Lead: Unsealed court filings show federal agents searched Washington Post reporter Hannah Natanson’s home in late 2025 and seized a Garmin device plus multiple drives and messaging records as part of a leak investigation. The materials released in Natanson’s motion to recover her devices indicate the FBI copied Signal conversations and took encrypted reporting notes after an affidavit sought access to her communications. Critics say the warrant materials did not disclose the 1980 Privacy Protection Act to the magistrate and that agents may have collected far more reporting material than the affidavit’s probable cause supported.
- Seizure scope: FBI agents seized Natanson’s Garmin, an encrypted drive, copies of Signal conversations and other reporting materials during a search tied to the Aurelio Perez-Lugones investigation.
- Surveillance window: The affidavit says the FBI conducted physical surveillance of Perez-Lugones from December 12, 2025, through January 8, 2026, and CCTV from December 17, 2025, without observing in-person meetings with Natanson.
- Digital preservation: Agents preserved the entirety of Signal conversations that had a new message or alert on or after October 1, 2025, regardless of the original message date.
- Privacy Protection Act omitted: Unsealed responses and reporting note the application did not inform the magistrate judge about the 1980 Privacy Protection Act, which generally bars seizure of journalistic work product.
- Potential over-seizure: Observers say the Garmin (location tracking) and broad Signal copies appear to exceed what the affidavit established as necessary to investigate alleged electronic transmission of classified material.
- Security practices compromised: The affidavit relied in part on details Natanson publicly described about her source-handling methods, and agents later seized devices tied to those practices.
- Prosecutorial scrutiny: AUSA Gordon Kromberg, who worked on related national security litigation, is noted in reporting as someone who should have been aware of the PPA’s relevance.
Background
Hannah Natanson is a Washington Post reporter who has published reporting related to classified matters and whistleblower accounts. In late 2025 the FBI arrested Aurelio Perez-Lugones in an investigation that, according to court filings, involved alleged electronic transmission of classified information. The government obtained search warrants that led agents to seize Natanson’s devices and to make forensic copies of messaging apps and drives tied to her reporting work.
The Privacy Protection Act (PPA) of 1980 creates special protections for journalists’ work product and documentary materials, making seizure unlawful unless narrow exceptions apply—most notably when the reporter is suspected of committing a crime related to the material. Advocacy groups and press-rights experts argued that the magistrate who authorized the warrants should have been told about the PPA so the judge could weigh its protections against the government’s requested intrusions.
Independent coverage of the unsealed materials has focused on two parallel concerns. Security analysts have examined which of Natanson’s operational safeguards worked and which were exposed, while legal reporters have highlighted omissions and procedural questions in the government’s filings, including whether the affidavit overstated or mis-specified the nexus between the alleged leak and the items seized.
Main Event
Natanson filed court declarations and motions seeking the return of devices and drives seized when the FBI executed a search tied to the Perez-Lugones investigation. Among the items described in her filings is a Garmin fitness device that could contain location data; Natanson says she communicated with Perez-Lugones only by Signal or phone. The government’s affidavit asserted that surveillance between December 12, 2025, and January 8, 2026, showed no in-person meetings, supporting the conclusion that transmissions occurred electronically.
Federal agents made forensic copies of Natanson’s Signal threads and preserved conversations that had any new activity on or after October 1, 2025. Roman Rozhavsky, whose declaration is part of the court record, described the process used to capture Signal data so that ephemeral messages would not be lost by automatic deletion settings. The breadth of preserved threads apparently covered reporting discussions unrelated to Perez-Lugones that took place via Signal in the October–December window.
According to Natanson’s declaration, FBI agents specifically instructed her not to bring her Garmin with her after the search began. That direction, and the subsequent inclusion of the Garmin among seized items, alarmed rights advocates because location traces are a different category of evidence than the electronic communications the affidavit emphasized. Critics say location data can reveal meetings with other sources and so carries heavy First Amendment implications when taken from a reporter.
