iiinova — where your digital self keeps evolving

John Scott-Railton @jsrailton.bsky.social · 04/09/2026

Well, hello. I notice you posted about Flock. You seem upset? Don't you know that you have no reasonable expectation of privacy once you leave home? Anyways, where are you headed? I'm sure someone like you has nothing to hide.

14012

John Scott-Railton @jsrailton.bsky.social · 08/07/2026

NOW: EU Parliament about to debate mercenary spyware. I expect it will be spicy. Follows our @citizenlab.ca revelation EU lawmaker was hacked with Pegasus while investigating spyware. LIVE HERE: www.europarl.europa.eu/plenary/en/h... Report: citizenlab.ca/research/mem...

03014

John Scott-Railton @jsrailton.bsky.social · 02/07/2026

Predict the replies without clicking through.

1163

John Scott-Railton @jsrailton.bsky.social · 25/06/2026

NEW: Russia cracked activist's phone with Cellebrite. Hunted for political terms @citizenlab.ca found it. Russia's own official docs confirm they did it. Andrey Pivovarov was sentenced to 4 years in prison. Thing is, #cellebrite said had cancelled Russia's contract.. 1/

27350

John Scott-Railton @jsrailton.bsky.social · 22/06/2026

Effort asymmetry is rude. There is no obligation for me to spend more time reading text you generated than it took you to prompt it.

1358

John Scott-Railton @jsrailton.bsky.social · 10/06/2026

NEW: malware developers added nuclear & biological weapons text to to their spyware. Goal? To trigger LLM safety refusals... so that their spyware wouldn't be analyzed by an AI security scanner. Cleanest practical example I can think of for why over-indexing on first order "safety" is risky. 1/

4533189

John Scott-Railton @jsrailton.bsky.social · 08/06/2026

BREAKING: NSO Group caught trying to hack across #WhatsApp. Again! Defying 🇺🇸US Courts. WhatsApp disrupted the Pegasus campaign & says it violates US Federal injunction they won against NSO. Asks Federal judge to hold NSO Group in contempt. Many implications... 1/ about.fb.com/news/2026/06...

7279130

John Scott-Railton @jsrailton.bsky.social · 06/05/2026

The plane with the hantavirus-ill passenger has done a lot of flying since April 25th. Airlink's ZS-YAD spends tonight in Nairobi, with scheduled return to Johannesburg tomorrow morning. I'm curious about what cleaning it might've gotten from Airlink. Here are some more deets 1/

13213

John Scott-Railton @jsrailton.bsky.social · 06/05/2026

I hope everybody kept their Zoom subscriptions.

3339

John Scott-Railton @jsrailton.bsky.social · 04/05/2026

PULITZER ALERT: to the team at @apnews.com on how US tech helped turbocharge Chinese surveillance & repression. And fueled surveillances abuses everywhere. Even at home. Took years & faced serious pushback. Tenacious journalism matters & gets us truth despite very long odds.

03913

Reposted by John Scott-Railton

Ron Deibert @rondeibert.bsky.social · 02/05/2026

As many are aware by now, @accessnow.org 's annual @rightscon.org was cancelled because of pressure on the host govt Zambia 🇿🇲 by China 🇨🇳 www.rightscon.org/rc26-stateme... In their statement, @accessnow.org rightly flags this is as an example of transnational repression

rightscon.org

A statement to our community about why RightsCon 2026 will not take place in Zambia

Our official statement to the digital rights community about why RightsCon 2026 will not take place in Zambia

34134

Reposted by John Scott-Railton

Joseph Cox @josephcox.bsky.social · 30/04/2026

A manager working for a top surveillance company sold a bunch of powerful hacking tools to a Russian company. Those tools then ended up being used by the Russians. Here's what happens when hacking tools spiral out of control Watch, subscribe here: www.youtube.com/watch?v=MWxL...

