable data to help build robots is still a hypothesis about the company’s broader strategy, rather than something the glasses alone prove. There are, however, several pieces of evidence behind it.

In February 2025, Meta created a humanoid robotics division within Reality Labs, the same broader organization responsible for its smart glasses. In May 2026, Meta also acquired Assured Robot Intelligence, a robotics lab co-founded by Lerrel Pinto.

Meta has also said it wants its technology to serve as the software layer for humanoid robots. Its research has already explored how egocentric recordings can help robots learn physical tasks. That makes the glasses relevant beyond their role as an AI assistant. They put cameras, microphones, and AI into a device people can wear throughout the day.

Meta’s next-generation wearable prototypes are described as moving toward more continuous sensing and stronger object tracking. Those capabilities could produce more useful data about how people interact with the physical world.

None of this establishes that Meta is secretly collecting every moment of its customers’ lives to build an army of robots. It does show why first-person wearable data could be strategically valuable to a company investing heavily in both AI and robotics.

The bigger question

Smart glasses make AI more useful because they give it access to the world around us. That same capability makes them different from the AI assistants most people are used to. The question is who gets to decide how this increasingly personal source of data is collected, processed, and used.

As AI moves from the screen into the physical world, first-person data becomes more valuable.

That makes it increasingly important to understand what a device can see, hear, store, and send away.

Proton partners with Apertus, Switzerland’s sovereign AI model

Eamonn Maguire — Thu, 17 Sep 2026 11:56:33 GMT

Proton is partnering with the team behind Apertus to bring its new Apertus 1.5 model to Lumo, Proton’s privacy-focused alternative to ChatGPT. The partnership will also give researchers behind Apertus access to real-world feedback that can help them improve it more quickly.

Apertus is a fully open large language model developed by researchers at EPFL, ETH Zurich, and the Swiss National Supercomputing Centre (CSCS). Its architecture, training data, and methods are open, and it’s trained on publicly available data, respecting opt-out requests and filtering out personal details. It fills an important role in today’s AI landscape by providing a fully open source model with a transparent and reproducible training pipeline. In a world dominated by US and Chinese models, Apertus is instrumental in Europe’s tech sovereignty.

The world’s leading AI models have millions of people using them every day, creating real-world feedback loops that help make them better. Fully open models developed in an academic context do not have access to feedback at the same scale, limiting their ability to compete at the frontier.

With this partnership, that could start to change. Proton is introducing a feedback mechanism that connects people using Apertus in Lumo with the researchers building it. Tens of millions of Lumo users around the world can now choose to contribute feedback, helping independent, ethical, and truly open source AI become more competitive.

Building a European alternative

Europe now has the pieces of an independent AI stack: infrastructure it controls, a model open by design, and a product that puts it directly in people’s hands.

“We don’t want to spend the next decade relying on other countries for the AI we use every day,” said Eamonn Maguire, Director of AI at Proton. “Having our own AI isn’t enough. It needs to be competitive so that people actually use it. This partnership with the Swiss AI Initiative gives Europe a path to get there.”

One of the biggest advantages leading AI labs have is a constant stream of feedback from millions of people using their models. Bringing Apertus to Lumo gives the university research teams behind it access to this feedback at scale, helping level the playing field.

Apertus in Lumo today

To start using Apertus in Lumo, select Apertus 1.5 from the model dropdown, and start chatting as normal. Like other conversations in Lumo, your chats are protected by zero-access encryption and stay private by default.

If you choose to give feedback on an Apertus response, tap the thumbs-up or thumbs-down button to send in your feedback. Your contribution will be anonymized, and made available to the university research teams behind Apertus.

“Real-world feedback is the one ingredient that open models have been missing. Thanks to Proton, Lumo users will be able to voluntarily provide feedback that contributes to Apertus research. For a fully open, publicly developed model, that is a game changer,” says Imanol Schlag, Research Scientist at the ETH AI Center and co-lead of the Apertus project.

