The Lockdown - Practical Privacy & Security

In this episode we're joined by Tony Daly, Managing Director of Seiber, for a deep dive into open-source intelligence (OSINT). Tony discussess what separates professional intelligence work from “spicy Googling,” how seemingly insignificant pieces of public information can expose identities and locations, and why good methodology, verification, proportionality and ethics matter. The conversation also covers digital footprints, social-media privacy, professional OSINT tools, dark-web investigations, AI and search, facial recognition, AI governance, and routes into a career in OSINT.

In the show:

1. What professional OSINT actually looks like, including the intelligence lifecycle, priority intelligence requirements, critical thinking, misinformation and disinformation.
2. How investigators pivot from tiny clues to useful intelligence using reverse-image searches, visual similarity, objects in photographs, architecture, signs, number plates and digital footprints.
3. The privacy consequences of oversharing, including location check-ins, travel patterns, family members, executive exposure, corporate intelligence and the surprising intelligence value of apps such as Untappd.
4. The legal and ethical boundaries of OSINT, including proportionality, privacy, Article 8 of the European Convention on Human Rights, surveillance and producing evidence that can withstand scrutiny.
5. Professional OSINT tools and tradecraft, including PimEyes, Maltego, Recorded Future, District 4 Labs/Darkside, DarkOwl, Indago and Epieos, plus the risks involved in dark-web investigations.
6. AI, surveillance and governance, from AI-generated search results and hallucinations to data poisoning, Flock license-plate cameras, police facial recognition and the growing financial-sector focus on AI risk.
7. Building an OSINT career through cybersecurity, anti-money laundering, journalism, due diligence, investigations and travel risk, plus training and communities including Seiber, NCSC Assured Training, OSMOSIS, and SANS.

Show Links:

• Seiber: https://www.seiber.co.uk/
• Seiber on LinkedIn: https://www.linkedin.com/company/seiberltd/
• Tony Daly at OSMOSIS: https://osmosisassociation.org/team-member/tony-daly/
• Careless People by Sarah Wynn-Williams (Amazon): https://www.amazon.com/dp/1250391237
• OSINT beginnings with BBC Monitoring: https://publications.parliament.uk/pa/cm201617/cmselect/cmfaff/732/73205.htm
• The Evolution of Digital Intelligence at the CIA: https://www.cia.gov/stories/story/intelligence-in-a-digital-world-inside-cias-directorate-of-digital-innovation/

OSINT Tools:

• PimEyes: https://pimeyes.com/
• Maltego: https://www.maltego.com/
• Recorded Future: https://www.recordedfuture.com/
• District 4 Labs: https://www.district4labs.com/
• DarkOwl: https://www.darkowl.com/
• Indago: https://indagotech.com/
• Epieos: https://epieos.com/
• Untappd: https://untappd.com/
• CyBOK, Cyber Security Body of Knowledge: https://www.cybok.org/
• Bellingcat: https://www.bellingcat.com/
• Kinahan Cartel: Wanted Narco Boss Exposes Whereabouts by Posting Google Reviews (Bellingcat): https://www.bellingcat.com/news/2024/03/30/kinahan-cartel-wanted-narco-boss-exposes-whereabouts-by-posting-google-reviews

Matrix Community Rooms:

• Matrix Community Space - https://matrix.to/#/#psysecure:matrix.org

Individual Room Links:

★ Support the show on Patreon ★

In this episode, we continue with a closer look at what cybersecurity competence actually means, and why qualifications, compliance frameworks, and public reputation are poor substitutes for understanding how real attacks work. We explore the cryptography behind Proton Mail, public and private keys, fingerprints, and what you can do with PGP word lists. We’ll also discuss passkeys, account recovery, SIM swaps, ClickFix malware, infostealers, VPN blocking, and the residential proxies that allow malicious traffic to hide behind ordinary household IP addresses.