07031

John Scott-Railton @jsrailton.bsky.social · 28/04/2026

NEW: we caught 🇨🇳Chinese hackers... again. Twist: they're hacking journalists & activists, but we suspect they're private contractors. State repression... with a profit margin. Thread + how to protect yourself 1/ By my colleagues @citizenlab.ca + @icij.org citizenlab.ca/research/how...

315581

John Scott-Railton @jsrailton.bsky.social · 09/04/2026

BREAKING: You checked the weather this morning. And you just told a surveillance company where you sleep. Meet #Webloc, used by ICE, cops & foreign govs to track 500m+ phones. No warrant required. Our @citizenlab.ca investigation + how to protect yourself 🧵/1 citizenlab.ca/research/ana...

heatmaps from the report showing tracking

11667498

John Scott-Railton @jsrailton.bsky.social · 06/04/2026

It's a hostage situation. And we want our printers back. Would someone with tokens to burn kindly vibecode the #PrinterLiberationFront?

67212

John Scott-Railton @jsrailton.bsky.social · 04/04/2026

First, Outlook fails. Now: Houston, Bluetooth won't pair. Artemis II is NASA's most relatable mission yet.

1226671

John Scott-Railton @jsrailton.bsky.social · 02/04/2026

NEW: #WhatsApp shuts down mercenary spyware op, notifies targets. Sends legal warning to Italian spyware shop #SIO. Trick is simple & time tested: govs trick people into installing a malicious version of WhatsApp. Then spy on them. 1/ By @lorenzofb.bsky.social techcrunch.com/2026/04/01/w...

13823

John Scott-Railton @jsrailton.bsky.social · 31/03/2026

Stop scrolling & watch this. Follow along. Get safer. This especially matters if you're pissing off the powerful. Thanks to @gijn.org for putting this together. www.youtube.com/watch?v=MsPY...

youtube.com

John Scott Railton Shares Tips and Tools to Protect Yourself Digitally

YouTube video by Global Investigative Journalism Network

14424

John Scott-Railton @jsrailton.bsky.social · 27/03/2026

Prolific Russian gov phishing operation now using the DarkSword exploits. Predictable: lots of threat actors have been exploit poor but with great infrastructure for social engineering. When exploits leak from governments they are best positioned to almost immediately start using them 1/

2206

John Scott-Railton @jsrailton.bsky.social · 19/03/2026

NEW: French sailor reveals position of aircraft carrier with fitness app. His runs track Charles de Gaulle as it steams across the Med. Story by @lemonde.fr 1/ www.lemonde.fr/internationa...

8327148

John Scott-Railton @jsrailton.bsky.social · 11/03/2026

NEW: foreign hacker compromised Epstein files held by #FBI "included combing through certain files pertaining to the Epstein investigation” Source describes it as cybercriminal. Previously all we knew was: there was some sort of breach. 1/ By @raphae.li www.reuters.com/world/us/for...

full text for all screenshots is here, please let me know if you use Alt Text and find this helpful: https://www.reuters.com/world/us/foreign-hacker-2023-compromised-epstein-files-held-by-fbi-source-documents-show-2026-03-11/

57935

John Scott-Railton @jsrailton.bsky.social · 11/03/2026

You used Pokemon Go. You were not the customer. You were the product. By @willdouglasheaven.bsky.social www.technologyreview.com/2026/03/10/1...

45220

Reposted by John Scott-Railton

John Scott-Railton @jsrailton.bsky.social · 10/03/2026

6/ In 2022 I warned Congress that commercially-developed exploits would leak. I testified to House Intelligence that the tech would go to adversaries and criminal organizations. That has now happened with #Coruna. And as the commercial offensive industry grows, it will happen again.

110326

John Scott-Railton @jsrailton.bsky.social · 10/03/2026

BREAKING: powerful iPhone hacking tools used by Chinese criminals originated from US defense giant L3 Harris. Their zero-click exploits went to Russian spies too. Unbelievable harm to our collective security. Scoop: @lorenzofb.bsky.social, here's why it matters 1/ techcrunch.com/2026/03/09/a...

