INVISIBLE WOMAN
THE VANISHED MESSAGES
The day when the security breach happened
On the morning of Saturday, 28 June 2025, Laureano Pastor and I were sitting in Sintra (Portugal) after breakfast when he suddenly stopped speaking.
He was staring at WhatsApp.
Messages were disappearing.
We watched the screen in disbelief. Conversations from the preceding weeks — the period in which our relationship, my administrative status and the sudden change in Laureano’s security position had all become matters of official concern — appeared to have vanished. Some messages later returned. Others did not.
Laureano then tried to access his personal Hotmail account. At first he could not get in. When access was restored, material appeared to be missing there too. In particular, communications surrounding the events of 17–20 June were no longer available in the form in which he expected to find them.
One important email was his request of 16 June to begin the administrative process of registering me as his partner. Other communications from 18, 19 and 20 June survived in my own archive because I had either received them directly, been copied into them or later received forwarded copies. Those copies subsequently helped Laureano reconstruct parts of his personal record.
“Yana,” he said, “I think they are watching us.”
My response was less alarmed than it perhaps should have been. If security authorities genuinely had concerns, I said, they were entitled to examine them through lawful procedures. But why would any legitimate examination require unexplained interference with a serving officer’s private communications?
At that stage, neither of us knew the answer. We still do not.
We observed anomalies. We preserved screenshots and copies. Laureano reported promptly tp his NATO ad Spanish command what had happened. But no competent authority ever carried out the forensic examination needed to establish whether the cause was hostile access, authorised monitoring, misuse of physical access to a device, a synchronisation failure, an account-security event or something else.
The absence of an investigation is not proof of a hack. It is the reason the possibility has never been properly confirmed or excluded.
So we were sitting there, in the garden of a nice hotel in Sintra and watching Laureano's private messages disappearing from his Whatsapp. Then he started reading the news and told me: "Look, you are in a good company!". This was his sense of humour - he read out a report about Blaise Metreweli, who had recently been appointed as the first woman to lead MI6. Reports published on 27–28 June described archival findings concerning her paternal grandfather, Constantine Dobrowolski, a Nazi intelligence collaborator reportedly known as “the Butcher.” The Foreign Office stressed that Metreweli had never known or met him.
I made a dark joke to Laureano: at least my own grandfather had not been a Nazi war criminal, so perhaps there was still hope for me to become a head of MI5 one day.
It was gallows humour after a disturbing morning. It also exposed the absurdity of judging a person’s security reliability through ancestry, birthplace or inherited associations rather than through evidence about the person herself.
Fifteen months later, the irony has become considerably harder to ignore.
What El Confidencial Digital has now reported
On 28 October 2026, Spanish journalist Aurelio Ruiz Enebral published a detailed investigation in El Confidencial Digital: “El oficial español apartado de la OTAN por su relación con una mujer de origen ruso denunció intrusiones en su WhatsApp y su correo”
The article reconstructs the following sequence.
On 18 June 2025, two officers from Spain’s Armed Forces Intelligence Centre, CIFAS, questioned a Spanish naval officer serving at NATO’s Allied Maritime Command, MARCOM, at Northwood. Days later, the officer detected anomalies affecting WhatsApp and email. Yes, that officer was Laureano Pastor Veiga.
According to the report, WhatsApp had been uninstalled from his phone. After it was reinstalled, messages received after 17 June did not download normally. That included communications concerning the CIFAS interview, the security dispute and conversations with the senior Spanish admiral at MARCOM. Messages were also delayed, while email traffic showed delays, failed delivery and problems with attachments.
The report further states that other people in the MARCOM environment appeared to know personal matters concerning the officer.
Laureano and I did not conceal any of this. Quite the opposite. The suspected interference was reported through Spanish and NATO channels multiple times. Screenshots and supporting material were supplied. The matter was reported to Allied Command Counter Intelligence, NATO security and communications-security structures, and the relevant chains of command. Individuals who might have had physical access to Laureano’s NATO UNCLASS laptop were identified.