In the show:

1. Hackers, threat actors, security influencers, and the risks created by confident but inaccurate advice
2. Kerckhoffs’s principle: designing security under the assumption that the enemy knows the system
3. How public and private keys work, including Proton Mail encryption, digital signatures, fingerprints, and independent key verification
4. Using the PsySecure Workbench and PGP word lists to make cryptographic fingerprints easier to exchange and verify
5. The problem with passkeys, and why weak account recovery can undermine their security
6. ClickFix attacks that imitate Cloudflare verification pages and trick users into running malicious terminal commands
7. How infostealers target browser data, authenticated sessions, cookies, passwords, and other valuable information
8. Why VPN traffic is increasingly blocked or challenged while attackers move toward residential proxies that resemble legitimate users
9. You are the proxy: How cheap smart home devices, streaming boxes, thermostats, and cameras, can become hidden residential proxies
10. The normalization of identity verification, digital ID checks, and other invasive systems

Show Links:

• The Hidden Backdoors Inside Millions of Smart Devices (WSJ): https://www.youtube.com/watch?v=apEPPKYgLL0
• keys.openpgp.org: keys.openpgp.org
• PsySecure Workbench: https://psysecure.com/workbench
• An Investigative Framework for Auditing the Security & Privacy of Mobile VPNs: https://www.ndss-symposium.org/wp-content/uploads/2026-s1573-paper.pdf

Matrix Community Rooms:

• Matrix Community Space: https://matrix.to/#/#psysecure:matrix.org

Individual Room Links:

• https://matrix.to/#/#lockdown-intro:matrix.org
• https://matrix.to/#/#lockdown-podcast:matrix.org
• https://matrix.to/#/#lockdown-general:matrix.org

How to check public key fingerprint from the command line:

★ Support the show on Patreon ★

Season 2 of The Lockdown is here, with a renewed focus on the overlap between privacy, security, and open-source intelligence. In this episode, Ray explains why reconnaissance should be treated as the first line of defense, not as the attacker’s free move. This episode lays out a practical way to think like a CISO in both your personal life and inside an organization. The core idea is simple: Minimize What Can Be Known, understand what you are protecting, and close the gap between having security controls and actually being protected by them.

In the show:

1. Why privacy and security should be treated as two sides of the same coin
2. Reconnaissance, OSINT, and how attackers build a picture from public information
3. Thinking like a CISO: threat modeling, risk, residual risk, and compensating controls
4. Practical privacy choices, including GrapheneOS, browsers, VPNs, prepaid SIMs, and data brokers
5. The control confidence gap, including SIM swaps, help desk attacks, security questions, and deepfakes
6. Real-world examples of reconnaissance-driven attacks, including MGM, Caesars, Marks & Spencer, and ransomware extortion
7. The updated OSINT Defense and Security Framework, plus practical homework for individuals and organizations

Show Links

• OSINT Defense & Security Framework PDF
• Weekday executive security briefing email

Matrix Community Rooms:
• Matrix Community Space - https://matrix.to/#/#psysecure:matrix.org

Individual Room Links:
• https://matrix.to/#/#lockdown-intro:matrix.org
• https://matrix.to/#/#lockdown-podcast:matrix.org
• https://matrix.to/#/#lockdown-general:matrix.org

Support the show on Patreon ★ https://www.patreon.com/TheLockdown

In this final episode of The Lockdown, I reflect on the journey of the podcast, and explaining why I’m redirecting my energy to other projects. I discuss the importance of practical privacy measures, measures over an ‘all-or-nothing’ approach, as well as sharing my thoughts on threat modeling, and address several listener questions about privacy tools and self-hosting. I also introduce a new concept from my recent blog post about the “space between” in cybersecurity, examining how compartmentalization of identities can serve as an early warning system against social engineering attacks.

In this week’s episode:

1. Why this is the final episode
2. The all-or-nothing fallacy
3. Airport facial recognition and the Clearview AI threat
4. Threat modeling for different life situations
5. The CIA triad and why 100% security doesn’t exist
6. UK and Swiss digital ID systems and their privacy implications
7. NPM breach case study and the psychology of social engineering
8. Why organizations should compartmentalize communication channels
9. Listener Q&A: MySudo virtual cards, self-hosting setup, and mobile hotspots
10. The new Privacy Tools page on PsySecure.com

Matrix Community Rooms

• Matrix Community Space - https://matrix.to/#/#psysecure:matrix.org

Individual Room Links:

• https://matrix.to/#/#lockdown-intro:matrix.org
• https://matrix.to/#/#lockdown-podcast:matrix.org
• https://matrix.to/#/#lockdown-general:matrix.org

Show Links:

• Privacy Tools Page - https://psysecure.com/privacytools/
• PsySecure ODSF Framework - https://odsf.psysecure.com
• "The Space Between" Blog Post - https://psysecure.com/ma-the-space-between-breaches
• Swiss E-ID System Information - https://www.bk.admin.ch
• Cyber Kill Chain (Lockheed Martin) - https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html
• Robert Cialdini's Principles of Persuasion - https://www.influenceatwork.com
• Daniel Kahneman's Thinking, Fast and Slow - https://www.amazon.com/Thinking-Fast-Slow-Daniel-Kahneman/dp/0374533555

