Runa Sandvik
@runasand.bsky.social
Founder of Granitt, securing journalists and at-risk people around the world.
In this week’s newsletter: insecure aircraft comms, voice cloning of air traffic control, an incredible thread on geolocating a mountainside in Syria, and – finally – how to use AI with your privacy intact. www.runasandvik.com/p/waypoints-...
Waypoints: About aircraft communications, geopositioning, and AI privacy
Aircraft communications are susceptible to interception, interference, spoofing, and jamming.
runasandvik.com
U.S. Senator Ron Wyden is coming for insecure aircraft communications, saying the links between controllers and planes are "incredibly insecure." Reminds me of Andrew Logan's 2025 DEF CON talk on voice cloning air traffic control. www.reuters.com/world/us/us-...
US aircraft communications with FAA 'incredibly insecure,' senator says
A government watchdog report on Monday shows communications between US air traffic controllers and commercial airplanes are "incredibly insecure" and the Federal Aviation Administration must take st...
reuters.com
I wrote about AI, privacy, lack of user awareness, and journalist security in this week's newsletter. Plus a bit about the Faroe Islands and the Rosenberg boys. www.runasandvik.com/p/waypoints-...
Waypoints: About Faroe Islands, OpenAI, and security for journalists
I’m exploring the Faroe Islands this week! Think charming villages and breathtaking scenery; a bit like Iceland, but with fewer people; Scandinavian waffles and so many rainbows.
runasandvik.com
TIL that a month prior to my presentation on hacking a sniper rifle at Black Hat and DEF CON in 2015, TrackingPoint CEO John McHale told the U.S. Army the company was preparing to sell its IP to the highest bidder. www.documentcloud.org/documents/28...
In this week's newsletter: a new podcast series about the search for missing journalist Austin Tice, a great podcast interview with Olympic champion Eileen Gu, and some U.S. lawmakers want the government to ban several hack-for-hire firms. www.runasandvik.com/p/waypoints-...
Waypoints: About Austin Tice, Eileen Gu, and hack-for-hire firms
Austin Tice, a U.S. Marine turned war correspondent, was abducted in Syria 14 years ago. A lot has changed in the country since then, but Tice has yet to be found.
runasandvik.com
Wrote about aircraft tracking, privacy bugs, censorship in North Korea, and unsolved mysteries in this week's newsletter. www.runasandvik.com/p/waypoints-...
Waypoints: About Airframes, North Korea, and unsolved mysteries
If you’re feeding ACARS messages to Airframes, know that the website appears to have a bug and does not currently honor the privacy settings you have applied to your profile.
runasandvik.com
If you’re sharing aircraft tracking data with Airframes, know that the site appears to have a bug and does not currently honor the privacy settings you have applied to your profile. www.runasandvik.com/p/waypoints-...
My flight from Milan to New York with Emirates diverted to Boston last week. So for this week's newsletter, I set out to see how much I could learn about EK 205 from publicly available sources. Here's altitude stats, ATC recordings, and more. www.runasandvik.com/p/waypoints-...
Waypoints: About Emirates, Boeing, and Roald Dahl
After four days of indoor skydiving in Europe last week, my flight from Milan to New York with Emirates was diverted to Boston due to heavy rain, flash floods, and strong winds.
runasandvik.com
A Chinese national studying in Canada took photos of U.S. aircraft and FedEx facilities at the direction of a suspected Chinese government official. The student said he was first approached on "an aviation spotter website." www.404media.co/a-student-sa...
Set up a Raspberry Pi 4b with two Airspy receivers so that I can feed the ACARS Drama project and access the full message archive. Can’t wait to see what fun things I can find with the API.
The FSB recruited a former Pussy Riot member through coercion and tasked her with organizing the killing of a former publisher and Pussy Riot member. theins.press/en/news/296386
Ex-Pussy Riot member Rita Flores says she cooperated with the FSB for nearly three years before escaping Russia
Former Pussy Riot member Rita Flores has stated that in February 2023, officers from the Russian Federal Security Service (FSB) coerced her into cooperating…
theins.press
Moscow continues to send intelligence officers to Norway under diplomatic cover. Great work from @thebarentsobserver.com in unmasking them. www.thebarentsobserver.com/security/the...
The GRU family: How Russian intelligence officers settled in Norway
Moscow continues to send GRU officers to Norway under diplomatic cover. The Barents Observer looks at their identities.
thebarentsobserver.com
Have to admit I'm a little disappointed the FBI does not have any records about Patrick Radden Keefe's amazing Wind of Change podcast from 2020.
Do I know anyone capturing ACARS near JFK? Looking for messages close to midnight UTC on August 20 / 21.
I wrote about Apple’s threat notifications, an FSB espionage story, and last week’s HOPE panel about the Epstein files in this week’s newsletter. www.runasandvik.com/p/waypoints-...
