Honestly though we are at the absolute tip of the iceberg.
3/ Here he is demoing access to the #Gmail of a purported key political insider in #Kenya just days before the election.
This tech & tactics is kerosene on the flames of democracy.
4/ “I know in some countries they believe #Telegram is safe. I will show you how safe it is”
Yikes.
Unclear how he is gaining access to these #Gmail & Telegram accounts, but the talk of #SS7 is a good hint.
And yet another reminder: SMS is not a safe second factor.
5/ Great to see mercenary election manipulators exposed. Solid journalism.
Trust me, this is a window into a *much bigger industry* active in elections around the world.
So rare to see it caught.
6/ The fact that so much political activity happens on a handful of platforms makes the tooling for political manipulation really interoperable.
Also radically lowers barriers to entry.
Making mercenary election manipulation scaleable & easy to export.
7/ Of course, we don't know whether these guys have successfully changed the outcome of any election.
The guy here is also pretty clearly boasting & trying to sell.
But the mere fact of mercenary election manipulators running around is damaging, even when they don't win.
8/ Even if mercenary election manipulators don't successfully throw an election (e.g. successfully shift mass sentiment), bots, hacking & turbocharged dirty tricks can distort political culture.
Opposing parties have to adjust.
And the net result is harm to democracy.
9/ UPDATE: @haaretzcom reports the mercenary political manipulators targeted 🇺🇸US politicians.
3/ We got a tip about a single bit of #Paragon infrastructure & my brilliant colleague @billmarczak developed a technique to fingerprint some of the mercenary spyware infrastructure (both victim-facing & customer side) globally.
#Paragon's carefully constructed image of being a clean mercenary spyware company that wasn't susceptible to abuses has been replaced by a more familiar tale of...
Abuses...
And #Italy is now saddled with an unfolding crisis around spyware abuse.
VPN advertising is the most common source of security misinformation that I encounter.
By far.
So many people misplace their trust in dubious consumer VPN products.
The industry is a scourge.
VPNs don't do most of the things that podcasters imply they do.
Security:
Coffee shop attacks on unencrypted logins are a thing of a decade ago.
VPNs won't stop even the dumbest spyware & phishing.
Privacy:
Advertisers still know it's you when you turn on a VPN... they use many other identifying signals from your device, like your browser & advertising IDs. Those don't change when you turn on a VPN.
Trust:
A lot of VPN companies are shady.... and the industry is consolidating fast around some questionable players with concerning histories.
When you turn on a VPN you entrust all of your data to those companies.