M. C. McGrath

A Massachusetts Pirate Party blog post of August 2013 says that he had been with the party since the age of 16.⁠[1]

Echoing Green’s fellows directory says that he studied civic technology at Boston UniversityBoston UniversityBoston University (BU) is a private research university in Boston, Massachusetts, United States. It traces its origins to the Newbury Biblical Institute, a Methodist theological school founded in Vermont in 1839, was chartered as a university in 1869, and has been a member of the Association of American Universities since 2012.Open the full entry and did research at the MITMassachusetts Institute of TechnologyThe Massachusetts Institute of Technology (MIT) is a private research university in Cambridge, Massachusetts, United States. It received its charter from Massachusetts in 1861, admitted its first students in 1865 and moved from Boston to its present campus in 1916. As of October 2025 it had 11,816 students, and it counts 106 Nobel laureates among members of its community.Open the full entry Media Lab; his speaker biography for the 32nd Chaos Communication Congress says that he “graduated from Boston University with a degree in civic technology” and did research at the MIT Media Lab.⁠[2][3]

Echoing Green lists him as a 2013 Global Fellow, with Transparency Toolkit as his organization. The directory describes him as a social entrepreneur focused on the power of transparency for uncovering and solving problems in government and other institutions, and says that he founded Transparency Toolkit after becoming frustrated, as a free information activist, that existing transparency initiatives failed to release understandable information.⁠[2]

The directory says that Transparency Toolkit increases access to public-interest information with a software toolkit for disclosing understandable and actionable information, building an open-source web application with collaborative tools for collecting, analyzing and releasing documents and data, and helping journalists, human rights organizations and others use it; it lists the organization’s structure as nonprofit. Its “Bold Idea” is to facilitate the disclosure of information to the public through open-source transparency toolkits that let journalists and organizations rapidly consolidate, evaluate and release critical data.⁠[2]

On August 22, 2013, the Massachusetts Pirate Party asked on its blog for volunteers for Transparency Toolkit, describing it as an open-source web application that lets groups and individuals collaboratively collect, analyze and release public-interest information, aimed at journalists, activists, educators and anyone interested in government and corporate transparency. The post says that existing transparency efforts such as WikiLeaks and Project PM often present information that is hard to follow or incomplete, and that Transparency Toolkit was meant to be usable by non-experts. It names him as Transparency Toolkit’s founder, who conceived the application and began building it, with the goal that anyone who can operate a digital device could make sense of the large amount of information being shared online. Under the arrangements it describes, he would meet each active volunteer one-on-one for up to 30 minutes a week to review progress, address problems and offer learning resources; group meetings were held every two weeks on the IRC channel #transparencytoolkit on Freenode, for no more than 45 minutes, followed by discussions of topics such as transparency, privacy and data analysis; and local volunteers occasionally met in Boston. Volunteers could take on programming tasks such as fixing bugs, helping build the core platform (collaborative investigation, an information bank and a plugin system), and writing scrapers, API connectors and analysis tools, or non-programming work such as finding and reporting bugs, identifying data sources and analysis tools, improving documentation, giving usability feedback and promoting the project; the post calls programming the project’s most pressing need.⁠[1]

On June 5, 2014, Entrepreneur published the list of that year’s 20 Thiel Fellows, which includes him, aged 20, with his hometown given as Boston, MassachusettsMassachusettsMassachusetts (officially the Commonwealth of Massachusetts) is a state in the New England region of the northeastern United States; its capital and largest city is Boston. One of the original 13 states, it ratified the U.S. Constitution on February 6, 1788, the sixth state to do so. Its population in the 2020 census (April 1, 2020) was 7,029,917.Open the full entry. The list says that he was developing open-source software called Transparency Toolkit “which allows investigative journalists to research documents very quickly without uncovering anything illegal, like corruption, civil liberties violations or human rights abuses.” Each fellow in this class received $100,000 over two years and had to drop out of college; fellows were expected to be largely self-guided, with mentorship and guidance from former Fellows, and were encouraged but not required to move to the San Francisco area.⁠[4]

His speaker biographies for re:publica and the 32nd Chaos Communication Congress both describe him as a Thiel Fellow and an Echoing Green Fellow.⁠[5][3]

In May 2015, at the re:publica conference in Berlin, he presented ICWatch, a database of the LinkedIn profiles of more than 27,000 people in the intelligence community, whose name plays on that of the NSA data-sharing program ICREACH. Transparency Toolkit’s project website stated that the data helps people “better understand mass surveillance programs and research trends in the intelligence community.” Help Net Security puts the collection at 27,094 résumés; the database could be searched by company, location, industry, job title, skills and other fields, many profiles carried a portrait photo, and the raw résumé data could be downloaded from GitHub. His re:publica speaker page lists his re:publica 2015 talk “Watching the Watchers: Building a Sousveillance State.”⁠[6][7][8][5]

