Nomma Zarubina, who once drunk-texted an FBI agent saying "Catch me baby. So many spies," is heading to U.S. prison for spying for Russian intelligence. www.occrp.org/en/news/russ...

Huge win for Hannah Natanson and the Washington Post today: the judge ruled that the government cannot search the devices they seized from her. www.washingtonpost.com/national-sec...

A new investigation from @amnesty.org found that a journalist in Angola was targeted with Predator spyware in 2024. We also know that @citizenlab.ca found links to Predator infrastructure in Angola in 2023, and links to FinFisher infrastructure in 2015. www.amnesty.org/en/latest/ne...

Latest research from @citizenlab.ca shows @cellebrite.bsky.social tech used for human rights abuse in Kenya. Imagine if the company spent more time discussing who *not* to sell to. citizenlab.ca/research/cel...

Two years ago, a Norwegian researcher skeptical that pulsed-energy weapons could do damage to human brains — aka “Havana syndrome” — built a device and tested it on himself. It didn’t go well. Someone from FFI, perhaps? www.washingtonpost.com/national-sec...

Decided to try Claude by revisiting a malware analysis project that I originally presented at OBTS in 2021: the CIA's OS X implant called Green Lambert. It's amazing what you can do with a terminal and ~15 min of free time these days.

Former exec at exploit development firm Trenchant, owned by L3Harris, admitted to selling internal hacking tools to a Russian broker. Did the company notify the vendors whose products were exploited so that they could be patched? techcrunch.com/2026/02/11/d...

Russia’s Sandworm is back in the news, having recently been linked to the late December attack on Poland’s power grid. I recommend reading @agreenberg.bsky.social's work on the hacking group, starting with these WIRED articles and his 2019 book. www.wired.com/story/sandwo...

If you've been laid off by the Washington Post this week and have any questions re: digital security, please email me on [email protected]. I'll help you pro-bono for the rest of the month.

We’ve heard a lot about use of AI to clone the voices of celebrities, execs, and politicians. Here’s a @defcon.bsky.social talk from @helicoptersofdc.bsky.social about cloning the voices of air traffic controllers to give false instructions to pilots. www.youtube.com/watch?v=JKwx...

The FBI has so far been unable to get into Washington Post reporter Hannah Natanson’s iPhone because it’s using Lockdown Mode — one of my favorite iOS features. You can turn it on for iPadOS, macOS, and watchOS too! www.404media.co/fbi-couldnt-...

Epstein was a New York Times subscriber; in 2017 he received an invite to the first CryptoParty my colleagues and I organized in New York. I've got no memory of him attending, though. www.justice.gov/epstein/file...

The old phone number for Norway’s crown princess is in the Epstein files. That number now belongs to a 14yo girl in Stavanger who says she’s receiving creepy calls and messages. I’m surprised the provider recycled the number and didn’t just archive it. www.dagbladet.no/nyheter/stav...

Between June and December 2025, a “likely Chinese state-sponsored group” compromised the infrastructure used by Notepad++ and served malicious updates to selectively targeted users. notepad-plus-plus.org/news/hijacke...

ProPublica names the two federal immigration agents who fired on Minneapolis protester Alex Pretti last weekend: Jesus Ochoa and Raymundo Gutierrez. www.propublica.org/article/alex...

I helped design and implement the secure tip line at the New York Times in 2016. Who can access what, when, where, and how is just as important as the specific apps, tools, and settings that are used. www.nytimes.com/2017/03/02/i...

New court record from the FBI details the state of the devices seized from Washington Post reporter Hannah Natanson: phone was on w/Lockdown Mode; personal laptop was off; work laptop was on w/Touch ID; several Signal chats used disappearing messages. storage.courtlistener.com/recap/gov.us...

Police in Norway are investigating an Italian company suspected of installing high-end FLIR cameras on a rooftop overlooking Melkøya, the endpoint of the pipeline for natural gas from the Barents Sea. www.nrk.no/tromsogfinnm...

Journalism is not a crime. www.cnn.com/2026/01/30/p...

Apple’s new iPhone security feature limits cell networks from collecting precise location data, but appears to have very limited support in the U.S. at the moment. Here’s to hoping all the big carriers get on board too. techcrunch.com/2026/01/29/a...

I’ll be in Copenhagen, Barcelona, and Madrid in March! I’ve got some extra time for security assessments; policy and process things; and presentations, so please get in touch if you’d like to work together.

Powerful new features announced by WhatsApp today to defend against sophisticated spyware. Includes the ability to block attachments and media from people not in your contact list. cyberscoop.com/whatsapp-str...

According to the DOJ, Hannah Natanson and the Washington Post published “at least five articles that contained classified information Perez-Lugones provided.” A review shows all five articles, published October 2025 - January 2026, were about Venezuela. www.justice.gov/usao-md/pr/m...

A number of Washington Post journalists asked for tips from government workers last year and posted their personal phone numbers for @signal.org. Please know that Signal allows you to create a username, meaning you can keep your phone number private. signal.org/blog/phone-n...

Given how aggressively the government has pursued Hannah Natanson and the Washington Post, it would not surprise me if Google and Proton also received subpoenas for access to her accounts.

Here are the items the FBI seized from Washington Post reporter Hannah Natanson: a recorder, two laptops, an external drive, a smart watch, an iPhone. Her December article mentioned that she stored notes “in an encrypted drive,” likely Proton Drive ref: her Jan 20 declaration.

