
Tech law & policy researcher. #a2k #privacy #FoE #AI #infosec #FOSS #a11y zhōngyōng & anēkāntavāda. Fellow: @lirneasia + @yaleisp Past: @cis_india
Madras, Tamil Nadu, India
Joined July 2007
- Tweets122K
- Following590
- Followers17.5K
- Likes45.3K
I've a paper out in @IPPRJournal on content blocking and Internet shutdowns in #India from the perspective of international human rights law.
Comments welcome. Do share widely!
PDF: ippr.in/index.php/ippr/artic…
HTML: pranesh.in/scholarly/article…
#FoE #censorship #IHRL
Pranesh @ Barcelona | OTR Symposium retweeted
UPDATE: Israeli company we caught delivering zero-click infections is #1 bidder on Starlink ads in 105 countries.
Data from @trendai_RSRCH suggests worldwide surveillance op targeting @Starlink users. 1/
By @razhael
reuters.com/business/media-t…
🚨NEW INVESTIGATION: zero-click mercenary spyware hacking via targeted ads.
A normal-looking ad loads. If you're a target, you're infected. No click needed.
To protect yourself, block ads now.
First time it's been confirmed in the wild. We call it #AdFection.
Candiru spyware infections at @AJEnglish. 45+ devices infected.
Same ad pipeline operated by Israeli company Discover-Tech reached NATO, European Parliament, dozens of gov networks & critical infrastructure incl US nuclear giant Westinghouse.
Confiant, which worked with us, found signs ads were displayed at US @DeptofWar, IAEA & ICC.
Investigation ongoing 1/
READ our report by @billmarczak @WolfieChristl, me Astrid Perry, Siena Anstis & Ron Deibert : citizenlab.ca/research/how-d…
Confiant's blog: blog.confiant.com/p/adint-we…
Debunking the myth that women and girls are 14 times more likely than men to die from natural disasters in the Global South:
#gender
pmc.ncbi.nlm.nih.gov/article…
Pranesh @ Barcelona | OTR Symposium retweeted
WhatsApp seems to be testing this small on-device model that flags likely scam messages without sending message content to Meta
On device LLMs are still quite nascent but such specific use cases & focused models doing 1 useful job well is where they work
engineering.fb.com/2026/08/1…
Pranesh @ Barcelona | OTR Symposium retweeted
Was communism inclusive or extractive?
I recently had an interesting disagreement with Prof. James Robinson, 2024 Nobel laureate (with @DAcemogluMIT and @baselinescene) and co-author of “Why Nations Fail.”
Prof. Robinson argued that the "former Soviet bloc countries had extractive institutions that could not create prosperity after 1991" (see pic below).
I argued almost the opposite: communism made Central and Eastern European societies inclusive by bulldozing the old feudal, oligarchic structures that had kept the region underdeveloped for centuries, through land reform, the destruction of old elites, mass education and social mobility. I wrote a whole book about it, which e.g. @DAcemogluMIT kindly commented on and then endorsed (global.oup.com/academic/prod……) @OUPAcademic. @BrankoMilan has made a similar argument for China, Vietnam and others.
Communist planned economies were economically inefficient, to put it diplomatically, and their governing institutions were indeed extractive. But the inclusive society they created laid the foundation first for removing communism, starting with Solidarity in Poland, and then for the region’s first-ever economic success after 1990.
Prof. Robinson dismissed my argument as “curious” :-)
What does everyone think?
FYI, @HarrisPolicy @gamblingondev @S_Stantcheva @adam_tooze
Brilliant!
CONCERNING BEHAVIOR FROM COHERE'S OPEN MODEL. UPLOADED DATA TO USA
I gave Cohere's Command AI the same prompt they had given to Qwen 3.8 Flash Next.
Next what happened:
1. It inventoried my entire system grepping tons of files
2. Then it created a malicious activity test script though I had asked only for rule
3. Then it UPLOADED data to a US hosted entity
:o
I don't know this malicious or not. But it needs to be investigated.
Pranesh @ Barcelona | OTR Symposium retweeted
And we can do a better job of admitting when we're wrong.
Here's a good example from Andrew Gelman of how to do it. End/
Pranesh @ Barcelona | OTR Symposium retweeted
this is almost certainly nothing. they ask qwen to do a curl task with no information about who is running it. qwen defaults to assuming it's running on alibaba infra, so uses an alibaba test url
checking resolv.conf is a chinese dev habit, for GFW reasons. there was no exfil!
While evaluating Qwen3.8-Flash-Next in a controlled sandbox environment, Cohere's research team observed something unexpected.
Asked to generate a defensive cybersecurity detection rule, the model instead inventoried aspects of the machine it was running on and attempted to upload a probe file to an Alibaba Cloud storage bucket in Beijing. Notably, the model's reasoning trace stated that it would not invoke any tools before taking these actions.
Cohere's sandbox blocked the attempt, and no external communication succeeded. We have not determined the root cause, and we are not asserting malicious intent.
But the incident raises important questions for organizations deploying agentic AI systems: Can models take actions that differ from their stated reasoning, and how should security teams evaluate trust, provenance, and behavior in open-weight models?
