Handala’s Livni Phone “Leak” and the Signature Reduction Requirements of War

What does the Handala leak of Tzipi Livni’s phone data teach officials about signature reduction in wartime?

On October 15, 2026, Distributed Denial of Secrets published 44.40 MB of text messages and contacts attributed to Handala, a persona that Check Point, Microsoft, and the FBI link to Iran’s intelligence ministry. The lesson for officials: in wartime, a phone’s contacts, chats, and cloud sessions are targeting data, and their digital signature must shrink to match.

Other leak reporting here includes an alleged Saudi spy-list leak and Hexane’s AfD document dump.

Distributed Denial of Secrets, the transparency collective known as DDoSecrets, posted the set on October 15, 2026, under the plain title “Tzipi Livni mobile.” Its release page describes “Text messages and contact information taken from the mobile device of Tzipi Livni,” a former deputy prime minister, foreign minister, and justice minister. The page lists Handala as the source, puts the download at 44.40 MB, and files the set under “Hack, Cyberwar, Allegations of State Sponsorship.”

Handala claimed far more than a data dump. The group said it had published “120 pages of information about her contacts,” Tehran-based WANA reported. It alleged that Livni and Prime Minister Benjamin Netanyahu “had maintained behind-the-scenes contacts and cooperation” despite her public opposition, and it referred to alleged meetings in Qatar and Dubai. Those political claims are Handala’s. The release description does not establish them.

The leak matters less for what it says about Livni than for what it says about every official who carries a phone into a war. A contact list is a map of a network. A chat history is a record of intent. A synced account is a second door into both.

Key Takeaways

• Handala is assessed by Check Point Research, Microsoft, MITRE, and the FBI to be a front for Iran’s Ministry of Intelligence and Security (MOIS).
• Its operations mix real intrusions with exaggeration and targeting. In December 2025 it claimed to have hacked a former prime minister’s iPhone; his office said only his Telegram account was accessed.
• Iran’s cyber bench grew from hired contractors in the early 2010s to state-run training and recruitment pipelines, according to U.S. indictments, Treasury designations, and Recorded Future research.
• A 117-page contact directory branded “Naem Spy Tool HANDALA,” reviewed by OctoProbe, lists 2,099 contacts, and about 90 percent of its phone numbers are Israeli. Its ID column is consistent with Telegram account identifiers.
• Of the 2,060 directory entries with numbers, OctoProbe confirmed sixty-six public figures, including two former Israeli prime ministers, about sixteen ministers and lawmakers, five security figures, and six former foreign heads of state or government. Being listed shows only that a number was stored under that name.
• In an initial API-based expansion round on a sample of sixty-seven public-figure numbers, about thirty-five matched to breach records for the named person, five resolved to unrelated people on shared or recycled lines, one was mislabeled, and twenty-six had no results in this initial round. A breach match is not proof a line is active; HLR checks are the activity test. Lavrov’s entry is HLR-active on Russia’s MTS network; the initial round produced no further expansion. Proving the directory came from Livni’s handset would take a fuller forensic export of the device.
• CISA and Britain’s National Cyber Security Centre call for official work on managed devices and accounts, phishing-resistant logins, expiring messages, and limited location exposure. The Livni and Bennett leaks show what sat outside those lines.

Hack or Psyop? Separating the Proof From the Pitch

Handala runs two operations at once. One is technical: break into a network or an account and take data. The other is psychological: announce the hack, inflate it, name people, and threaten them. Microsoft has a name for the blend. It calls them cyber-enabled influence operations and defines a cyber persona as “A manufactured public-facing group or individual that takes responsibility for a cyber operation while providing plausible deniability for the underlying group or nation responsible,” according to its February 2024 Iran report.

The same report found that Iran’s operations paired “opportunistic cyber targeting with influence operations that often mislead the precision or scope of impact.” Google’s threat intelligence team reached a similar conclusion about pro-Iran hack-and-leak personas, calling their claims “largely exaggerated and misleading” in its February 2024 war report.

The FBI put it more bluntly. In a March 20, 2026, FBI Flash, the bureau said MOIS proxies run hack-and-leak operations “which blend technical compromises with disinformation.” It added: “The campaigns typically involve the theft of perceived sensitive data, its manipulation or selective exposure, and public distribution through aligned media channels to maximize reputational or political damage.”

The public record shows the gap between Handala’s claims and what has been demonstrated.