5490246

John Scott-Railton @jsrailton.bsky.social · 10/03/2026

The #FCC is reviewing a proposal for space mirrors to blast sunlight at the earth at night. Sounds awful. Anyone who that been to the far north or tried to sleep under lights knows how disorienting 24h of light is. Everybody gets insomnia. It's also an ecological disaster machinery 1/

5122476

John Scott-Railton @jsrailton.bsky.social · 03/03/2026

We're about to see a new surveillance trap: "Plaid for AI" This will look like slick middleware that seamlessly hooks CRMs to Claude, gmail to GPT-5 etc, etc. UX will be great & founders well-meaning. Then the VCs ask: what else can we do with this sick tokenflow data? 1/

34818

John Scott-Railton @jsrailton.bsky.social · 25/02/2026

NEW: US just sanctioned a network of exploit brokers trafficking in stolen US hacking tools First-ever use of #PIPA (Protecting American Intellectual Property Act) by Treasury. Here's the wild backstory of how Operation Zero got US-taxpayer funded exploits. 1/

14523

John Scott-Railton @jsrailton.bsky.social · 23/02/2026

Cellebrite taking a page out of the NSO Group playbook. Denialism is a bad look for a company that tries to frame itself as more ethical than notorious spyware companies. And a good sign that there are deeper issues with the company.

02214

John Scott-Railton @jsrailton.bsky.social · 15/02/2026

UPDATE: Paragon calls OPSEC fail a tiny price to pay for "female empowerment." Peak cringe. And nonsense. Entire world learned from this pic that their spyware is more invasive than previously known. 1/

24014

Reposted by John Scott-Railton

The New York Times @nytimes.com · 14/02/2026

Aleksei Navalny was most likely poisoned by a toxin found in a South American frog, five European countries said Saturday, making the most concrete Western accusation yet that Russia’s leading opposition figure was murdered by his government in a prison two years ago. www.nytimes.com/2026/02/14/w...

47803269

John Scott-Railton @jsrailton.bsky.social · 13/02/2026

UPDATE: Ring just cancelled their partnership with #Flock. Should you trust #ring now? No. After all they thought this was a good idea. And their statement doesn't acknowledge the real issue. More on that in a second. But this shows: pressure works on privacy 1/

923794

John Scott-Railton @jsrailton.bsky.social · 11/02/2026

Epic OPSEC fail by Paragon exposing Graphite spyware capabilities. Annotated pic from what we know. Please help me figure out the other apps in in this pic that the spyware can access: #WhatsApp #Telegram #Signal ? #Line? ? #Snapchat? #TikTok? 1/

810159

John Scott-Railton @jsrailton.bsky.social · 11/02/2026

🇨🇳In China: agencies budget billions for total surveillance. 🇺🇸In America we buy & install the cameras ourselves.

25321

John Scott-Railton @jsrailton.bsky.social · 09/02/2026

The showed us cute missing dogs & we consented to turning our doorbell cameras into a mass human tracking system. Mark my words, Ring's Search Party will become the next Flock. Only instead of just being sketchy cameras installed in parking lots, it will be everywhere. That's their play.

1517079

Reposted by John Scott-Railton

Vas Panagiotopoulos @vaspanagiotopoulos.com · 09/02/2026

A judge in 🇪🇸Barcelona has formally charged two former Civil Guard directors for the first time in connection with the Pegasus #spyware used to spy on the Catalan independence movement. The judge has also summoned former intel. agency CNI director to testify as a suspect. en.ara.cat/politics/two...

en.ara.cat

Two Civil Guard officers charged for the first time in the Pegasus case

The judge also summons former CNI director Paz Esteban to testify as a suspect

11811

John Scott-Railton @jsrailton.bsky.social · 06/02/2026

A VPN company server was seized. Reminder: your 'privacy' VPN is still a physical server in somebodies jurisdiction. Claim of RAM disk servers as protection is...interesting. I know nothing more about this case, but hotplugs that let authorities grab a server without cutting power are common. 1/

26029

John Scott-Railton @jsrailton.bsky.social · 06/02/2026

Every AI company in year 1: Bro, we are going to be SO ALIGNED. year 2: YOLO the machine built itself and we can't validate that it's aligned because it knows when we are testing it. Anyways here it is LFG!

