Federal agents executed a search warrant at the home of Washington Post reporter Hannah Natanson in January, seizing laptops, encrypted drives, Slack log-ins, and even a Garmin fitness device — material that, according to filings and reporting, included far more than the narrow investigative lead the government cited. The disclosures have set off alarm among journalists and privacy experts: did the Justice Department cross a legal line in hunting for sources, or did it follow a legitimate criminal lead that incidentally swept in ordinary reporting tools?
The short version: the affidavit supporting the warrant focused on an investigation of Aurelio Perez‑Lugones, a cleared government contractor charged with taking classified intelligence home. The FBI’s theory, as laid out in the affidavit, was that Perez‑Lugones transmitted classified information electronically to Natanson. But agents also copied Signal conversations beyond the narrow timeframes the affidavit emphasized, took Natanson’s encrypted reporting notes and Slack access, and ordered her to leave a Garmin device behind when she left the home during the search. Critics say that combination looks less like precision targeting and more like a broad dragnet on reporting materials.
Why the Garmin raised eyebrows
A striking detail: the affidavit says the FBI surveilled Perez‑Lugones and never observed in‑person meetings with Natanson during the period they monitored him. If the government’s own surveillance suggested communications were electronic, the utility of seizing a fitness tracker — which logs locations and routes — is unclear. That is exactly the point made in a declaration by Natanson filed to get her equipment returned: the Garmin could reveal unrelated meetings and movements, and it’s not obvious why such granular location data was necessary to investigate alleged electronic transfers.
The seizure of location and movement data from a reporter’s device touches a broader worry: digital crumbs can expose not just a single source, but an entire reporting thread. The affidavit’s description also suggests agents preserved every Signal conversation that had any new activity after October 1, regardless of when the messages originated — potentially capturing months of reporting threads for stories that had nothing to do with the underlying criminal case.
Signal, Lockdown Mode and the limits of access
For all the data the FBI collected, some things remained out of reach. Reporting shows the bureau could not access Natanson’s personal iPhone because she had Lockdown Mode enabled. Other reporting describes agents obtaining Signal messages on her work device by using a fingerprint to unlock a laptop — a reminder that security is often only as strong as the weakest device in a chain. That dynamic is one reason journalists and technologists emphasize device‑level protections and compartmentalization: a locked phone can be effective, but an unlocked laptop or an always‑logged‑in Slack session can be an easy entry point.
These tensions sit against a fast‑moving tech backdrop where tools and services can sweep through an individual’s digital footprint; in that broader context, debates about device hardening and what constitutes reasonable investigative scope are increasingly urgent for reporters and the public alike. For context on how platform and device features are reshaping what investigators can — and cannot — access, see recent coverage of AI search features and how they integrate into user data flows like Gmail and Drive Gemini’s Deep Research May Soon Search Your Gmail and Drive — Google Docs Gains ‘Document Links’ Grounding. And the way Apple tweaks device behavior can matter in these disputes, too; changes to ecosystem features have implications for both security and access Apple to Disable iPhone–Apple Watch Wi‑Fi Sync in EU.
Legal guardrails the government did not emphasize
The filings unsealed after the search revealed another flashpoint: prosecutors did not flag the Privacy Protection Act of 1980 (PPA) in the warrant application submitted to the magistrate judge. The PPA generally prohibits searches and seizures of journalists’ work product and documentary materials unless the journalist is suspected of committing an enumerated crime. Observers, including reporters committee lawyers and media‑law specialists, say omitting the PPA from the materials the judge reviewed could have led to less scrutiny than the application otherwise might have drawn.
That omission has ripple effects. Some observers suspect the investigation of Perez‑Lugones was used in part as a pretext to get at a broader set of reporting materials and source identities unrelated to his alleged conduct. Others point to internal DOJ policy shifts: a policy limiting compelled process against reporters was rescinded last year, and that change has renewed concerns about how easily prosecutors can seek reporters’ records in leak investigations.
Prosecutorial choices and ethical questions
The AUSA named on the filings, Gordon Kromberg, and the FBI agent who framed journalists’ record‑keeping practices in the affidavit both carry experience in national‑security matters. That experience cuts two ways: it could mean the team appreciated press protections; or, critics say, it could heighten the ethical stakes if the PPA was knowingly left out of the judge’s view. Legal observers have flagged the possibility of remedy or challenge in court: motions to suppress, return of materials, or even potential professional inquiries if the PPA’s omission was intentional and material.
What reporters are doing differently — and what this episode shows
Natanson’s account of how she tried to protect sources — private browser sessions, retitling Signal chats, storing notes on encrypted drives, avoiding written names — reads now like a cautionary tale. Some of those measures worked (Lockdown Mode kept her phone sealed), some did not (logged‑in Slack and the encrypted drive were seized). The lesson is not that reporters must go to extreme ends to do their job, but that modern reporting requires thoughtful operational security across multiple devices.
If you’re a journalist, an editor or someone who cares about a robust press, this episode matters because it tests the balance between national‑security investigations and constitutional press freedoms. The search at Natanson’s home feels novel to many: it is one of the first times the federal government executed a residential search of a reporter in a leak probe. How courts, newsrooms and lawmakers respond will shape the practical realities of newsgathering in a digital age.
One concrete thing to watch in the near term is litigation over the return of seized materials and any judicial findings about whether the PPA should have been front‑and‑center in the magistrate’s review. Even as technology keeps changing how information is created and stored, the legal questions here are old: when does law enforcement’s interest in evidence override a journalist’s need to protect sources? The answers will matter for reporters, sources and the public conversation about transparency and secrecy.