Monday, May 25, 2026

Reclaiming Social Engineering for Good


<img src="https://spectrum.ieee.org/media-library/a-photo-illustration-of-a-person-inside-a-swirling-tunnel-of-colorful-digital-shapes-and-screens.jpg?id=66742827&width=1200&height=800&coordinates=0%2C0%2C0%2C0"/><br/><br/><p>“Social engineering” sounds like something out of a conspiracy thriller, charged with totalitarian control and fringe paranoia. More mundanely, it’s come to be associated with phishing and other scams, in which fraudsters manipulate people into disclosing personal information. </p><p>Yet the concept is older and more benign: it is the deliberate shaping of human behavior, often at scale. It predates silicon—and became pervasive, and ungoverned, especially once its practitioners learned to hide it. Authoritarian regimes and more recently scammers and big companies have profited from it. To defend ourselves from bad actors, and to benefit from social engineering’s good side, we need to reclaim the name, and <a href="https://spectrum.ieee.org/why-engineers-must-try-to-save-the-world" target="_blank">govern it prudently</a>.</p><h2> The roots of engineering</h2><p>In 1894, Dutch entrepreneur Jacques van Marken urged companies to hire “social engineers” to manage human systems such as insurance, education, and profit sharing for workers as carefully as they did mechanical ones. Fifteen years later, reformer William H. Tolman published <em>Social Engineering</em>, describing how U.S. industrialists optimized workers’ conditions alongside manufacturing methods. If industrialists could shape steel and electricity on demand, why not society itself?</p><p> By the 1920s, that confidence had spread. The architect Le Corbusier declared that dwellings were “machines for living in,” imagining cities as orderly lattices where people moved like parts on a conveyor belt. Civilization would run like a Swiss watch.</p><p>The idea soon darkened. Authoritarian regimes pushed it to extremes, promising to fashion “<a href="https://www.jstor.org/stable/20719929" rel="noopener noreferrer" target="_blank">the New Man</a>.” In Nazi Germany, engineer Fritz Todt founded Organization Todt, a vast state engineering enterprise that emerged from the autobahn highway system and later operated concentration camps using slave labor. </p><p>In the Soviet Union, leaders adopted U.S. scientific management techniques to plan factory-worker movements and classify populations through centralized records, feeding both rapid industrialization drives and the gulag system of forced labor. The same tools and managerial methods used to build highways and enact five-year plans worked for repression and mass control.</p><p>By the 1950s, “social engineering” had become a contaminated phrase. The revelations of Nazi and Soviet abuses, along with Cold War <a href="https://en.dialektika.org/society-politics/politics/karl-popper-and-the-social-engineering-utopian-vs-piecemeal/" rel="noopener noreferrer" target="_blank">critiques of grand social planning</a> turned the term from a progressive slogan into a warning label. Banishing the words pushed the practice underground, making it harder to recognize when it resurfaced in new forms—such as organizational psychology and systems management that still relied on classification and behavioral influence techniques but under softer, less loaded labels.</p><h2>Social engineering’s more subtle spread</h2><p>In the postwar years, the new social-engineering lexicon included “human factors” and “urban planning,” all promising integration rather than command. As computing advanced, the language shifted again: “customer journey mapping” to track interactions, “user experience” to script them. Engineering, which began as a means of reshaping physical space, set its sights on shaping behavior. Digital design features embedded in our smartphones now target our attention and desire.</p><p> Language helps conceal these modern forms of social engineering. “Data analytics” sounds neutral beside “surveillance.” “Personalization” flatters individuality while still sorting users into predictable categories. “Behavioral nudges” guide decisions without the sense of intrusion. We attach “social” as a favorable modifier to sciences, capital, and media, yet recoil when it meets “engineering.”</p><p> That discomfort is a clue. Engineering implies control, and control prompts us to ask who directs whom, toward what ends, and with whose permission.</p><p> Not all social engineering these days is hidden. Hackers don’t need to break a firewall if someone hands over their password. Romance scammers cultivate intimacy the way farmers cultivate crops. They succeed not through force but by exploiting trust. If even these obvious attacks work, the invisible kind, with roots in social engineering, are a shoo-in. </p><p>Most of the social engineering we encounter is proprietary and beyond our control. Firms build recommendation algorithms tuned to boost engagement and profit with no hearings or right of appeal. Browser and cookie defaults decide what data we surrender. A single autoplay toggle can cost users hours and build unhealthy habits. These are acts of engineering as deliberate as laying a road or redrawing an electoral district. They create a kind of curated itch by which boredom never settles, and satisfaction never arrives. The results are predictable—users click on targeted ads, make purchases, form habits, and lock in opinions. </p><p>Consent has transformed along with it. Once straightforward and revocable, it is now subtle and persistent, buried in defaults or opaque terms of service too quickly accepted. You remain free to opt out, much as you are free to refuse roads or electricity. Consent has become the preselected setting of modern life.</p><p>When social engineering operated more in the open, citizens could contest it, at least in societies with responsive government. Today’s invisible version diffuses accountability so thoroughly that scrutiny becomes hard to direct. Despite recent <a href="https://www.judiciary.senate.gov/committee-activity/hearings/social-media-and-the-teen-mental-health-crisis" rel="noopener noreferrer" target="_blank">congressional hearings</a> on social media’s impact on youth mental health and juries agreeing that <a href="https://spectrum.ieee.org/social-media-trial" target="_self">firms are knowingly designing algorithms that cause harm</a>, pinpointing responsibility remains elusive. When the mechanism is buried inside a system used by billions, we cannot easily point to a single decision-maker or trace the precise moment of manipulation. </p><p>Today’s social engineering is less overt and theatrical than its predecessors. Earlier versions arrived on public posters and loudspeakers for mass audiences. Today’s version is more intimate, delivered through personal devices and constant feeds tailored to the individual. The model succeeds because participation feels like freedom, not control. </p><p>Not all social engineering is dystopian. Well-kept parks foster community, accessible buildings extend dignity, vaccines and seatbelts save lives. Even in the digital realm, positive examples exist: browser extensions that automatically block hidden trackers, search engines that refuse to build personalized surveillance profiles, and decentralized social platforms that give users greater control over their own data and feeds. </p><p> The term “social engineering” still unsettles, though. But “asocial” engineering, which ignores human consequences entirely, is worse. Recognition of the human dimension to engineering is the beginning of repair. Only by seeing the machinery clearly and naming it honestly can we decide who engineers what and why. The machinery will not dismantle itself. Once named, it becomes subject to choice. That negotiation of purpose, power, and process are the defining political questions of any real democracy. We cannot ensure that social engineering serves and sustains society so long as we dodge the words.</p> Reference: https://ift.tt/D0ywnal