“Making Apertus available in Lumo gives us valuable insights into how the model performs in real-world settings. Voluntary feedback also helps us identify where it can be made more useful and more robust,” says Martin Jaggi, Professor at EPFL and co-lead of the Apertus project. “It also means that we are enabling a broader community to contribute to the model’s further improvement.”

Why work together

Building an open and independent AI ecosystem is bigger than any one model or company. To compete in AI, Europe needs to pool its resources and build public-private partnerships that can do what no single organization can achieve alone. Europe’s future in AI depends on researchers building in the open, infrastructure governed in Europe, companies turning that technology into products people can use, and people willing to help those technologies improve.

Through this partnership, we are taking steps to make that alternative more than an idea. Starting today, fully open source AI is now something people can use and — if and when they choose to — help shape for the future.

Try Lumo now

87% of Canada’s biggest companies depend on US tech

Raphael Auphan — Thu, 17 Sep 2026 11:48:36 GMT

It’s clearer than ever that too much of the technology the world relies on is controlled by too few tech giants, most of them based in the United States and China.

Cloud storage, web hosting, email, social media, video calling, communication platforms, and the basic productivity tools that companies and governments use every day have become essential infrastructure. The modern economy cannot function without them. And control over that infrastructure gives both providers — and the countries whose laws they operate under — outsized power over everyone who depends on it.

We’ve been tracking this concentration for some time. Our previous research found that 74% of publicly listed European companies rely on US tech, fueling a wider debate in Europe about economic security, digital sovereignty, and geopolitical risk.

Now we’ve found that Canada is even more exposed than Europe. We examined 220 publicly listed companies representing 70% of the Canadian stock market’s total capitalization and found that 87% rely on US-owned infrastructure for their email. The same was true for 84% of the 100 largest municipalities. We also found that 14 out of 14 federal, provincial, and territorial government domains rely on American email infrastructure.

To be clear, the problem is not that these companies are American. The risk comes when too much of the infrastructure the world depends on sits under the control and jurisdiction of any single government. At a time of increasing geopolitical tensions and trade negotiations, we believe it’s important to fully understand the different levers that one country can hold over another behind the scenes.

How we measured Canada’s dependence on US tech

We collected the data using the same method as our earlier research in Europe. Using public DNS lookups, we identified the mail exchange (MX) records associated with each organization’s domain. These records show which companies handle an organization’s email, either directly or through an email security service.

For Canada, we looked at three parts of the economy and public sector:

Federal, provincial, and territorial governments. We examined all 14 federal, provincial and territorial domains. Of these, all 14 rely on Microsoft 365.

Companies. We analyzed the 220 companies in the S&P/TSX Composite Index, which together account for around 70% of the Canadian stock market’s total capitalization. Of the companies reviewed, 161 used Microsoft 365 and nine used Google Workspace for their email infrastructure.

Municipalities. Canada has more than 4,000 local governments, so we focused on the country’s 100 largest municipalities by population. Of those, 77 used Microsoft and one used Google.

Why this matters

The problem with this arrangement is quite simple: One company, headquartered in one country, operating under one country’s laws, carries the email of an entire G7 nation’s governments.

US law gives that country real power. Under the CLOUD Act, US authorities can compel American tech companies to hand over data they hold, including data stored outside the US. When the US placed sanctions on the International Criminal Court, for example, Microsoft cut off the email account of the court’s chief prosecutor — a move Microsoft initially told UK lawmakers was the ICC’s own decision, before acknowledging that testimony was inaccurate. Access to infrastructure can be withdrawn on political terms and virtually overnight.

AWS, Microsoft Azure, and Google Cloud serve an estimated 85% of the European cloud market — and when one of them fails, the failures cascade. A major AWS outage in late 2025 crashed apps across industries; an Azure outage followed nine days later, knocking Outlook, Teams, and dozens of enterprise services offline for eight hours.

Much of the email infrastructure used by Canadian companies and governments depends on Microsoft, leaving them exposed to the same kind of service disruption.

