NEW: Google sent ICE the personal financial data of a student and journalist who attented a pro-Palestinian protest in 2024. The agency had sent Google an admininistrative subpoena, a request that companies are not mandated to respond to. techcrunch.com/2026/02/10/g...

New: India is extending Aadhaar into mobile wallets, hotels, and offline verification. But as the world's largest ID system grows more ubiquitous, questions about consent, security, and oversight remain. techcrunch.com/2026/02/09/i...

Ring is a wildly dangerous company. Always has been. But it has sort of flown under the radar the last couple years as it tried to soften its image. Make no mistake that this is an extremely dangerous surveillance dragnet: www.404media.co/with-ring-am...

NEW: A hacktivist scraped than half a million payment records from a stalkerware and consumer surveillance tech maker, exposing customers' email addresses and partial card numbers. The hackvisit told us they did it because they think these companies are "creepy."

This is incredible.

Had to blog about digital de-aging, the original Jurassic Park, and why nobody seems to ask themselves "hey, is this going to look good when we do it?" aftermath.site/jurassic-par...

I’m mad that he didn’t say anything during the superbowl show.

“With Amazon’s role in ICE ops under greater scrutiny and Bezos’ dismantling of the organ that once proudly declared itself on being a defender of democracy, it’s worth examining how close Amazon and Trump are—& how closely aligned their projects are” www.bloodinthemachine.com/p/how-jeff-b...

New, by me: I wrote some words for TechCrunch about Sen. Ron Wyden's recent unclassified letter to the CIA director, citing his "deep concerns" about the agency's activities. This isn't the first time Wyden has sounded his "siren" — and history tells us why this new letter is likely a big deal.

Taking care of one's digital security as a freelancer is not easy. And Runa is one of the best in the business of protecting journalists. You should take advantage of this opportunity.

If you've been laid off by the Washington Post this week and have any questions re: digital security, please email me on [email protected]. I'll help you pro-bono for the rest of the month.

NEW: In a new report, Norway says China's Salt Typhoon compromised several organizations in the country with the goal of espionage. The country did not name the victims. techcrunch.com/2026/02/06/c...

NEW: An alleged ransomware attack has taken the computer systems of one of the largest universities in Europe offline for three days. La Sapienza university in Rome is still working to restore the systems, and the hackers behind the attack are reportedly a new ransomware gang called Femwar02.

NEW: Govtech giant Conduent says a 2025 data breach now affects far more people than first disclosed, with the number of victims who had personal and medical data stolen stretching to tens of millions of people across the United States. Conduent says its business supports 100+ million people.

NEW: The notorious cybercrime gang ShinyHunters claimed responsibility for last year's data breaches at Harvard University and University of Pennsylvania. The hackers also published some stolen personal information from the two schools, saying the universities refused to pay a ransom.

Media layoffs are always infuriating but the ones happening today at WaPo are especially enraging.

I wrote some words for TechCrunch about how Homeland Security is using administrative subpoenas, which aren't subject to judicial oversight, to seek data from tech giants about Trump critics and anonymous accounts of ICE trackers. Featuring really great reporting by Bloomberg & Washington Post.

NEW: French Police searched the local X offices as part of a criminal investigation for several crimes, including possession and distribution of child sexual abuse material. Paris prosecutor's office also announced that it summond Elon Musk and former X CEO Linda Yaccarino for questioning.

NEW: NSO tried to hijack the Pall Mall Process to whitewash their reputation in the midst of ongoing Pegasus abuses. France & UK govs leading the process say: "Not so fast!" Submitting comments ≠ participation/compliance! By @suzannesmalley.bsky.social therecord.media/spyware-make...

I know the Grammys are dumb in general, but giving "Best Metal Performance" to Turnstile is so so fucking dumb. Who in their right mind would classify anything Turnstile has ever done as "metal"?

Tensions ran high during the 33rd hearing of 🇬🇷Greece’s wiretappings trial, as defense lawyers challenged the inclusion of documents detailing surveillance products marketed by Intellexa. The court ultimately rejected the objections. www.dnews.gr/eidhseis/new...

hate to be that guy, but today brings yet another reminder of why everyone should stop posting on the elon musk platform

NEW: An informant told the FBI in 2017 that Jeffrey Epstein had a "personal hacker," according to a document released today. The document does not name the hacker, but says he is Italian, developed and sold zero-days (iOS and Blackberry) to governments such as the U.K. and the United States.

NEW: Russian government hackers were able to break into parts of Poland's energy infrastructure thanks to default usernames and passwords and no multi-factor authentication, the Polish government said in a report. facepalm.gif techcrunch.com/2026/01/30/r...

The internet can still be a good place sometimes.

Oh...🤔 www.haaretz.com/israel-news/...

New: Fintech firm Marquis, used by hundreds of banks & credit unions across the U.S., told its customers that it plans to seek compensation from its firewall provider SonicWall after blaming the company for a breach that allowed hackers to steal tons of people's personal and financial data & SSNs.