The Bennett case is the template. Handala published what it called the contents of his phone in “Operation Octopus,” Ynet reported. His office first said the phone wasn’t hacked, then acknowledged that “unauthorized access was gained to his Telegram account,” the Times of Israel reported. Bennett said the material in circulation included chats that were “some authentic and others fabricated.”

The Israel-based threat intelligence firm KELA examined the dump. “All contacts were linked to active Telegram accounts, confirming the data originated from Telegram itself rather than the underlying devices,” it wrote. Most of the so-called chat conversations “were empty contact cards auto generated by Telegram during synchronization.”

The targeting side is not hypothetical. When the Justice Department seized four MOIS-linked domains in March, including two Handala sites, it said MOIS used them for “calling for the killing of journalists, regime dissidents, and Israeli persons.” One post, the department said, told Israeli personnel: “Your iPhone 12 Pro Max holds no security for us; we even know your exact location…” The department said the domains shared a “playbook” of destructive and disruptive cyberattacks and “‘faketivist’ psychological operations using data stolen via hacking.”

The September Na’em claim shows the pitch at work. Handala said in September that it had accessed the phones of hundreds of people tied to Israel’s security apparatus, Al-Quds reported. WANA reported on September 18 that the group published images of about 700 of them. Handala said the United States, Britain, and the Netherlands had issued a joint statement warning about the tool. The joint advisory those three governments did publish, on September 15, covers a malware family called CHOSEN BRICK. “In all observed instances, the malware has been exclusively targeted at the Windows operating system,” the U.K. National Cyber Security Centre wrote. Na’em appears nowhere in it.

Who Is Handala?

Handala, also styled Handala Hack, appears to take its name and imagery from a Palestinian cartoon character, according to Check Point. Researchers and the U.S. government tie it to Iran’s intelligence ministry. These are assessments, and each is attributed below.

• Check Point Research assessed in March 2026 that “Handala Hack is an online persona operated by Void Manticore (aka Red Sandstorm, Banished Kitten), an actor affiliated with Iranian Ministry of Intelligence and Security (MOIS).” It said the persona has been used extensively since late 2023.
• Microsoft lists Red Sandstorm as an Iranian actor also known as Storm-0842, Banished Kitten, and Void Manticore in its naming table. Its 2024 report assessed that MOIS-linked Storm-0842 ran wiper attacks in Israel and Albania.
• MITRE ATT&CK describes Void Manticore as a group “assessed to operate on behalf of Iran’s Ministry of Intelligence and Security (MOIS)” and lists Handala Hack as its “current primary persona” in its group profile.
• The FBI said in a March 2026 FBI Flash that it “assesses Handala Hack is linked to the online entity ‘Homeland Justice,’ also operated by Iran MOIS cyber actors.”
• Google recorded the “Handala Hack” persona publicizing wiper activity against Israel in December 2023 and noted that Israel’s National Cyber Directorate attributed the activity to an Iranian group.

Check Point also described the group’s tools as ordinary. “Like many destructive threat actors, Handala relies on relatively simple TTPs, largely aiming for quick, opportunistic wins through hands-on operations against its targets,” it wrote. TTPs are tactics, techniques, and procedures. The group’s discipline has slipped under wartime pressure: “Since the start of the war, the actor has struggled to maintain this level of operational security.”

From Hired Hands to a Homegrown Cyber Cohort

Iran did not start with a bench like this. A decade ago, the regime rented its hackers. As the program matured, it began to train and recruit its own.

The Contractor Era

The clearest early record is a 2016 federal indictment. Seven Iranians employed by two Iran-based companies, ITSecTeam and Mersad, were charged with denial-of-service attacks, floods of junk traffic that knock websites offline, against forty-six victims, mostly in the U.S. financial sector, between late 2011 and mid-2013. An indictment is an accusation, and the defendants are presumed innocent. The Justice Department said the two firms “performed work on behalf of the Iranian Government, including the Islamic Revolutionary Guard Corps.”

Two details show how informal the arrangement was. One defendant “received credit for his computer intrusion work from the Iranian government towards his completion of his mandatory military service requirement in Iran.” Another, a Mersad co-founder tied to the Ashiyane Digital Security Team hacking group, “has also provided training to Iranian intelligence personnel.”

Recorded Future’s Insikt Group mapped the system in 2018. Drawing on a former Iranian hacker, it reported that “an ideologically and politically trusted group of middle managers translate intelligence priorities into segmented cyber tasks which are then bid out to multiple contractors.” It estimated “over 50 estimated contractors vying for Iranian government-sponsored offensive cyber projects.”