The laptop was important. It was the work-issued, unclassified device assigned to Laureano at MARCOM. His private email and WhatsApp were accessible through it, and it contained personal files. After he was excluded from Northwood, the laptop was removed from his workplace and remained beyond his control.
The Spanish report’s most consequential finding is not that a particular actor hacked Laureano. It does not establish that. Its real significance is institutional: despite repeated reports, no NATO or Spanish authority examined the phone or other relevant devices, and Laureano received no substantive explanation.
He was treated as a security risk. His communications, however, were not treated as a security incident worthy of forensic examination.
When Aurelio was writing his article, he asked me: "Have you or your communications ever been examined by anyone"? My response was short: "Nunca" (never). I have never been a subject or object of any security investigation by the NATO, British or Spanish authorities. I have never been aware of any of such investigation and I have never been notified about any inquiries about me or my background. Nobody spoke to me, asked me any questions or requested any information. None of my devices have ever been examined. My role was different - to be a reason to take illegal action against my former partner and to destroy our relationship.
It has never been a security matter. It has always been personal.
What can — and cannot — be concluded forensically
The word “hack” is convenient, but it can conceal several technically distinct possibilities.
WhatsApp messages may appear to disappear because of local deletion, remote deletion within the permitted window, failure to restore a backup, re-registration of an account, a linked-device session, database corruption, synchronisation problems or unauthorised access. An application can disappear because of user action, device-management action, corruption, an operating-system event or interference by another person with physical or remote access.
Email can similarly appear incomplete because of compromised credentials, forwarding or deletion rules, altered folders, retention settings, synchronisation failures, client-side configuration or direct deletion.
The observed pattern therefore does not identify an actor by itself.
But the timing made the incident obviously reportable. The anomalies appeared immediately after a counter-intelligence interview and the officer’s abrupt exclusion from Northwood. They affected communications about precisely those events. The officer’s unclassified NATO laptop, through which private accounts had been accessed, was no longer under his control. He then reported the incident and requested investigation.
A competent response could have preserved and examined:
That examination might have demonstrated malicious access. It might equally have identified an innocent technical explanation. Either outcome would have mattered.
Instead, the evidential window was allowed to close.
Four formal attempts to obtain an investigation
The documentary record shows at least four distinct formal complaints or reports concerning the communications and personal-data issue.
On 12 July 2025, a complaint to MARCOM requested a formal investigation into the disappearing WhatsApp messages and email anomalies, including analysis of who had access to Laureano’s private accounts through the NATO UNCLASS laptop.
On 25 July, Laureano submitted a report intended for Allied Command Counter Intelligence and NATO security structures. It requested counter-intelligence review and a full cybersecurity forensic assessment.
On 29 August, he submitted a formal complaint to Spain’s Chief of the Defence Staff, copied to the Director of CIFAS. It requested investigation and institutional protection and included the retention of the laptop and alleged interference with private communications among the matters requiring examination.
On 16 September, he submitted an Information Rights Complaint to MARCOM. He requested the return of his personal material and a full report on the investigation into access to his personal email and WhatsApp — or, if no investigation had been conducted, an explanation of why not.
Different versions, attachments and covering emails exist, but they should not be inflated into separate complaints. The significant fact is simpler: the same substantive issue was raised repeatedly, through different competent routes, and no forensic result was provided.
Why we went to Northwood on 26 August
This history also explains an element missing from many accounts of the incident at Northwood Headquarters on 26 August 2025.
Laureano did not go there arbitrarily. He had two concrete objectives.
First, he needed a proof-of-employment letter that had been promised for his son’s university-related requirements. Contemporary correspondence records that he had sought the document in advance and had been told it was ready, but it had not been sent to him.
