I.

I can’t say I’m surprised to learn that spyware maker Paragon “has no technical way to know if customers misuse its software” or a way “to disable customers when misuse occurs” either. And rather than investigate allegations of misuse by Italy in 2025, the company cancelled the two contracts it had with the country’s domestic and foreign intelligence service. Citizen Lab confirmed two journalists and two activists were targeted.

Paragon says its spyware “system is rendered ineffective in about 12 hours” without essential system updates. But in another case, Citizen Lab found that Russia used Cellebrite – a different tool – to extract information from an activist’s phone after the company had cancelled the contract. So if there’s a will, there’s a way.

II.

I spoke to RFE/RL for an article on Oxygen Forensics, the digital forensics firm which allegedly concealed its Russian ownership from U.S. authorities. Russian ownership does not mean the company is doing anything suspicious… but legitimate companies typically do not structure themselves the way Oxygen Forensics has done.

III.

I’ll be in London later this month to speak about journalism security and source protection ahead of CIJ’s Logan Symposium! If you’re in town and want to learn more about the rise of London’s private intelligence industry, I highly recommend you grab yourself a ticket to the Symposium.

IV.

Friday is a publicly available, searchable archive of declassified Cold War documents on Soviet espionage. Looks like a fantastic resource for my future Journalist and Spy posts.

I.

More than 50 years after D.B. Cooper parachuted out of a commercial airplane with a bag full of cash, there’s now a lawsuit asking the court to force the FBI to disclose its records in the case. Kudos to Court Watch for finding the court filing.

II.

A former member of Pussy Riot recently shared that she’d been recruited by Russia’s FSB security service and cooperated with the agency for three years. In her first media interview since fleeing Russia, Rita Flores describes blackmail, death threats, and the agency tasking her to help kidnap and murder a Kremlin enemy.

III.

I signed up for an introductory flight lesson with American Flyers and got to fly a single engine Piper Pilot around Morristown, NJ yesterday! You can track the entire 30-minute flight on Flightradar24. (Oh, and I did a barrel roll in the simulator too.)

IV.

The U.S. Justice Department is going after Oxygen Forensics, a top firm in the digital forensics space, for concealing that it’s owned and operated by Russians. Up until last week, Oxygen Forensics worked with numerous EU and U.S. agencies, including the IRS, DHS, and the Justice Department. What puzzles me is how these agencies vetted Oxygen Forensics. The company’s Russian ownership was reportedly an open secret, something journalist Kim Zetter wrote about in 2016.

I.

Aircraft communications are susceptible to interception, interference, spoofing, and jamming. A new report by the U.S. Government Accountability Office, published earlier this week, says the Federal Aviation Administration “may not have sufficient information to identify, prioritize, and respond to” such threats. The report makes nine recommendations to improve security, which the FAA says it agrees with.

II.

At the DEF CON security conference in 2025, Andrew Logan highlighted how AI can be used to impersonate air traffic controllers and issue false clearance commands. It’s unclear if the recommendations from the GAO are related to his presentation, though they’re likely aware of it.

III.

Austin Tice, a U.S. Marine turned war correspondent, was abducted in Syria in 2012. He has yet to be found. A YouTube video published that same year shows Tice bound, blindfolded, and surrounded by armed men. Journalists and researchers have tried to geolocate the video for years — and they’ve now succeeded. Here’s an incredible step-by-step thread on X from Thomas Bordeaux with CNN. This week’s podcast episode of “Where is Austin Tice?” covers the video in more detail.

IV.

In last week’s newsletter, I noted that “most people likely don’t consider that other humans can read their [AI] chats” and there’s a “need for user awareness and control.” I’m thrilled to see that Andy Greenberg has written a guide for WIRED on how to use AI with your privacy intact.

I.

I’m exploring the Faroe Islands this week! Think charming villages and breathtaking scenery; a bit like Iceland, but with fewer people; Scandinavian waffles and so many rainbows. I’m posting plenty of photos and stories on Instagram.

II.

404 Media reported on OpenAI’s practice of hiring contractors to read “a massive stream of real users’ ChatGPT prompts … to improve the responses ChatGPT gives to its users.” The problem is that prompts often include sensitive personal information, despite the company’s efforts to anonymize them. I’d argue most people likely don’t consider that other humans can read their chats. OpenAI’s “improve the model for everyone” setting is enabled by default, but you can turn it off. (Anthropic does this too, by the way.)