The government’s application materials and subsequent responses discussed efforts to limit access to genuinely privileged material going forward, but the court filings show limited acknowledgment of the PPA in initial submissions. Reporting by legal journalists has raised the question of whether prosecutors—particularly those familiar with press-vs.-national-security conflicts—failed to flag statutory protections to the magistrate authorizing the warrants.
Analysis & Implications
The seizure raises a core tension: national security leak investigations can warrant aggressive collection, but seizure of a reporter’s work product implicates statutory and constitutional safeguards. If a warrant fails to adequately address the PPA, a magistrate may not have applied the statute’s heightened scrutiny, increasing the risk of over-collection of journalistic material. That procedural omission could affect admissibility of seized information and prompt motions challenging the search’s scope.
Practically, copying entire messaging threads based on a threshold of ‘‘any activity’’ after an arbitrary date (October 1, 2025) swept in months of reporting communications. Reporters who used Signal to gather and corroborate sensitive stories—some dated October 9, October 20, and October 31—may find unrelated reporting captured by the FBI’s preservation rule. The consequence is chilling: sources and methods could be exposed, and newsroom collaborations might be subject to forensic review beyond the stated target of the probe.
Seizure of wearable-location data such as a Garmin introduces a privacy vector distinct from text preserved from Signal. Location histories can identify contacts and face-to-face encounters that the affidavit denies existed during intensive surveillance periods. If the government used Perez-Lugones as the predicate for broader collection, courts will need to scrutinize whether any non-targeted materials were lawfully obtained and whether the investigative rationale matched the items taken.
Comparison & Data
| Item | Described Purpose | Date Range / Note |
|---|---|---|
| Signal conversations | Preserve messages with activity | All threads with a new message/alert on/after Oct 1, 2025 |
| Encrypted drive (reporting notes) | Potential documentary evidence | Seized in search; contained reporting notes |
| Garmin device | Location data; possible meeting evidence | Seized despite affidavit asserting no in-person meetings Dec 12, 2025–Jan 8, 2026 |
The table shows the mismatch critics highlight: the affidavit emphasizes electronic transmission and a surveillance window that allegedly detected no in-person meetings, yet agents collected location-tracking hardware and broad messaging archives. That contrast is central to arguments that the seizure exceeded what the probable cause statements justified.
Reactions & Quotes
“By not alerting the judge to the existence of a federal law that is supposed to limit searches for reporting materials, it may have greased the skids for the judge agreeing to the warrant.”
Gabe Rottman, Reporters Committee for Freedom of the Press (press-rights organization)
“The affidavit relies on descriptions of Natanson’s public account of her sourcing practices to establish probable cause for accessing protected communications.”
Legal reporting and analysis (summation of coverage)
“Security reviewers found that some of Natanson’s operational precautions worked but that public descriptions exposed collection points.”
Runa Sundvik / 404 Media (security analysis / news site)
Unconfirmed
- The record does not yet establish whether prosecutors deliberately omitted the PPA from the warrant application or whether the omission was inadvertent; that question remains under review.
- It is not confirmed that the Garmin data contained meetings with third parties; the device was seized but the contents and their evidentiary value have not been publicly disclosed.
- The extent to which the preserved Signal threads include unrelated reporting conversations beyond Perez-Lugones material is not fully documented in public filings.
Bottom Line
The filings around the Natanson search crystallize a recurring legal and policy clash: how to balance legitimate national-security inquiries with statutory protections for journalists. The combination of broad digital preservation rules, seizure of location-tracking hardware, and an apparent failure to flag the Privacy Protection Act to the authorizing magistrate heightens the risk that ordinary reporting materials were swept up beyond the investigation’s stated target.
Key next steps will be litigation over the search’s scope, motions asserting PPA and First Amendment protections, and potential review of prosecutors’ disclosures to the court. For reporters and newsrooms, the episode underscores operational risk: public descriptions of source-handling routines can create searchable roadmaps for investigators, and device-level holdings such as wearables and encrypted drives can expose reporting networks in ways that text-only analyses may not anticipate.