IT TOOK just 20 minutes to build, but Chris Soghoian's hastily constructed website capable of generating fake airline boarding passes led to a rebuke from a congressman, a raid by the Federal Bureau of Investigation (FBI), an investigation by the Transport Security Administration (TSA), worldwide media coverage-and ultimate vindication. With a series of similar exploits that have exposed security flaws and privacy violations, he has demonstrated his ability to hack the media with just as much facility as he manipulates computers. At the age of 30 he has established himself as the most prominent member of a new generation of activist technology researchers who delight in causing a media stink in order to shame companies and governments into fixing problems with their systems.

The boarding-pass example occurred in 2006, when Dr Soghoian, then a graduate student at Indiana University, became irritated by an obvious flaw in airport procedures used by TSA screeners. Although screeners checked the name on each passenger's boarding pass against a government-issued identity document, they had no way of verifying that the boarding pass itself was valid. Fake boarding passes could easily be created for any flight using a computer and image-manipulation software, as had already been pointed out by Bruce Schneier, another security guru, in 2003. Charles Schumer, a senator, even issued a press release in February 2005 explaining how easily security could be bypassed in this way.

Yet it took Dr Soghoian to light the right kind of firecracker under this known problem. In October 2006 he threw together a web page that could generate fake boarding passes for Northwest Airlines that appeared valid to TSA screeners. The page received enormous press attention, even though he never printed out or used a false pass himself. Ed Markey, a congressman, called for Dr Soghoian's arrest. The FBI had his website shut down and seized his computers. The TSA opened an inquiry. But when the simplicity of the "hack" became apparent, along with Dr Soghoian's academic status, Mr Markey apologised and suggested that rather than investigating Dr Soghoian, the TSA should hire him instead. Dr Soghoian's computers were returned a few weeks later and the TSA investigation was closed. This year the TSA finally began testing equipment to validate boarding passes at airports.

Dr Soghoian has since perfected this modus operandi and used it to expose problems with internet encryption, online privacy and electronic surveillance. In each case he identifies a problem, creates a technology demonstration to highlight it and sometimes files Freedom of Information Act requests or complaints to government agencies. He then presents the results neatly packaged for the news media. The organisations targeted by Dr Soghoian usually start off by accusing him of being mistaken or naive, before admitting that he is right and modifying their policies, or issuing a statement saying that a fix was already in the works.

Dr Soghoian has, among other things, revealed the extent to which Sprint, an American telecoms operator, was disclosing its customers' satellite-positioning data to law-enforcement agencies; shamed Google, an internet giant, into upgrading its encryption; exposed a woefully misguided attempt to attack Google by a public-relations firm hired by Facebook, a rival internet giant; embarrassed Dropbox, a provider of online file-storage, over its marketing claims and technical practices; and pushed for the adoption of a "Do Not Track" scheme to allow internet users to opt out of targeted advertising. "Every privacy scandal essentially has to take the form of a firestorm," says Dr Soghoian. "I try to focus on things that are really important that haven't gotten enough attention." He is now campaigning against the widespread trawling of internet traffic by law-enforcement agencies, calling instead for a more targeted focus on specific cases or leads.

The FBI made me do it

Having grown up surrounded by computers (his father used to be a software engineer), Dr Soghoian says he slid into computer science without even considering other disciplines. He became interested in computer security in particular during his undergraduate studies, and was then drawn to the specialised field of privacy. But it was only when the FBI raided his home in 2006 and his PhD adviser suggested that he take a law class that Dr Soghoian decided to concentrate on the intersection between computing and the law. He wrote his thesis on governmental use of third parties to monitor electronic communications and was awarded his doctorate in July 2012.

But it would be wrong to characterise Dr Soghoian simply as an academic or an activist, because he has an unusual gift for working outside conventional institutional strictures. While completing his PhD, he was also attached to America's Federal Trade Commission (FTC) as a technical adviser. This came about as a result of Dr Soghoian's support for the "Do Not Track" standard, and his efforts to make it easier for people to prevent their use of the internet being tracked by advertisers. Turning such tracking off can be quite tricky, and must be done for multiple groups, or networks, of advertisers.