A “chronic lack of cooperation from the Israeli authorities” has forced Spain’s highest criminal court to shelve its investigation into use of Pegasus against Spanish ministers, inc. the prime minister. Cases uncovered by @citizenlab.ca go back to 2021. www.theguardian.com/world/2026/j...

If you store your BitLocker key with Microsoft, Microsoft can and will hand the key over to law enforcement in response to valid court orders. www.forbes.com/sites/thomas...

I know people are looking for digital security guides and checklists in light of the FBI seizing devices of a Washington Post reporter. Here’s a guide I wrote for @gijn.org in 2024, which remains up to date and relevant. gijn.org/resource/int...

I started Granitt in 2022 to help journalists and other groups of at-risk people continue to do their work safely and securely. Please get in touch if you’re looking for an assessment, policy and process development, training, or presentation. techcrunch.com/2022/07/15/g...

Spoke to @zackwhittaker.com about a hacking campaign targeting high-profile Gmail and WhatsApp accounts across the Middle East, found by @nariman.bsky.social earlier this week. Gharib believes the campaign is linked to Iran, TechCrunch was unable to attribute it. techcrunch.com/2026/01/16/h...

The home of Hannah Natanson, a Washington Post reporter, was searched by the FBI. Her devices were seized. I spoke to @columjournreview.bsky.social about the potential damage and what news organizations need to know. www.cjr.org/news/hannah-...

61 flights, 7 new countries, 1 around-the-world trip. Can’t wait to see what 2026 brings.

Excited to be running a workshop on digital security and source protection for investigative journalists in Sweden next year! More info👇 for those who are local.

My latest for Journalist and Spy: Mikhail Vasenkov was a news photographer, professor, and Russian spy. Part of the Illegals Program and arrested by the FBI in 2010. After he died in 2022, the SVR said he helped obtain "valuable political information." www.journalistandspy.com/p/mikhail-va...

I always love seeing what journalism students pull off with the right training and support. This team tracked Russian vessels in Europe and connected them to drone swarms over military bases. www.digitaldigging.org/p/they-drone...

I’ve been told that according to Bjørn Hallstrøm, the computer system used to communicate with his handlers at the CIA in the 1980s/1990s was called “Shamrock.” Does this sound familiar to anyone? www.journalistandspy.com/p/bjrn-halls...

Me in Spain on a random Sunday.

It’s been a year since I wrote this guide for @gijn.org on security best practices for investigative journalists, all of which is still very accurate. Check it out if you haven’t, consider reviewing if it’s been a while. gijn.org/resource/int...

My latest for Journalist and Spy: Pablo González, Russian-Spanish journalist, alleged GRU agent. Wrote for EU + U.S. media, @drewhinshaw.bsky.social & Joe Parkinson say he began working for GRU in 2010. Arrested in Poland in '22, swapped with Russia in '24. www.journalistandspy.com/p/pablo-gonz...

Igor Rogov, who claimed to be a Russian opposition activist when he was arrested in Poland last summer, "has admitted he worked as an undercover agent" for the FSB and "informed on other opposition figures." Rogov is due to go on trial next month. www.theguardian.com/world/2025/n...

If you're not familiar with Masih Alinejad's work and the story of how the Iranian government paid two Russian men $500,000 to kill her in 2022, I recommend reading this piece. The men were sentenced to 25 years in prison in a New York courtroom yesterday. www.theguardian.com/us-news/2025...

Peter Williams, former exec at Trenchant, has pleaded guilty to two counts of stealing trade secrets and selling them to a Russian broker. Williams "even agreed to provide three months’ worth of support or software updates to the products he sold." www.wired.com/story/peter-...

Been a while since we heard from Memento Labs / Hacking Team! This time a government client was caught using an “outdated version of the Windows spyware” and the CEO is “not sure which of the company’s customers were caught.” techcrunch.com/2025/10/28/c...

iOS with Lockdown Mode is still the best defense we have against sophisticated spyware. Here's a snippet from @micahflee.com's keynote at @bsidespdx.bsky.social a few days ago. micahflee.com/practical-de...

Exploit development shop Trenchant, owned by L3Harris, lost a bunch of internal tools in a “damaging leak” recently. A former employee was targeted with spyware, he claims the company designated him as a scapegoat. This should be bigger news, imo. techcrunch.com/2025/10/21/a...

My latest for Journalist and Spy: Bjørn Hallstrøm is a Norwegian TV producer and self-proclaimed spy. He says CIA in 80s-90s asked him to infiltrate groups in Afghanistan, Colombia, Cuba, Kuwait, Libya, and funded shows he sold to media in the Nordics. www.journalistandspy.com/p/bjrn-halls...

I’ve followed various coverage of Havana Syndrome over the years; still interesting to hear what @jenniferpforde.bsky.social and @bungey.bsky.social uncovered in their podcast ‘Havana Helmet Club’ (and I loved ‘West Cork’ from a few years ago). www.bbc.com/audio/brand/...

Been really enjoying this new book about Gunvor Galtung Haavik, a nurse turned secretary for the Norwegian MoFA in Moscow — and KGB spy for 30 years. The KGB used her to get closer to Americans, including Marion Peacock, Lloyd Eddenfield, Bernie G. Britain, and Roy Rhodes.

I’m very excited to discuss journalism and source protection at the @gijn.org conference in Kuala Lumpur next month, alongside @sandrine-rigaud.bsky.social, @thesignalsnetwork.bsky.social, @pm-arnaud.bsky.social, and @paulradu.bsky.social. gijn.org/stories/gijc...