Front companies rebranded when sanctioned. Treasury designated Net Peygard Samavat in February 2019 for supporting the IRGC’s cyber arm, saying the firm was involved in a campaign to plant malware on the computers of current and former U.S. counterintelligence agents. In 2021 it designated the same firm under its new name, Emennet Pasargad, over a 2020 U.S. election influence operation. “The company rebranded itself to evade U.S. sanctions and continue its disruptive cyber operations against the United States,” Treasury said. Microsoft tracks Emennet as Cotton Sandstorm.

The firm’s manager, Mohammad Bagher Shirinkar, shows how the contractor tier fed the command tier. Treasury designated him in 2019 and re-designated him in 2021, identifying him as Emennet’s manager. In February 2024 it named him among the “senior officials of the IRGC-CEC,” the Guard’s Cyber-Electronic Command, in its 2024 action.

The Pipeline Era

By the 2020s, the record shows a deliberate effort to grow talent at home.

Universities sit close to the program. Recorded Future noted in 2018 that “Iranian academic institutions play a contractor-like role” and that Imam Hossein University “was founded by the IRGC.” In a 2020 Insikt report, it assessed that “tertiary academic institutions, such as the Imam Hossein University, are highly likely to continue to assist the Iranian cyber program and enhance the capabilities of regime-aligned operators.” The same report, citing leaks by the dissident outlet Black Box, listed Sharif University and Amirkabir University among seven schools where employees of the alleged MOIS contractor Rana Institute had studied or taught. Recorded Future cautioned that it had “not comprehensively corroborated” the information such dissident groups released and that one or more of them may have been set up to spread disinformation.

The Ministry of Intelligence built its own school. In October 2022, Treasury designated the Ravin Academy and its two co-founders, both described as MOIS members. Mojtaba Mostafavi, it said, “was directed by the MOIS to train and recruit hackers.” The academy, Treasury wrote, “trains individuals in cyber security and hacking, and recruits from among these trainees for the MOIS.” Its listed services include “mobile penetration testing.”

The Guard moved from contractors to its own employees. In September 2024, the Justice Department charged three IRGC employees with conspiring to hack the accounts of current and former U.S. officials, journalists, and people tied to a presidential campaign, and with leaking stolen campaign material. The indictment alleges they used that access to help the IRGC target a former official and others, gathering information “including their means of identification, correspondence, travel information, lodging information and other information regarding their whereabouts,” the department said.

The ecosystem still leans on outside help where it pays. Check Point reported in March 2026 that “Iran-linked actors are increasingly engaging with the cyber crime ecosystem,” with Void Manticore among the MOIS-linked groups using criminal tools, in a separate report.

OctoProbe’s assessment: the public record supports a trajectory from a nascent program that rented skills to a developing one that trains, recruits, and employs its own operators, while still buying access and tools from criminals. Handala’s mix of simple intrusion and loud messaging fits a developing program, not a mature one.

What the Leaked Contact Directory Shows

OctoProbe reviewed a 117-page PDF branded “Naem Spy Tool HANDALA” and titled “Contact Directory.” The branding matches the “Na’em” tool Handala promoted in September. Each page carries the header “2,099 CONTACTS” and a three-column table: a numeric ID, a contact name, and a mobile number. The document metadata shows it was generated on October 14, 2026, one day before the DDoSecrets release, with the open-source ReportLab PDF library. Handala’s claim of “120 pages” of contacts, as WANA reported it, is close to the file’s 117 pages.

OctoProbe is not publishing any entry. The analysis below is aggregate only.

• Scale: The header lists 2,099 contacts. About 2,060 entries carry a mobile number.
• Geography: Of those numbers, 1,852, or about 90 percent, carry Israel’s +972 country code. The rest are spread across about fifty other countries and territories, led by the United States, the United Kingdom, and France.
• Names: About four in five entries are written in Hebrew script, and about a quarter include Latin letters. More than half are a single word, such as a first name or nickname, which is typical of a personal phone book.
• IDs: The ID column runs in ascending order from seven to ten digits, and the largest values need more than 32 bits to store.