These risks, however, exist regardless of which country holds leverage. A world where one government can lawfully reach into the central communications of other nations is the problem, no matter who that government is, and wherever its companies are headquartered.

Canadians are already reacting

The dependence we measured in Canada’s public and private sectors comes amid a wider rupture in Canada-US relations, including retaliatory tariffs matched dollar for dollar and trade talks that broke down in a very public manner.

This backdrop is already shaping how Canadians see their tech dependence. Politico’s reporting on Canada’s digital sovereignty dilemma describes a country forging its own path to reduce reliance on American tech, noting that its smaller economy and US-tied tech industry severely limit its bargaining power. This mirrors the shift we documented in Europe over the last year, where our research found 73% of Europeans believe their societies rely too heavily on US tech and 56% now say local infrastructure matters more to them than a year ago.

Canada’s position differs from Europe’s in one important way: European institutions have moved from diagnosis to legislation, with the European Commission’s tech sovereignty package committing major funding to local alternatives. Canadian institutions haven’t announced migration plans, and we’re not the ones to call for it. Proton is a Swiss company. What we can do is show what the data says and what it implies for anyone who depends on these systems, including what Europe’s slow, imperfect transition reveals about how hard these moves are in practice.

What any organization can do about it

For Canadian businesses and institutions assessing their own exposure, the starting steps are concrete:

List every third-party tool you use: Flag which are headquartered outside Canada and which of those fall under a foreign government’s legal jurisdiction.

Identify what would stop your operations: Which tools, cut off tomorrow, would halt work? This belongs in business continuity planning.

Check where your data sits: Which country’s laws govern it? Who can access it, and through what legal process?

Test the alternatives: For most critical tools, Canadian and European alternatives are available, and some offer built-in tools that make switching easier, such as Proton’s Easy Switch.

Move the highest-risk services first: Full migration takes time. Start with the systems you can’t operate without.

When your business email relies on US tech companies, you’re exposing your organization to strategic risks that, at the end of the day, are out of your control.

8 more privacy tools experts actually use

Proton Team — Tue, 15 Sep 2026 18:02:32 GMT

Privacy technology does not have to mean replacing every device you own or learning how to build your own computer.

There are plenty of smaller changes you can make to adjust the way you use technology. You can keep information offline, block trackers across your home network, choose software that gives you more control, or even carry an entire operating system on a USB drive.

The tools below take different approaches to privacy, but they share a common idea: you get to decide how your technology works instead of simply accepting its default settings.

Build a smartwatch that only does what you want

Many smartwatches are designed to work alongside an app and an online account. Your activity data is collected by the watch, transferred to another device, and potentially sent onwards to a company’s servers.

You can take a different approach with Watchy, a small programmable computer designed to be used as an open-source smartwatch. Because you can program the device yourself, you get to decide what it does and what information it collects. You could use it for something as simple as counting your steps without requiring an account or constantly syncing your activity to a remote service.

The data can either stay on the device or transfer it to your computer. You can also customize the watch with your own features, information, and displays. This makes Watchy an interesting alternative to more ubiquitous smartwatch brands if you want the functionality of a wearable without automatically handing control of the experience to a third party.

Use Flipper Zero to understand wireless technology

A surprising amount of everyday technology communicates wirelessly. Your garage door opener, office access system, television remote, and other devices all rely on different kinds of wireless signals to communicate. Most of the time, you never see any of this happening.

Flipper Zero gives you a way to experiment with some of those signals. It can read, save, and replicate certain wireless communications, depending on the technology and security involved.

For example, you can use it with a compatible infrared remote. The device can capture the signal sent by the remote, store it, and transmit the same command itself. That does not mean it can unlock or control everything around you. What it can interact with depends on the particular technology being used.

The real value is educational. Instead of treating wireless communication as something invisible happening in the background, you can use a Flipper Zero device to understand how some of it actually works.

