Moumen Alaoui

My background is in data science and statistics. I've always been interested in a question that keeps appearing in different forms: what can you actually learn from a system by observing what it exposes?

I didn't start out in security; that came later.

It all began with learning how much a modern browser can reveal about the person using it. That was enough to make me switch to LibreWolf, a privacy-focused fork of Firefox. From there I came across arkenfox's user.js, which led me into about:config, a corner of the browser most people never open.

I spent weeks there, learning what each setting gave away and what it cost to turn it off. Eventually it became clear that the fingerprint was only one layer: hardening the browser means little if the connection underneath betrays you.

So I kept going down the stack. First to the network, where VPNs, Tor, and I2P make very different tradeoffs. That's the layer that really got me hooked, and why I now contribute to Arti, Tor's Rust client (my contributions). Then to messaging, where encryption can protect what is said without necessarily hiding who is talking to whom. And finally to the device itself, where the operating system decides how much any of this matters: Tails, Qubes, and GrapheneOS, which I still find the most interesting of the three.

What I took from the bottom was that no system is ever fully anonymous. Every one of them leaks somewhere, and the question worth asking is where.

For most people, the answer is a matter of preference. For a journalist or a dissident under an authoritarian government, it can decide whether they stay safe. That's what brought me to tech policy in Washington, and to research at the Washington Institute for Near East Policy and the Special Competitive Studies Project.

The same leaks cut the other way. What can expose a dissident can just as easily expose a regime, which is why open-source intelligence has always pulled at me, and why I built BLACKOUT, a censorship tracker now hosted by SCSP.

Tracking shutdowns raises an obvious next question: what keeps people connected when the infrastructure underneath is cut? That has led me toward mesh networks, which face the same problem whether the cut comes from a government shutting down its internet or from jamming on a battlefield. From there it was a short step to defense, to autonomous systems, drones in particular, and to simulating how they perform in contested environments before anyone fields them.

Outside of work, I fly FPV drones, DJ, train BJJ, and enjoy target shooting. I've had a soft spot for reptiles and arachnids for as long as I can remember. I speak French, Arabic (MSA and Darija), Amazigh, English, and Spanish; I'm currently learning Russian.

I write occasionally under Writing, and the easiest way to reach me is at moumenalaoui@proton.me.