Technology & Surveillance Theories

On 11 March 2025, National Security Advisor Mike Waltz accidentally added The Atlantic editor Jeffrey Goldberg to a Signal group chat called 'Houthi PC small group' that included Defense Secretary Pete Hegseth, VP JD Vance, Secretary of State Marco Rubio, DNI Tulsi Gabbard, senior adviser Stephen Miller, envoy Steve Witkoff, and others. The group discussed and coordinated US military strikes on Yemen. Goldberg published his account on 24 March 2025 with some details redacted; Hegseth had shared specific weapons and strike timings approximately two hours before attacks occurred. Congressional hearings followed. Waltz was subsequently reassigned to serve as US Ambassador to the United Nations.

Avid Life Media's extramarital-affair dating site Ashley Madison was breached by a hacker group calling itself the 'Impact Team,' which exfiltrated more than 32 million user records and 25GB+ of data. The Impact Team issued a first leak on 19 July 2015 and released the full dump on 18 August 2015 via BitTorrent and Tor. The data included names, email addresses, home addresses, sexual preferences, and partial payment details. At least two suicides were documented in direct connection with the exposure — a Texas pastor and a San Antonio police captain. Avid Life Media CEO Noel Biderman resigned on 28 August 2015. The FTC and state attorneys general reached a $11.2 million civil settlement and a $1.66 million fine in July 2016. Subsequent analysis found approximately 95% of female profiles were bots, and legacy systems had stored passwords in plaintext.

On 27 June 2017 a destructive malware campaign — publicly branded NotPetya — erupted from Ukraine and spread globally within hours, masquerading as ransomware while in reality being a pure wiper designed to maximise damage. US CISA, UK NCSC, and Five Eyes partners attributed the attack to Russian GRU Unit 74455 (Sandworm) in February 2018; the US DOJ indicted six GRU officers in October 2020. The supply-chain entry point was a trojanised update to M.E.Doc, a Ukrainian accounting software package used by roughly 80 percent of Ukrainian businesses. Global losses exceeded $10 billion, making it the costliest cyberattack in recorded history.

Between August 2016 and April 2017, an anonymous group calling itself the Shadow Brokers released a series of files containing what appeared to be NSA Equation Group/Tailored Access Operations (TAO) cyberweapons, including the EternalBlue, EternalRomance, EternalSynergy, and DoublePulsar exploits. Microsoft patched the primary vulnerability (MS17-010) on 14 March 2017 after a pre-disclosure from the NSA; within two months the exploits were weaponised in WannaCry (May 2017) and NotPetya (June 2017). The identity and affiliation of the Shadow Brokers has never been definitively established; leading theories include Russian intelligence theft, an NSA insider, or both.

On 23 December 2015, cyberattackers disrupted electricity supply to approximately 230,000 customers in Ukraine's Ivano-Frankivsk Oblast for one to six hours — the first publicly confirmed successful cyberattack on civilian power grid infrastructure anywhere in the world. US-CERT (IR-ALERT-H-16-056-01), the Ukrainian SBU, and security researchers attributed the attack to Sandworm (GRU Unit 74455), who used spear-phishing to compromise three Ukrainian regional electricity distribution companies, deployed the BlackEnergy malware and KillDisk wiper, and launched a telephony denial-of-service to hamper restoration. A follow-on attack on 17 December 2016 (Industroyer/Crash Override) struck the Kiev transmission substation.

The Equifax breach exposed the personally identifiable information of 147.9 million Americans — Social Security numbers, dates of birth, addresses, and driver's licence numbers — via an unpatched Apache Struts vulnerability (CVE-2017-5638). The patch was available on 8 March 2017; the breach began on 13 May 2017 and was discovered internally on 29 July 2017. Equifax did not disclose publicly until 7 September 2017. In the interim, the company's CFO and three other executives sold approximately $1.8 million in stock. Two officers — Jun Ying and Sudhakar Bonthu — were later charged with insider trading. CEO Richard Smith resigned on 26 September 2017. The $700 million FTC and state AG settlement in July 2019 remains one of the largest data-breach settlements in US history.

