Sign in

Runa Sandvik

@runasand.bsky.social
11K followers 52 following 324 posts

Founder of Granitt, securing journalists and at-risk people around the world.

PostsRepliesMedia
Runa Sandvik @runasand.bsky.social · 08/10/2026
In this week's newsletter: reckless Paragon spyware, more about Oxygen Forensics, upcoming journalism security talks in London, and a searchable archive of Cold War docs on Soviet espionage. www.runasandvik.com/p/waypoints-...
runasandvik.com
Waypoints: About Paragon spyware, Oxygen Forensics, and speaking in London
I can’t say I’m surprised to learn that spyware maker Paragon “has no technical way to know if customers misuse its software” or a way “to disable customers when misuse occurs” either.
050
Runa Sandvik @runasand.bsky.social · 07/10/2026
Paragon says its spyware "system is rendered ineffective in about 12 hours" without updates, and I immediately think of how Russian authorities still found a way to use Cellebrite against an activist after the company cancelled the contract. www.wired.com/story/the-se...
wired.com
The Secrets of a US Spyware King
In an exclusive interview with WIRED, Paragon Solutions CEO Andrew Boyd reveals the limits of the company’s promise to keep bad actors from abusing its powerful espionage tool.
0164
Runa Sandvik @runasand.bsky.social · 02/10/2026
Report from Air Traffic and Navigation Services in South Africa last month says it "discovered ransomware-linked malware" in an OT network, along with possible "insider's theft of data." www.darkreading.com/cyberattacks...
darkreading.com
South Africa Seeks Aid After Air Traffic Control Cyberattack
As aviation suffers more cyberattacks, air traffic systems are the latest target, with a ransomware toolkit installed on at least one OT network.
052
Runa Sandvik @runasand.bsky.social · 02/10/2026
Magnet Forensics says it has found a way to freeze an iPhone in a state that lets investigators more easily access data on the device. The company also claims to have had a hand in the creation of the Apple usbliter8 exploit from a few months ago. www.404media.co/cops-can-byp...
404media.co
Cops Can Bypass iPhone’s Automatic Reboot to Get Into Locked Phones, Leaked Video Claims
Magent Forensics, the owner of the GrayKey phone unlocking tool, says it can bypass an iPhone rebooting feature that was locking cops out.
0114
Runa Sandvik @runasand.bsky.social · 01/10/2026
In this week’s newsletter: I flew a single engine Piper Pilot yesterday; the FBI is being sued for D.B. Cooper’s file; former Pussy Riot member details forced cooperation with the FSB; and turns out Oxygen Forensics’ Russian ownership was an open secret. www.runasandvik.com/p/waypoints-...
runasandvik.com
Waypoints: About D.B. Cooper, Pussy Riot, and my first flight lesson
More than 50 years after D.B. Cooper parachuted out of a commercial airplane with a bag full of cash, there’s now a lawsuit asking the court to force the FBI to disclose its records in the case.
040
Runa Sandvik @runasand.bsky.social · 24/09/2026
In this week’s newsletter: insecure aircraft comms, voice cloning of air traffic control, an incredible thread on geolocating a mountainside in Syria, and – finally – how to use AI with your privacy intact. www.runasandvik.com/p/waypoints-...
runasandvik.com
Waypoints: About aircraft communications, geopositioning, and AI privacy
Aircraft communications are susceptible to interception, interference, spoofing, and jamming.
040
Runa Sandvik @runasand.bsky.social · 21/09/2026
U.S. Senator Ron Wyden is coming for insecure aircraft communications, saying the links between controllers and planes are "incredibly insecure." Reminds me of Andrew Logan's 2025 DEF CON talk on voice cloning air traffic control. www.reuters.com/world/us/us-...
reuters.com
US aircraft communications with FAA 'incredibly insecure,' senator says
A government watchdog report on Monday shows communications between US air traffic ​controllers and commercial airplanes are "incredibly insecure" and the Federal Aviation ‌Administration must take st...
2184
Runa Sandvik @runasand.bsky.social · 17/09/2026
Will do this week!