III.

I spoke to Alfred Ng at Politico about AI, privacy, and the need for user awareness and control. Just like Anthropic and OpenAI can do more to help people understand how model improvement works, Meta can do more to help people understand where its AI gets information from.

IV.

I spoke to first year journalism students at New York University last week. In addition to practical security steps and threat modeling, we also discussed the FBI’s January raid on a Washington Post reporter’s home; the Trump administration attempting to subpoena three New York Times reporters in June; and WhatsApp’s Strict Account Settings for enhanced security.

V.

Ethel and Julius Rosenberg were convicted and executed by the U.S. government in 1953 for passing atomic bomb secrets to the Soviet Union during the Cold War. The couple left behind two young sons, ages 6 and 10. A longread in The Atlantic tells the story of Robby and Michael, now 79 and 83, who are still trying to make sense of what happened.

I.

Austin Tice, a U.S. Marine turned war correspondent, was abducted in Syria 14 years ago. A lot has changed in the country since then, but Tice has yet to be found. A new podcast series from the BBC and NPR takes a closer look at his work, disappearance, and potential new clues.

II.

I really enjoyed this podcast interview with Olympic champion freestyle skier Eileen Gu on On Purpose with Jay Shetty. Gu and Shetty discuss mindset, personal growth, her athletic career, and winning mantra: “I train like I’ve never won, and I compete like I’ve never lost.”

III.

A group of U.S. lawmakers has (finally) asked the U.S. government to ban several hack-for-hire firms they say operate “at the behest of the Qatari government.” TechCrunch reported that “one of the companies, Appin, previously [in 2023] secured a global court order from an Indian court forcing Reuters to take down its reporting on the company while Reuters appealed the order.” The order was lifted a year(!) later and Reuters republished the report.

I.

If you’re feeding ACARS messages to Airframes, know that the website appears to have a bug and does not currently honor the privacy settings you have applied to your profile. I created an account last week, after setting up a Raspberry Pi with two Airspy receivers to feed the ACARS Drama project, but paused once I realized my privacy settings were not sticking. I’ve tried to get in touch with Airframes via email, X, and Discord, but have yet to hear back.

II.

In more fun news, adsb.win has turned aircraft tracking into a game with collections, milestones and friendly competition. Feeding ADS-B data gives you access to the API, just like FlightAware and Flightradar24. (If you want to buy a flight tracker starter kit, check out PiAware.)

III.

Here’s another interesting presentation from the Hackers On Planet Earth conference in NYC last month: Jon Thompson demonstrated how North Korean citizens, along with a network of defectors and technologists, are circumventing censorship and surveillance using sneakernets, smuggled phones, and purpose-built tools.

IV.

Bellingcat spent more than a year investigating a decades-old cold case using open sources, freedom-of-information requests, newspaper archives, and interviews with investigators who worked on the case. Great read if you like investigative journalism, open source intelligence, and solving puzzles.

V.

A few years ago, I binged a podcast, articles, and a documentary about the mysterious death of an unidentified woman in Isdalen near Bergen, Norway in 1970. The police investigation turned up abandoned suitcases, coded notepads, and multiple identities. Some wondered if she’d been a Cold War spy. Records that I obtained from the FBI through FOIA show that the police in Oslo requested assistance in identifying the unmarked cosmetics found in the woman’s suitcase. The FBI interviewed employees at department stores in New York and Washington, D.C., but without getting any clear answers. You can read more about the documents and see the cosmetics here.

I.

After four days of indoor skydiving in Europe last week, my flight from Milan to New York with Emirates was diverted to Boston due to heavy rain, flash floods, and strong winds. There was even a tornado warning in effect for parts of the city. So I did what any respectable aviation geek would do: I set out to see just how much I could learn about flight EK 205 from publicly available sources.

Flightradar24 shows EK 205 performing a go-around at ~1,300 ft. LiveATC captured a Delta pilot reporting a go-around due to wind shear moments before Emirates. ATC then asked Emirates if the pilots wanted to try again. After a brief standby, Emirates requested to proceed to Boston as its alternate destination. Mike Sheward of ACARS Drama and I tried to find ACARS messages from Emirates, without any luck.

According to Flightradar24, a total of 16 JFK-bound flights diverted that evening: 13 to other airports and 3 air-return to origin. EK 205 continued its journey from Boston to New York the next day. The A380 completed the trip in 46 minutes. I’m pretty sure we spent longer on the ground waiting for a gate than we did in the air. (Compare: the shortest scheduled Emirates A380 flights – BKK to HKG and DXB to JED – are around two hours.)