- Daniel Kahneman, Thinking, Fast and Slow 

In this episode, I share news from my recent trip to the UK, noticing how it seems to have reached the epic proportions of a Black Mirror episode; from the absurd TV licensing program to the new Digital ID Brit cards that will track your behavior. I also explore how the UK may be serving as a testing ground for new levels of behavioral surveillance that could eventually spread globally. I dive into California’s $900 “smart” license plates that track your every move, centralized government digital currencies, and my predictions for the next 20 years of Orwellian surveillance.

Support the show on Patreon!

In this week’s episode:

1. The UK’s TV licensing system: Legal extortion through private contractors
2. The Reviver R-plate: $900 to track yourself in California and Arizona
3. Brit Cards: UK’s new “voluntary” Digital ID system
4. The Bank of England’s digital pound and programmable money
5. Historical patterns of control: From land ownership to neural interfaces
6. Why the UK is the blueprint for global surveillance rollout
7. Predictions for the next 20-50 years of biosurveillance

Matrix Community Rooms

• Matrix Community Space - https://matrix.to/#/#psysecure:matrix.org

Individual Room Links:

• https://matrix.to/#/#lockdown-intro:matrix.org
• https://matrix.to/#/#lockdown-podcast:matrix.org
• https://matrix.to/#/#lockdown-general:matrix.org

Show Links:

• PsySecure ODSF Framework - https://odsf.psysecure.com
• LCD License Plate (not privacy friendly!) - https://reviver.com/rplate/
• Black Mirror S03E01 "Nosedive" - https://www.imdb.com/title/tt5497778/
• Bank of England's Digital Pound - https://www.bankofengland.co.uk/the-digital-pound
• Brit Card Digital ID System - https://www.labourtogether.uk/all-reports/britcard
• TV Licensing Detector Ads (1980s-90s): 
  • The Detector Van - https://www.youtube.com/watch?v=8NmdUcmLFkw
  • "We know exactly where he is" - https://www.youtube.com/watch?v=qF3-S2sCnb8
  • Keep One Eye Open - https://www.youtube.com/watch?v=mVfOmR7gAek
  • More Powerful Dector Vans! - https://www.youtube.com/watch?v=1Q9CsRRhWQI

- Mustapha Mond (Brave New World

In this episode I address listener feedback and questions, from clarifying my stance on the “Tea” controversy to sharing practical tips from the community about Privacy.com workarounds. This episode covers some loose ends before I take a brief hiatus. I also discuss why I won’t be at Black Hat this year, share thoughts on minimalism versus practicality in privacy, and reveal my favorite Indian restaurant in Vegas for those attending Black Hat!

In this week’s episode:

1. Addressing the “Tea” controversy and clarifying my positions on doxing
2. Community solution for Privacy.com and Plaid privacy concerns
3. Contact information protection strategies when family uses social media
4. Future of capture-the-flag challenges and OSINT considerations
5. Conference attendance updates and travel

Matrix Community Rooms

• Matrix Community Space - https://matrix.to/#/#psysecure:matrix.org

Individual Room Links:

• https://matrix.to/#/#lockdown-general:matrix.org
• https://matrix.to/#/#lockdown-podcast:matrix.org
• https://matrix.to/#/#lockdown-intro:matrix.org

Show Links:

• Tea app leak article - https://www.bleepingcomputer.com/news/security/tea-app-leak-worsens-with-second-database-exposing-user-chats/
• OSMOSIS Institute - https://osmosisinstitute.org/events/
• Privacy.com - https://privacy.com

- Friedrich Nietzsche

In this episode, I discuss the challenges facing privacy-focused payment solutions like Privacy.com, exploring alternatives and the troubling rise of KYC requirements across the industry. I dive deep into the Switzerland privacy crisis that’s forcing Proton to consider relocating their infrastructure, and what this means for encrypted email providers globally. I also cover the catastrophic security failure at Tea, a women’s safety app that exposed 72,000 images including government IDs through basic incompetence, leading to harassment campaigns on 4chan.

I wrap up with thoughts on vehicle tracking through DCM/Telematics modules, why buying older vehicles might be the better privacy-conscious choice, and how embracing the stoic lifestyle aligns with both privacy and my own philosophical principles.