Between 27 November and 18 December 2013, attackers stole 40 million payment-card numbers and 70 million records of personal information from Target's point-of-sale systems. Entry was gained via stolen credentials belonging to Fazio Mechanical Services, an HVAC vendor with network access. BlackPOS RAM-scraping malware was installed on Target's POS terminals. Journalist Brian Krebs first disclosed the breach publicly on 18 December 2013, the same day Target confirmed it. CEO Gregg Steinhafel resigned on 5 May 2014; CIO Beth Jacob resigned in March 2014. Target reached an $18.5 million settlement with state AGs in May 2017. Total costs exceeded $300 million.

The Marriott Starwood breach exposed approximately 339 million guest records — including passport numbers, encrypted payment card details, and travel history — from a database that had been compromised since 2014. Marriott acquired Starwood Hotels in September 2016 without discovering the intrusion, which continued for more than two years post-acquisition. The breach was disclosed on 30 November 2018. US and UK intelligence attributed the attack to APT10, a hacking group linked to China's Ministry of State Security, based on tools and techniques. The UK's ICO issued an initial GDPR fine of £99.2 million in July 2019, subsequently reduced to £18.4 million in October 2020. Seven million UK records were affected.

AT&T technician Mark Klein revealed in 2006 that a secret room on the 7th floor of AT&T's 611 Folsom Street facility in San Francisco had been equipped with a Narus STA 6400 deep-packet inspection system fed by a fiber-optic splitter. Klein's sworn declarations in EFF v. AT&T (Hepting) showed AT&T had allowed the NSA to tap internet backbone traffic without warrants. The New York Times had disclosed the broader warrantless wiretap program in December 2005. The FISA Amendments Act of 2008 granted retroactive immunity to telecoms. The room and the surveillance program are confirmed.

On 6 June 2013, the Washington Post (Barton Gellman) and The Guardian (Glenn Greenwald) simultaneously published NSA PowerPoint slides leaked by contractor Edward Snowden revealing PRISM — a Section 702 Foreign Intelligence Surveillance Act program that compelled direct upstream data collection from Google, Facebook, Yahoo, Microsoft, Apple, AOL, Skype, YouTube, and PalTalk. NSA Director Keith Alexander testified to Congress. The Privacy and Civil Liberties Oversight Board (PCLOB) issued a detailed 2014 report confirming the program's scope. Companies denied 'direct access' but acknowledged compliance with court orders. The program is confirmed.

On 21 June 2013, The Guardian published reporting by Ewen MacAskill, Julian Borger, and Nick Hopkins revealing TEMPORA — a GCHQ program operating from the Bude facility in Cornwall that tapped more than 200 transatlantic fiber-optic cables and buffered up to 21 petabytes of data per day on a rolling 3-day storage window. Related programs included INCENSER, MUSCULAR (shared with NSA), and CARBOY. The Investigatory Powers Act 2016 codified UK bulk collection powers. The European Court of Human Rights ruled in Big Brother Watch v UK (2018, 2021) that some UK interception practices violated ECHR Article 8. Confirmed.

The CIA and West German BND covertly co-owned Swiss cipher-machine manufacturer Crypto AG from 1970, selling rigged encryption hardware to approximately 120 governments and militaries worldwide. For decades the agencies read the encrypted traffic of foreign governments while those governments believed their communications were secure. A joint WaPo/ZDF/SRF investigation published 11 February 2020 — drawing on a classified internal CIA history called the Minerva Files — confirmed the operation. The BND exited in 1993 citing compromise risk; the CIA continued as sole owner until 2018. The operation is assessed as confirmed by primary documentation.

Russian SVR foreign intelligence (APT29 / Cozy Bear / Nobelium) compromised the build pipeline of SolarWinds' Orion IT-monitoring platform in late 2019, inserting a trojanized DLL (SUNBURST) into a signed software update distributed to approximately 18,000 customers. Of those, roughly 100 high-value targets were enumerated for deeper intrusion, including nine US federal agencies — Treasury, Commerce, State, DHS, and others — as well as Microsoft, FireEye, and Mimecast. FireEye disclosed the attack on 8 December 2020 after discovering its own breach. CISA issued Emergency Directive 21-01 on 13 December 2020. The operation is one of the most significant intelligence-gathering cyber-intrusions ever documented against the United States government.