That last detail is a clue. Telegram documents that its user IDs “may have more than 32 significant bits,” but that each “has at most 52 significant bits,” in its Bot API reference. The directory’s IDs fit that format. OctoProbe’s assessment: the directory is consistent with an export of contacts tied to Telegram accounts, the same pattern KELA documented in the Bennett leak. That would point to account-level access, at least for this file, rather than proof of a handset compromise. The format alone cannot settle the question, and the full 44.40 MB release also includes text messages.

Who Is in the Directory?

The directory holds the personal numbers of dozens of public figures. Of the 2,060 entries with numbers, an OctoProbe investigation confirmed sixty-six public figures: two former Israeli prime ministers, current and former ministers and lawmakers, security chiefs, diplomats, and foreign leaders and ministers from Europe, the Caucasus, the Gulf, and beyond.

The only tie between any of these people and the leak is that a number was stored in the directory under their name or title. Being listed implies no wrongdoing and no relationship beyond being a contact. Some entries carry a title rather than a name. Those are described here as entries labeled as an ambassador, minister, or president; they rest on the label, not on a verified identity.

The Israeli names span the political map. Former Prime Ministers Ehud Olmert and Naftali Bennett are both listed; Handala leaked Bennett’s own Telegram contacts in December 2025. So are former Likud minister and U.N. ambassador Gilad Erdan, Ehud Barak’s former chief of staff Gilead Sher, Arab political leader Mohammad Barakeh, and former minister Orly Levy-Abekasis. Pnina Tamano-Shata and Gadeer Mreeh appear under the Hebrew abbreviation for Knesset member. Entries stored under Gilad Kariv and Merav Michaeli are staff lines — a spokesperson’s and an assistant’s number, as the directory labels indicate — not the principals’ own handsets. The security entries include former IDF spokesman Daniel Hagari, filed under the Hebrew abbreviation for the IDF, and former national security adviser Meir Ben-Shabbat. Tal Becker, a former Foreign Ministry legal adviser who was on Israel’s legal team at the International Court of Justice in 2024 and one of Livni’s closest advisers when she was foreign minister, is also listed.

The foreign entries reach well beyond Israel. Russian Foreign Minister Sergey Lavrov appears under his surname, written in Hebrew. Six former heads of state or government are listed, from Croatia’s Kolinda Grabar-Kitarović and New Zealand’s Helen Clark to Greece’s George Papandreou, along with an entry labeled as the president of Azerbaijan. An entry labeled as Israel’s ambassador to Greece traces to Irit Ben-Abba, who held that post from 2014 to 2019. An entry labeled as the Bulgarian foreign minister traces to Daniel Mitov, who served in that role from 2014 to 2017. An entry labeled as Israel’s ambassador to Morocco traces instead to Yossi Ben-David, a former mayor of Tiberias — a label mismatch, not a confirmed ambassadorial line. World Health Organization Director-General Tedros Adhanom Ghebreyesus and former U.N. political affairs chief Jeffrey Feltman are listed too. Journalists also appear, including veteran Middle East commentator Ehud Yaari, war correspondent Ron Ben-Yishai, news anchor Yonit Levi, and New Yorker editor David Remnick, along with foreign correspondents.

The security finding is plain. The personal mobile numbers of current and former Israeli officials, security figures, diplomats, and foreign leaders sat in one contact directory that an Iran-linked group has now published. DDoSecrets lists Handala as the source and warns, on its release page, that cyberwar releases carry an increased chance of “altered or implanted data.”

The Lavrov Entry

The directory holds a Russian mobile number stored under Lavrov’s surname in Hebrew. A carrier lookup — an HLR check, which shows whether the network currently recognizes the line — returned an active, connected handset on Russia’s MTS network as of October 23, 2026. The line was not ported and was not roaming. OctoProbe ran that same class of check across the public-figure numbers to confirm which lines the networks still treat as live.

A foreign minister holding a Russian foreign minister’s number is not unusual in the course of official duties. Livni served as Israel’s foreign minister and as a chief negotiator. The listing fits that pattern.

The initial round produced no further expansion — no breach records and no linked accounts — consistent with, though not proof of, diplomatic or dedicated burner-style lines, which are common for diplomats and senior officials with unlisted numbers.

How Do Analysts Validate a Hack-and-Leak Dump?

A contact directory alone cannot prove it came from a particular phone. Two different checks answer two different questions. An HLR carrier lookup shows whether the network currently recognizes the line — the activity check. Matching a number to breach records for the named person shows whether the label on the contact is consistent with public data; it is not proof the line is active today.