In this week’s episode:

1. Privacy.com troubles: Account freezes, limited alternatives, and the KYC nightmare
2. Switzerland’s surveillance crisis: Why Proton is threatening to leave and relocating to Germany/Norway
3. Email provider comparison: Proton vs Tutanota vs Atomic Mail, and understanding intelligence alliances
4. Tea app breach: How 72,000 IDs and 1.1 million private messages ended up on 4chan
5. Vehicle tracking: DCM modules, telematics, and why your car is spying on you
6. Philosophy of privacy: Stoicism, minimalism, and why less is more

Matrix Community Rooms

• Matrix Community Space - https://matrix.to/#/#psysecure:matrix.org

Individual Room Links:

• https://matrix.to/#/#lockdown-general:matrix.org
• https://matrix.to/#/#lockdown-podcast:matrix.org
• https://matrix.to/#/#lockdown-intro:matrix.org

Show Links:

• Privacy.com - https://privacy.com
• Cloaked.com - https://cloaked.com
• Proton Warrant Canary - https://protonvpn.com/blog/transparency-report/
• Climate Activist Arrest - https://proton.me/blog/climate-activist-arrest and https://www.wired.com/story/protonmail-amends-policy-after-giving-up-activists-data/
• Tuta Crypt - https://tuta.com/documents/tuta-crypt-spec.pdf
• Proton elliptic curve cryptography - https://proton.me/blog/elliptic-curve-cryptography
• SimpleLogin - https://simplelogin.io
• HashiCorp Vault - https://www.vaultproject.io
• RAM IS SPYING ON YOU (Cozy Living Machine) - https://www.youtube.com/watch?v=0-Y1SUSRqNU
• Meditations by Marcus Aurelius - https://www.amazon.com/Meditations-New-Translation-Modern-Library-ebook/dp/B000FC1JAI

- Marcus Aurelius

In this episode, I address listener feedback and corrections regarding use of public Wi-Fi, MAC addresses, and aliases. I dive deep into the nuances of MAC address randomization on GrapheneOS versus Apple’s private Wi-Fi addresses, explaining why GrapheneOS offers superior privacy protection. I discuss the real threats of public Wi-Fi in 2025 (hint: it’s not hackers with Wireshark), and share my approach with aliases.

I also cover the rising threat of infostealers like Atomic Info Stealer for macOS, the dangerous intersection of gaming cheats and malware, and why I avoid third-party antivirus software. Most importantly, I address the GrapheneOS controversy: the loss of a senior developer to military conscription, Google’s strategic pivot that threatens custom ROMs, and why claims of GrapheneOS “dying” are misinformation spread by those with competing agendas.

In this week’s episode:

1. Clarifications and Corrections: Public Wi-Fi, MAC addresses, and alias management
2. MAC address randomization: GrapheneOS vs Apple’s implementation
3. The real threats of public Wi-Fi in 2025
4. Info stealers and video games can be a privacy nightmare
5. GrapheneOS controversy: Developer conscription, Google’s lockdown, and the future of custom ROMs
6. Why antivirus software might be the malware you’re trying to avoid

Matrix Community Rooms

• Matrix Community Space - https://matrix.to/#/#psysecure:matrix.org

Individual Room Links:

• https://matrix.to/#/#lockdown-general:matrix.org
• https://matrix.to/#/#lockdown-podcast:matrix.org
• https://matrix.to/#/#lockdown-intro:matrix.org

Show Links:

• MAC Address Lookup - https://maclookup.app/
• OUI Lookup - https://oui.is/
• 33mail - https://www.33mail.com/
• OpenSnitch - https://github.com/evilsocket/opensnitch
• Privacy.com - https://privacy.com
• Lithic - https://lithic.com
• Kaspersky and Russian Government - https://en.wikipedia.org/wiki/Kaspersky_and_the_Russian_government
• Google Not Killing AOSP - https://www.androidauthority.com/google-not-killing-aosp-3566882/
• GrapheneOS on Developer Conscription - https://grapheneos.social/@GrapheneOS/114359660453627718
• GrapheneOS on OEM Partnerships (June 19) - https://grapheneos.social/@GrapheneOS/114671100848024807
• GrapheneOS Response to Misinformation - https://grapheneos.social/@GrapheneOS/114825492698412916
• GrapheneOS on iPhone Security - https://grapheneos.social/@GrapheneOS/114824816120139544

- Kevin Mitnick

In this episode, I explore the difference between the military mindset and the more stealth approach of minimization in cybersecurity. I share the results from the Ghost in the Source Capture the Flag (CTF) challenge, revealing how the winners cracked the AES encryption using dictionary attacks, keyword harvesting and the cipher tool hidden in robots.txt. I discuss why the “assume breach” mentality just leaves the doors wide open, using examples from Kevin Mitnick’s 1981 Pacific Bell infiltration to modern ransomware groups like Scattered Spider who breached MGM and Marks & Spencer through social engineering.

