228 points
• 6 days ago
• Article
Link
2026 年 5 月 13 日，互联网清理基金会推出了 SecurityBaseline.eu，这是一个用于监控和可视化欧洲各国政府网络安全状况的新网站。该项目源自 Netherlands 的"Basisbeveiliging"计划，后者已经追踪基础安全十余年。基金会在网站上线前三个月向欧洲各国政府发送了数万封邮件，给各方机会在数据公开前审查并修复问题。其目标是提高网络透明度，并通过促使政府对自身和国家实施更高的安全标准来更好地保护公民。
SecurityBaseline.eu 使用名为 Web Security Map 的软件，该软件已开发超过十年。网站覆盖 32 个国家，包括所有 EU 成员国以及 Switzerland 、 Norway 、 Iceland 和 Liechtenstein，检测约 67,000 个地方政府的近 200,000 个互联网域名（实际的政府域名数量可能高出十倍）。网站每天生成超过 1,800 张"交通灯"式地图：红色表示存在安全问题，橙色表示有警告，绿色表示无问题。这些地图基于 21 项指标，涵盖从加密质量到是否存在跟踪 cookie 等多方面内容。
其中一项令人担忧的发现是，有 3,081 个欧洲政府网站在未经用户同意的情况下使用跟踪 cookie，这违反了 GDPR 。按比例看，Slovakia 以近 9.88% 位列首位，其次是 Greece（8.16%）和 Portugal（7.63%）。 YouTube 是这些跟踪 cookie 的最大来源，出现 2,077 次，其次是 Google Ads（842 次）。基金会指出，许多跟踪 cookie 是集成现代技术时带来的副作用，这类技术往往隐藏了广告相关代价，因此敦促政府采用更尊重隐私的网页开发做法。
另一大问题是数据库管理界面的外置，尤其是 phpMyAdmin，本不应对外公开。基金会在 3,529 个域名上发现了 1,070 个 phpMyAdmin 门户，France 有 513 个实例、 Poland 有 499 个。暴露的管理面板风险极高，容易引发安全事故，例如今年早些时候 cPanel 中发现的严重漏洞。基金会还指出，尽管 phpMyAdmin 是开源软件，但没有任何欧洲政府对该项目提供资助，这反映出对自身线上安全投入的不足。
或许更令人震惊的是，欧洲有 99% 的政府邮件加密水平不达标。只有 Netherlands 和 Denmark 的情况相对较好，分别有 58% 和 44% 的邮件域名符合现代加密标准。该加密质量依据 Netherlands 政府的最新指南进行测评，这些指南尚未在欧洲层面标准化。 Germany 和 France 等国虽有各自指南，但相互不兼容且缺乏简便的检测工具。加密不足使得政府通信易被窃听和篡改。
基金会强调，这些问题不能靠一次性修补解决，而需要持续改进并适应未来变化，例如更强的加密和量子密码学。他们敦促各国政府建立变更流程并加大线上安全投入。 SecurityBaseline.eu 的数据公开可查，基金会鼓励政府利用这些数据提升安全态势，并邀请组织与个人通过成为会员或提出进一步研究请求来支持他们的工作。
文章最后附有详细来源表，展示各国在跟踪 cookie 、 phpMyAdmin 面板与邮件加密质量方面的分布，直观呈现了安全格局，便于政府与公众识别需改进之处。基金会的工作得到包括 CIP 、 RDI 、 SIDN Fonds 、 cobytes 和 procolix 及其会员的支持，致力于通过透明化与对在线可用性、完整性和机密性的研究，推动互联网更安全。
## European Government Security: A Wake-Up Call from SecurityBaseline.eu
On May 13, 2026, the Internet Cleanup Foundation launched SecurityBaseline.eu, a new website designed to monitor and visualize the cybersecurity posture of European governments. This initiative is a spin-off from the Dutch "Basisbeveiliging" project, which has been tracking baseline security for over a decade. The foundation sent tens of thousands of emails to European governments three months prior to the launch, giving them time to review their security status and address any issues before the data became public. The goal is to make the web more transparent and to help governments protect their citizens by imposing higher security standards on themselves and their countries.