II.

Speaking of ACARS Drama, I set up a Raspberry Pi with two Airspy receivers so that I can feed the project and access the full message archive. I’ve already found a Cargolux pilot report that a kettle is broken, and another asking “AS WE ARE ALREADY LATE, DO WE NEED TO FLY.”

III.

A new Netflix documentary about Boeing paints a picture of a company contributing to its own decline. (I forgot the company tried to outsource the majority of the 787 Dreamliner to suppliers around the world, resulting in puzzle pieces that did not fit together.) For a deep dive on the issues with the 737 Max, check out this podcast or this 2022 documentary.

IV.

The Secret World of Roald Dahl, published in January, is a podcast series about the creator of Willy Wonka, Matilda and The BFG. The series explores how Dahl, a former fighter pilot and British spy, became one of the most successful children’s authors in history. The podcast also asks whether we can separate the art from the artist as it digs into Dahl’s personal history of making deeply antisemitic and controversial public statements.

I.

“An unprecedented number of Apple customers have reported receiving a recent threat notification,” and the good news is that we are getting better and better at detecting use of sophisticated spyware. If you’re concerned about spyware, turn on Apple’s Lockdown Mode feature.

II.

A bungled bomb plot in Poland two years ago exposed a spy, but whose spy was he? The story of Igor Rogov is one about the shadow world of intelligence games and sabotage plots, with the Russian FSB, Ukrainian intelligence, and opposition activists in exile.

III.

Last week’s Hackers On Planet Earth conference in NYC included a panel with journalists who received the leaked Epstein emails, preserved the files, and reported the story. You can view a video trimmed from the live feed or read the transcript here.

I.

What happens when a political movement built on conspiracy theories becomes the target of its own creation? Here’s the story of how the conspiracists that Charlie Kirk once amplified are now spinning theories about his killing. Brandy Zadrozny, who’s investigated disinformation for years, has found that the right is “willing to embrace conspiracy theories as a means to a political end.”

II.

A few months ago, a medevac plane with two pilots and two nurses crashed into the side of a mountain in New Mexico. There were no survivors. WIRED asked whether a military GPS jamming exercise was to blame, seeing how it left the pilots unable to use modern navigation systems. I think it’s sadly more likely all the holes in the Swiss cheese lined up: navigation disruptions, unfavorable weather conditions, pilots with fewer hours and less experience than at the big airlines, and a rush to get a medevac plane to its destination.

III.

The story of the JetBlue flight that went into free fall last year has nothing to do with GPS jamming and everything to do with space, science, and bit flips.

IV.

Speaking of science, security researchers found a way to hack a Boeing 737 using a “roughly coin-sized, Wi-Fi-enabled prototype device that costs less than $100.” The device is capable of sending new commands to sensitive computer systems on the plane, redirecting the autopilot or sabotaging its flight plan. I think the research is fascinating, but the key takeaway is perhaps this: “the researchers note that a careful pilot would be able to recover from almost any of the attacks they’ve imagined.”

V.

Here’s a long read, but a good one: a 21-year-old man in Seattle built a “replica of his hero Andrew Tate’s webcam enterprise”, a community of porn addicts joined forces to take him down. The White Knights, as they called themselves, went all in: “obtaining police records, pooling information, contacting the models’ parents, and eventually even talking to” the man behind the operation, before handing the evidence over to law enforcement.

VI.

I hosted a Reddit AMA with Zack Whittaker of TechCrunch yesterday! We answered numerous questions about US border searches, device security, and protecting your digital data. You can read all the questions and answers here.

I.

I’m hosting a Reddit AMA with Zack Whittaker of TechCrunch on r/pwnhub on Wednesday, August 12 at 5PM PT! Ask us anything about the American citizen charged with a felony for wiping his phone at the US border, device security, and protecting your digital data. See this announcement for more information. I’ll be posting as runasand_.

II.

China’s shadow war is an investigative podcast series from The Observer, published in late March, exploring transnational repression, state-backed intimidation, and covert operations conducted by the Chinese state in the UK and the US. I wrote about how China targets civil society abroad in 2023. Last year, ICIJ published an investigation into China’s sinister tactics based on interviews with more than 100 victims in 23 countries. In April, ICIJ reported that its journalists had been targeted by Chinese actors following the publication.