000
Runa Sandvik @runasand.bsky.social · 17/09/2026
I wrote about AI, privacy, lack of user awareness, and journalist security in this week's newsletter. Plus a bit about the Faroe Islands and the Rosenberg boys. www.runasandvik.com/p/waypoints-...
runasandvik.com
Waypoints: About Faroe Islands, OpenAI, and security for journalists
I’m exploring the Faroe Islands this week! Think charming villages and breathtaking scenery; a bit like Iceland, but with fewer people; Scandinavian waffles and so many rainbows.
151
Runa Sandvik @runasand.bsky.social · 16/09/2026
TIL that a month prior to my presentation on hacking a sniper rifle at Black Hat and DEF CON in 2015, TrackingPoint CEO John McHale told the U.S. Army the company was preparing to sell its IP to the highest bidder. www.documentcloud.org/documents/28...
160
Runa Sandvik @runasand.bsky.social · 10/09/2026
In this week's newsletter: a new podcast series about the search for missing journalist Austin Tice, a great podcast interview with Olympic champion Eileen Gu, and some U.S. lawmakers want the government to ban several hack-for-hire firms. www.runasandvik.com/p/waypoints-...
runasandvik.com
Waypoints: About Austin Tice, Eileen Gu, and hack-for-hire firms
Austin Tice, a U.S. Marine turned war correspondent, was abducted in Syria 14 years ago. A lot has changed in the country since then, but Tice has yet to be found.
040
Runa Sandvik @runasand.bsky.social · 03/09/2026
August roundup: airline passengers and their AirPods.
2228
Runa Sandvik @runasand.bsky.social · 03/09/2026
Wrote about aircraft tracking, privacy bugs, censorship in North Korea, and unsolved mysteries in this week's newsletter. www.runasandvik.com/p/waypoints-...
runasandvik.com
Waypoints: About Airframes, North Korea, and unsolved mysteries
If you’re feeding ACARS messages to Airframes, know that the website appears to have a bug and does not currently honor the privacy settings you have applied to your profile.
050
Runa Sandvik @runasand.bsky.social · 03/09/2026
If you’re sharing aircraft tracking data with Airframes, know that the site appears to have a bug and does not currently honor the privacy settings you have applied to your profile. www.runasandvik.com/p/waypoints-...
0100
Runa Sandvik @runasand.bsky.social · 27/08/2026
My flight from Milan to New York with Emirates diverted to Boston last week. So for this week's newsletter, I set out to see how much I could learn about EK 205 from publicly available sources. Here's altitude stats, ATC recordings, and more. www.runasandvik.com/p/waypoints-...
runasandvik.com
Waypoints: About Emirates, Boeing, and Roald Dahl
After four days of indoor skydiving in Europe last week, my flight from Milan to New York with Emirates was diverted to Boston due to heavy rain, flash floods, and strong winds.
070
Runa Sandvik @runasand.bsky.social · 26/08/2026
A Chinese national studying in Canada took photos of U.S. aircraft and FedEx facilities at the direction of a suspected Chinese government official. The student said he was first approached on "an aviation spotter website." www.404media.co/a-student-sa...
060
Runa Sandvik @runasand.bsky.social · 26/08/2026
Ship tracking is having a moment. www.cjr.org/analysis/the...
cjr.org
The shipping news stars.
With the Strait of Hormuz crisis raging, experts in commercial maritime traffic are having a moment.
040
Runa Sandvik @runasand.bsky.social · 26/08/2026
Set up a Raspberry Pi 4b with two Airspy receivers so that I can feed the ACARS Drama project and access the full message archive. Can’t wait to see what fun things I can find with the API.
0231
Runa Sandvik @runasand.bsky.social · 24/08/2026
The FSB recruited a former Pussy Riot member through coercion and tasked her with organizing the killing of a former publisher and Pussy Riot member. theins.press/en/news/296386
theins.press
Ex-Pussy Riot member Rita Flores says she cooperated with the FSB for nearly three years before escaping Russia
Former Pussy Riot member Rita Flores has stated that in February 2023, officers from the Russian Federal Security Service (FSB) coerced her into cooperating…
611854
Runa Sandvik @runasand.bsky.social · 24/08/2026
Moscow continues to send intelligence officers to Norway under diplomatic cover. Great work from @thebarentsobserver.com in unmasking them. www.thebarentsobserver.com/security/the...
thebarentsobserver.com
The GRU family: How Russian intelligence officers settled in Norway
Moscow continues to send GRU officers to Norway under diplomatic cover. The Barents Observer looks at their identities.
