Thread by @jsrailton

Got a threat notification from Apple this week?

✅Take it seriously.

Devices that get warnings usually show signs of spyware infection (or an attempt).

✅Then take action.

If you're part of civil society, you should reach out to a digital security org for assistance.

Apple threat notifications are *clear & invaluable* signs something serious is going on.

They've triggered major investigations & uncovered widespread spyware abuses.

For example, #Pegasus hacking against activists & opposition figures in Thailand...
citizenlab.ca/2022/07/geckos…

Since Apple began delivering threat notifications we @citizenlab & others like @AmnestyTech have used them as a key indication that investigation is needed.

Another country where the threat notifications uncover likely-political hacking? #Poland.

@citizenlab @AmnestyTech Apple's threat notifications have also helped confirm + expand our understanding of cases we're already investigating, like #Pegasus infection clusters in #ElSalvador and #Mexico.

@citizenlab @AmnestyTech Apple's threat notifications turbocharged our research into mercenary spyware.

And they are a blinking red light that a government is likely trying to get up to something on your phone.

Which is why, since they started back in 2021, some actors pushed disinformation about them.

@citizenlab @AmnestyTech Another case where Apple's threat notifications led to a major investigation & string of hacking discoveries?

Extensive #Pegasus hacking #Armenia.

Report by @accessnow in collaboration with @CyberHubAm @citizenlab @amnestytech @RubenMuradyan accessnow.org/publication/ar…

@citizenlab @AmnestyTech @accessnow @CyberHubAm @RubenMuradyan The US took vigorous action against mercenary spyware proliferation. Including an executive order.

Key early sign something needed to be done?

Apple threat notifications in the inboxes of #US diplomats...

Many more cases were eventually found.

https://twitter.com/jsrailton/status/1640383736729542662

@citizenlab @AmnestyTech @accessnow @CyberHubAm @RubenMuradyan Apple threat notifications on spyware, key takeaways:

✅We researchers see all signal, no noise
✅Points to targeting & attempted targeting by a gov
✅Track record of major finds & accountability impacts

Take them with great seriousness. Patterns must be investigated.

@citizenlab @AmnestyTech @accessnow @CyberHubAm @RubenMuradyan If you or someone you know got an Apple threat notification, seek assistance.

At risk because of who you are or what you do?

Enable Lockdown Mode.

Our research throughout 2023 has *not* found cases of #Pegasus & #Predator infection when it's enabled.

https://twitter.com/jsrailton/status/1705276865898856449

@citizenlab @AmnestyTech @accessnow @CyberHubAm @RubenMuradyan If Apple, Meta, Google, Yahoo threat notifications are landing anywhere in your vicinity...

The canary in your coal mine has just passed out.

Seek out orgs with digital security expertise. There is nubstitute for competent assistance when the threat is serious.

@citizenlab @AmnestyTech @accessnow @CyberHubAm @RubenMuradyan Apple has a world class threat intelligence team hunting mercenary spyware & other bad things.

The notifications come from their finds.

Like all the other companies that do notifications, they tend to read as a bit low on details of exactly who & what they found. Why?...

@citizenlab @AmnestyTech @accessnow @CyberHubAm @RubenMuradyan Threat notifications are big deal for a recipient.

They're also *closely scrutinized by spyware operators*

So threat hunting teams try to balance what they share in warnings with not "burning" their investigative techniques so they can keep tracking spyware groups.

@citizenlab @AmnestyTech @accessnow @CyberHubAm @RubenMuradyan There's a vital conversation happening now about improving impact & value of notifications for victims and researchers while not burning investigations.

But if you're puzzled by why some find the current generation of warnings from Apple/Google/Meta 'vague' I hope this helps.

Personally, I'm on the side of rebalancing notifications to be more informative & impactful for recipients.

Also, evidence-based tuning of language & UX to make next steps clear & easy

Things getting better, but it's a slow road w/tricky problems & equities to balance.