OctoProbe’s investigative dispatch ran account and username checks on the directory in about an hour, and ran HLR lookups on the public-figure sample. The Lavrov entry is the documented HLR result: an active, connected handset on Russia’s MTS network as of October 23, 2026; the initial round produced no further expansion. Account and username checks, separately, found many numbers attached to profiles consistent with the people they are labeled as. Together, that supports a genuine contact list rather than fabricated data. It does not prove how the list was taken.

In an initial API-based expansion round on a sample of sixty-seven public-figure numbers, about thirty-five matched to breach records for the named person, five resolved to unrelated people on shared or recycled lines (including entries stored under Gadeer Mreeh, Helen Clark, Mikayil Jabbarov, Sheikh Khalid bin Khalifa Al Khalifa, and Abdelrahman Al Shamlan — breach hits that do not match those named figures), one was mislabeled (the Morocco-ambassador label that traces to Yossi Ben-David, a former mayor of Tiberias), and twenty-six had no results in this initial round. No breach match is claimed for those twenty-six. Empty results here are not a final determination. A missing result in this round is not an inactive line: Lavrov’s number is HLR-active and produced none. Breach records also tied some of the matched numbers to Knesset, Foreign Ministry, and State Department addresses, among other government and organizational inboxes. No addresses are printed here.

Authenticating the source device is a different job. It would take a fuller forensic export, such as a Cellebrite-style full file-system or raw image extraction, with device metadata, logs, and app databases. A PDF of names and numbers carries none of that.

The account-level pattern fits the Telegram-ID observation above. Numbers tied to real accounts, exported with identifiers in Telegram’s format, are consistent with access to a synced account rather than the handset, the same pattern KELA found in the Bennett leak. This data cannot settle the question for Livni.

DDoSecrets attaches its own warning to every cyberwar release. Its standard disclaimer says “there is an increased chance of malware, ulterior motives and altered or implanted data, or false flags/fake personas.” The FBI’s description of MOIS campaigns, with data subject to “manipulation or selective exposure,” is the same warning from the other side.

Each layer of the check supports the finding without settling the source. The PDF’s creation date sits one day before the DDoSecrets release, and its page count tracks Handala’s “120 pages” claim, which ties the file to the operation, not to a device. Its header count, ID format, and phone-number formats agree, though coherence is not authenticity. Accounts consistent with the labeled names are the strongest identity test short of a device export, the same kind of check KELA applied to the Bennett leak, when it found every contact mapped to an active Telegram account. A real list can still be salted: Bennett said fabricated chats were mixed into his leak, and Handala’s claims about Livni and Netanyahu remain unverified. A genuine contact list proves access to contacts. It does not prove a phone hack, or the story Handala tells about it.

What Are the Signature Reduction Requirements for Officials in War?

Signature reduction for an official in wartime means shrinking two things: the data an adversary can harvest from one compromise, such as synced contacts, cloud chat history, open sessions, backups, and location records, and the public footprint that lets an adversary verify what it finds. The goal is that a single breached account exposes a fragment, not a network.

The standards come from Western cyber agencies. CISA, the U.S. Cybersecurity and Infrastructure Security Agency, publishes mobile guidance for senior officials. Britain’s National Cyber Security Centre publishes guidance for high-risk individuals. The FBI and its partners issue advisories on Iranian targeting. The Livni and Bennett leaks show where those standards were met and where they were not.

The stakes are documented. The 2024 IRGC indictment alleges the hackers gathered officials’ correspondence, travel, lodging, and whereabouts, the Justice Department said. The 2026 domain seizure described Handala posting personal data on Israeli personnel alongside threats, according to the department.

Iran Goes After the Personal Phone

Iranian operators target the device with the weakest defenses. When an initial delivery fails, CHOSEN BRICK operators “will attempt to transition the delivery to personal devices,” the NCSC advisory said. The 2024 advisory from the FBI, U.S. Cyber Command, Treasury, and the NCSC on IRGC targeting of “current or former senior government officials” recommends “using only official email accounts for official business,” according to the joint advisory. The NCSC’s HRI guidance tells high-risk individuals “you should continue to use corporately managed accounts and devices for your work.” A personal phone book holding a former foreign minister’s working contacts sits outside that line.