Keep Wikipedia in your pocket with Kiwix

Kiwix lets you download large collections of information so you can access them offline. One of the best-known examples is Wikipedia, which you can store locally and search without being connected to the internet.

That can be useful when you’re travelling somewhere with unreliable connectivity, spending an extended amount of time in a remote location, or simply want access to information without constantly requesting it from an online service.

There is one obvious limitation: your offline library is only as current as the version you downloaded. But once the content is stored on your device, you do not need a live connection to access it.

It is a useful reminder that you do not have to depend on the internet for every piece of information you need. Sometimes, you can simply keep the information yourself.

Turn an old iPod into a dedicated music player

You probably already have a device that can play music. Your phone can stream millions of songs, recommend something based on your listening habits, and keep your entire library in the cloud. But if all you want is a device that plays your music, an old iPod Classic can still do the job.

With alternative software such as Rockbox, you can give an iPod Classic a new lease on life. Hardware modifications can also bring it up to date with features such as USB-C. The result can be deliberately simple. You load your own music onto the device, much like copying files to a USB drive, and listen without needing a streaming subscription or account.

That way, there are no recommendations for deciding what you should listen to next. Nor is there a need for a service to track your listening habits as your music library can simply remain on the device. You can even use the extra storage for things such as important phone numbers or other information you might want available when your phone is unavailable.

Sometimes privacy means choosing a device that does less.

Block trackers across your home network with Pi-hole

Your phone is not the only device that can connect to advertising and tracking services. Your laptop, smart TV, tablet, and other connected devices can all make requests to servers around the internet.

Pi-hole lets you filter some of those requests at the network level. You can run Pi-hole on a small computer like a Raspberry Pi. It sits between the devices on your network and the wider internet, checking where they are trying to connect. Requests to destinations on your blocklist can then be stopped before they leave your network.

Because Pi-hole operates at the network level, you can use it to cover multiple devices at once. This can be particularly useful for devices such as smart TVs, where installing conventional ad-blocking software may not be possible. You can also see the requests being made by devices on your network, including the ones Pi-hole has blocked.

For even more local control, you can combine Pi-hole with Unbound. Instead of relying entirely on another company’s DNS server to resolve website addresses, your own system can handle more of that work and store the answers locally. Your home network becomes something you can inspect and manage rather than a black box.

If you want to try it yourself, check out our guide explaining how to set up a Pi-hole and use it to filter DNS requests across your network.

Take your own network with you when you travel

Hotel Wi-Fi can become awkward when you have several devices. You might have to connect your phone, laptop, tablet, and other hardware individually, and some hotels place limits on how many devices you can use. A travel router gives you another option.

Instead of connecting every device directly to the hotel’s network, you connect the router to the hotel Wi-Fi. Your devices then connect to your router. That means you only have to deal with the hotel’s network once. Your own devices can stay connected to the network you’ve configured, even if you’re travelling with several of them.

You can also run a VPN directly on the router. Traffic from the devices connected to it can then pass through the VPN connection before reaching the internet. A travel router is a small piece of hardware, but it gives you considerably more control over how your devices connect when you’re away from home.

Our guide to setting up a VPN on your router explains how router-level VPN protection works and how it can cover devices across a network.

Choose a laptop you can repair and customize

A laptop does not have to be a closed system that gets replaced when something goes wrong. Framework laptops are designed so you can open them up, replace components, upgrade parts, and customize the hardware. Even the ports are modular, allowing you to swap one type for another when your needs change. That philosophy extends to the software if you run Linux.

Linux gives you more control over what is running on your computer and most Linux distributions are largely open source. That means the underlying code can be inspected by developers and researchers rather than requiring you to rely entirely on a company’s description of what its software does.

Open-source software is not automatically private or secure. But having access to the underlying code gives you another level of control over the technology you use.

Together, repairable hardware and open-source software let you take greater ownership of both the physical computer and the software running on it.