He built ICWatch with Brennan Novak, a coder, and Kevin Gallagher, a sysadmin. Motherboard writes that after Edward SnowdenEdward SnowdenEdward Snowden is a former American intelligence worker and technologist who worked for the Central Intelligence Agency (CIA) and later, as a contractor employee, for the National Security Agency (NSA); in 2013 he gave journalists a large cache of classified NSA documents that set off a series of reports on mass surveillance by the U.S. government, after which he was charged in the United States with theft of government property and violations of the Espionage Act, and he has lived in Russia ever since.Open the full entry’s disclosures many intelligence workers were found to list secret surveillance code names on their LinkedIn profiles, where a basic GoogleGoogleGoogle is an American technology company founded by Larry Page and Sergey Brin and incorporated in 1998. It became an Alphabet subsidiary in 2015. Its businesses include internet search, advertising, software platforms, cloud computing, and artificial intelligence.Open the full entry search could find them, and that after finding some himself he decided to automate the search. The search terms included code names, names of agencies and departments, and technical terms; some, such as XKEYSCORE, were already public, and some journalists asked him to search for specific terms. The results included people who appeared to work for the NSA’s hacking unit Tailored Access Operations (TAO); he noted that most of those posting were not NSA employees but mainly worked for contractors such as Booz Allen Hamilton and Lockheed MartinLockheed MartinLockheed Martin is an American aerospace and defense company whose main businesses include military aircraft, missile defense, rotary-wing aircraft and mission systems, and space systems.Open the full entry. Speaking to Motherboard over an encrypted call, he said that the group collects open data such as résumés, job listings and social media, mainly to study surveillance programs and secondarily human rights abuses. He found some more personal photos by checking Facebook profiles by hand, saying, “I'm yet to automate that part,” and suggested that he might someday match Facebook and LinkedIn profiles automatically.⁠[6][9]

At re:publica he presented four intelligence officers and used LinkedIn, Facebook and other sites to reconstruct their work and private lives; one listed more than two dozen surveillance programs, including XKeyscore and programs not on the public record. He inferred the rough meaning of new code words from the context of LinkedIn profiles, for example PENNANTRACE in the profile of a senior SIGINT operator, which he believes relates to surveillance drones and which a job description called an “airborne collection platform.” Using LinkedIn’s “related profiles” feature, the team also built network graphs of how companies, members and programs are connected and of how the military and surveillance industries connect, and charted how often programs were mentioned over time to estimate when large programs began and which agencies were involved; he found that the number of people claiming experience with SIGINT databases rose sharply from 2008, with a small decline from 2013. The Register writes that he pointed to a 22-year veteran who appeared to have pushed for “transparency and change” on some programs, changed jobs within months and later left the industry to sell used cars, and that he said this pattern “is an indication that people are perhaps trying to change the intelligence community from within.” Help Net Security describes an example of a person who, while at a government contractor, lobbied for an independent review of collection management processes, left or was dismissed within two months, worked two more months at a similar company and then left the intelligence industry to become a used car salesman; he said, “Some people are probably trying to change the system from within, and we don't know it.”⁠[9][6][8]

He said, “Luckily it is very easy to find out who is in the surveillance state with just a few Google searches,” that people post things like “I know how to use XKeyScore and MS Word,” and that people in intelligence need to advertise their skills: “When you need a job, you need to post about what you can do.” Help Net Security writes that he said institutions are made of people and that understanding what people do within institutions, and why, can help reform them. PCWorldPCWorldPCWorld is a PC and consumer-technology publication launched in 1983, providing news, reviews and practical guides within Foundry’s media portfolio.Open the full entry writes that he calls this approach, which relies on public data rather than leakers or journalists, a “sousveillance” state; The Register writes that he noted the irony of officers listing OPSEC as a skill.⁠[9][7][8]

PCWorld notes that ICWatch publishes the names and photos of intelligence workers, and its author Ian Paul argues that the more realistic risk is harassment. At re:publica McGrath said, “This isn't a hit list,” and “I don't think they're all necessarily horrible people that you should demonize,” and that his goal was to “provide a face to the surveillance state” and “a better mechanism for researching these programs and accountability.” Motherboard quotes him as saying that most of the people in the profiles were “pretty normal people,” that he had consulted a number of lawyers before starting the project, and that the aim was to “understand the intelligence community” and draw attention to “some of the individuals involved”; asked about it, he said he had not yet heard from anyone in the database but might. The Register quotes him as saying that open-source data would keep surfacing even if this dataset were taken down, that the data should not be used to demonize people in the intelligence industry, and that he hoped it would “start debates about programs not previously known” or serve as a basis for freedom of information requests. The Register also writes that some entries include locations drawn from LinkedIn and other easily accessible sources.⁠[7][6][9]