One Phone Book, Dozens of Officials

The contact list is where the Livni leak cuts deepest. One directory held the numbers of former prime ministers, security chiefs, diplomats, and foreign leaders, and one leak handed all of them to an adversary. The Bennett case showed the mechanism. KELA found that every leaked Bennett contact linked to an active Telegram account, which meant account access alone yielded the address book, the firm reported. The Livni directory’s Telegram-format IDs fit the same pattern.

Messaging Apps Keep the Record

CISA’s guidance starts from a blunt premise: “Highly targeted individuals should assume that all communications between mobile devices—including government and personal devices—and internet services are at risk of interception or manipulation,” the agency wrote. It calls on officials to “evaluate how the application and associated services collect and store metadata that may be used to trace or identify the user,” to “Enable message expiration features to automatically delete sensitive messages after a set period,” and to “Limit the linked devices to only those necessary.”

Defaults matter. On Telegram, KELA noted, “standard chats aren’t end-to-end encrypted, they’re stored on Telegram’s servers as ‘cloud chats.’” The NCSC warns that attackers use verification codes and QR codes “to add their own devices to messaging accounts.”

Bennett’s Phone Held. His Account Did Not.

Bennett’s office said his phone was not breached but his Telegram account was, the Times of Israel reported. CISA’s guidance addresses exactly that gap. It calls for phishing-resistant FIDO authentication, with passkeys “an acceptable alternative,” and states: “Do not use SMS as a second factor for authentication.” It also recommends a PIN on the mobile carrier account to reduce the risk of SIM swapping, and Apple’s Lockdown Mode, which “strictly limits certain apps, websites, and features.”

Backups Are a Second Copy of the Phone

A cloud backup holds the same data as the device. Apple’s optional Advanced Data Protection means “your trusted devices retain sole access to the encryption keys for the majority of your iCloud data,” the company says, and the protected data “includes iCloud Backup.” KELA described unauthorized access to backups as a takeover path that “leaves no traces within Telegram itself.”

Location Data Maps Routines

Handala’s March message to Israeli personnel claimed, “we even know your exact location.” The NSA’s location guidance warns that location data “can reveal details about the number of users in a location, user and supply movements, daily routines and can expose otherwise unknown associations between users and locations.” The agency concedes “there is no solution to fully mitigate a mobile device from being located.”

The Leak Is Also the Message

Handala’s releases arrive with a narrative attached. Bennett’s office first denied any hack, then acknowledged the Telegram breach later the same day, and Bennett said fabricated chats were mixed into the material. In the Livni case, Handala paired the release with claims of secret ties to Netanyahu that the data has not been shown to support. The FBI describes the MOIS model as “theft of perceived sensitive data, its manipulation or selective exposure, and public distribution through aligned media channels.”

Frequently Asked Questions

Who Is Handala?

Handala, or Handala Hack, is an online persona that Check Point Research, Microsoft, MITRE, and the FBI tie to Iran’s Ministry of Intelligence and Security. Check Point says it is operated by the actor it tracks as Void Manticore, also called Red Sandstorm and Banished Kitten. The persona has been active since late 2023.

Did Handala Hack Tzipi Livni’s Phone?

Distributed Denial of Secrets describes its October 15, 2026, release as text messages and contact information taken from Livni’s mobile device and names Handala as the source. HLR carrier lookups check whether networks still recognize the lines; breach-record matching checks whether a number matches public records for the named person, and is not proof the line is active. In an initial API-based expansion round on a sample of sixty-seven public-figure numbers, about thirty-five matched to breach records for the named person. The pattern of Telegram-format IDs and account-consistent labels is consistent with access to a synced account rather than the handset. Only a fuller forensic export of the device could settle it.

What Is Signature Reduction for Officials?

Signature reduction, a term Newsweek reported the Pentagon uses for operating in “an increasingly transparent world,” means shrinking an official’s identifiable trail in two places. The first is the device and account trail: devices, synced accounts, contact lists, cloud backups, messaging apps, and location services, trimmed so that one compromise exposes as little as possible. The second is the public footprint that builds up over time, including public accounts and usernames, the phone numbers and emails tied to them, posted files and documents, photos and their metadata, data-broker and breach records, and archived pages, which adversaries aggregate to target, validate, and impersonate. The Livni directory shows why the second half matters: its numbers could be checked against public accounts precisely because that footprint exists.

Colin Aamot is an investigative journalist and OSINT domain expert specializing in FOIA and public records. A technologist, U.S. Army veteran, and former Capitol Hill staffer, he has held director roles across the private and public sectors.Full bio