Spoke to @lorenzofb.bsky.social last week about settings that help you defend against sophisticated spyware on Android, iOS, Gmail, and WhatsApp. Includes Lockdown Mode, Advanced Protection Program, Advanced Protection Mode, and Strict Account Settings. techcrunch.com/2026/05/23/y...

Crazy to think that while Snowden and I taught people to keep their data safe with TrueCrypt, the tool's alleged creator Paul Le Roux was busy plotting murders, buying meth by the North Koreans, and helping the Colombians set up their own meth lab. www.penguinrandomhouse.com/books/549566...

My latest for Journalist and Spy: Louis Budenz was an American journalist and communist spy. A member of the Communist Party USA, he shared gossip with Soviet intelligence. He later renounced communism and debriefed the FBI on the party's inner workings. www.journalistandspy.com/p/louis-budenz

Curious to see what happens to the Hungarian media landscape following the end of Orbán’s regime. So far, employees with state media orgs have fired prominent staff; expressed a desire to host guests opposing Orbán; and demanded editorial impartiality. www.cjr.org/analysis/hun...

Journalists reporting on China should be aware of ways the authorities may respond to their work. Here's what happened to @icij.org and its network following a 2025 exposé on Beijing’s tactics to threaten, coerce and intimidate regime critics overseas. www.icij.org/investigatio...

I’ll be in Oslo next month! I’ve got extra time for security assessments; policy / process design; and presentations, please reach out if you’d like to work together.

Iranian journalists in London “say they fear for their lives after a recent spate of threats and physical attacks,” and I’m willing to bet the regime is leveraging digital attacks against critics too. www.theguardian.com/global-devel...

Updated my post about journalist and spy Vicky Peláez yesterday to include some quotes from @gordoncorera.bsky.social’s book, including that the FBI listened in as she discussed Moscow’s feedback on her husband’s intelligence reports. www.journalistandspy.com/p/vicky-pelaez

Have there been any cases in Denmark or Sweden where the authorities have gained access to a journalist’s device using Touch ID or Face ID? Ref: the FBI and WaPo in January.

An investigation by journalists with NRK in Norway and SVT in Sweden found that a multimillion-dollar, prestige ferry project in Lofoten, Norway relies on hydrogen fuel cell technology that "cannot live up to what it promises." www.nrk.no/trondelag/xl...

Apple’s Lockdown Mode feature is the best defense we have against spyware on iOS, macOS, watchOS, and iPadOS. Apple launched the feature four years ago and has not yet seen a device with Lockdown Mode on be compromised. techcrunch.com/2026/03/27/a...

We still don't know if Trenchant and L3Harris notified Apple once it learned its iPhone-hacking toolkit had been stolen/leaked. The toolkit was later used to target people in China and Ukraine. techcrunch.com/2026/03/09/a...

Nomma Zarubina, who once drunk-texted an FBI agent saying "Catch me baby. So many spies," is heading to U.S. prison for spying for Russian intelligence. www.occrp.org/en/news/russ...

Huge win for Hannah Natanson and the Washington Post today: the judge ruled that the government cannot search the devices they seized from her. www.washingtonpost.com/national-sec...

A new investigation from @amnesty.org found that a journalist in Angola was targeted with Predator spyware in 2024. We also know that @citizenlab.ca found links to Predator infrastructure in Angola in 2023, and links to FinFisher infrastructure in 2015. www.amnesty.org/en/latest/ne...

Latest research from @citizenlab.ca shows @cellebrite.bsky.social tech used for human rights abuse in Kenya. Imagine if the company spent more time discussing who *not* to sell to. citizenlab.ca/research/cel...

Two years ago, a Norwegian researcher skeptical that pulsed-energy weapons could do damage to human brains — aka “Havana syndrome” — built a device and tested it on himself. It didn’t go well. Someone from FFI, perhaps? www.washingtonpost.com/national-sec...

Decided to try Claude by revisiting a malware analysis project that I originally presented at OBTS in 2021: the CIA's OS X implant called Green Lambert. It's amazing what you can do with a terminal and ~15 min of free time these days.

Former exec at exploit development firm Trenchant, owned by L3Harris, admitted to selling internal hacking tools to a Russian broker. Did the company notify the vendors whose products were exploited so that they could be patched? techcrunch.com/2026/02/11/d...

Russia’s Sandworm is back in the news, having recently been linked to the late December attack on Poland’s power grid. I recommend reading @agreenberg.bsky.social's work on the hacking group, starting with these WIRED articles and his 2019 book. www.wired.com/story/sandwo...

If you've been laid off by the Washington Post this week and have any questions re: digital security, please email me on [email protected]. I'll help you pro-bono for the rest of the month.

We’ve heard a lot about use of AI to clone the voices of celebrities, execs, and politicians. Here’s a @defcon.bsky.social talk from @helicoptersofdc.bsky.social about cloning the voices of air traffic controllers to give false instructions to pilots. www.youtube.com/watch?v=JKwx...

The FBI has so far been unable to get into Washington Post reporter Hannah Natanson’s iPhone because it’s using Lockdown Mode — one of my favorite iOS features. You can turn it on for iPadOS, macOS, and watchOS too! www.404media.co/fbi-couldnt-...

