Post by @mattblaze@federate.social

It's been widely reported that former Rep. Eric Swalwell, a longtime Trump critic under investigation for sexual assault, had his electronics confiscated at an airport by the FBI last month. It's messy story in which facts are still emerging.

But what caught my eye as a surveillance nerd was this (paywalled) story https://www.theatlantic.com/politics/2026/09/eric-swalwell-air-marshals-fbi/688489/ about his flight in. Apparently a team of Air Marshalls was assigned to watch him in flight and attempt to shoulder surf any passwords he entered en route.

Your access has been blocked – The Atlantic

28 Replies

3 Boosts

Darren du Nord

@darren@c.im 31 min. ago

@mattblaze Great use case for pervert glasses.

Subhendu Ghosh

@sgnj151@hachyderm.io 2 hr. ago

@mattblaze
#giftLink
https://www.theatlantic.com/politics/2026/09/eric-swalwell-air-marshals-fbi/688489/?gift=liTgHStS08LJiHJzg-cVguhOB13NoZ-xw3BG-xy09Kg&utm_source=copy-link&utm_medium=social&utm_campaign=share

Your access has been blocked – The Atlantic

Carolyn

@CStamp@mastodon.social 2 hr. ago

@mattblaze In which I learn a new term: shoulder surf.

I am so cautious when entering pwds in public. I cover the hand entering the pwd and move over my keyboard as if any of the keys could be the one I am depressing.

But what a scummy thing for anyone to do, let alone "law enforcement."

foo ✅

@slashdottir@mastodon.online 2 hr. ago

@mattblaze https://archive.ph/ZOabS

Matt Blaze

@mattblaze@federate.social 2 hr. ago

This is interesting for a few reasons.Air Marshalls are specially trained officers who fly in plainclothes on regular rights, mostly to be ready to intervene during a hijacking, etc. They are not normally part of this sort of criminal investigation, except in very special cirucmstances.

I assume shoulder surfing passwords is a fairly specialized skill to do well. Are air marshals routinely trained to do this? If so, it suggests they have rather different role than we've been led to believe.

AN/CRM-114

@flyingsaceur@ioc.exchange 47 min. ago

@mattblaze does this smell like parallel construction to you? If they got the password some other way, the air marshal plan doesn’t actually have to work, it just has to possibly work

Matt Blaze

@mattblaze@federate.social 44 min. ago

@flyingsaceur I doubt it in this case. They could more easily just say they forensically unlocked the phone with some tool.

Sumocat 🐈‍⬛

@Sumocat@mastodon.world 1 hr. ago

@mattblaze “I assume shoulder surfing passwords is a fairly specialized skill to do well.” — Depends on the password, but the story states they were looking for passcodes, which are considerably easier to spot and can be as minimal as 4 digits.

Matt Blaze

@mattblaze@federate.social 1 hr. ago

@Sumocat They also refer to phones and laptops. I don't think what they were looking for was clear.

Matt Blaze

@mattblaze@federate.social 2 hr. ago

The other thing is that I'd imagine even with highly trained observers posing as passengers seated near him, the chances this would be successful at capturing something would be fairly low. He'd have to enter the passwords while they're watching, and with a reasonably good view of the keyboard and screen, all the while being undetected. This doesn't seem like a sure thing, but rather more a hail mary you'd only attempt if you REALLY wanted the passwords as part of a very important investigation.

CM Harrington

@octothorpe@mastodon.online 1 hr. ago

@mattblaze also considering wouldn’t he be in a position to make use of password wallets (due to IT policy/regs), so the notion of shoulder surfing a password is impossible in that case. Now, that is orthogonal to folks being planted to try. But they’d be kinda doomed to fail.

dan

@dan@tilde.zone 1 hr. ago

@mattblaze How often does anyone enter a password into a phone, or even a web form on a phone except for the first time. The whole thing just sounds like they were hoping to stumble into some blind luck.

Matt Blaze

@mattblaze@federate.social 1 hr. ago

@dan It really surprises me that they tried this. Seems like such a low probability of success.

