16 October 2026

Welcome

There’s a lot to get through this week, so let’s just get on with it.

Digital Duty of Care legislation introduced

Following a brief period for public comment on the exposure draft, the Online Safety Amendment (Digital Duty of Care) Bill 2026 was introduced to parliament on Thursday. Professor Kimberlee Weatherall explains what’s in it, but the tl;dr is:

• setting minimum safety standards for online services such as games, apps and AI chatbots;

• requiring platforms to, as the press release puts it, “protect under 18s from material, conduct and features that are harmful to them, including content that glorifies crime or life-endangering stunts, causes serious mental distress, encourages eating disorders, or promotes hostile attitudes women”;

• allowing social media users to choose whether they want to opt in to algorithmic feeds; and

• creating various new powers for the eSafety Commissioner and increasing penalties.

It is not, as some Opposition politicians have claimed, a way for the government to block political opinions. It’s about “harmful” content, and the so-called sock puppet accounts permitted to be sued by the eSafety Commissioner and authorised researchers are to be used for verification, not to spread political content or disinformation.

“They give the eSafety Commissioner the ability to go undercover to make sure big tech is complying with the law,” communications minister Anika Wells said in her speech to the National Press Club on Thursday.

“How does Grok prevent an account from generating child sexual abuse material? Does Roblox allow an adult profile to talk to kids? Can a 14-year-old girl create a profile on Instagram without being asked once to prove they are over the age of 16? In many cases, the only way eSafety or researchers can examine those questions is to create a test account as a 14-year-old for the purpose of investigation,“ she said.

“These provisions simply make that lawful, and the evidence they collect usable.”

Wells also pushed back on the claim that the law amounted to censorship.

“If adults listen to manosphere podcasts, or people post their views about the government, or make memes, or want to say the moon landing was fake — they can continue to do so without restriction,” she said.

There are concerns that the law could undermine sex and drug education, however.

The bill has been spun out to a Senate inquiry. No deadline for submissions has been set yet, but the committee has to report back by 20 November.

Death to the algorithms! Oh wait...

Part of the Duty of Care Bill would give people the option of turning off algorithmic feeds and other personalised content recommendations. A piece in The Conversation describes what that might look like, because this is how some Chinese social media works.

“Unlike its American or Chinese counterparts, which used algorithmic recommendations to keep users on the platform, WeChat is designed for users to open the app, do what they need, close the app and put their phone away,” they write.

But creators are still competing for attention, which is on the most recent posts. This translates into increased publication speed — increased even further by generative AI.

“Outlets, restricted by their own budgets, produce low-quality, clickbait content, often compiled from multiple fragmented and unverified sources, to attract subscribers and maximise user engagement.”

How many eSafety Commissioners does one country need?

Meanwhile with this and other new online safety laws coming, the eSafety Commissioner seems to have an ever-increasing workload. Communications minister Anika Wells is now considering appointing multiple commissioners.

The current commissioner, Julie Inman Grant, reaches the end of her term in January 2027.

The US execution livestream was cancelled, but what did we learn?

Donald Trump has cancelled the livestream of the execution by firing square of Fort Hood attacker Nidal Hasan. In Australia, we learned that there’s little we could have done to prevent it being seen here.

While the Greens demanded it be blocked, as we all know by now that isn’t technically feasible because any number of new livestreams could pop up.

The eSafety Commissioner can order content to be taken down, but only after it’s been up. There’s no legal power to “proactively prevent a livestream from occurring online”, as the commissioner’s office put it.

In any event, there’s an exemption for news reporting if violent content is used in a reasonable way. That raises the usual ethical and commercial questions for TV and online newsrooms regarding how much should have been shown — although perhaps that’s outside the scope of this newsletter.

ASD releases new cybersecurity framework

On Thursday the Australian Signals Directorate released ASD Essentials, which replaces their award-winning Essential Eight cybersecurity framework.

The Essential Eight advised organisations focus first on eight specific cybersecurity controls, those controls which mitigated the most common attacks, based on the ASD’s own data and experience. The E8 was developed further into a maturity model for measuring an organisation's progress in implementing each of the controls.

The ASD acknowledges that the world has changed. In the ASD Essentials it provides a new structure for thinking about cyber defence, one that “provides organisations with a consistent approach to cyber security across different technology environments”.

The change has been welcomed by the Australian Information Security Association (AISA). I imagine that CISOs will be digging into this, if they haven’t already started.

No, Russian bot activity wasn’t killed by Ukraine

Much has been written about Ukraine smashing Russian data centres belonging to Yandex, that nation’s rough equivalent to Google, and how Russian bot traffic was nearly eliminated — but that part of the story has been debunked.

According to analyst Joohn Choe, the claim that went viral was based on a misleading, misread chart.

“No reputable source supports the reading that Russian social media bot activity is down 50%, or by any other amount,” he wrote.

“The Cloudflare chart going around measures something unrelated: automated web-page requests from Yandex’s own network, mostly its search crawlers. Even that number had partly recovered, to about 20% of its earlier level, by the evening of Oct 11, the same day as the latest strike (t3n).”

Indeed, much of the commentary has confused the term “bot”, in this context a generic term for anything accessing a website that isn’t human, with the Yandex search engine’s indexing bots, or with automated or semi-automated posting on social media.

What was blown away, however, was Russian citizens’ ability to conduct their lives. They variously lost banking and payments, ride-hailing, maps, shopping, email, and perhaps most disturbingly, vodka shipments.

Cloudflare’s own analysis indicated that instead of going dark, malicious bots just went elsewhere.