US's big bet on quantum computing may not be entirely legal


<p>Last week, the US government announced <a href="https://arstechnica.com/gadgets/2026/05/us-government-takes-2-billion-equity-stake-in-nine-quantum-computing-firms/">$2 billion in investments</a> in quantum computing companies, allocating $100 million each to a range of startups in exchange for equity in the companies. Those could be make-or-break investments for many companies that are likely years away from a product that could see widespread use. But a member of the US Congress is now arguing that those deals are illegal, as Congress did not allocate the money for this purpose—instead, it was meant to support public research in semiconductors.</p> <p>But the biggest chunk of money would go to a company that likely wouldn't exist if it weren't for the government's backing. Anderon will be set up with a billion dollars each from IBM and the government and will inherit personnel and IP from IBM. It will serve as a foundry for fabricating quantum processing units and will contract its services out to IBM and any other company that wants access to cutting-edge hardware.</p> <h2>Is any of this legal?</h2> <p>Zoe Lofgren (D–Calif.), the ranking member of the House Science, Space, and Technology Committee, <a href="https://lofgren.house.gov/media/press-releases/ranking-member-lofgren-calls-out-trump-admin-illegal-use-chips-and-science">made it clear</a> that she is not happy with how the government is using its money to support this technology.</p><p><a href="https://arstechnica.com/tech-policy/2026/05/uss-big-bet-on-quantum-computing-may-not-be-entirely-legal/">Read full article</a></p> <p><a href="https://arstechnica.com/tech-policy/2026/05/uss-big-bet-on-quantum-computing-may-not-be-entirely-legal/#comments">Comments</a></p> Reference : https://ift.tt/5FdTg79