President Bush secretly authorised the NSA to conduct warrantless surveillance of Americans' international communications beginning in October 2001, in a programme codenamed Stellar Wind. The programme bypassed the Foreign Intelligence Surveillance Court. A 2004 Department of Justice revolt — dramatised by the Comey/Ashcroft hospital confrontation — nearly ended it. The New York Times revealed the programme in December 2005 after sitting on the story for a year. Stellar Wind is confirmed by declassified NSA documents, congressional testimony, and multiple Inspector General reports.

XKeyscore is a global NSA analytic system that allows analysts to search across vast repositories of intercepted internet content and metadata by selector — email address, phone number, IP address, or keyword. Revealed by the Guardian in July 2013 using Snowden training documents, XKeyscore was described in NSA materials as the agency's 'widest-reaching' signals intelligence analytic tool. Analysts could query billions of records covering email, chat, browsing history, and search queries without prior court approval for individual searches.

Revealed in September 2013 by a joint ProPublica, New York Times, and Guardian investigation using Snowden documents, Bullrun was a classified NSA programme to covertly undermine encryption standards, introduce backdoors into commercial products, and work with or coerce technology companies to weaken their cryptographic implementations. The most specific confirmed element was the NSA's role in promoting Dual_EC_DRBG as an NIST standard with a likely built-in backdoor. A December 2013 Reuters report revealed that RSA Security had received $10 million from the NSA to make Dual_EC the default random number generator in its BSAFE toolkit.

The MUSCULAR programme, revealed by the Washington Post in October 2013 based on Snowden documents, showed that the NSA and GCHQ had secretly tapped the unencrypted fibre-optic links connecting Google's and Yahoo's data centres to one another. Unlike PRISM, which used legal orders to compel disclosure, MUSCULAR accessed data in transit on private backbone infrastructure without the companies' knowledge. The disclosure prompted both companies to encrypt their internal links. MUSCULAR is confirmed by NSA slides published by the Washington Post.

In 2024, two men who had raised safety concerns about Boeing aircraft died under circumstances that attracted intense scrutiny. John Barnett, a former Boeing quality manager who was mid-deposition in a lawsuit against the company, was found dead in his pickup truck on March 9 2024 in North Charleston, South Carolina; the Charleston County Coroner ruled the death a self-inflicted gunshot wound. Joshua Dean, a Spirit AeroSystems quality control inspector who had raised concerns about defects in the 737 MAX fuselage, died in May 2024 of a rapid MRSA infection at age 45. The conspiracy framing — that Boeing or its allies eliminated both men to silence their testimony — is the active claim. Official rulings for both deaths are documented; no direct link to Boeing action has been established.

Pegasus is a commercial surveillance software package developed by the Israeli firm NSO Group and sold exclusively to government clients. Its existence and capabilities were first definitively confirmed by Citizen Lab (University of Toronto) forensic analysis beginning in 2016. The 2021 Pegasus Project — a coordinated investigation by Forbidden Stories with Amnesty International and 80 journalists across 17 media organisations — documented over 50,000 phone numbers in a data leak, identifying journalists, human rights activists, lawyers, heads of state, and associates of murdered journalist Jamal Khashoggi as apparent surveillance targets. NSO Group disputes characterisations of misuse; the US Commerce Department added NSO to its Entity List in November 2021; Apple and Meta both filed lawsuits against NSO. The surveillance capabilities are forensically confirmed; the scale of alleged misuse is documented; the specific authorisations for each target remain contested.

Claims that conflict footage is AI-generated, staged, or misattributed, sometimes used to deny casualties or assign false blame.

Claims that real disaster survivors, victims, or witnesses are AI-generated fabrications, often based on compression artifacts or synthetic-media panic.

Claims that real crisis footage, victims, or witnesses are AI-generated fabrications.

Claims by targeted-individual communities that coordinated networks surveil, harass, or electronically attack them.