III.

Here’s a Google Map with a handful of restaurants, cafes, and ice cream shops I love in NYC. Let me know if you have a favorite spot I should add!

I.

I’ve been reading For the Sun After Long Nights about Iran’s 2022 Woman, Life, Freedom uprising by Fatemeh Jamalpour and former New York Times colleague Nilo Tabrizy. A beautifully written and powerful record of Iranian women’s resilience and strength against an oppressive regime.

II.

The U.S. Justice Department is prosecuting an American for allegedly wiping his GrapheneOS phone with a duress password during a border search. Zack Whittaker at TechCrunch has the full story here. As I told Zack, I’ve discussed the potential scenario with activists and journalists over the years, but this is the first time I’m seeing authorities bring charges in this way.

III.

Following the news that the Tate brothers were arrested in the U.S., I watched Louis Theroux: Inside the Manosphere on Netflix and read Heidi Blake’s New Yorker piece on Andrew Tate’s empire of abuse. I also found a one hour video of Tate talking about how he built his “pimping business” in the UK, including how he lies to, profits off of, and maintains financial control over women.

I.

Crazy to think that while Edward Snowden and I taught people to keep their data safe with TrueCrypt, the tool’s alleged creator Paul Le Roux was busy plotting murders, buying drugs from the North Koreans, and helping the Colombians set up their own meth lab. Evan Ratliff details Le Roux’s life as a criminal kingpin in The Mastermind – the U.S. sentenced him to 25 years in 2020. Turns out Lorenzo Franceschi-Bicchierai was right when he told me “Le Roux’s involvement with TrueCrypt is the least interesting part of the story.”

II.

I wrote about Louis Budenz – labor activist, journalist and decade-long communist spy – in my Journalist and Spy newsletter a couple of months ago, based on FOIA documents I had recently obtained from the CIA. I finally got around to uploading those documents, so you can view them here.

III.

Madison Square Garden – where Taylor Swift got married this month – is suing WIRED for its reporting on the company’s surveillance operation. An internal database tracked and categorized hundreds of individuals, labeling some “LGBTQIA,” “DO NOT HOST,” and low to high “risk.” In response, WIRED removed the paywall from two stories Madison Square Garden does not want you to read, making them free for everyone. You can read them here and here.

IV.

The Wall Street Journal has the backstory on the U.S. - UAE agreement on AI, complete with spycraft, diplomacy, and lobbying. Emirati AI giant G24 is mentioned too, run by former DarkMatter staff – the firm created to help the Gulf state spy on rivals, activists, and journalists with former NSA hackers. In November, Microsoft announced a strategic partnership with G24 as part of a $15.2 billion investment in the UAE.

I.

I miss microblogging. I miss Twitter. I still enjoy sharing bits and pieces on a regular basis. So in between navigating wildfire smoke in New York City and dodging the cyclosporiasis outbreak, I had the great idea to create yet-another-newsletter.

II.

Binding Hook says it’s “past time to do something about” spyware, following a Citizen Lab report on a Greek MEP who was targeted (twice) while investigating spyware in Europe. Back in 2023, I wrote an article for Binding Hook arguing that “civil society organizations have been sounding the alarm on spyware for over a decade, yet very little has been done to counter the growing threat.”

III.

New reporting from Amnesty International, Forbidden Stories, and OCCRP details the evolution of the Pegasus spyware and shows how Morocco used it to spy on a journalist, contradicting the government’s public claims to have never used the spyware. In early 2023, Morocco organized an in-person hearing to “disprove” years of spyware research by Amnesty International and Citizen Lab. I fact-checked that here.

IV.

If you’re looking for a podcast to binge this summer and don’t mind an older story, check out The Missing Cryptoqueen from the BBC about the OneCoin fraud scheme. OneCoin’s founder, Dr. Ruja Ignatova disappeared in October 2017 – her whereabouts remain a mystery to this day. Authorities are slowly but surely seizing assets and recovering funds on behalf of the victims.

V.

I finished The Missing Cryptoqueen on Tuesday and jumped straight into We Call Her Emma from Tortoise Investigates and The Observer. Published in 2023, the series takes a closer look at Asma al-Assad – former First Lady of Syria – and her journey from middle-class girl in West London to becoming the First Lady. The Guardian reported last year that the “Assad family are living an isolated, quiet life of luxury in Moscow and the UAE.”