This prompted Dr Soghoian to develop two add-ons for the Firefox web browser that demonstrated simple ways to turn off tracking automatically. The first manipulated "cookies", the tiny snippets of information stored by web browsers, to disable tracking. The second, developed with the help of Sid Stamm, a programmer, sends a special message with every page request asking that the user not be tracked. Dr Soghoian got the idea for this approach from Dan Kaminsky, a security researcher. But it will work only if websites are required to detect and act on such messages. At first this suggestion was ridiculed. In 2009, however, Dr Soghoian was contracted by the FTC to provide lawyer-to-geek translation for its staff. In this role he was able to garner support for his "Do Not Track" scheme within the FTC, and technology firms including Microsoft and Twitter have subsequently backed it. The advertising industry dislikes it, but seems resigned to accepting it in some form.

A few months after joining the FTC Dr Soghoian recorded a Sprint executive speaking at a surveillance trade show attended by telecoms firms, law-enforcement agencies and equipment-makers. The executive explained that Sprint had built an automatic system that had provided 8m lookups of customers' locations in the preceding year in response to requests backed by court orders. (Sprint said later that a single court order could generate several thousand lookups.) Dr Soghoian briefed the press and posted the audio online. He insisted that he was doing so in his role as a graduate student, rather than an FTC contractor. The scale of tracking caused a furore that persists three years later about the ease and scale of mobile-phone surveillance. When Dr Soghoian's first year at the FTC was up, the agency did not renew his contract. He blames the fuss caused by the Sprint recording. (The FTC will not comment.)

Dr Soghoian is one of a group of researchers, some of whom are affiliated with academic institutions and many of whom work together, who have risen to prominence by showing how tedious technical flaws can affect ordinary people. Ashkan Soltani, who like Dr Soghoian has worked as an adviser to the FTC, has shown how some companies have devised "evercookies"-cookies that are very difficult to eradicate. Along with Jonathan Mayer of Stanford Law School, he showed how Google was bypassing tracking preferences in Apple's web browser, Safari, which resulted in Google having to pay a $22.5m fine. Mr Kaminsky spotted a huge flaw in the internet's addressing system in 2008, and then worked closely with large technology firms to fix it. And Dr Stamm is now a privacy advocate at the Mozilla Foundation, which oversees the development of the Firefox web browser.

First among equals

Can Dr Soghoian's reputation as a knight in digital armour be squared with his obvious flair for self-promotion? Yes, says Jules Polonetsky, director of the Future of Privacy Forum, a think-tank based in Washington, DC, who by his own admission does not always see eye-to-eye with him. "People would be surprised by the number of times that this otherwise very public media bomb-thrower has quietly worked to get a company to simply solve a problem when it could have been a front-page story," says Mr Polonetsky. Dr Soghoian's agenda is "not about money, not about fame or anything like that," says Lee Tien of the Electronic Frontier Foundation, a lobby group with which Dr Soghoian sometimes collaborates. He just uses the glare of the media to get results.

"The economics of modern surveillance are not beneficial to the consumer."

Though known for his strong views on privacy and surveillance, Dr Soghoian is no absolutist. In April he published a paper in the Berkeley Technology Law Journal on how best to grant law-enforcement agencies access to individuals' location data, with proper checks and balances. It was co-written with Stephanie Pell, who was on the Department of Justice team that prosecuted people accused of being linked to al-Qaeda. Writing the paper, says Dr Soghoian, involved finding a balance between Ms Pell's knowledge of the utility of location-tracking in law enforcement and his own concerns about unwarranted privacy intrusions. "The marginal cost of spying on one more person is essentially zero now," he says. "The economics of modern surveillance are not beneficial to the consumer."

As a respite from his campaign to defend personal privacy, Dr Soghoian likes to go to India. But he may have to find somewhere else to holiday. "India is rapidly becoming a surveillance state," he says. Such trips may be less frequent in any case, because Dr Soghoian now has a new job at the American Civil Liberties Union, mediating between geeks and lawyers, as he did at the FTC. His new employers must be well aware that they have captured lightning in a bottle-and should not be surprised when it escapes.