0186
Runa Sandvik @runasand.bsky.social · 23/08/2026
Have to admit I'm a little disappointed the FBI does not have any records about Patrick Radden Keefe's amazing Wind of Change podcast from 2020.
0120
Runa Sandvik @runasand.bsky.social · 22/08/2026
Couldn’t find the messages I wanted there, may need to pay for access to the archive.
000
Runa Sandvik @runasand.bsky.social · 22/08/2026
Do I know anyone capturing ACARS near JFK? Looking for messages close to midnight UTC on August 20 / 21.
146
Runa Sandvik @runasand.bsky.social · 20/08/2026
I wrote about Apple’s threat notifications, an FSB espionage story, and last week’s HOPE panel about the Epstein files in this week’s newsletter. www.runasandvik.com/p/waypoints-...
runasandvik.com
Waypoints: About threat notifications, a bungled bomb plot, and the Epstein files
“An unprecedented number of Apple customers have reported receiving a recent threat notification,” and the good news is that we are getting better and better at detecting use of sophisticated spyware.
03811
Runa Sandvik @runasand.bsky.social · 18/08/2026
“An unprecedented number of Apple customers have reported receiving a recent threat notification,” and the good news is we’re getting better and better at detecting use of sophisticated spyware. techcrunch.com/2026/08/17/u...
techcrunch.com
‘Unprecedented’ number of Apple users received recent spyware alert, say investigators | TechCrunch
Cybersecurity experts who investigate spyware attacks say the number of people who received a recent threat notification from Apple is unusually high.
1161
Runa Sandvik @runasand.bsky.social · 18/08/2026
Also says something hopeful about our ability to now detect use of spyware.
051
Runa Sandvik @runasand.bsky.social · 13/08/2026
I wrote about that medevac plane, JetBlue flight, and Boeing 737 in this week's newsletter. Plus conspiracy theories, last night's Reddit AMA, and the White Knights. www.runasandvik.com/p/waypoints-...
runasandvik.com
Waypoints: About conspiracy theories, aviation, and the White Knights
What happens when a political movement built on conspiracy theories becomes the target of its own creation?
020
Runa Sandvik @runasand.bsky.social · 11/08/2026
The pilots have a limited amount of characters and have to abbreviate at times.
100
Runa Sandvik @runasand.bsky.social · 11/08/2026
Don’t do this, kids. techcrunch.com/2026/08/11/d...
1405
Runa Sandvik @runasand.bsky.social · 10/08/2026
ICYMI I’m hosting a Reddit AMA with @zackwhittaker.com on Wednesday to answer questions about US border searches, device security, and protecting your digital data. I'll be posting as runasand_. www.runasandvik.com/p/waypoints-...
runasandvik.com
Waypoints: About Reddit AMA, China’s shadow war, and restaurant recommendations
I’m hosting a Reddit AMA with Zack Whittaker of TechCrunch on r/pwnhub on Wednesday, August 12 at 5PM PT!
01610
Runa Sandvik @runasand.bsky.social · 06/08/2026
I asked the FBI for information about Ivor Montagu, a 1930s communist activist and spy, and received five mostly redacted pages, including this gem. www.documentcloud.org/documents/28...
170
Runa Sandvik @runasand.bsky.social · 06/08/2026
"Perhaps the most striking irony is that those who called for Spain’s suspension from Schengen have been among the loudest beneficiaries of European solidarity themselves." www.newstatesman.com/internationa...
newstatesman.com
Europe failed Spain in Ceuta
A single day of pressure on Europe's border was enough to provoke calls to dismantle Schengen itself
094
Runa Sandvik @runasand.bsky.social · 06/08/2026
I wrote about my upcoming Reddit AMA, a podcast about China’s shadow war, and my favorite NYC restaurants in this week’s newsletter. www.runasandvik.com/p/waypoints-...
runasandvik.com
Waypoints: About Reddit AMA, China’s shadow war, and restaurant recommendations
I’m hosting a Reddit AMA with Zack Whittaker of TechCrunch on r/pwnhub on Wednesday, August 12 at 5PM PT!