Carry a privacy-focused operating system on a USB drive

You can carry an entire privacy-focused computer environment without carrying another computer.

Tails is an operating system designed around privacy that you can boot from a USB drive on a compatible computer. Instead of using the operating system already installed on the machine, you can start the computer using Tails.

Internet traffic is routed through the Tor network, which sends connections through multiple relays to make it harder to determine where they originally came from. Tails is also designed to be amnesic. When you shut it down, it aims to leave as little trace as possible on the computer you were using.

That makes a USB drive containing Tails something like a portable privacy setup. You can carry your preferred operating system with you and use it on a compatible computer without relying on the machine’s usual operating system.

It is an extreme example of the same principle behind many of the other tools here: you can have more control over the technology you use, even when you are away from your own devices.

If you want to understand how Tor and VPNs differ, Our guide to Tor over VPN explains how the two technologies provide different layers of privacy.

Start with one change

You do not need a programmable smartwatch, a modified iPod, or a privacy-focused operating system on a USB drive to take more control over your technology.

Each of these tools represents a different way to change a default. You can keep your data locally instead of automatically syncing it. You can block trackers at the network level. You can store information offline, choose open-source software, or create your own network when travelling.

You can also start much smaller. Check which permissions your existing apps have. Think about whether an app actually needs access to your location, microphone, or other device features. Look at which services require accounts and which information is being stored remotely.

You also do not have to change everything at once. One deliberate choice can reduce the amount of information you hand over by default.

Privacy does not require completely changing how you use technology. It can start with deciding that one part of your technology should work differently.

What does CC mean in emails? To, CC, and BCC explained

Alanna Alexander — Fri, 11 Sep 2026 18:57:00 GMT

CC (carbon copy) and BCC (blind carbon copy) are standard email features that control who receives a message and what information they can see.

Understanding the difference between To, CC, and BCC is crucial in a business context. CC the wrong person and your client sees an internal aside they shouldn’t have. Forget to CC a decision-maker and they never see an email thread they really needed to.

Keep reading to find out which option to select to communicate clearly (to the right recipient/s), avoid unnecessary replies, protect recipients’ email addresses, and safeguard sensitive information.

What does CC mean?

CC stands for Carbon Copy, a throwback to a time when physical, handwritten memos or letters would be replicated using a sheet of carbon paper.

CC allows you to send a copy of an email to multiple recipients who are not the primary recipient in the To field. The primary recipient will see the email address(es) you have entered into the CC field, and any responses from them. Likewise, the person you have CCd will see any responses from the recipient (unless they’re removed from the CC field, or the recipient clicks Reply instead of Reply all).

CC’ing is especially useful when sending business emails, because you can add as many recipients into an email as you like, all of whom will receive a copy of the same email and see each other’s addresses and responses. This keeps everyone in the loop and creates a transparent record of the conversation without requiring a response.

When to use CC in email

CC is a useful function when you need someone (or multiple people) other than the recipient to know about and follow an email thread.

For example, when you want to loop in an entire project team on something that affects everyone’s work, such as a scope or deadline change, you can simply CC them in.

CC’ing can also be helpful when you want particular individuals to have visibility of an email thread without requiring their input. When emailing a client proposal, for example, you might want to CC anyone directly involved in the project so they have visibility of their feedback and your subsequent discussion. If anything gets escalated or referenced in a review later, they’re always informed on time.

When not to use CC in email

CC’ing should be avoided when your email (or the subsequent email thread) contains sensitive or confidential information. When you email one person sensitive information, there’s a risk they could forward or store it, but CCing increases that risk by adding more recipients, often including people who weren’t the intended audience for the content in the first place.

You should also avoid using CC when you expect someone you’re CC’ing to take action. People included in CC often assume they don’t need to respond, which can lead to missed tasks or delays. This risk grows when you CC large numbers of recipients unnecessarily, which also clutters inboxes with irrelevant noise.

CC’ing an entire distribution list on a routine status update creates noise without adding accountability. Emailing your entire team about a change that doesn’t affect them can create confusion.