SecurityBaseline.eu uses software called Web Security Map, which has been in development for over ten years. The site measures security across 32 countries, including all EU member states plus Switzerland, Norway, Iceland, and Liechtenstein. It covers nearly 200,000 internet domains across approximately 67,000 local governments, though the true number of government domains is likely ten times higher. The site generates over 1,800 maps daily, each colored like a traffic light: red for security issues, orange for warnings, and green for no issues. These maps cover 21 different metrics, ranging from encryption quality to the presence of tracking cookies.
One of the most alarming findings is that 3,081 European government sites use tracking cookies without user consent, which is illegal under the GDPR. Slovakia leads with nearly 9.88% of its governmental sites placing tracking cookies, followed by Greece at 8.16% and Portugal at 7.63%. YouTube is the largest source of these tracking cookies, with 2,077 instances, followed by Google Ads with 842. The foundation notes that many of these tracking cookies are a side effect of integrating modern technologies that have hidden advertising costs, and they urge governments to adopt more privacy-friendly web development practices.
Another significant issue is the exposure of database management interfaces, specifically phpMyAdmin, which should not be publicly accessible. The foundation found 1,070 phpMyAdmin portals across 3,529 domains, with France leading at 513 instances and Poland at 499. These exposed panels are particularly dangerous because they are prone to security incidents, such as the severe vulnerability discovered in cPanel earlier this year. The foundation also points out that while phpMyAdmin is open-source software, no European governments have financially contributed to the project, highlighting a concerning lack of investment in their own online security.
Perhaps the most shocking discovery is that 99% of governmental email in Europe is poorly encrypted. Only the Netherlands and Denmark show somewhat promising numbers, with 58% and 44% of their email domains meeting modern encryption standards, respectively. The encryption quality is measured using the latest guidelines from the Dutch government, which are not yet standardized at the European level. Countries like Germany and France have their own guidelines, but they are not compatible and lack simple testing tools. This poor encryption leaves government communications vulnerable to eavesdropping and tampering.
The foundation emphasizes that these issues cannot be fixed with a one-time effort but require continuous improvement and adaptation to future changes, such as stronger encryption and quantum cryptography. They urge governments to establish change processes and invest in their online security. The data from SecurityBaseline.eu is publicly available, and the foundation encourages governments to use it to improve their security posture. They also invite organizations and individuals to support their mission by becoming members or requesting further research.
The article concludes with detailed source tables showing the distribution of tracking cookies, phpMyAdmin panels, and email encryption quality across European countries. These tables provide a clear and transparent overview of the security landscape, allowing governments and citizens to see where improvements are needed. The foundation's work is supported by various organizations, including CIP, RDI, SIDN Fonds, cobytes, and procolix, as well as their members. They remain committed to making the internet safer through transparency and research into online availability, integrity, and confidentiality.