AI with Model-Based Design: Virtual Sensor Modeling


<img src="https://spectrum.ieee.org/media-library/mathworks-logo-with-3d-wave-symbol-and-text-mathworks.png?id=26851519&width=980"/><br/><br/><p>This webinar presents a workflow offering end-to-end solutions for designing, training, validating and verifying, compressing, and deploying AI-based virtual sensor models to embedded processors within a single environment.</p><p><strong>Highlights</strong></p><ul><li>Integrate AI models into Simulink for system-level simulation, verification, and simulation-based testing</li><li>Apply formal verification techniques to assert neural network behavior</li><li>Compress the AI model for memory footprint reduction and execution speedup</li><li>Generate library-free C code from AI models and performing PIL tests</li><li>Profile code performance and evaluate design and model selection tradeoffs</li><li>Design and train AI-based virtual sensors using MATLAB</li></ul><div><span><a href="https://content.knowledgehub.wiley.com/ai-with-model-based-design-virtual-sensor-modeling/" target="_blank">Register now for this free webinar!</a></span></div> Reference: https://ift.tt/76cHAQ5

Friday, May 22, 2026

Texas AG sues Meta over claims that WhatsApp doesn't provide end-to-end encryption


<p>The Texas Attorney General has sued Meta over allegations that the company’s WhatsApp messenger, used by more than 3 billion people, doesn’t provide the end-to-end encryption (E2EE) it has long claimed.</p> <p>Since at least 2016, Meta (then named Facebook) has said WhatsApp provides robust end-to-end encryption, meaning that messages are encrypted on a sender’s device with keys that are available only to the receiver's. By definition, E2EE means that no one else—including the platform itself—can read the plaintext messages.</p> <p>In sworn testimony before two US Senate committees in 2018, CEO Mark Zuckerberg <a href="https://www.congress.gov/event/115th-congress/senate-event/LC64510/text">said</a> Meta does “not see any of the content in WhatsApp; it is fully encrypted” and that “Facebook systems do not see the content of messages being transferred over WhatsApp.” The engine for this E2EE is the Signal protocol, an open source code base that multiple third-party experts have said lives up to its promises.</p><p><a href="https://arstechnica.com/security/2026/05/texas-ag-sues-meta-over-claims-that-whatsapp-doesnt-provide-end-to-end-encryption/">Read full article</a></p> <p><a href="https://arstechnica.com/security/2026/05/texas-ag-sues-meta-over-claims-that-whatsapp-doesnt-provide-end-to-end-encryption/#comments">Comments</a></p> Reference : https://ift.tt/ip0TYqc