You should also be careful about CC’ing someone into an existing conversation without the other party’s knowledge or agreement — like, for example, adding a new stakeholder to a client thread without telling the client first. Even if you have a legitimate reason, it can look like you’re widening access to a conversation that may be confidential.

What does BCC mean?

BCC stands for Blind Carbon Copy. It works like CC’ing, without the visibility. The BCC function allows you to send copies of the same email to multiple people without revealing that they are part of a mass email, or revealing the other recipients’ email addresses or responses to your original email.

Another key difference: If you enter multiple contacts into the BCC field, when they respond it is only you who will receive their response email. It will not be received by any other BCC recipients.

When to use BCC in email

BCC should be used whenever you need to send multiple people the same email, but you do not want them to know they are a part of a mass email or to be able to see the email addresses of the other recipients.

BCC’ing is useful for protecting the privacy of people who have given you their email address with the expectation that you will not share it without their permission. For example, when sending an update about your company to a mailing list, you should use the BCC function to ensure the individual recipients cannot see the addresses of everyone else who has signed up for that mailing list.

You can also BCC yourself when sending an email from a shared or generic team inbox, to keep a personal record of correspondence sent on your team’s behalf.

When not to use BCC in email

As with CC’ing, be wary of BCC’ing when your email contains sensitive information, or you suspect that the email thread resulting from your email will contain sensitive information.

Avoid using BCC in situations where transparency matters. Covertly adding someone to the conversation can damage trust if it surfaces and be considered a breach of email etiquette. It’s better to CC them openly or send a separate note.

BCC should not be used for ongoing conversations, such as an active back-and-forth negotiation or client conversation — where you expect whoever you’ve BCC’d in to be able to follow the whole conversation. Since BCC recipients are excluded from replies, this means cutting them out of exactly the conversation you wanted them to follow.

What’s the difference between To, CC, and BCC?

Feature	To	CC	BCC
Role	The intended main contact of the email.	For people who need to stay in the loop.	To include people without others knowing.
Visibility	Visible to everyone.	Visible to everyone.	Hidden from all other recipients.
Recipient Awareness	Everyone knows they are the main contact.	Everyone knows who else is being kept informed.	Only you and the BCC’d person know they are there.
Reply All Behavior	Receives all replies.	Receives all replies.	Excluded from future “Reply All” threads.
Expectation	Response expected.	For your information (FYI) only.	Should not participate in the thread.
Best For	Direct requests, tasks, and 1:1s.	Transparency and team collaboration.	Mass emails, privacy, and discreet oversight.

What happens when you hit reply or reply all?

Reply behavior can be confusing, especially when multiple recipients are involved. What happens depends on whether you choose Reply or Reply all.

Hitting Reply all when you intended to hit Reply can lead to internal asides and information leaking to clients, or to an entire distribution list being emailed by mistake. One wrong click can stifle your team’s productivity and even threaten your company’s reputation.

If you are in the To or CC field:

Clicking Reply sends your response only to the sender.
Clicking Reply all sends your response to everyone in the To and CC fields.

If you are in the BCC field:

Clicking Reply sends your response only to the sender.
Clicking Reply all sends your response to everyone in the To and CC fields, not to other BCC recipients — but you will reveal to them that you were BCC’d

A better way to send group emails

Although using the CC and BCC functions is the main way to send an email to multiple people, our encrypted email service Proton Mail also lets you do this by putting multiple recipients in a contact group.

Contact groups are useful for emailing multiple people who all know each other, especially if you regularly email them as a group. For example, a team sending weekly updates to stakeholders can save time by using a contact group instead of adding recipients manually every time.

Once you’ve created a contact group in your Proton Mail account, you can email everyone in that group at once by typing the name of the contact group into the To field and selecting the contact group you want to mass-email from the autofill menu. This will enter all of the email addresses of the contacts in that group to the To field.