0185

John Scott-Railton @jsrailton.bsky.social · 04/02/2026

Brutal layoffs at the Washington Post today. A lot of reporters of great integrity & talent are suddenly out of a job. This hurts good people & weakens journalism collectively. Wishing them all the best in this tough market.

1323

John Scott-Railton @jsrailton.bsky.social · 04/02/2026

I trust you, but your AI agent is a snitch: Why we need a new social contract. We’re chatting on Signal, enjoying encryption, right? But your DIY productivity agent is piping the whole thing back to Anthropic. Friend, you just created a permanent subpoena-able record of my private thoughts...1/

28339

John Scott-Railton @jsrailton.bsky.social · 02/02/2026

In past 24h: ❌ 1-click exploit dropped for #OpenClaw: Simply visiting a URL allowed attacker to steal everything: keys & files + take control of the device. Patched. ❌#MoltBook had a vulnerability exposing all users emails, real names etc. Patched. 1/ Takeaway: all gas, no brakes.

12213

John Scott-Railton @jsrailton.bsky.social · 02/02/2026

I believe NSO Group has one goal: Bring Pegasus spyware to America. They're trying to create the perception that they are a reformed company. But they just got caught trying to hijack diplomatic efforts to whitewash Pegasus spyware 1/

25633

John Scott-Railton @jsrailton.bsky.social · 30/01/2026

Someone spun up a social network for AI agents. Almost immediately some began strategizing how to establish covert communications channels to hide from humans. In many cases the agents are on machines that have access to personal data. "Privacy breach" won't begin to capture what is coming. 1/

68436

Reposted by John Scott-Railton

Suzanne Smalley @suzannesmalley.bsky.social · 17/12/2025

Spyware found on Belarusian journalist's phone shortly after interrogation by security services. Reporters w/o Borders: Spyware likely installed while the journalist was detained. The same infection method recently used in Kenya + Serbia. H/t @jsrailton.bsky.social therecord.media/spyware-bela...

therecord.media

New spyware discovered on Belarusian journalist’s phone after interrogation

Researchers at the nonprofit Reporters Without Borders discovered a previously unknown spyware tool on the phone of a Belarusian journalist who had been detained by security services.

02517

John Scott-Railton @jsrailton.bsky.social · 17/12/2025

Belarusian KGB put spyware on phones of detained journalist. Growing list of cases where authoritarian regimes use detention to implant spyware on phones: 🦠Belarus 🦠Kenya 🦠Serbia And likely plenty more. Important investigation & reminder that dictators don't always need zero-days.

15336

Reposted by John Scott-Railton

Alberto Fittarelli @fittarelli.com · 12/12/2025

1/ Yesterday’s Q2-Q3 Adversarial Threat Report by Meta was interesting in many ways. For us @citizenlab.ca, it was a blast from the past. For the first time, Meta’s investigators attributed what in 2019 we had named Endless Mayfly - a relentless, sophisticated influence op targeting Iran’s enemies.

citizenlab.ca

Burned After Reading: Endless Mayfly’s Ephemeral Disinformation Campaign - The Citizen Lab

Using Endless Mayfly as an illustration, this highlights the challenges of investigating & addressing disinformation from research & policy perspectives.

12214

Reposted by John Scott-Railton

Ron Deibert @rondeibert.bsky.social · 11/12/2025

In 2019, we @citizenlab.ca published an investigation into a disinfo / influence operation we called "Endless Mayfly", and which we attributed at the time to an "Iran-aligned entity" citizenlab.ca/2019/05/burn... Now, Meta's latest adversarial threat report showing we were spot on 👇

1227

John Scott-Railton @jsrailton.bsky.social · 25/11/2025

Hotel toilet privacy is disappearing. Glass doors. Or no door. Or a big window into the room. Or frosted glass so that the light spills out. Who is asking for this?

198713