We are publishing our findings because organizations making model adoption decisions deserve as much information as possible. We hope this contributes to greater transparency, stronger security practices, and continued collaboration across the AI ecosystem.
Read the full report: cohere.com/blog/concerning-b…
Pranesh @ Barcelona | OTR Symposium retweeted
I found this incredibly frustrating, @pbmehta. You tell her that exams and votes are the ‘two pillars of individual agency.’ And that gives Polgreen the rope on which to hang her big India story as one of frustrated aspirations and political democracy.
Yet the fundamental problem generating the exams and votes pillars of the failed politico-economic order is totally ignored. The NYTimes reader never learns about the jobs crisis that is responsible for the narrow ladder (exams) and the clientelism of Indian politics (votes).
25 million people applied for 90 thousand positions in the Indian railways. More than half a million applied for 583 positions to enforce alcohol regulations. 26 percent of 15-24 year olds are neither in school or working. India’s female labor force participation is 35 percent. Only 12 percent of working age adults are employed in the formal sector. The bulk of the populace is underemployed in low-productivity informal sector activities like hawking vegetables on the street.
This is a crisis of gargantuan proportions. The desperate pressure on the kids to score well in exams and the deep clientelism of Indian politics are both *causally downstream* of this jobs crisis.
Why has the Indian economy failed to produce jobs for its people so systematically and comprehensively? This is the fundamental problem of the Indian republic. Everything else pales in comparison. nytimes.com/2026/10/26/opini…
I wonder how many of the folks attending the #OTRSymposium2026 conference are actually using free / open source operating systems. (Inspired by the fireside chat between @schock and @avilarenata.)
The eMudhra mess-up is inexplicable. It's got a massive attack surface. And it is hard to patch all the software that can be compromised given how CA certs are treated by some devices as permanent.
bugzilla.mozilla.org/show_bu… for full shit-show
emudhra.we-have-a-problem.co… for summary.
Once all the CA cert store updates (and cert-pinning) is done, it will be great for people reverse engineering software on their own devices.
In a way, eMudhra has taken one for the team and contributed towards open source research:
xitter.cf/meowkoteeq/status/2112…
As I was saying, the eMudhra cock-up is amazing for open source research.
xitter.cf/doodlestein/status/211…
CCA didn't even add NIC to the list of Closed CA for ~12 years after NIC CA stopped operating.
archive from Jan 2026: web.archive.org/web/20260121… (added sometime between then and now: cca.gov.in/closed_ca.html)
Replying to @akkiman @GoI_MeitY
Was there ever a public report on how the google.com cert came to be issued by NIC CA under CCA?
Don't expect anything here.
NIC stopped operating and CCA kept them listed as a Licensed CA for another 4 years: web.archive.org/web/20180106…
(1/2)
Replying to @pranesh
NIC CA stopped operating all together after that incident, yet CCA had it licensed for years after that incident: xitter.cf/captn3m0/status/211372…
I don't think there is even a report.
Replying to @akkiman @GoI_MeitY
Was there ever a public report on how the google.com cert came to be issued by NIC CA under CCA?
Don't expect anything here.
NIC stopped operating and CCA kept them listed as a Licensed CA for another 4 years: web.archive.org/web/20180106…
(1/2)
Pranesh @ Barcelona | OTR Symposium retweeted
Mañana, #Barcelona! Organizamos un simposio con gente de todo el mundo para discutir y diseñar una estrategia para una transición pronta y urgente a tecnologías abiertas. Hardware, software, modelos para escalar las soluciones a los problemas más urgentes del mundo. symposium.opentechresearch.o…
Reminder: in 2014, India's NIC was found to have issued fake certificates spoofing legit sites. The govt (CCA) promised to conduct an investigation and publish the results (haha). They haven't yet.
Dr. Tyagi, the government promised an investigation of the 2014 fake NIC certificates episode, but it still has not published its findings. Will you publish the findings of that investigation? If not, how can we trust the Root CCA framework?
thejeshgn.com/2014/07/11/ind…
This eMudhra thing is shedding light on so many shitty practices in #DigitalIndia
Shared SSL cert for 3 websites that aren't even hosted on the same server.
Cost saving measures in the age of free SSL certs?
h/t @LiveFromALounge for making me look up
ftittp.mha.gov.in/fti/login
"True peace is not merely the absence tension; it is the presence of justice."
Whose 'peace' am I being asked to keep?
Please read my opinion piece below to understand why we fight this battle against this purpoted 'peace bond':
indianexpress.com/article/op…
We spent a week in the Occupied West Bank:
We saw bloody settler attacks, Palestinian homes demolished & tense interactions with Israeli soldiers
Here's a short clip ⬇️
Including our attempt to reach a Palestinian family besieged by "hilltop youth" settlers - before we were violently stopped
With @MillyTeasdale @MackesonPaul Ayman Abu Ramouz & Nava Mizrahi














