When you email people who are in a contact group with each other, they can all see each other’s email addresses, although they will not know that you have put them in a contact group, and the name of that group won’t appear in their inboxes. If you don’t want the contacts in your contact group to know the other members’ addresses, you can enter the contact group into the BCC field instead.

Key takeaways on using CC and BCC in a professional setting

To: is for the people expected to take action.
CC (Carbon Copy): is for keeping people informed (FYI).
BCC (Blind Carbon Copy): is for privacy (recipients are hidden from everyone else).

How Proton Mail protects To, CC and BCC email messages

Contact groups make CC and BCC quicker to use, but they don’t make them any safer from interception by a third party. That’s a different problem, and it’s one Proton Mail’s encryption can help with.

Proton Mail encrypts messages sent between Proton accounts with end-to-end encryption, and protects everything stored in your mailbox with zero-access encryption, meaning even Proton can’t read it — or decrypt it, even under compulsion from law enforcement. You can also add password protection to emails sent to non-Proton addresses, so they’re encrypted too.

None of this stops an email reaching the wrong person through a misplaced CC or BCC, and it doesn’t change who can see whose address in a CC or BCC field. That’s still down to you using the fields correctly. What encryption does protect is the content of a CC’d or BCC’d business email in transit, so a client proposal or an internal aside can’t be intercepted by a third party.

If your business regularly sends CC’d and BCC’d correspondence containing sensitive content like client proposals and internal decisions, Proton’s business email service applies that protection automatically, without your team having to think about it.

FAQ

Is BCC safer than CC?

When it comes to protecting your contacts’ email addresses from your other contacts, BCC is safer than CC. With BCC, there is no way for a recipient to know that they are not the only recipient of an email (as long as all other recipients are marked BCC), let alone find out the email addresses of other recipients. For this reason, you should use BCC when you do not have permission to share a contact’s email address with anyone else.
It’s important to note that neither CC nor BCC is safer when it comes to protecting your messages against interception by a third party. That protection only comes with encryption, not through your choice of field.

Is it safe to CC or BCC sensitive business information?

This depends on who you send it to: the mechanisms don’t protect you. CC and BCC control who receives a copy of an email, not what happens to it afterward. Anyone included in a CC or BCC field for a message can forward, screenshot, or store it. If you’re sending confidential information, keep your recipient list as small as possible, and consider encrypting the message itself so the content stays protected even if it ends up somewhere you didn’t intend.

Is it better to CC or BCC?

If you want to maintain a conversation with all the original recipients of your email, it is better to use the CC function, so that all contacts who were initially included in the email receive all the responses. However, if it is important that your contacts’ email addresses are not exposed to each other, and they are not expected to continue an inclusive email chain, then you should use BCC to conceal your recipients’ contact information.

Can a CC’d person see BCC’d recipients?

No. CC recipients cannot see the names or addresses of anyone who was included as a BCC on any original message. The only time the BCC recipients’ contact information will be exposed is if they respond to the email using “reply all”.

How is CC different from To?

The To field should be used for the main recipient(s) of your email, who you expect to respond or take some kind of action after receiving your email. The main recipients will usually be the ones the email is addressed to in the salutation of your email.

Can you use CC and BCC at the same time?

Yes. People in the To and CC fields can see each other, while BCC recipients are hidden from everyone else. BCC recipients can still see who is in the To and CC fields, but they do not receive replies from those recipients.

What happens if someone I BCC’d replies to all?

Their reply is sent to the sender and everyone in the To and CC fields. Their address is still not shown as a BCC recipient, but the reply can reveal that they were included in the original email.

Can you tell if you were BCC’d on an email?

Usually no. BCC recipients are hidden from other recipients. If you receive an email but your address does not appear in the To or CC fields, you were likely BCC’d.

Does CC or BCC affect email delivery?

Not directly. However, sending emails to large numbers of recipients using CC or BCC can trigger spam filters. For large groups, it’s better to use a mailing list or newsletter service.