The Register, PCWorld and Help Net Security all wrote in the week of the launch that the ICWatch site was offline at the time of writing; Help Net Security attributed this to apparently heavy demand.⁠[9][7][8]

On May 28, 2015, Democracy Now! aired an interview with WikiLeaks founder Julian AssangeJulian AssangeJulian Assange is an Australian computer programmer and the founder of WikiLeaks. After WikiLeaks published large numbers of classified U.S. military and diplomatic documents in 2010, he was caught up for more than a decade in investigations, extradition proceedings and criminal proceedings in Sweden, Britain and the United States, spending almost seven years in Ecuador’s London embassy and five years in a British prison before a 2024 plea agreement with the U.S. Justice Department secured his release.Open the full entry; the program page’s summary says that WikiLeaks had begun hosting ICWatch, a database built by Transparency Toolkit. In the interview Assange called Transparency Toolkit “a little journalism startup” and said that ICWatch had launched a couple of weeks earlier with more than 27,000 profiles, drawn from LinkedIn, of people tied to the U.S.United StatesThe United States is a federal country in North America made up of 50 states, the District of Columbia as the seat of government, and territories such as Puerto Rico and Guam; its capital is Washington, D.C. The Continental Congress adopted the Declaration of Independence on July 4, 1776. The 2020 census (April 1, 2020) counted a resident population of 331,449,281, and the 435 seats of the House of Representatives are apportioned among the states on the basis of the census.Open the full entry intelligence community; he said that those behind it had then received “quite serious death threats” and had been attacked electronically, that ICWatch had asked WikiLeaks to protect the data, and that it had been merged with the other 8.3 million records in the WikiLeaks system.⁠[10]

On June 12, 2015, the Dutch site ID.nl described the Snowden Document Search (search.edwardsnowden.com): a tool built by Courage, a group that supports whistleblowers, with its database made in cooperation with Transparency Toolkit; it holds the Edward Snowden documents that led to published news stories rather than all of them, including at least those released by Glenn GreenwaldGlenn GreenwaldHost of System Update.Open the full entry, and can be searched by keyword, by country or by pairs of countries with ties to each other. The Courage Foundation also states that it developed the Snowden Doc Search in partnership with Transparency Toolkit, and says that it maintains the most comprehensive search engine for the published Snowden documents. His re:publica speaker biography says he worked on projects including ICWatch and the Snowden Document Search to help expose surveillance programs and make large sets of documents more understandable, and his author biography at The InterceptThe InterceptThe Intercept is a New York-based nonprofit investigative news outlet founded on February 10, 2014 by Glenn Greenwald, Laura Poitras and Jeremy Scahill under Pierre Omidyar’s First Look Media, initially to report on the NSA documents leaked by Edward Snowden; it became an independent nonprofit separate from First Look in 2023.Open the full entry says he built numerous searchable document archives, including the Snowden Document Search and ICWatch.⁠[11][12][5][13]

On October 14, 2015, Tactical Tech’s Exposing the Invisible project published a series of short interview films with him, “M.C. McGrath: Hiding in the open.” In “Watching the watchers” he talks about using open data to understand the intelligence sector and why he chooses to focus on individuals; in “The making of IC Watch” he explains the process and methodology behind ICWatch, including inserting misleading data, verifying information and cleaning messy data, and discusses the reactions he has experienced from people in the intelligence community and what mass publication of data can be used for; in “Accidental leaking and other types of open data” he proposes three main ways for individuals and groups to get data from governments and organizations: governments releasing it themselves, through freedom of information requests or open data initiatives; whistleblowers leaking documents; and data that people and institutions leak accidentally themselves, the technique ICWatch uses; in “Using the tool” he introduces ICWatch, what data it contains and how users can find relevant information and patterns about the intelligence community; and in “Activists and online activity” he suggests tips and techniques to help activists stay safer online, drawing on lessons from creating ICWatch and Transparency Toolkit.⁠[14][15][16][17][18]