Developers: Get Your Medical Mobile App Verified By IEEE


<img src="https://spectrum.ieee.org/media-library/conceptual-illustration-of-user-interface-layers-such-as-networking-information-assurance-and-design.jpg?id=66768355&width=1245&height=700&coordinates=0%2C62%2C0%2C63"/><br/><br/><p>Patients who use mobile applications to manage medical conditions including depression and chronic pain might assume the apps have been evaluated by regulatory agencies to be safe and effective. But that isn’t necessarily the case.</p><p>Most of the more than 55,000 medical apps that claim to diagnose or treat a condition—or ones that provide clinical decision support, known as “therapeutic” apps—have never been assessed by any trusted neutral bodies or regulatory agencies to evaluate them for technical soundness, ethical design, or clinical benefit. The apps often don’t comply with regional data security and privacy laws to protect people’s sensitive health information.</p><p>Medical apps differ from traditional wellness apps, which provide users with insights into becoming healthier by, for example, tracking fitness activities, monitoring blood pressure, and analyzing sleep patterns.</p><p>There is no reliable way to verify that therapeutic apps deliver the results they indicate. To help ensure such apps are credible, the <a href="https://standards.ieee.org/" rel="noopener noreferrer" target="_blank">IEEE Standards Association</a> (IEEE SA) recently launched the <a href="https://standards.ieee.org/products-programs/icap/mobile-health-app-registry/" rel="noopener noreferrer" target="_blank">IEEE Global Medical Mobile App Assessment and Registry</a>. The publicly searchable directory is designed to list apps that have been vetted by experts across several criteria including technical soundness, ethical design, compliance with data security and privacy regulations, and clinical efficacy, which is evidence of a clinical benefit for the patient.</p><p>“Patients, clinicians, payers, and health care systems often struggle to distinguish clinically meaningful therapeutic apps from those that are simply well-marketed,” says IEEE Senior Member <a href="https://research.bidmc.org/yuriquintana" rel="noopener noreferrer" target="_blank">Yuri Quintana</a>, chair of the assessment and registry program. He is chief of the <a href="https://bidmc.org/departments-divisions/medicine/clinical-informatics" rel="noopener noreferrer" target="_blank">clinical informatics division</a> at <a href="https://bidmc.org/" rel="noopener noreferrer" target="_blank">Beth Israel Deaconess Medical Center</a>, in Boston. “Our goal is to establish a standardized review method using criteria developed by experts.”</p><h2>Why regulation is lacking</h2><p>Because the apps are intended for medical use without being part of a medical implement, they fall under the designation of <a href="https://www.fda.gov/medical-devices/cdrh-international-affairs/international-medical-device-regulators-forum-imdrf" rel="noopener noreferrer" target="_blank">software as a medical device</a> (SaMD), according to the <a href="https://www.fda.gov/medical-devices/cdrh-international-affairs/international-medical-device-regulators-forum-imdrf" rel="noopener noreferrer" target="_blank">International Medical Device Regulators Forum</a>. SaMD is supposed to be regulated by public health agencies such as the U.S. <a href="https://www.fda.gov/" rel="noopener noreferrer" target="_blank">Food and Drug Administration</a>, but the apps have developed and grown in popularity so quickly that regulators haven’t been able to keep up, Quintana says. Some companies have received approval, but most have not, he says.</p><p>Many users are unaware of the regulatory gap, he says.</p><p>“Seeing an app from a well-known company often creates the impression that it has been meaningfully vetted for safety and efficacy, even when that is not the case,” he says.</p><p>Some companies are using deceptive advertising to sell their product, he adds. Marketing materials might claim that all of a company’s health apps are certified, even though only one app has been approved by a regulatory body to treat a particular condition. Or the verbiage might imply the company has clinical evidence proving its application works, even though the app has never been tested independently.</p><p>Another concern is that updated apps aren’t being vetted, says <a href="https://www.linkedin.com/in/mpalombini/" rel="noopener noreferrer" target="_blank">Maria Palombini</a>, IEEE SA’s director of health care and life sciences global practice lead.</p><p>“The original app might have received approval from a regulatory agency, but not the updated version,” Palombini says. “There could have been significant changes from the original.”</p><p>“Not every medical-related app triggers the same regulatory classification or review across jurisdictions,” Quintana adds. “That leaves a large gray zone of clinically relevant but lower-risk apps that haven’t undergone an independent assessment. The IEEE registry was created to help fill these gaps.</p><p>“IEEE is the best organization to address this problem because this is fundamentally a standards, trust, interoperability, and conformity assessment challenge,” he says. IEEE “is the world’s largest technical professional organization, with deep expertise in developing globally recognized standards including in <a href="https://spectrum.ieee.org/ieee-standard-biomedical-devices-data" target="_self">health care</a>, <a href="https://standards.ieee.org/initiatives/cybersecurity-standards-projects/" rel="noopener noreferrer" target="_blank">cybersecurity</a>, <a href="https://spectrum.ieee.org/two-new-ai-ethics-certifications" target="_self">AI ethics</a>, and <a href="https://standards.ieee.org/ieee/1547/5915/" rel="noopener noreferrer" target="_blank">interoperability</a>.”