061
Runa Sandvik @runasand.bsky.social · 06/08/2026
Following the mass border crossing in Ceuta, Italian authorities have decided to temporarily reinstate border controls for passengers arriving in Italy on flights from Spain for all of August. Here’s the email I just received from Iberia.
662
Runa Sandvik @runasand.bsky.social · 06/08/2026
Looking forward to it!
070
Runa Sandvik @runasand.bsky.social · 03/08/2026
"Instead, far-right and MAGA politicians, influencers, and podcasters will immediately use the most divisive language possible in order to make voters as angry as possible, as fast as possible, regardless of what actually happened." www.theatlantic.com/ideas/2026/0...
theatlantic.com
The Far Right Is Distorting Ceuta
We’ve seen this before.
151
Runa Sandvik @runasand.bsky.social · 30/07/2026
In addition to lots of indoor skydiving this week, I also started a book on Iran’s 2022 anti-government protests; discussed the GrapheneOS + U.S. border search case; and went down the manosphere rabbit hole. www.runasandvik.com/p/waypoints-...
runasandvik.com
Waypoints: About Iran, U.S. border searches, and the manosphere
I’ve been reading For the Sun After Long Nights about Iran’s 2022 Woman, Life, Freedom uprising by Fatemeh Jamalpour and former New York Times colleague Nilo Tabrizy.
051
Runa Sandvik @runasand.bsky.social · 27/07/2026
While reading this @forbidden-stories.bsky.social report on Morocco's use of the Pegasus spyware, remember that Morocco in early 2023 organized an in-person hearing to "disprove" years of research by @amnestytech.bsky.social and @citizenlab.ca. forbiddenstories.org/codename-mor...
forbiddenstories.org
Codename “Morgan”: A look back at Morocco’s acquisition of Pegasus, involving Israel and the United Arab Emirates
From product demonstrations at a secret villa in Rabat to training sessions at NSO’s Herzliya headquarters, Forbidden Stories and its partners retrace the early stages of Morocco’s use of Pegasus.
085
Runa Sandvik @runasand.bsky.social · 25/07/2026
Spoke to @zackwhittaker.com about the case of U.S. federal prosecutors going after an American for allegedly wiping his phone with a duress password during a border search. First case I've seen, though I've discussed the potential scenario with at-risk folks. techcrunch.com/2026/07/24/u...
techcrunch.com
US accuses American of allegedly wiping his phone using a 'duress' password during border search | TechCrunch
A U.S. citizen has asked a court to throw out the government's claim that he gave over a passcode to border authorities that wiped his phone's data, opening up fresh questions about a person's constit...
98434
Runa Sandvik @runasand.bsky.social · 23/07/2026
Here are the FOIA docs I obtained from the CIA about journalist and spy Louis Budenz a few months ago. www.documentcloud.org/documents/28...
documentcloud.org
Louis-Budenz-CIA-April-2026
071
Runa Sandvik @runasand.bsky.social · 23/07/2026
Wrote short blurbs about TrueCrypt, my Journalist and Spy project, MSG surveillance and the WIRED lawsuit, and AI in this week’s Waypoints newsletter. www.runasandvik.com/p/waypoints-...
runasandvik.com
Waypoints: About TrueCrypt, spies, and AI
Crazy to think that while Edward Snowden and I taught people to keep their data safe with TrueCrypt, the tool’s alleged creator Paul Le Roux was busy plotting murders, buying drugs from the North Kore...
081
Runa Sandvik @runasand.bsky.social · 23/07/2026
My post missed a little detail in that the environment was set up, but not fully configured / did allow a proxy which is what allowed the model to do more. I believe that’s an easy mistake to make, also something to have guardrails for.