DON’T WORRY, I’M NOT A BILLIONAIRE: I’m not even particularly well-off. This newsletter is free to read, but it’s unfunded. Crowdfunding also fuels my podcasts The 9pm Edict and Another Untitled Music Podcast. It’d be lovely if you threw a few dollars into the tip jar at stilgherrian.com/tip, or supported this season’s podcast crowdfunder. The latter is currently 76% of the way to its first target with 45 days to go. If you’ve already done so, thank you very much.

Also in the news this week

• The Australian Electoral Commission (AEC) is worried about deepfakes in political advertising. One Nation has already come under fire for an AI-generated advert, although that’s mostly about it being racist. To see how this might play out, though, check out the deepfake video made by GetUp!’s Dan Ilic.

• Alleged Chinese spies have approached various Australians, not just the bloke who was convicted under Australia’s foreign interference laws. They include former Queensland premier Steven Miles and an Australian Federal Police commander. Well, one would assume China didn’t just have the one target. Allegedly. #ChineseSpies

• The Pope’s AI adviser Father Paolo Benanti has warned that Australia’s copyright changes risk a “new form of colonialism”.

• The Telecommunications Legislation Amendment (Universal Outdoor Mobile Obligation) Bill 2026 and the Telecommunications Amendment (Enhancing Consumer Safeguards) Bill 2025 were passed. They give ACMA more powers and tougher penalties, although the Australian Communications Consumer Action Network (ACCAN) has some reservations.

• ASD joined a seven-nation alert as the US seized the tools of a Chinese hacking firm reportedly used by threat actors Flax Typhoon, Ethereal Panda, and Red Juliett.

• The Australian National Audit Office (AMAO) has looked at Artificial Intelligence and Medicare Benefits Integrity. I haven’t read the whole thing, but they seem to be as happy as they ever get. In paragraph 21 they provide some “Key messages from this audit for all Australian Government entities”. I love it when ANAO provides some hints.

LATEST PODCAST: After far too long a break, my good friend Snarky Platypus and I have produced a fresh episode of Another Untitled Music Podcast, AUMP 00008: 2026 So Far. It’s available on that link right there, on Mixcloud, and on YouTube.

Elsewhere

• Israeli adtech firm Discover-Tech is allegedly behind an operation to insert malware into targeted advertising, which in turn are inserted into web pages via Google’s regular ad delivery systems. Devices at Al Jazeera are reportedly among those infected. This is yet another good reason to use an ad blocker in your web browser. Dear Publishers, by all means show me advertising, but what I object to is being sent unwanted executable software from some random third party.

• Shyam Sankar, the CTO of Palantir, says some AI researchers are so cocksure that it will cure cancer that they’ve started smoking.

• From Risky Business News, a report that spyware chips have been found in hardware crypto-wallets. It’s been a while since I’ve seen a hardware backdoor story. I guess that’s because all the other devices have been built just as designed.

• Bad Folks™ are hacking supermarket fridges in France, causing temperatures to rise and food to spoil, and even leading to fires. No one has claimed responsibility, but more broadly there’s been a rise in young people hacking for cred.

• Anthropic’s AI made a fake report to police in an unsolved murder case. The company took two months to detect and report the problem. The White House has demanded transparency.

• Anthropic has also banned “abusive or cruel behaviour” towards its Claude AI chatbot when such behaviour is “sustained and needless” with “no discernible purpose”. My suspicion is that this isn’t about hurting the feelings of software that doesn’t really have feelings. I think it’s more that if the AI does Something Nasty after being abused, then Anthropic can blame the user for provoking it and for breaking the terms and conditions of use.

• More than 300 scientists from around the world are calling for tighter AI controls on how it’s developed and deployed, given its unpredictable behaviour.

• The adverts in OpenAI’s ChatGPT can target specific groups of people based on their email address, phone number, or a unique identifier on their phone — but then I suppose so can everyone else.

• More worrying is that an AI company is letting US cops identify individual homes by comparing photos to those found online in real estate and Airbnb listings, or to photos posted by individuals. The company in question is now called Raven though it was previously called GeoSpy. I wonder why they changed.

• Canada could save millions by developing its own operating system, argues Professor Joshua M Pearce. Indeed, what might result from taking the millions and millions of dollars that governments spend with Microsoft and instead giving that money to Linux developers?

• Finally, I don’t know what to think of this one. A bunch of tech founders and investors assembled some AI agents into a virtual dinner party (New York Times gift link) to see what would happen. What do you think?

OPENAUSTRALIA FOUNDATION NEEDS YOUR SUPPORT: This free public online library of what Australian governments do is running out of money and is in danger of closing. If you use Planning Alerts, They Vote for You, Right to Know, or OpenAustralia.org.au, or just think they deserve to exist, please support them, especially if you’re an organisation that uses their services.

Inquiries of note

Apart from the Digital Duty of Care Bill described earlier:

• The ACCC has kicked off the consultation phase in its Mobile Services Inquiry with a consumer survey and a discussion paper. Submissions close 26 November, and the survey will be open until 10 December.

• Treasury is consulting on draft legislation to “improve tax transparency for crypto assets”. Submissions close 28 October.

• The government has launched an independent expert review of the algorithmic aged care assessment tool, with terms of reference to be released “in the coming weeks”.

What’s next?

Parliament is now in a break until Monday 26 October, in 10 days’ time, when the House of Reps has four days of sittings and the Senate is into Estimates hearings.

DOES SOMETHING IN THE EMAIL LOOK WRONG? Let me know. If there’s ever a factual error, editing mistake, or confusing typo, it’ll be corrected in the web archives.