This reporting by @TomasStatius @oliviasolon follows our previous exposé of a related EU biometric border system fiasco involving French industrial group Atos.

While contracting giant Sopra Steria and agency EU-Lisa quibbled about costs, issues that should have been fixed in 2 months were sometimes taking more than 5 years.

Schengen Information System II, meant to enforce border control, was found to have 1000s of “high severity” security issues by EU audit, making it vulnerable to hackers.

A critical EU security database with biometric info on 1.7m people is in chronic disarray, exclusive docs from @LHReports and @Business show

Three cheers to the team including @MargotGibbs @ElenaDebre @Cynthia_Gichiri @tessapang_ @johnallannamu @SamMunia @mougendi @EmmanFre @Sarasvati_NT @thinink @careygillam @sfoucart @nathmorris @AntonyKip @Enugu62 @namlyd @mojeed07 @gabriels_geiger @TomasStatius @aathiperinchery.

Honoured that our investigation Poison PR won the Environmental Reporting prize at  @onewm last week, and to see key collaborator @Cynthia_Gichiri shortlisted as Journalist of the Year for her amazing work with @AfUncensored.

For the full story and background on how we did this investigation check the link. Reporting by @rj_gallagher @gabriels_geiger @cr0ft0n

We found sensitive logins for over 1000 companies routing through Fink’s network. @privacymatters describes it as “a shocking example of why companies should not be sending account authentication codes by text message”.

In reporting this story we analysed a vast leak of nearly 100mn raw data packets passing through Fink Telecom – a small company based in Switzerland. In 2023 we revealed how it acted as a surveillance contractor for governments and spy companies

The nature of the SMS industry means that nobody is immune. Even security-first companies like @signalapp can’t or don’t prevent their logins from travelling via untrustworthy routes.

Tech companies care more about cost than security on 2FA. This means outsourcing message delivery to whoever can get the job done quickest and cheapest. The result is a chain of subcontractors, invisible at both ends, functioning without accountability or oversight.

We teamed up with @business to investigate how the world’s largest tech companies send their “secret” passwords. We found a marketplace that feeds an opaque and sprawling network of untrusted middlemen – including a notorious surveillance enabler

You’ve seen the “don’t share this code with anyone” SMS messages when you log in to your most sensitive online accounts: banking, messaging, @google, @meta, @amazon. But who else might have seen them before you?.

Kudos to @eileenguo @JeroenvanRaalte @gabriels_geiger @jus_braun @apsilverman.

We’re committed to showing how we work. Our full methodology and the underlying code are available on Github.

To answer it, we interviewed welfare recipients, civil servants, data scientists and experts. We obtained code, documentation, and internal records.

And in Dutch with partner @trouw

Read what happened in English with partner @techreview .

And it invited @LHreports to watch as it unfolded. They gave us full access to their system, including code, ML models and comprehensive data.

Amsterdam spoke to academic experts. Audited for bias. Reweighted data. Spents 1000s of € on consultants. Chose explainable models over black boxes. It even consulted welfare recipients for feedback.