Original subtitles

This chart comes from the FBI. It's

marked law enforcement sensitive and it

came out through a public records

request. It lists what agents can

legally pull from nine messaging apps.

Most columns are packed. Look at this.

One, no message content. The [music]

date you signed up and the last day you

connected. The Justice Department even

has a name for apps like that. Warrant

proof encryption. [music]

I went looking for the free open source

projects that make life that hard for

investigators [music]

and I found seven on GitHub. I ran them

on my own machine. A file with no

signature at all, so it looks like pure

noise.

A phone that a police forensic company

lists as a flat no. A way to hand

someone a file [music] with no server in

the middle to raid. And the app in that

column, the kind of app the FBI itself

told Americans to use in December 2024.

Quick note before we start. This video

is for education. Use what you learn

responsibly and only on systems you own

or have permission to test. Don't forget

to subscribe my channel and watch the

video till the end. So, let's get into

the video soon.

>> [music]

>> Number seven is a tool that checks

whether your phone was hacked by

spyware.

It's called MVT, the mobile verification

toolkit, and it's on GitHub from Amnesty

International Security Lab. They

released it in 2021 during the Pegasus

project, the investigation into NSO

Group spyware. Pegasus could take over a

phone and read everything on it, and it

was used against journalists and

activists.

Here's why it belongs on this list. In

2022, the FBI confirmed it had bought

Pegasus.

Its statement says the bureau procured a

limited license for product testing and

evaluation only, and that there was no

operational use to support of any

investigation. So, the spyware the FBI

paid to test is exactly what this tool

hunts for. I installed MVT in my lab and

pulled its public indicator lists.

>> [music]

>> 11,619

indicators in 19 files. 1,549

of them are Pegasus.

>> [music]

>> These are domains, file names, and

processes tied to real spyware

investigations. You point MVT at a

backup of your own phone and it checks

every record against those lists. Now,

the honest limit, MVT's own docs say

it's built for consensual forensic

analysis by technologists and

investigators, so expect a command line

and some reading. And a clean result

only means nothing known turned up.

Brand new spyware won't be on any list

yet.

Number six is the Mullvad VPN app and

the whole thing is open source on

GitHub, desktop and mobile. Mullvad is a

Swedish company with a strange way of

signing you up. No username, no

password, [music]

no email address. You get a random

account number and that's it. You can

even pay by putting cash in an envelope.

Mullvad says it adds the time to your

account and then shreds the envelope.

That setup got tested the hard way. In

April 2023, at least [music] six

officers from the Swedish police walked

into Mullvad's office in Gothenburg with

a search [music] warrant. They wanted

computers with customer data. Mullvad's

own write-up says that data didn't

exist. After the company showed them how

the service works and the officers

talked to the prosecutor, they left

without taking anything and without any

customer information.

And Mullvad points out that even if they

had taken something, it wouldn't have

given them access to any customer

information. Now, the honest limit,

a VPN doesn't make you anonymous. It

moves your trust from your internet

provider to the VPN company

>> [music]

>> and your browser can still give you away

with logins and cookies. So, the

question to ask any VPN is simple. What

happened the last time the police showed

up?

Number five is OnionShare. Most file

sharing runs through somebody else's

server. Google Drive, Dropbox, [music]

WeTransfer. Whoever runs that server can

be ordered to hand your files over.

OnionShare cuts that server out. Your

own computer becomes a server and it's

only reachable through Tor. Here's my

lab. I made a small text file of fake

interview notes and shared it.

OnionShare turned my PC into a Tor onion

service and printed this address.

That long string is the whole link and

nobody can find it unless you give it to

them. Then I fetched it back through Tor

the way the other person would and the

notes came through byte for byte.

OnionShare's security page puts it

plainly, "Third parties don't have

access to anything that happens in

OnionShare because the files are never

uploaded to anyone's server." For this

demo, I switched off its private key so

normally there's a second secret on top

of the address. Now the honest limit.

Whoever has the address can open the

door. If you send it over an app someone

is reading, they can open it, too. And

the docs say exactly that. And your

computer has to stay on until the other

side finishes the download.

Number four is VeraCrypt, the

open-source encryption tool that took

over from TrueCrypt. Here's the case

that made its reputation.

Brazilian police seized five hard drives

from a banker named Daniel Dantas

encrypted with TrueCrypt.

>> [music]

>> Brazil's National Crime Lab couldn't

open them, so the drives went to the

FBI. 12 months later, the FBI handed

them back, still locked. Now compare

that with BitLocker, the encryption

built into Windows. In a fraud case in

Guam, the FBI asked Microsoft for the

recovery keys to three laptops and

Microsoft handed them over. By default,

BitLocker uploads those keys to

Microsoft's cloud. VeraCrypt keeps no

copy of anything. Watch what that means.

This is a real VeraCrypt volume, a test

file the Hashcat project publishes. A

normal zip file starts with PK and every

tool recognizes it. The VeraCrypt file

starts with noise. Ask the file command

what it is and it just says data.

