Intelligence Capability Development consultant @Mandiant, studying the intersection of intelligence, risk, and business operations.
Virginia, USA
Joined November 2020
- Tweets3.9K
- Following848
- Followers569
- Likes748
There is “blameless post mortem” and then there is “not even referring to the PIC as PIC.” Just “a pilot.”
Sav retweeted
But could we detect foreign influence campaigns? The answer is yes. We found a British campaign to import digital ID laws to America. We worked backwards through decentralized federal and state filings to create a unified record of foreign interference.
effort.news/uk-lobby
Very fun seeing this drop just after finishing @OrinKerr’s border search exception chapter.
First known US case: American charged for using a “duress” password
Samuel Tunick, an Atlanta resident, is being prosecuted for allegedly giving border agents a passcode that wiped his phone.
The feature comes from GrapheneOS, a privacy-focused Android OS. Entering the duress code triggers a full factory reset.
This is believed to be the first time federal prosecutors have brought such charges.
The incident happened in January 2025 at Atlanta airport. Agents demanded access to his phone without a warrant, saying he hadn’t yet officially entered the US. When they entered the code, the phone wiped itself.
Tunick has pleaded not guilty. His lawyers argue the seizure was unlawful and that agents were investigating his activism against “Cop City.”
The case raises big questions about digital rights at the US border.
What do you think?
Article: techcrunch.com/2026/07/24/us…
#Privacy #GrapheneOS #DigitalRights
Sav retweeted
👀👀
This is a really interesting report from Hugging Face about their recent intrusion. I also love the transparency here.
The biggest takeaway imo is that teams should have a capable model ready to run locally before an incident.
We now rely so much on AI to accelerate IR that having a capable model ready to run locally should be part of incident response planning.
huggingface.co/blog/security…
So…anyone seen details on this?
On Mythos, from @MarkWarner in this morning's Senate Banking hearing: "the head of the NSA and Cyber Command came and said this tool broke into almost all of our classified systems, not in weeks, but in hours"; I had not seen that mentioned elsewhere?
Sav retweeted
I’m hiring a sr principal threat researcher. When big things happen on the internet, you’ll lead the threat research to hunt across our vast telemetry & write the threat briefs. Senior role w/ strong comms & collab experience.
jobs.paloaltonetworks.com/en…
Sometimes I put this on the projector and just shout “QUADBOX” at my wife until she is forced to acknowledge.
Today, we’re officially launching fully customizable multiview on @YouTubeTV.
Our @youtube teams made one of our most popular features even better. The new multiview builder gives you full control to mix and match live streams (including add-ons like @nfl Sunday Ticket), and build the personalized viewing experience you've been asking for.
Sav retweeted
The Department of Justice, through U.S. Attorney Jeanine Ferris Pirro and Assistant Attorney General A. Tysen Duva of the Criminal Division, together with its partners, today announced a series of coordinated actions by the Scam Center Strike Force against Southeast Asian criminal organizations operating scam centers that have defrauded Americans of billions of dollars.
Read More Here: justice.gov/usao-dc/pr/scam-…
@USAttyPirro @FBI @SecretService @USTreasury @StateDept
ALT Dark image of numerous cell phones lying on tables, press release, in yellow text, April 23, 2026, in white text, Scam Center Strike Force Takes Major Actions Against Southeast Asian Scam Centers Targeting Americans, in white text, U.S. Attorney Jeanine Ferris Pirro, District of Columbia, in yellow text
Sav retweeted
Had an interview with a “crypto” recruiter. We talked for about 40 minutes, and then they asked me to look at some code.
Their first instruction was to clone the repo. I didn’t. They seemed surprised, so I told them I wanted a moment to check whether it was safe first.
I ran a quick analysis with Claude.
Turns out the code had a backdoor. It would copy my environment variables and send them to a remote server.
The recruiter went speechless and ended the call pretty quickly.
Be careful who you talk to. Scammers are real.
A special place in hell for the people indicted here.
Seeing western-based ransomware negotiators & incident responders deploying ransomware at victims & playing both sides of negotiation is sickening 🤮
21st century version of the 1990’s movie Backdraft
justice.gov/opa/pr/florida-m…
Sav retweeted
The @SLEUTHCON CFP closes next week. Don’t waste valuable time doing your taxes. Submit! Submit! Submit!
We want to hear from YOU 🫵 Got something you think would make a great talk at SLEUTHCON this year?
Full-talk speakers get a $500 honorarium, ALL speakers get the best swag!
Don't wait - submissions close April 17th at 11:59 (ET)! Learn more about our CFP and submit yours today
It’s nice to fantasize about a comprehensive integration into CI/CD pipelines to the point where we all get to hold hands and sip daiquiris on the beach, but you are still a river of fire and brimstone away from that level of tool and patch adoption.
This quoted post is unavailable.
If there are any Delve customers left on @ZackKorman’s list, this should be some sort of blunt force instrument. A brand new “How cooked are we?” metric.
Sav retweeted
The FLARE team now freely distributes its quality reverse engineering and malware analysis educational content at github.com/mandiant/flare-le…. Launched with:
- Malware Analysis Crash Course
- Go Reversing Reference
- Intro to TTD
