Patrick Howell O’Neill

Patrick Howell O’Neill

@patrickhowelloneill.com

Journalist at Bloomberg News in DC. Signal: @howelloneill.01, email: patoneill1@bloomberg.net https://www.bloomberg.com/authors/AXb8dLPHBFc/patrick-howell-oneill

8.2K followers1K following249 posts

This whole Yandex incident has been a nice and tidy case study in a bunch of people posting what they feel and hope to be true (and seemingly winging it on the definition of the word "bot") vs relatively quick and sound pushback from actual experts

Kate Starbird@katestarbird.bsky.social

Y’all, I hate to rain on the dead bot parade, but the Yandex data center destruction doesn’t seem to have significantly impacted social media bots. I made temporal graphs of X posts about AfD around the time of the attack and there’s no sign of a sudden dip or residual impact on that conversation.

Patrick Howell O’Neill reposted

WASHINGTON (AP) — Federal agents searched Minnesota Rep. Ilhan Omar's home as part of a criminal investigation, AP sources say.

Patrick Howell O’Neill reposted

Patrick Howell O’Neill reposted

Over six months, we tracked the appearance of child sexual abuse material on X. We found images from the National Center for Missing and Exploited Children's database, which is considered one of the most highly vetted and which many tech companies block on upload. www.nytimes.com/2026/09/11/t...

nytimes.comElon Musk Has Pledged to Rid His Platform, X, of Child Sexual Abuse, but It PersistsReviews by the Canadian Center for Child Protection and The New York Times found that explicit images of children remain on the social media site owned by Elon Musk.

Patch Tuesday and other big patches being this huge again is interesting. It all seems like an unqualified success for defenders rather than the apocalyptic win for offense that gets touted a lot by doomsayers. Is it really an AI vulnpocalypse if the main result so far is quicker and faster patches?

BleepingComputer@bleepingcomputer.com

Today is Microsoft's September 2026 Patch Tuesday, with security updates released for a record-breaking 966 flaws, including two actively exploited zero-day vulnerabilities.

A mini-controversy periodically emerges about elected officials on Signal. It's rarely a nuanced discussion. The idea that using Signal is in and of itself shady is truly wacky. But elected officials conducting business in ways that escapes public records and oversight actually warrants attention

View full thread

withthat said, Signal is a landmark app first for delivering easy e2ee to the public but also because for most people, not public officials, auto-deleting messages is the smart thing to do from a security and privacy pov, making it normal and easy is great. I wish every app had this option.

A mini-controversy periodically emerges about elected officials on Signal. It's rarely a nuanced discussion. The idea that using Signal is in and of itself shady is truly wacky. But elected officials conducting business in ways that escapes public records and oversight actually warrants attention

View full thread

Using auto-deleting messages in private chats to conduct government business or hiding chats that should be responsive to record-keeping, that all needs attention. But some non-technical people get really weird about Signal and then about encryption and by the end of it the issue is garbled badly

A mini-controversy periodically emerges about elected officials on Signal. It's rarely a nuanced discussion. The idea that using Signal is in and of itself shady is truly wacky. But elected officials conducting business in ways that escapes public records and oversight actually warrants attention

But questionable reporting on this prevents a good discussion. I've seen big outlets say that Signal's e2ee are incompatible with record-keeping and freedom of information laws. Huh? Are we responding to FOIA by capturing data in transit? Must have missed that FOIA office capability

I know that's a dumb and obvious thing to say, it just comes to mind because of the parade of posts I've read over the last year who were (understandably) sure that it's currently impossible for bad behavior to have consequences

My other dumb thought is that it's kind of wild that whatever the deal ESPN has with Shams, it obviously allows for him to post his scoops on social way, way, way before they're able to get anything up on ESPN dot com. I guess just goes to show what matters to them now.

Patrick Howell O’Neill reposted

Resharing my scoop. It's an interesting window into tensions inside CISA between staff in CSD, based in DC, and IOD, spread out across the country. “It has been hard on the IOD side,” said one person familiar with the matter. IOD field staff sometimes struggle to keep up w/ what's happening at HQ.

