Comment by sailfast

I’ll update my threat model to include sophisticated non-state human traffickers or smugglers that are all sharing intel with each other if that’s what you’re suggesting? Or perhaps just selling in the dark to whomever is buying? Sounds like you know this is happening?

I’m not making a good guy / bad guy judgment here FWIW. I do, however, find it less likely a smaller scale non-state operation would bother hacking a government agency or buying info on the open market. Sounds like it’s a higher priority than I thought.

Makes sense for larger orgs at higher levels - but I admit my mental model didn’t think about parallel private attempts to exploit, sell, use and otherwise secure comms. It was a blind spot. Seemed too leaky and obvious given the incentives to leak information - but I clearly don’t understand bad guys very well.