On December 30, 2015 (day 4 of the congress), at 18:00, he gave a one-hour talk in English titled “Collect It All: Open Source Intelligence (OSINT) for Everyone” in Hall 2 at the 32nd Chaos Communication Congress (32C3), in the “Ethics, Society & Politics” track. The congress schedule says that governments publish reports about their operations and journalists publish whistleblower documents, but that information people and companies post about themselves is an often overlooked third source of open data that can be used to build “an independent, distributed system of accountability”; that intelligence analysts routinely use open source intelligence (OSINT), that ICWatch showed open data online can also be used to watch the intelligence community, and that Transparency Toolkit has built free software anyone can use to collect OSINT without coding; and that the talk covers techniques for gathering OSINT on surveillance and human rights issues and how such data could be used in journalism, litigation and policy change. The congress’s speaker biography describes Transparency Toolkit as an organization that investigates surveillance and human rights abuses by collecting open data and making free software to analyze it.⁠[19][3]

On February 4, 2016, Berliner Gazette published his audio piece “Whose Future Is at Stake When It Comes to Working with the Snowden Archives?” in its “Tacit Futures” series. The paper’s author page describes him as a hacker and activist who created Transparency Toolkit, a set of tools for collecting data from various open data sources, which was the basis for ICWatch, a database of an estimated 27,000 LinkedIn résumés of people working in the intelligence sector.⁠[20]

His re:publica speaker page lists his re:publica 2016 session with Naomi Colvin, “Spook Sociology: How the Intelligence Community Sees the World.”⁠[5]

On April 20, 2018, The Intercept published an article by him and Glenn Greenwald, “How Shoddy Reporting and Anti-Russian Propaganda Coerced Ecuador to Silence Julian Assange.” The authors argue that Ecuador’s March 27, 2018, cutoff of Julian Assange’s internet access and of visitors other than his lawyers followed diplomatic pressure from Spain and its NATONATONATO, the North Atlantic Treaty Organization, is an alliance founded on the North Atlantic Treaty signed in 1949, with collective defence as its core principle. Its political and administrative centre is in Brussels, Belgium.Open the full entry allies over Assange’s criticism of the crackdown on Catalan independence activists, with his tweets about the arrest of former Catalan president Carles Puigdemont in Germany as the breaking point, and that claims of Russian interference in Catalonia involving Assange and Edward Snowden were largely unsupported; the article singles out El País and the Hamilton 68 dashboard.⁠[21]

The article’s data analysis says that an El País claim, based on a TwitterAudit analysis of 5,000 of Assange’s followers, that 59 percent of them were fake relied on data from February 2014, three years before his account first tweeted on February 14, 2017, and that a reassessment on November 24, 2017, found 92 percent of his followers to be real. It also says that, against El País’s view that 2,000 retweets within an hour of a September 15, 2017, Assange tweet showed bot activity, only one-sixth of that tweet’s retweets came in the first hour, and that only 1 to 3 percent of RT and Sputnik stories on Catalonia mentioned Assange. The article states that he submitted a full report with more detailed data to the U.K. Committee on Fake News, the House of Commons Digital, Culture, Media and Sport Committee.⁠[21]

On July 4, 2019, he taught the course “Building Your Own Searchable Document Archive” at the Centre for Investigative Journalism (CIJ) Summer Conference.⁠[22]

On November 14, 2024, from 16:05 to 17:00, he spoke on the panel “After Assange: Journalists and the Espionage Act,” a CIJ symposium event in Frobisher Auditorium 1 at the Barbican, chaired by Trevor Timm, co-founder and executive director of the Freedom of the Press Foundation, with Holger Stark and Rebecca Vincent, director of campaigns at Reporters Without Borders. The event description says that Julian Assange had been released from a U.K. prison following a plea deal with the U.S. government, and the panel addressed the prospect of espionage laws in the U.S., the U.K. and Europe being used to threaten and intimidate journalists who work with sources and whistleblowers on national security stories, and what can be done about it.⁠[23][22]

The CIJ’s biography says that he is a member of Julian Assange’s legal team and worked as a legal researcher on his extradition case.⁠[23][22]

Echoing Green’s fellows directory gives Berlin, Germany, as his and Transparency Toolkit’s location; Berliner Gazette’s author page describes him as a hacker and activist based in Berlin.⁠[2][20]

Echoing Green: Official website: https://echoinggreen.org/ (opens in a new window).⁠[24]

Thiel FellowshipThiel FellowshipThe Thiel Fellowship is a two-year grant program started by investor Peter Thiel and run by the Thiel Foundation that funds young people who skip or stop out of college to build new things instead. The program has been criticized by figures in education for encouraging young people to leave college.Open the full entry: Official website: https://thielfellowship.org/ (opens in a new window).⁠[25]

X: Public account: https://x.com/Shidash (opens in a new window).⁠[13]