2 more replies

Matt Blaze

@mattblaze@federate.social 2 hr. ago

And now, of course, I have another (not) hypothetical for my surveillance course. Do you have a reasonable expectation of privacy in passwords you enter from your airplane seat? What's the legal standard here? What if communications is involved? Etc.

standev

@standev@mstdn.social 2 hr. ago

@mattblaze my mom did it at a small law firm in the 2000/2010s and had to convince the attorneys that the real threat to client privacy was someone watching their screen at a coffee shop or just stealing the unlocked computer when the attorney went to the restroom, so I could imagine “no expectation of privacy on airplanes” passing muster in the US (not a lawyer, just an IT nerd)

Flaming Cheeto

@PizzaDemon@mastodon.online 2 hr. ago

@mattblaze my weird answer is I would if I had the window seat.

OTOH, my gut says anyplace where it'd violate social norms to watch pornography doesn't carry privacy rights for the screen.

Greg Whitehead

@grwster@mastodon.social 2 hr. ago

@mattblaze Expectation of privacy or not, I have seen things on airplanes without even trying. I’m thankful for touch/face id on my devices and just stick to reading a book or getting some sleep if I can

ThePdog

@thepdog@mas.to 2 hr. ago

@mattblaze I don't type passwords in public places. I use a VPN and make sure it's connected before I type in a pw in a hotel room or other private spot. Too much scam going on to trust the general public with sensitive pws.

Andres

@Andres4NY@social.ridetrans.it 2 hr. ago

@mattblaze I have long (local) passwords that I type very quickly, so no, not really. If you have a correct horse battery staple password, then you're typing your passwords at speeds you'd type any other sentence. I'd be very impressed if someone could figure out my password(s) from like 5 feet away as I type them quickly.

And then firefox is auto-generating and saving website passwords, so no real concerns there.

1 more reply

Tim Bray 🇨🇦

@timbray@cosocial.ca 2 hr. ago

@mattblaze I'd have thought that most laptop-wakeup events involved a fingerprint reader these days.

1 more reply

Beachbum

@Beachbum@mastodon.sdf.org 2 hr. ago

@mattblaze I would hope I have a reasonable expectation of privacy everywhere, so yes, on a plane, in my seat or wherever.

1 more reply

Mike Olson

@mikeolson@mastodon.social 2 hr. ago

@mattblaze Important questions. Also an object lesson in the virtues of passkeys and password managers, integrated with your laptop's security infra.

Curious how the Swalwell case develops. Not to assign you homework or anything, but I'd read any updates on that you posted here.

1 more reply

Matt Blaze

@mattblaze@federate.social 2 hr. ago

Also, you don't hear the phrase "shoulder surfing" much these days. Its heyday was during the 80's and 90's, referring to people who'd hang around banks of payphones at places like airports and attempt to watch people entering (then valuable) long distance calling card numbers.

1+ more replies

Matt Blaze

@mattblaze@federate.social 2 hr. ago

As a general rule, observing things with your unaided human senses from places you're legally entitled to be is usually not considered a "search" for the purposes of the fourth amendment. But there are a lot of qualifiers in there, and a lot depends on specific facts and circumstances.

Paul_IPv6

@paul_ipv6@infosec.exchange 1 hr. ago

@mattblaze

seems like how you can use what you "observe" has some questions too.

if i observe someone keying in a code to unlock their door, that doesn't give me the right to use it; i'd still need a warrant to enter/search, would i not? assuming it's not biometric, if there is a warrant, the law can compel someone to disclose passwords or codes to unlock devices. so it sure seems like a lot of complication, risk, and expense to get something they could get legally if they had grounds and couldn't use anyway if they didn't have legal grounds?

of course, competence, sanity, and legality are not hallmarks of the current head of FBI, DOJ, or WH...

Adam Shostack :donor: :rebelverified:

@adamshostack@infosec.exchange 2 hr. ago

@mattblaze Or if air marshals are seen as low value and so: why not have them try?

Matt Blaze

@mattblaze@federate.social 2 hr. ago

@adamshostack The risk is alerting the target.

Brian Tatosky

@virtualbri@mastodon.online 2 hr. ago

@mattblaze Also, is that legal?

Discussion

Discussion