Act I. The fall
I was charged by Estonia's central criminal police. I was young, I could break things, and I did.
I sold my skills to people who used them to get into accounts that weren't theirs, and I told myself the line I was standing on was a legal one. It wasn't. On 20 November 2024 Harju County Court convicted me of preparing computer crime: I had made my own version of the Evilginx phishing toolkit and sold it. The sentence was ten months in prison. I served five, and the other five were suspended with a one-year probation period.
I take full responsibility for my actions during that time. I'm not going to narrate the case here, name anyone involved, or describe what the tools did. None of that would make this page more honest. The short version is enough: I had a rare skill, no direction for it, and I pointed it at the wrong things.
Act II. The pivot
The pivot wasn't a moment. It was a slow realization that the thing I was good at was worth nothing on its own.
Breaking a system tells you exactly one thing: where the gap is between what it claims to verify and what it actually verifies. That knowledge has two uses. You can sell the gap, or you can close it. The first pays faster and ends the way mine ended. The second is the only version that compounds.
So I stopped selling and started writing. Same eyes, different direction. The skill that got me charged is the skill that now lets me read a protocol specification and see the approval step nobody thought about, or read an anti-fraud VM and see which of its promises are enforceable and which are just hopeful. I didn't have to become a different person. I had to point the same person somewhere useful.
Act III. The work
Everything I've published since is evidence for that claim. You don't have to take my word for it.
- SoK: Client-Side Anti-Automation Under VLM-Based Attack
A systematization of five paradigms of client-side anti-fraud, from VM attestation to hardware-anchored determinism, with a cost model for attacks that synthesize operators with vision-language models. Over a hundred people have starred it on GitHub, and the BotGuard teardown behind it is on this site.
- Smart-ID research
Protocol-level analysis of Estonia's most widely used authentication method: why it resists the attacks people expect, and where the approval layer fails instead. Where findings touched live systems, they went to the vendor and to RIA before they went public.
- Zero-Trust Octagon
A zero-trust architecture framework built from eight axioms rather than from vendor slides, with a morphological matrix and breach walkthroughs. It's a textbook, not a product.
- ee-eudiw
An independent technical specification for an Estonian EU Digital Identity Wallet, with a zero-knowledge proof-of-age profile and a working demo over ISO 18013-5 mdoc. Prove you're over 18 without revealing who you are. Public soon.
- ProksiAbel OÜ
The company I run for research and consulting. The security research policy on this site is its policy, and the PGP key in the footer is mine.
I publish my findings publicly. I disclose vulnerabilities through coordinated disclosure. I build production systems that are secure by design, under threat models I write myself. That's the difference between Act I and Act III: same fault line, opposite side.
If you want to know what I can do now, read my research. If you want to know why I can do it, you just did.
Delfi covered the case at the time. Their interview is here (in Estonian). I'd rather you read it than wonder about it.