I also cover practical tactics for using public Wi-Fi, data curation techniques, the invisible surveillance net including Stingray devices, and provide a deep dive into GrapheneOS covering user profiles, app sandboxing, network controls, sensor permissions, and the proper use of sandboxed Google Play services.

In this week’s episode:

1. Ghost in the Source Capture the Flag challenge results
2. The military mindset problem in cybersecurity
3. Strategic use of public Wi-Fi for account creation and privacy techniques
4. Data curation tactics, and “Minimizing What Can Be Known”
5. Invisible surveillance net and Stingray devices
6. GrapheneOS discussion on user profiles, app sandboxing, network controls, sensors permissions, sandboxed Google Play services, and security architecture

Matrix Community Rooms

• Matrix Community Space - https://matrix.to/#/#psysecure:matrix.org

Individual Room Links:

• https://matrix.to/#/#lockdown-general:matrix.org
• https://matrix.to/#/#lockdown-podcast:matrix.org
• https://matrix.to/#/#lockdown-intro:matrix.org

Show Links:

• Noam Chomsky on Internet Privacyhttps://www.youtube.com/watch?v=QIWsTMcBrjQ
• Noam Chomsky on Advertising - https://www.youtube.com/watch?v=PfIwUlY44CM
• TryHackMe Platform - https://tryhackme.com
• Hack the Box - https://hackthebox.com
• Wired Article on DNC Stingray Surveillance - https://www.wired.com/story/2024-dnc-cell-site-simulator-phone-surveillance/
• IntelTechniques Data Removal Guide - https://inteltechniques.com/workbook.html
• Optery Data Broker Removal - https://optery.com
• Graphene OS - https://grapheneos.org

- Hajime Ryudo

In this episode, I discuss three key strategies for maintaining privacy and security across your physical mailbox, email, and phone. I discuss the growing Matrix community, explore alternative mailing solutions using co-working spaces, detail a four-tier email strategy, and examine the concerning spread of Flock ALPR cameras. I also share insights on anonymous eSIM options and answer listener questions about dealing with Know-Your-Customer requirements.

In this week’s episode:

1. Joining the Matrix community with Element
2. Physical mailbox strategies: UPS stores, virtual CMRA addresses, and co-working spaces
3. Four-tiered email approach using ProtonMail, Fastmail, SimpleLogin, and Gmail sock puppet
4. Mobile phone privacy with Mint Mobile and anonymous eSIM options
5. The Flock ALPR camera threat and how to protect yourself
6. Listener questions: Australian SIM card strategies with KYC requirements
7. Capture the Flag challenge details for June 21st

Matrix Community Rooms

It seems on Element X, it doesn’t list the rooms associated with the Matrix space, so you can click on each of these links to join the rooms:

• https://matrix.to/#/#lockdown-general:matrix.org
• https://matrix.to/#/#lockdown-podcast:matrix.org
• https://matrix.to/#/#lockdown-intro:matrix.org

Show Links:

• Matrix Clients - https://matrix.org/clients
• Matrix Community - https://matrix.to/#/#psysecure:matrix.org
• Smarty Address Lookup - https://www.smarty.com/products/single-address
• Expired Domains - https://www.expireddomains.net/
• Stealths.net (Anonymous eSIMs) - https://stealths.net/
• DeFlock.me (ALPR Camera Map) - https://deflock.me/
• Flock Safety Privacy Policy - https://www.flocksafety.com/privacy-policy
• EFF Article on DeFlock - https://www.eff.org/deeplinks/2025/02/anti-surveillance-mapmaker-refuses-flock-safetys-cease-and-desist-demand
• CTF Challenge Rules - https://psysecure.com/ctf

- “Future of Communications” Alan Watts

Official Website: https://psysecure.com

Podcast music: The R3cluse