DOJ Over-Seized Hannah Natanson’s Garmin Device and Other Reporting Materials

I was busy with the site changeover last week and so never wrote up the materials released in WaPo reporter Hannah Natanson’s bid to retrieve her devices last week:

There have been two strands of important reporting on the materials.

First, on security, Runa Sundvik wrote up what security features that Natanson used succeeded and what failed. Then 404 Media described that the FBI had thus far failed to get into Natanson’s personal phone because she had it in lockdown mode (they got her Signal texts, instead, by using her finger to access her work laptop).

To those security concerns I will note that my concerns about Natanson’s description of how she (attempted) to protect her sources proved prescient.

I shuddered when I read this article from Hannah Natanson in real time, in December, which was the first I really took notice of the name behind a flood of important reporting on Trump’s attack on the government.

[snip]

[I]n telling that story, Natanson told how she protected the anonymity of her sources.

[snip]

After consulting Post lawyers, I developed what we felt was the safest possible sourcing system. If I planned to use someone in a story, I asked them to send me a picture of their government ID, then tried to forget it. I kept notes from reporting conversations in an encrypted drive, never writing down anyone’s name. To Google-check facts and identities, I used a private browser with no search history. I retitled every Signal chat by agency — “Transportation Employee,” “FDA Reviewer,” “EPA Scientist” — until the app, unable to keep up, stopped accepting new nicknames. (Then I started moving contacts into two-person group chats, which I could still rename.)

Three weeks later, FBI seized the phone on which all those contacts were labeled with aliases. When they searched her home, she was logged into the Slack on which she had shared all those leads with colleagues. They seized the encrypted drive on which she had her notes.

In short, she publicly revealed where to look for everything else, and three weeks later, Trump agents came and took it all.

Seven paragraphs of the search warrant affidavit detail things Natanson said in the article, and from that foundation, used it to establish probable cause to go get her Signal chats, including preserving those she had set to delete.

Meanwhile, Charlie Savage has provided other important coverage: noting that the affidavit failed to mention the Privacy Protection Act, and describing that the AUSA involved, Gordon Kromberg, may have some ethical exposure if he knew of the PPA and failed to alert the Magistrate Judge who authorized the warrants.

The Justice Department failed to tell a magistrate judge about a 1980 law protecting journalists in its application materials for a warrant to search a Washington Post reporter’s home last month as part of a leak investigation, an unsealed court filing shows.

Gabe Rottman, the vice president for policy at the Reporters Committee for Freedom of the Press, which had asked the judge to unseal the materials, called that omission significant.

“By not alerting the judge to the existence of a federal law that is supposed to limit searches for reporting materials, it may have greased the skids for the judge agreeing to the warrant when otherwise the judge might have scrutinized it more carefully,” Mr. Rottman said.

The 1980 law, the Privacy Protection Act, says “it shall be unlawful” for investigators to search for or seize journalistic work product and documentary materials unless the reporters themselves are suspected of committing certain crimes related to those materials.

Kromberg was one of the prosecutors on the Julian Assange case, so has been steeped in the boundaries between national security and journalism cases for a decade. Additionally, the FBI agent, Keith Starr, confidently cited what journalists “are required” to do with their sourcing notes (when describing that he wanted to go get those records) with no citation to any source of knowledge besides his training and experience, claiming expertise about journalism I doubt he has. So both should be expected to know there is a specific prohibition on seizing journalist work project.

The failure to account for the PPA (though the response graciously claims to be adhering to it going forward, while describing many ways it is not) is fairly critical, given how they seem to have over-seized material based on what they showed probable cause to collect. For example, the affidavit only renews my suspicion that DOJ used the Aurelio Perez-Lugones investigation as a pretext to go seize Natanson’s notes of her other reporting.

I already raised concern that they seized her Garmin device, for example.

It’s the Garmin that really gets me. According to the declaration Natanson submitted in a bid to get her stuff back, she only communicated with Perez-Lugones via Signal or phone. The FBI is trying to obtain evidence about other people she met with, face-to-face.

The affidavit accords with this. Starr established probable cause to get Natanson’s Signal texts by laying out that she and Perez-Lugones had never met in person during the four weeks they had him under surveillance before arresting him.

35. Alternatively, my training and experience has included witnessing or learning of hand delivery of paper documents by individuals who are involved in the unlawful transmission of classified information. From December 12,2025, until January 8,2026, the FBI maintained physical surveillance of Perez-Lugones to observe any potential in-person meetings between Perez-Lugones and Natanson. The FBI physical surveillance provided coverage every day from 6:00 a.m. to l0:00 p.m., including holidays and weekends. Additionally, since December 17, 2025, the FBI maintained closed-circuit television (“CCTV”) surveillance of Perez-Lugones’ residsnce for around the clock coverage of any comings and goings by Perez-Lugones. Neither FBI physical surveillance nor CCTV surveillance have observed any meetings between Natanson and Perez-Lugones. Hence, it is my professional assessment that Perez-Lugones transmitted classified information to Natanson exclusively via electronic means.

If they only communicated via electronic means, then there’s no purpose to seizing the Garmin, which would show where she went and might help show with whom she met in person. Nevertheless, FBI agents specifically instructed her not to take her Garmin with her when she left the FBI to conduct their search.

That’s not the only thing that the FBI over-seized, and the other is more pertinent to Savage’s concerns.

As noted above, the FBI made copies of Natanson’s Signal texts, to prevent any from being automatically deleted. Rozharvsky described that they did this for every single conversation that continued after October 1.

[T]his process preserved the entirety of all Signal conversations, in which there was a new message or alert on or after October 1, regardless of the date of the message, notification, or attachment.

Among the other things I surmised that DOJ might be seeking, in addition to any non-public materials that Perez-Lugones shared, this story about a Greenland-related slush fund is dated October 9 (there’s a third topic that Starr describes to be particularly sensitive, in addition to the invasion of Venezuela and the preparation and aftermath, that is redacted in the affidavit; the story about Russia is the only one classified TS/SCI). WaPo’s interview with Social Security whistleblower Chuck Borges is dated October 20 and linked a September 4 story. A story about Trump’s expansion of the Park Police is dated October 31.

To the extent to which Natanson’s reporting for those stories was done via Signal, the entire reporting thread would have been preserved in the FBI treatment.

It’s not just that DOJ did not alert the Magistrate Judge that they were seizing reporting materials in violation of the PPA. It’s that they seized far more of Natanson’s reporting materials than justified given their probable cause statement.