VeraCrypt's own specs says volumes have

no signature and until decrypted they

look like random data. So, I wrote a few

lines of Python that follow that spec.

With a wrong password, the header

decrypts to more noise. With the right

[music] one, the first four bytes turn

into Vera.

Each guess took my PC about 4/10 of a

second

>> [music]

>> because VeraCrypt runs the password

through 500,000 rounds of hashing.

Now, the honest limit. None of that

helps with a short or reused password,

[music] and it can't help if someone

sees you type it.

Number three is Tor. Its code lives on

the Tor Project's own GitLab with a

mirror of it on GitHub.

Tor sends your traffic through three

volunteer relays, and each one only

knows the hop before it and the hop

[music] after it. Here's my lab. Tor

version 0.4.9.12

running on my PC.

I asked the Tor Project's check page who

I am through Tor.

>> [music]

>> Is Tor true? And the address it sees

belongs to an exit relay. My real

address never shows up.

Then I read my live circuit straight

from Tor. A guard relay in Russia, a

middle relay in America, and an exit in

[music] Germany. The guard knows who I

am and nothing about where I'm going.

The exit knows where I'm going and

nothing about who I am. So, how does the

FBI deal with Tor? The Playpen case

answers that. In 2015, the FBI took over

a criminal site hidden on Tor and kept

it running for almost 2 weeks.

>> [music]

>> So, the FBI went around Tor through the

browser. The Electronic Frontier

Foundation says the malware exploited a

vulnerability in Firefox, the browser

inside Tor browser, and the government

acknowledged that more than a thousand

computers all over the world were

infected. Now, the honest limit. Tor

protects the path, and the weak spot is

the software at each end.

Keep Tor browser updated and switch its

security level to safest, which turns

off JavaScript on every site.

Number two is GrapheneOS,

a hardened version of Android for Google

Pixel phones, and every part of it is

open source on GitHub. When police labs

lead into a locked phone,

>> [music]

>> they reach for tools like Cellebrite. In

late 2025, someone sat in on a private

Cellebrite Teams call and photographed

this slide. It's Cellebrite's own access

matrix for Pixel phones. On stock

Android, the columns say yes. Now the

Graphene OS columns. On older Pixels,

yes, but only up to late 2022 security

patches. And the Pixel 9 row, locked

before and after first unlock, no and

no. Three settings do a lot of that

work. Auto reboot. When the phone sits

locked for 18 hours by default, it

restarts and your data goes back to

rest. The USB-C port is charging only

while the phone is locked, so a cable

plugged in while it's locked only gets

power. And a duress pin. Type it at the

lock screen and the phone irreversibly

wipes itself, eSIMs included. Now the

honest limit. The same slide lists

unlocked Graphene phones as a yes. If

the phone is already open in someone's

hand, the lock screen can't help you.

And Graphene OS only runs on Pixels, so

you'd be buying a Google phone to get

away from Google.

Number one is Signal. The Android app,

the iPhone app, the desktop app and the

server are all open source on GitHub.

Remember that FBI chart from the start?

That column was Signal. And Signal

publishes what it hands over when it's

forced to. In 2016, a federal grand jury

subpoena from the Eastern District of

Virginia asked for data on two users.

Signal's answer was that the only

information it can produce is the date

and time a user registered

>> [music]

>> and the last data of a user's

connectivity. It matches the two lines

in the FBI chart. Messages, contacts and

groups are end-to-end encrypted and

Signal doesn't hold the keys. Now the

twist. In December 2024, Chinese state

hackers called Sand Typhoon were inside

American phone networks. Officials from

CISA and the FBI briefed reporters and

urged Americans to use encrypted

messaging apps. A CISA official put it

in four words, "Encryption is your

friend." So the government that calls

this warrant proof told its own people

to use it once its phone networks were

breached. Now, the honest limit. Signal

can't protect a phone that's already

infected, which is why number seven

exists.

>> [music]

>> And anything you send can still be

screenshotted by the person you send it

to. Turn on disappearing messages

>> [music]

>> and set a registration lock pin so

nobody can take over your number.

One more story because it explains why

every tool today came from GitHub. The

FBI once ran an encrypted phone of its

own. It was called Anom and the FBI

secretly ran the platform. Criminals

bought more than 12,000 devices across

more than 300 crime groups in over 100

countries. Agents cataloged more than 27

million messages. Nobody outside could

read Anom's code, so nobody could check

it. Every project in this video puts its

code in public where anyone can read it

and people [music] do. So, here's one

thing to do this week. If your Windows

laptop uses BitLocker, go [music] to

aka.ms/myrecoverykey,

sign in and see if Microsoft is holding

your key. If it is, you now know exactly

who can be asked for it. [music] If you

want to know seven AI hacking tools you

can use completely free right now, click

on this video and I will see you there.

>> [music]