106 comments • Comments Link
• 德国对"黑客"行为的刑事化（如《刑法典》第 202a 条和第 202c 条）产生了明显的寒蝉效应：把未经授权访问、甚至对公开可访问系统的测试定为违法，使得道德黑客因担心被起诉而不敢去检测包括政府网站在内的安全弱点。
• 德国存在一种更倾向于推脱责任和官僚自我保护的文化，而非主动改善安全，这导致漏洞常被搁置，往往只有在发生重大事故后才被迫处理。
• 尽管是 Chaos Computer Club 的发源地，德国在留住和发挥技术人才方面却困难重重：许多技术人员选择出走，留在国内的则常被僵化的体制限制，无法充分施展专长。
• GDPR 初衷良好，但在欧洲各国的执行不均：如西班牙等南欧国家积极对大型公司罚款，而德国等北欧国家则狭隘地把注意力集中在 cookie 同意问题上，忽视了更广泛的数据治理和执法议题。
• 一个名为 SecurityBaseline 的新项目扫描了全欧洲超过 267,000 个政府和公共网站，揭示出普遍存在的问题：非法跟踪 cookie 、暴露的数据库接口、薄弱的电子邮件加密等，凸显出对基础安全实践的系统性忽视。
• 也有批评认为，部分发现（例如缺少 DNSSEC 或使用第三方电子邮件服务）被过度渲染或错误归类为高风险，这种将轻微配置问题与真正安全威胁混淆的做法可能削弱报告的可信度。
• 在官方欧盟域名 ec.europa.eu 上发现一个疑似恶意 PDF 文件，讽刺地表明：在严格约束私营部门的数字法规面前，政府自身的基础设施安全却未得到相应保障。
• 与德国相比，意大利在公共部门数字化方面表现相对更好，这在很大程度上得益于集中化举措（如共享市政网站框架）以及较早采用 SPID 和 PEC 等国家级数字身份体系。
• 政府 IT 岗位普遍缺乏问责机制且停滞不前，绩效不佳的员工很少被解聘，通常只在部门间调动，从而缺乏维护现代化、安全系统的动力。
总体上，讨论暴露出德国在网络安全方面的深刻矛盾：一方面拥有深厚的黑客文化和隐私保护传统，另一方面法律与体制障碍却抑制了道德安全研究和实际改进。尽管 SecurityBaseline 之类的工具揭示了政府基础设施中的明显漏洞，官方回应却常呈防御性或淡化态度，反映出更倾向于追求合规形式而非切实安全的做法。与此同时，意大利等国表明，集中化、充足投入和有执行力的领导比单纯监管更能带来可见成效。讨论还指出，公众对 GDPR 的认知越来越被简化为 cookie 横幅等表面现象，掩盖了数据治理与执法中更关键的议题。 • Germany's strict hacking laws, such as § 202a and § 202c StGB, create a chilling effect on security research by criminalizing unauthorized access even to publicly reachable systems, discouraging ethical hackers from testing government websites for fear of prosecution.
• There is a cultural tendency in Germany to prioritize blame avoidance and bureaucratic self-preservation over proactive security improvements, meaning vulnerabilities are often ignored until a major incident forces action.
• Despite being home to the Chaos Computer Club, Germany struggles with retaining tech talent, as skilled individuals either leave the country or are stifled by rigid institutional structures that fail to leverage their expertise.
• The GDPR, while well-intentioned, suffers from inconsistent enforcement across Europe, with southern countries like Spain actively fining large corporations while northern nations like Germany focus narrowly on cookie consent rather than broader data protection issues.
• A new project called SecurityBaseline has scanned over 267,000 government and public sites across Europe, revealing widespread issues including illegal tracking cookies, exposed database interfaces, and poor email encryption, highlighting systemic neglect of basic security practices.
• Some critics argue that certain findings, like missing DNSSEC or the use of third-party email providers, are overemphasized or misclassified as high-risk, potentially undermining the credibility of the report by conflating minor configuration issues with serious security threats.
• The discovery of a potentially malicious PDF hosted on an official EU domain (ec.europa.eu) underscores the irony of governments failing to secure their own infrastructure while enforcing strict digital regulations on private entities.
• In contrast to Germany, Italy performs relatively well in public sector digitalization, thanks to centralized initiatives like shared municipal website frameworks and early adoption of national digital identity systems such as SPID and PEC.
• Government IT roles often suffer from low accountability and stagnation, with underperforming staff rarely fired and instead transferred between departments, creating little incentive for maintaining modern, secure systems.
The discussion reveals a deep frustration with Germany's paradoxical relationship with cybersecurity: despite a strong tradition of hacker culture and privacy advocacy, legal and institutional barriers actively discourage ethical security research. While tools like SecurityBaseline expose glaring vulnerabilities in government infrastructure, responses are often defensive or dismissive, reflecting a broader pattern of prioritizing legal compliance over actual security. Meanwhile, other European countries like Italy demonstrate that centralized, well-funded digital initiatives can yield better outcomes, suggesting that political will and competent leadership matter more than regulation alone. The conversation also highlights how public perception of laws like GDPR has become fixated on superficial elements like cookie banners, overshadowing more critical aspects of data governance and enforcement.