130
Runa Sandvik @runasand.bsky.social · 23/07/2026
Great writeup from @lorenzofb.bsky.social on the recent OpenAI vs. Hugging Face incident. Turns out it started with a human mistake at OpenAI: someone forgot to set up an isolated environment prior to testing a model; the model went rogue; and attacked Hugging Face. techcrunch.com/2026/07/22/h...
24216
Runa Sandvik @runasand.bsky.social · 21/07/2026
The WSJ has the backstory on the U.S.-UAE agreement on AI, w/spycraft, diplomacy and lobbying. AI giant G24 is there too, run by former DarkMatter staff -- the firm created to help the UAE spy on rivals, activists, and journalists with former NSA hackers. www.wsj.com/world/middle...
wsj.com
The CIA Operative Who Spied on the U.A.E.—and Played a Role in Its AI Win
While conducting espionage against sheikh’s tech company, Jonny Gannon helped Gulf country quash U.S. suspicions about China ties.
0126
Runa Sandvik @runasand.bsky.social · 21/07/2026
Sky News looked into the deadly strike on an Iranian primary school in February and found that (1) "the evidence points towards US responsibility," and (2) US analysts had "ample opportunities ... to spot that the building had become a school." news.sky.com/story/reveal...
news.sky.com
Revealed: A catalogue of failures and the devastating aftermath of Iran school bombing
Revealed: A catalogue of failures and the devastating aftermath of Iran school bombing
081
Runa Sandvik @runasand.bsky.social · 16/07/2026
I miss microblogging. I miss Twitter. I still enjoy sharing bits and pieces on a regular basis. So I decided to create yet-another-newsletter. Here's the first post! www.runasandvik.com/p/waypoints-...
runasandvik.com
Waypoints: About spyware, the OneCoin fraud scheme, and Asma al-Assad
I miss microblogging.
0133
Runa Sandvik @runasand.bsky.social · 14/07/2026
If you’re looking for a podcast to binge this summer and don’t mind an older story — still unresolved(!) — check out Jamie Bartlett’s The Missing Cryptoqueen. podcasts.apple.com/us/podcast/t...
podcasts.apple.com
The Missing Cryptoqueen
Documentary Podcast · Dr Ruja Ignatova persuaded millions to join her financial revolution. Then she disappeared. Why? Jamie Bartlett presents a story of greed, deceit and herd madness.
061
Runa Sandvik @runasand.bsky.social · 29/06/2026
Incredibly excited to attend this four-day OSINT course by @giselilla.bsky.social and Haley Willis next month! Check out the page for details and to sign-up. The course will cover tools for investigating bombings, cartels, and disinfo. gisela-perez-de-acha.mykajabi.com/osint_summit
gisela-perez-de-acha.mykajabi.com
FactFinder OSINT Summit
Four days of live OSINT training for journalists, lawyers, and researchers who already know the basics. War, conflict, and disinformation. July 14–17.
173
Runa Sandvik @runasand.bsky.social · 26/05/2026
Spoke to @lorenzofb.bsky.social last week about settings that help you defend against sophisticated spyware on Android, iOS, Gmail, and WhatsApp. Includes Lockdown Mode, Advanced Protection Program, Advanced Protection Mode, and Strict Account Settings. techcrunch.com/2026/05/23/y...
techcrunch.com
These special phone and app features can help protect you from spyware | TechCrunch
Apple, Meta, and Google offer special security modes that provide your devices more secure against targeted spyware attacks. Here are how those modes work, what they do, and how to switch them on.
0126
Runa Sandvik @runasand.bsky.social · 18/05/2026
Crazy to think that while Snowden and I taught people to keep their data safe with TrueCrypt, the tool's alleged creator Paul Le Roux was busy plotting murders, buying meth by the North Koreans, and helping the Colombians set up their own meth lab. www.penguinrandomhouse.com/books/549566...
penguinrandomhouse.com
The Mastermind by Evan Ratliff: 9780399590436 | PenguinRandomHouse.com: Books
The incredible true story of the decade-long quest to bring down Paul Le Roux—the creator of a frighteningly powerful Internet-enabled cartel who merged the ruthlessness of a drug lord with the techno...
060