</p><p>“Through the <a href="https://standards.ieee.org/products-programs/icap/" rel="noopener noreferrer" target="_blank">IEEE Conformity Assessment Program</a>, we already run rigorous assessment and registry programs,” Palombini says. “Our neutral, consensus-driven, multidisciplinary approach—bringing together clinicians, regulators, developers, and ethicists without commercial bias—makes IEEE uniquely positioned to create trustworthy global guardrails that can scale across jurisdictions and support regulatory harmonization.”</p><h2>How the registry works</h2><p>The assessment framework was developed by a multidisciplinary group of 35 volunteer experts from 10 countries, Quintana says. The panel includes academics, AI experts, app developers, clinicians, ethicists, mental health experts, patient advocates, regulators, researchers, technologists, and those who assess safety in health care.</p><p>The registry is for any app used for clinical care or therapeutics that claims to demonstrate a medical benefit. That includes apps designed for cardiology, diabetes, mental health, neurology, oncology, rehabilitation, and respiratory diseases, Quintana says.</p><p>Initially, he says, the focus will be on apps that aim to treat mental health conditions, given the large number of offerings in that area and the registry committee’s expertise.</p><p>The submission of apps is voluntary. There is no government mandate that requires a company to use the IEEE registry.</p><p>The products will be evaluated against about 150 consensus-based criteria across three major areas: </p><ul><li><strong>Clinical efficacy</strong> including therapeutic effectiveness, any sustained benefits, risk management, comparison to standard care, user engagement, and real clinical value.</li><li><strong>Technical soundness</strong> including accessibility, privacy and security, error handling, interoperability, AI governance, usability, and operational quality.</li><li><strong>Ethical design</strong> including bias prevention, patient consent, data governance, conflict-of-interest transparency, responsible use of AI and large language models, and prioritization of public health benefits.</li></ul><p>IEEE charges a nonrefundable submission fee that covers the cost of the assessment plus the registry’s annual subscription for the first year.</p><p>Developers first must demonstrate they are a legally established entity before they can complete the <a href="https://forms.zohopublic.com/healthappregistryie1/form/AppPublisherRegistrationForm/formperma/vKV62XuzwMV6hoOZnUv3QiFo8BDLpUSFp2CZlOOIOyM" rel="noopener noreferrer" target="_blank">app publisher registration form</a> and then submit documentation and attestations about the product.</p><p>The IEEE review of an app is estimated to take six to eight weeks, Palombini says. The assessment results will be privately shared with the app publisher, she says, and to be listed in the registry, an app must achieve more than 85 percent compliance in each category.</p><p>Upgraded apps must be submitted and reassessed, Palombini says. Similar to how users are notified when an app on their smart devices has , the registry will be notified when listed apps have a new update available, she says.</p><p>Applicants who do not pass the assessment are to receive feedback explaining why. They will be given an opportunity to make changes or provide additional documentation, Palombini says.</p><p>“It’s a pretty methodological process, with checks and balances,” Quintana says. “We’re being very transparent about the process.”</p><p>Approved apps added to the registry receive an IEEE certification badge and submission identifier, which the company can display on its website, app store listings, and marketing materials.</p><p>“The badge serves as visible proof that the app has met the independent, consensus-based assessment for clinical value, technical robustness, and ethical design,” Quintana says.</p><p>The registry will be publicly available at no cost, he says.</p><p>Patients and families seeking safe, trustworthy apps—and payers and insurers evaluating reimbursement potential—will find the registry helpful, he says.</p><p>The <a href="https://forms.zohopublic.com/healthappregistryie1/form/AppPublisherRegistrationForm/formperma/vKV62XuzwMV6hoOZnUv3QiFo8BDLpUSFp2CZlOOIOyM" rel="noopener noreferrer" target="_blank">application website</a> is open. The public registry page does not yet list a specific count of approved apps because assessments are ongoing. Approved apps and their unique identifiers are to be published when the initial reviews are completed.</p><p>To learn more, you can watch a <a href="https://engagestandards.ieee.org/medical-app-registry-webinar.html?_gl=1*1bfk6ug*_gcl_au*MTcwMjc4NjczMy4xNzc2Mjc4MzQy*_ga*MTE2MjkxMjYxMC4xNzc2Mjc4MzQy*_ga_XDL2ME6570*czE3NzgwOTUwNTIkbzIzJGcxJHQxNzc4MDk1ODUzJGo2MCRsMCRoMA.." rel="noopener noreferrer" target="_blank">webinar</a> recorded in March.</p>The assessment framework that underpins the registry is supporting the formal recognition of <a href="https://standards.ieee.org/products-programs/icap/mobile-health-app-registry/" rel="noopener noreferrer" target="_blank">IEEE P3962 Standard for Criteria Assessment Framework f</a> Reference: https://ift.tt/qEG0YX2