Eric Geller@ericjgeller.com

Scoop: CISA is ending six free cybersecurity assessments for critical infrastructure operators, significantly reducing the hands-on guidance it offers to those organizations even as it tries to rebuild and reassert its value: www.cybersecuritydive.com/news/cisa-cy...

US military officials are set to brief a House oversight committee next week as part of lawmakers’ examination of an unusually high number of deaths by suicide among personnel of US Cyber Command as its workload has surged because of conflicts abroad www.bloomberg.com/news/article...

bloomberg.comCyber Command to Brief Congress Military Committee On SuicidesUS military officials are set to brief a House oversight committee next week as part of lawmakers’ examination of an unusually high number of deaths by suicide among personnel of the country’s cyberwa...

bike commuting is excellent. driving during rush hour in dc is a nightmare. through ebikes, all things are possible. highly recommend giving it a try

Olúfẹ́mi O. Táíwò@olufemiotaiwo.bsky.social

big change to my material conditions: I am a bike commuter now. I will be updating my transportation opinions dialectically (I am already 27% more opinionated about bike lanes and our school crossing guard comrades)

Patrick Howell O’Neill reposted

I've covered surveillance for a long time, and I've never seen an outcry like that around Flock cameras. I've got a few ideas what makes this different but am curious why people think Flock in particular has gotten so many so riled up.

There's a whole cottage industry now of professional posters who take journalism and repost it with no credit, no link. What's considered normal now is wild. Polymarket is a multibillion dollar company and their whole social media strategy is to never ever credit journalists who work they use

Patrick Howell O’Neill reposted

NEW -> Trump’s new plan to enlist private companies to disrupt cybercriminals abroad may face a fundamental problem when it comes to Russia: distinguishing criminal hackers and state-backed operatives, former officials + experts tell me. www.nextgov.com/cybersecurit...

nextgov.comThe Russian hurdle in Trump’s new offensive cyber programThe White House wants private companies to help take down cybercriminals overseas. But in Russia, the line between criminal hackers and the government is difficult to draw.

I think a lot of people have thoughts about the latest White House EO but have not read the entire EO. This is genuinely understandable, these memos are written in lawyerly gobbledygook, but if you care about cyber I beg you to read the whole memo before posting takes. Fact sheet doesn't count!

Patrick Howell O’Neill reposted

New, by me: The Justice Department is prosecuting an American for allegedly providing U.S. border agents with a "duress" passcode that wiped the contents of his phone when they entered it. We've confirmed the phone was running GrapheneOS. Bypass for ad-blockers: web.archive.org/web/20260724...

techcrunch.comUS accuses American of allegedly wiping his phone using a 'duress' password during border search | TechCrunchA U.S. citizen has asked a court to throw out the government's claim that he gave over a passcode to border authorities that wiped his phone's data, opening up fresh questions about a person's constit...

I still don't fully understand cyber company code names. If you're tracking a Russian group that you name explicitly as Russian, why do you need a cryptonym that means Russia? Isn't this just an extra layer of obfuscation? Only thing I can make out is that coming up with code names is kick ass fun

View full thread

Okay, fun aside, the answer is more likely that it's a marketing function. You own the name "borscht," whenever someone mentions the vaunted threat actor SPICY BORSCHT, someone relevant with the power of the purse may think of your CTI firm.

I still don't fully understand cyber company code names. If you're tracking a Russian group that you name explicitly as Russian, why do you need a cryptonym that means Russia? Isn't this just an extra layer of obfuscation? Only thing I can make out is that coming up with code names is kick ass fun

I understand everything about visibility, confidence, difficulty of attribution, yada yada yada. If I say in a blog that "borscht" = Russia, can't we just cut out the borscht bit entirely? Wouldn't that make this whole thing simpler? Again, I come back to: Naming a military agency borscht seems fun

Blog history question: Nowadays, it seems like all the cool weather blogs/accounts do weather ratings. The 1st time I remember seeing this was in The Awl, Choire Sicha would post a pic of the sky in ny and rate it and then write some unhinged prose. Was this a thing before Choire's weather reviews?