TIL Skype was once owned by eBay. www.cnet.com/tech/tech-in...

NEW, by me: A security and privacy feature rolled out to select models of the latest iPhones and iPads this week will make it more difficult for law enforcement, spies, and malicious hackers to obtain a person's precise location data from their phone provider.

Jon is joined by @josephcox.bsky.social and @radleybalko.bsky.social to discuss Palantir's advanced targeting technology and how federal agencies like ICE are using it.

If you take OPSEC advice from Elon Musk and Pavel Durov, good luck, you're basically screwed. I wouldn’t trust those two to make me a coffee with a Nespresso machine, let alone help me stay secure online.

NEW: After Apple launched Lockdown Mode years ago, and Google released its own special security feature for Android last year, WhatsApp now offers a new mode for users at high risk of being targeted with spyware. It's called Strict Account Settings and enables certain restrictions to protect users.

Vas has tirelessly and constantly followed virtually every story related to government spyware that is developing in any corners of the world. I don't know how he can keep up with everything that's happening in that world, but I am glad he does.

A number of Washington Post journalists asked for tips from government workers last year and posted their personal phone numbers for @signal.org. Please know that Signal allows you to create a username, meaning you can keep your phone number private. signal.org/blog/phone-n...

NEW: Microsoft handed the FBI the recovery keys to decrypt the hard drives of three laptops encrypted with BitLocker. BitLocker is enabled by default in modern Windows laptops, but Microsoft also prompts users to upload the recovery keys to the company's cloud, which opens up this possibility.

25 days later, White Date is still down.

Spanish judge closes probe into NSO in wake of Pegasus hack of several govt officials, incl the PM. Court says Israel ignored five requests for information and probe can't proceed as a result. NSO has historically been shielded from accountability by the Israeli govt therecord.media/spanish-judg...

NEW: Ireland is working on a law to regulate the use of spyware by the police. There's no details yet, but the Irish government promises to balance the need to fight serious crime with spyware, with the need to respect privacy and human rights. techcrunch.com/2026/01/22/i...

New, by me: Under Armour says it’s aware of data breach claims after 72M customer records were posted online. A spox. told me a "small percentage" of customers had sensitive information compromised but wouldn't say what it considers "sensitive," nor provide an accurate figure of affected customers.

So…is the PS5 Pro worth the extra $$$ or should I just get the normal one?

*pinches bridge of nose and sighs heavily* These utter fuckwits have returned with the *same* phishing campaign on the *same* burned infrastructure and leaking the same data, which leads me to think that it's probably Iranian intelligence after all. My writeup from last week with more details:

NEW: Two members of Elon Musk’s Department of Government Efficiency (DOGE) who were working at the Social Security Administration may have shared SSNs to help an advocacy group that had the aim "to overturn election results in certain States," according to a court document.

Last year, a member of the Spanish parliament sent a letter to the government asking what it thinks about the fact that there are several Israeli offensive cybersecurity folks in Barcelona working on spyware, and whether the government wants to do anything about it. www.congreso.es/entradap/l15...

These are good pieces on the alleged U.S. cyberattack against the Venezuelan power grid. It seems that for now the skepticism is warranted until we get more details and some independent confirmation from threat intelligence/infrastrucure researchers. 1) This Linkedin post by @metacurity.com

A new this.weekinsecurity.com is out, featuring stories on: FBI raiding WaPo reporter's home; Iran's internet shutdown passes one week; Flock flucked up license plate redactions; millions of headphones at risk of eavesdropping; a ton of max 10.0 bugs; that Venezuela "cyberattack," and much more.

Trying to protect everything from everyone all the time is a good way to drive yourself crazy. This is why we threat model. Here is EFF's Surveillance Self Defense guide to putting together your security plan, also known as threat modeling: ssd.eff.org/module/your-...

NEW: Nicholas Moore, a hacker who broke into the systems of the U.S. Supreme Court and the Department of Veteran Affairs stole the personal data of victims and then posted it online on his @ihackthegovernment Instagram account. Moore faces a maximum of a year in prison and a fine of up to $100,000.

NEW: A hacking campaign targeted high-profile Gmail and WhatsApp users across the Middle East this week. I obtained a copy of the phishing page & analyzed it with the help of experts. The page stole passwords, hijacked WhatsApp accounts, and took location data. A bug also *exposed* victims' data.

New: meet ELITE, the Palantir app ICE is using to find neighborhoods to raid. Map interface; officers search for immigrants; click person to bring up individual dossier. This is clearest link between what Palantir is building and ICE's activities on the ground yet www.404media.co/elite-the-pa...

NEW: Iran is entering its second week (170 hours and counting) of a nationwide internet blackout, now one of the longest in history. The ongoing shutdown is helping the Iranian authorities hide their brutal crackdown on protesters, which has killed more than 2,000 people according to one estimate.