Epstein was a New York Times subscriber; in 2017 he received an invite to the first CryptoParty my colleagues and I organized in New York. I've got no memory of him attending, though. www.justice.gov/epstein/file...

The old phone number for Norway’s crown princess is in the Epstein files. That number now belongs to a 14yo girl in Stavanger who says she’s receiving creepy calls and messages. I’m surprised the provider recycled the number and didn’t just archive it. www.dagbladet.no/nyheter/stav...

Between June and December 2025, a “likely Chinese state-sponsored group” compromised the infrastructure used by Notepad++ and served malicious updates to selectively targeted users. notepad-plus-plus.org/news/hijacke...

ProPublica names the two federal immigration agents who fired on Minneapolis protester Alex Pretti last weekend: Jesus Ochoa and Raymundo Gutierrez. www.propublica.org/article/alex...

I helped design and implement the secure tip line at the New York Times in 2016. Who can access what, when, where, and how is just as important as the specific apps, tools, and settings that are used. www.nytimes.com/2017/03/02/i...

New court record from the FBI details the state of the devices seized from Washington Post reporter Hannah Natanson: phone was on w/Lockdown Mode; personal laptop was off; work laptop was on w/Touch ID; several Signal chats used disappearing messages. storage.courtlistener.com/recap/gov.us...

Police in Norway are investigating an Italian company suspected of installing high-end FLIR cameras on a rooftop overlooking Melkøya, the endpoint of the pipeline for natural gas from the Barents Sea. www.nrk.no/tromsogfinnm...

Journalism is not a crime. www.cnn.com/2026/01/30/p...

Apple’s new iPhone security feature limits cell networks from collecting precise location data, but appears to have very limited support in the U.S. at the moment. Here’s to hoping all the big carriers get on board too. techcrunch.com/2026/01/29/a...

I’ll be in Copenhagen, Barcelona, and Madrid in March! I’ve got some extra time for security assessments; policy and process things; and presentations, so please get in touch if you’d like to work together.

Powerful new features announced by WhatsApp today to defend against sophisticated spyware. Includes the ability to block attachments and media from people not in your contact list. cyberscoop.com/whatsapp-str...

According to the DOJ, Hannah Natanson and the Washington Post published “at least five articles that contained classified information Perez-Lugones provided.” A review shows all five articles, published October 2025 - January 2026, were about Venezuela. www.justice.gov/usao-md/pr/m...

A number of Washington Post journalists asked for tips from government workers last year and posted their personal phone numbers for @signal.org. Please know that Signal allows you to create a username, meaning you can keep your phone number private. signal.org/blog/phone-n...

Given how aggressively the government has pursued Hannah Natanson and the Washington Post, it would not surprise me if Google and Proton also received subpoenas for access to her accounts.

Here are the items the FBI seized from Washington Post reporter Hannah Natanson: a recorder, two laptops, an external drive, a smart watch, an iPhone. Her December article mentioned that she stored notes “in an encrypted drive,” likely Proton Drive ref: her Jan 20 declaration.

A “chronic lack of cooperation from the Israeli authorities” has forced Spain’s highest criminal court to shelve its investigation into use of Pegasus against Spanish ministers, inc. the prime minister. Cases uncovered by @citizenlab.ca go back to 2021. www.theguardian.com/world/2026/j...

If you store your BitLocker key with Microsoft, Microsoft can and will hand the key over to law enforcement in response to valid court orders. www.forbes.com/sites/thomas...

I know people are looking for digital security guides and checklists in light of the FBI seizing devices of a Washington Post reporter. Here’s a guide I wrote for @gijn.org in 2024, which remains up to date and relevant. gijn.org/resource/int...

I started Granitt in 2022 to help journalists and other groups of at-risk people continue to do their work safely and securely. Please get in touch if you’re looking for an assessment, policy and process development, training, or presentation. techcrunch.com/2022/07/15/g...

Spoke to @zackwhittaker.com about a hacking campaign targeting high-profile Gmail and WhatsApp accounts across the Middle East, found by @nariman.bsky.social earlier this week. Gharib believes the campaign is linked to Iran, TechCrunch was unable to attribute it. techcrunch.com/2026/01/16/h...

The home of Hannah Natanson, a Washington Post reporter, was searched by the FBI. Her devices were seized. I spoke to @columjournreview.bsky.social about the potential damage and what news organizations need to know. www.cjr.org/news/hannah-...

61 flights, 7 new countries, 1 around-the-world trip. Can’t wait to see what 2026 brings.

Excited to be running a workshop on digital security and source protection for investigative journalists in Sweden next year! More info👇 for those who are local.

My latest for Journalist and Spy: Mikhail Vasenkov was a news photographer, professor, and Russian spy. Part of the Illegals Program and arrested by the FBI in 2010. After he died in 2022, the SVR said he helped obtain "valuable political information." www.journalistandspy.com/p/mikhail-va...

I always love seeing what journalism students pull off with the right training and support. This team tracked Russian vessels in Europe and connected them to drone swarms over military bases. www.digitaldigging.org/p/they-drone...

I’ve been told that according to Bjørn Hallstrøm, the computer system used to communicate with his handlers at the CIA in the 1980s/1990s was called “Shamrock.” Does this sound familiar to anyone? www.journalistandspy.com/p/bjrn-halls...

Me in Spain on a random Sunday.