Victor Morel

Victor Morel

PhD in Computer Science / Researcher in cybersecurity

DNV

Biography

I hold a PhD in computer science from Inria - Privatics. I am currently a Senior Researcher at DNV, where I work on cybersecurity for critical infrastructure, with a particular focus on the energy and maritime sectors.

In my past position, I was a postdoctoral researcher in the Security & Privacy Lab at Chalmers University of Technology. I have been selected (twice) as a member of the EDPB’s support pool of experts.

My current research interests include cybersecurity and resilience of industrial cyber-physical systems, AI security, privacy and data protection, and the interplay between technology, regulation, and society. I am particularly interested in understanding how emerging technologies can be deployed safely and responsibly in safety-critical environments. My previous research interests were more focused on privacy and data protection, for instance studying how the adtech industry violates our privacy, and human-computer interactions (see also this), although I was already interested in cybersecurity and the impact of AI.

I now conduct applied research at the intersection of cybersecurity and digitalization, exploring challenges introduced by technologies such as artificial intelligence, industrial automation, and connected systems. My work combines technical, organizational, and regulatory perspectives to strengthen the security and resilience of critical infrastructure. More broadly, I am interested in technology that is secure, trustworthy, and practical, and in ensuring that innovation remains aligned with societal needs and values.

On a personal level, I appreciate sober, hackable, and accessible technology that works. I am a member of FELINN’s collegial council, a French non-profit (“association loi 1901”) hosting ethical digital services, defending decentralization of the web, privacy, and free software through popular education.

Interests

  • Cybersecurity
  • Industrial Cyber-Physical Systems
  • AI Security
  • Interplay Law/Technology/Society
  • Applied Cryptography
  • Privacy/Data Protection

Education

  • Qualification Maître de Conférence (MCF) Section 27 (computer science), 2022

  • PhD in Computer Science, 2020

    INSA de Lyon - Inria

  • Master Thesis, 2016

    Uppsala University

  • Engineer Degree, 2016

    Polytech' Lyon

Recent Posts

Building secure software for operational technologies applications with forensics readiness in mind

Handout of the slides and lecture notes of my trial lecture at Kristiania University of Applied sciences

Against backdoors in end-to-end encrypted communications

With two colleagues, we initiated an open letter to argue against the introduction in Sweden of backdoors in end-to-end encrypted messaging apps, followed by a popular article in the Swedish press.

Call for views on “consent or pay” business models

The UK DPA, ICO, recently called for views on “consent or pay” business models. Here is our feedback.

The reason behind Meta's last move

Meta just rolled a new way to address legal compliance in the EU: leave people with a choice to either subscribe or have their data collected. I have a pretty good idea as to why, and guess what: they’re not doing it out of good heart.

Master thesis proposals

Living page for my master thesis proposals.

Recent Publications

Quickly discover relevant content by filtering publications.

The TCF doesn’t really A(A)ID – Automatic Privacy Analysis and Compliance of TCF-based Android Applications

The Transparency and Consent Framework (TCF), developed by the Interactive Advertising Bureau (IAB) Europe, provides a de facto …

AI-driven Personalized Privacy Assistants: a Systematic Literature Review

In recent years, several personalized assistants based on AI have been researched and developed to help users make privacy-related …

'I will never pay for this' Perception of fairness and factors affecting behaviour on 'pay-or-ok' models

The rise of cookie paywalls (‘pay-or-ok’ models) has prompted growing debates around the right to privacy and data …

'I'm not for sale' -- Perceptions and limited awareness of privacy risks by digital natives about location data

Although mobile devices benefit users in their daily lives in numerous ways, they also raise several privacy concerns. For instance, …

To Be or Not to Be (in the EU): Measurement of Discrepancies Presented in Cookie Paywalls

Cookie paywalls allow visitors to access the content of a website only after making a choice between paying a fee (paying option) or …

Projects

CoIoT

CoIoT is a project to manage consent in the IoT. It takes the form of an Android app enabling the definition of data subject privacy policies to automatically interact with IoT devices according to the user’s choices.

CyberSecIT

CyberSecIT will develop a practical, secure and privacy-enhancing solution regaining control for end-users and companies over their IoT ecosystems while enjoying all the benefits that come from automated data analysis and autonomous privacy-preserving security monitoring.

Map of Things

Map of Things is a map to visualize devices in the smart city collecting personal data, please mail me for comments or feature request.

Talks & Press

Keynote: Should I trust it with my data? Capabilities, limits, and perspectives of AI technologies for privacy

Invited keynote to SPAIML, based on my recent work around privacy and AI. It is impossible to miss the AI wave which shakes many …

'I will never pay for this' Perception of fairness and factors affecting behaviour on 'pay-or-ok' models

The rise of cookie paywalls (‘pay-or-ok’ models) has prompted growing debates around the right to privacy and data …

Legitimate Interest is the New Consent – Large-Scale Measurement and Legal Compliance of IAB Europe TCF Paywalls

Invited talk to the CNIL (the French DPA) regarding our work on cookie paywalls.

Of cookies and paywalls

Invited talk to the Citi lab.

Of cookies and paywalls

Invited talk to the Privaski seminar in the Alps.

Teaching & Service

Academic service

  • Program Committee Member ACM CCS 2026.
  • Program Co-Chair IWPE 2025 (former PC member).
  • Program Committee Member Annual Privacy Forum 2024-2025.
  • Program Committee Member PoPETS 2023-2025.
  • External Reviewer PoPETS 2021-2022.
  • Program Committee Member and session chair IFIP Summer school 2023.

I also do external reviews for venues such as S&P, WWW, ESORICS, etc.

Teaching

Current(-ish)

At Chalmers, I teach:

  • Cryptography (lecturer)

I used to teach in:

  • Advanced programming in python (lecturer)

I also supervise master theses, 11 successful defenses so far, on topics spanning over applied cryptography, web security, privacy measurements, and privacy engineering.

Past lives

At UGA (2020), I taught a full-time duty in Databases (fr and en).

At Insa de Lyon (2016-2019), I have taught:

  • Genetic Algorithms and Project Management (fr),
  • Computer basics: Networks and Security (fr),
  • Algorithmic and Programming 4 (fr & en).

At Uppsala University (2016), I was a teacher assistant in Database Design I (en).