A hacker group is poisoning open source code at an unprecedented scale


<p>A so-called software <a href="https://www.wired.com/story/the-untold-story-of-solarwinds-the-boldest-supply-chain-hack-ever/">supply chain attack</a>, in which hackers corrupt a legitimate piece of software to hide their own malicious code, was once a relatively rare event but one that haunted the cybersecurity world with its insidious threat of turning any innocent application into a dangerous foothold in a victim’s network. Now <a href="https://www.wired.com/story/meta-pauses-work-with-mercor-after-data-breach-puts-ai-industry-secrets-at-risk/">one group of cybercriminals</a> has turned that occasional nightmare into a near-weekly episode, corrupting hundreds of open source tools, extorting victims for profit, and sowing a new level of distrust in an entire ecosystem used to create the world’s software.</p> <p>On Tuesday night, open source code platform GitHub announced that it had been breached by hackers in one such software supply chain attack: A GitHub developer had installed a “poisoned” extension for VSCode, a plug-in for a commonly used code editor that, like GitHub itself, is owned by Microsoft. As a result, the hackers behind the breach, an increasingly notorious group called TeamPCP, claim to have accessed around 4,000 of GitHub’s code repositories. GitHub’s statement confirmed that it had found at least 3,800 compromised repositories while noting that, based on its findings so far, they all contained GitHub’s own code, not that of customers.</p> <p>“We are here today to advertise GitHub’s source code and internal orgs for sale,” TeamPCP wrote on BreachForums, a forum and marketplace for cybercriminals. “Everything for the main platform is there and I very am happy to send samples to interested buyers to verify absolute authenticity.”</p><p><a href="https://arstechnica.com/information-technology/2026/05/a-hacker-group-is-poisoning-open-source-code-at-an-unprecedented-scale/">Read full article</a></p> <p><a href="https://arstechnica.com/information-technology/2026/05/a-hacker-group-is-poisoning-open-source-code-at-an-unprecedented-scale/#comments">Comments</a></p> Reference : https://ift.tt/AIiVDKc

Thursday, May 21, 2026

US government takes $2 billion equity stake in nine quantum computing firms


<p>The US government will take equity stakes worth a total of $2 billion in a slew of quantum computing companies, including a startup backed by a firm with links to the Trump family and one taken public by a Pentagon official.</p> <p>The announcement by the commerce department that it had signed letters of intent with nine companies—including GlobalFoundries and IBM—sent shares in quantum specialists soaring on Thursday.</p> <p>Both IBM, which is set to get $1 billion, and GlobalFoundries, which will receive $375 million, were up more than 6 percent in pre-market trading. D-Wave Quantum, an awardee that was taken public in 2022 by Emil Michael—now a top Pentagon official—was up more than 20 percent.</p><p><a href="https://arstechnica.com/gadgets/2026/05/us-government-takes-2-billion-equity-stake-in-nine-quantum-computing-firms/">Read full article</a></p> <p><a href="https://arstechnica.com/gadgets/2026/05/us-government-takes-2-billion-equity-stake-in-nine-quantum-computing-firms/#comments">Comments</a></p> Reference : https://ift.tt/zFUTfNL

Reclaiming Social Engineering for Good

<img src="https://spectrum.ieee.org/media-library/a-photo-illustration-of-a-person-inside-a-swirling-tunnel-of-colorful-digital-sha...