Waypoints: About threat notifications, a bungled bomb plot, and the Epstein files
“An unprecedented number of Apple customers have reported receiving a recent threat notification,” and the good news is that we are getting better and better at detecting use of sophisticated spyware.
runasandvik.com
“An unprecedented number of Apple customers have reported receiving a recent threat notification,” and the good news is we’re getting better and better at detecting use of sophisticated spyware. techcrunch.com/2026/08/17/u...
‘Unprecedented’ number of Apple users received recent spyware alert, say investigators | TechCrunch
Cybersecurity experts who investigate spyware attacks say the number of people who received a recent threat notification from Apple is unusually high.
techcrunch.com
I wrote about that medevac plane, JetBlue flight, and Boeing 737 in this week's newsletter. Plus conspiracy theories, last night's Reddit AMA, and the White Knights. www.runasandvik.com/p/waypoints-...
Waypoints: About conspiracy theories, aviation, and the White Knights
What happens when a political movement built on conspiracy theories becomes the target of its own creation?
runasandvik.com
ICYMI I’m hosting a Reddit AMA with @zackwhittaker.com on Wednesday to answer questions about US border searches, device security, and protecting your digital data. I'll be posting as runasand_. www.runasandvik.com/p/waypoints-...
Waypoints: About Reddit AMA, China’s shadow war, and restaurant recommendations
I’m hosting a Reddit AMA with Zack Whittaker of TechCrunch on r/pwnhub on Wednesday, August 12 at 5PM PT!
runasandvik.com
I asked the FBI for information about Ivor Montagu, a 1930s communist activist and spy, and received five mostly redacted pages, including this gem. www.documentcloud.org/documents/28...
I wrote about my upcoming Reddit AMA, a podcast about China’s shadow war, and my favorite NYC restaurants in this week’s newsletter. www.runasandvik.com/p/waypoints-...
Waypoints: About Reddit AMA, China’s shadow war, and restaurant recommendations
I’m hosting a Reddit AMA with Zack Whittaker of TechCrunch on r/pwnhub on Wednesday, August 12 at 5PM PT!
runasandvik.com
Following the mass border crossing in Ceuta, Italian authorities have decided to temporarily reinstate border controls for passengers arriving in Italy on flights from Spain for all of August. Here’s the email I just received from Iberia.
Looking forward to it!
Zack Whittaker@zackwhittaker.com · 2mo agoI'm hosting an AMA with security researcher @runasand.bsky.social on August 12th at 5pm PT / 8pm ET to answer questions about the recent case of an American charged by the DOJ for allegedly wiping his phone with a "duress" password during an airport interrogation. It's the first case of its kind.
"Instead, far-right and MAGA politicians, influencers, and podcasters will immediately use the most divisive language possible in order to make voters as angry as possible, as fast as possible, regardless of what actually happened." www.theatlantic.com/ideas/2026/0...
The Far Right Is Distorting Ceuta
We’ve seen this before.
theatlantic.com
In addition to lots of indoor skydiving this week, I also started a book on Iran’s 2022 anti-government protests; discussed the GrapheneOS + U.S. border search case; and went down the manosphere rabbit hole. www.runasandvik.com/p/waypoints-...
Waypoints: About Iran, U.S. border searches, and the manosphere
I’ve been reading For the Sun After Long Nights about Iran’s 2022 Woman, Life, Freedom uprising by Fatemeh Jamalpour and former New York Times colleague Nilo Tabrizy.
runasandvik.com
While reading this @forbidden-stories.bsky.social report on Morocco's use of the Pegasus spyware, remember that Morocco in early 2023 organized an in-person hearing to "disprove" years of research by @amnestytech.bsky.social and @citizenlab.ca. forbiddenstories.org/codename-mor...
Codename “Morgan”: A look back at Morocco’s acquisition of Pegasus, involving Israel and the United Arab Emirates
From product demonstrations at a secret villa in Rabat to training sessions at NSO’s Herzliya headquarters, Forbidden Stories and its partners retrace the early stages of Morocco’s use of Pegasus.
forbiddenstories.org
Spoke to @zackwhittaker.com about the case of U.S. federal prosecutors going after an American for allegedly wiping his phone with a duress password during a border search. First case I've seen, though I've discussed the potential scenario with at-risk folks. techcrunch.com/2026/07/24/u...
US accuses American of allegedly wiping his phone using a 'duress' password during border search | TechCrunch
A U.S. citizen has asked a court to throw out the government's claim that he gave over a passcode to border authorities that wiped his phone's data, opening up fresh questions about a person's constit...
techcrunch.com
Wrote short blurbs about TrueCrypt, my Journalist and Spy project, MSG surveillance and the WIRED lawsuit, and AI in this week’s Waypoints newsletter. www.runasandvik.com/p/waypoints-...
Waypoints: About TrueCrypt, spies, and AI
Crazy to think that while Edward Snowden and I taught people to keep their data safe with TrueCrypt, the tool’s alleged creator Paul Le Roux was busy plotting murders, buying drugs from the North Kore...
runasandvik.com
