Work

Selected projects from my technical, research, standards, and policy work.

• Security and Privacy Questionnaire - work at the W3C Technical Architecture Group on security and privacy review of Web standards, including co-authoring and editing the questionnaire.
• Humanitarian consequences of cyber operations - research at the International Committee of the Red Cross on cyber operations and their potential human consequences in relation to international humanitarian law.
• What The Internet Knows About You - research and demonstration of browser history leaks, showing how browsing history could be exposed through browser behaviour.
• How Much Are You Worth - research and transparency tools examining personal-data flows, information disclosure, and privacy in Real-Time Bidding systems.
• SensorsPrivacy - research and demonstrations concerning privacy risks created by sensors exposed through devices and Web browsers.

Books

• Propaganda: From Disinformation and Influence to Operations and Information Warfare, CRC Press 2024.
• Philosophy of Cybersecurity, CRC Press 2023.

Reports (technical/scientific/policy).

• Written contribution for EP LIBE Committee: data protection and privacy analysis of the European Commission proposal to amend eID Regulation
• On the governance of privacy-preserving systems, Handbook on the Politics and Governance of Big Data and Artificial Intelligence, Edward Elgar Publishing., 2023
• Self-Review Questionnaire: Security and Privacy (W3C announcement).
• The Potential Human Cost of Cyber Operations (PDF, (my blog), report of International Comittee of the Red Cross, 2019

I sometimes write articles, op-eds, etc.

• The Window for Combating AI Propaganda Is Closing, Foreign Policy, 2025.
• The Outer Space Treaty and Promoting Responsible Use of Space, Just Security 2023
• Smartphones Blur the Line Between Civilian and Combatant, Wired 2022
• The Dire Possibility of Cyberattacks on Weapons Systems, Wired 2021
• India's Data Protection Bill Threatens Global Cybersecurity, Wired 2020
• Websites Ask for Permissions and Attack Forgiveness (blog), Opinion in Wired, 2019
• Global Consequences of Escalating U.S.-Russia Cyber Conflict, Opinion at Council on Foreign Relations/Net Politics, 2019
• A second life for the 'do not track' setting - with teeth (blog), Opinion in Wired, 2019
• Making Web Ecosystem Safer - Certificates, Browsers, Web (my blog), IEEE Standards Education E-magazine, 2018

Research papers

• AI Propaganda factories with language models, 2025.
• My LL.M. dissertation in Information Technology Law (data protection assessment of Protected Audience API) (PDF)
• Policy strategies for value-based technology standards. Internet Policy Review, 10(3). (PDF).
• The CNAME of the Game: Large-scale Analysis of DNS-based Tracking Evasion (

  PDF

  ), Privacy Enhancing Technologies Symposium, 2021.
  The Register
• Shedding light on web privacy impact assessment: A case study of the Ambient Light Sensor API, International Workshop on Privacy Engineering 2020 (

  PDF

  )
• Enhancing user transparency in online ads ecosystem with site self-disclosures (PDF)
• The potential human cost of cyber operations: Starting the conversation
• Making web ecosystem safer - certificates, browsers, web
• Privacy of Web Request API
• Stealing sensitive browser data with the W3C Ambient Light Sensor API (

  PDF

  )
• Battery Status Not Included: Assessing the Privacy Impact of the Modern Web, International Workshop on Privacy Engineering 2017,

  Best Paper Award

• Report on Sensors APIs: privacy and transparency perspective
• The leaking battery: A privacy analysis of the HTML5 Battery Status API (

  PDF

  )
  Guardian, and more.

  Fix: Firefox, W3C standard.

• To bid or not to bid? Measuring the value of privacy in RTB
  Sunday Times
• I'm 2.8% Neanderthal - The Beginning of Genetic Exhibitionism?, Workshop on Genome Privacy (PETS '14)
• Analysis of OpenX-Publishers Cooperation, HotPETS 2014
• Selling off User Privacy at Auction (

  PDF

  ), NDSS 14.
  Slashdot, De Correspondent
• Towards Web-based Biometric Systems Using Personal Browsing Interests, 8th International Conference on Availability, Reliability and Security
• Data Harvesting 2.0: from the Visible to the Invisible Web, The 12th Workshop on the Economics of Information Security (WEIS 2013)
• Why Johnny Can't Browse in Peace: On the Uniqueness of Web Browsing History Patterns, HotPETS 2012

  (PDF)

  American Scientist, CNET
• Secure quantum private information retrieval using phase-encoded queries, Phys. Rev. A, 2011
• Processing business data in Microsoft Azure, INGRID 2011 Workshop
• Web Browser History Detection as a Real-World Privacy Threat, ESORICS 2010

  (PDF)

  (Also: W2SP)

  (description)
  Slashdot, The Register, Heise, ...