Second, he wanted access to, or the return of, personal data and files stored on the NATO UNCLASS laptop. By then, the unresolved communications incident made the status of that personal archive a serious concern. The material was personal and sensitive. He wanted to know what had happened to it, who had accessed it and when it would be returned.
Our attendance on 26 August was therefore connected not only with an employment document but with an unresolved personal-data and communications-security issue that Laureano had already reported several times.
We were refused access. The encounter escalated from security staff to RAF Police and then to Hertfordshire Police. Laureano did not recover the data he had requested.
He reported the suspected loss or theft of his personal information to civilian police that day.
A recording made on 27 August appears to capture a Hertfordshire Police officer telling him that he had been dismissed and connecting the situation with his having brought a Russian citizen to Northwood. At that point, Laureano had not yet received the later formal notification concerning the end of his MARCOM assignment.
The recording raises a further traceability question. Why was information about his employment and his relationship being introduced into a police conversation about his report concerning personal data? Who supplied it? Was it verified? And why was his relationship with a supposedly “Russian” woman relevant to whether his private material had been lost, retained or accessed?
Those questions should not be answered through paraphrase or outrage. The original recording and police records should be examined. The point is that they exist and are capable of examination.
If I was the security risk, who was protecting our information?
The report in El Confidencial Digital raises another question that the institutions concerned have yet to answer.
It also describes my account of a meeting with a man I identified as an FSB operative. During that meeting, he asked questions and showed me materials whose contents suggested that they could have originated in Laureano’s personal archive.
I know that I did not supply those materials. Laureano has consistently stated that he did not supply them either.
That does not establish where they came from. It does make their provenance a serious question—particularly when the handling of Laureano’s private WhatsApp and Hotmail accounts remains unexplained.
The documentary record already raises concerns about how NATO and Spanish authorities circulated information about both of us, what they verified before sharing it, and who received it. That record does not prove that either institution supplied information to a Russian operative. But it makes scrutiny of their own handling of our information unavoidable.
For fifteen months, I have been asking how our information was handled. Against that background, the suggestion that I pursued a relationship with Laureano to obtain information demands more than repetition. It demands evidence—and an explanation of what the institutions themselves did to protect the information they controlled.
Five questions that require answers
How can institutions treat me as a suspected route by which information might reach Russia, yet leave unanswered my report that a Russian operative appeared to possess private material whose source neither Laureano nor I could explain?
There is a joke I keep returning to: the hardest part of investigating a crime is making sure the trail does not lead back to you.
After the report in El Confidencial Digital, that joke carries an uncomfortable question.
The authorities that treated me as a suspected espionage risk, and Laureano as a security concern, should now explain what they have done to investigate the reported possession of private material by a man I identified as an FSB operative.
If they decline to investigate—or to provide a substantive account of any investigation already undertaken—they will leave a central possibility untested: whether information reached Russian hands through deliberate disclosure, reckless sharing or failures within their own environments.
That would not prove an institutional leak. It would mean that the institutions which scrutinised us had failed to demonstrate comparable scrutiny of themselves.
Are you prepared to follow the evidence wherever it leads—including back into your own institutions?
Exactly two years ago, I met Laureano on Tinder.
In those two years, no authority has invited me to a formal investigative interview. Nobody has put the allegations to me and asked for my answers. Apart from the Russian operatives I have described, nobody has questioned me substantively about these matters.
Twenty minutes in a car with two officers, talking about the weather, does not amount to an investigative interview. They did not put any substantive allegations to me.
Yet somehow, there has been no shortage of claims about me: a Russian spy, a “red sparrow”, supposedly under investigation, supposedly implicated in a breach of the Official Secrets Act.
Two years of allegations. Not one formal interview.
If you have evidence, put it to me. If you have questions, ask them. If information about me has been circulated without verification, explain who circulated it, who received it and what you are doing to correct it.
And if you believe I was a route by which private information could reach Russia, explain what you did when I reported that a Russian operative appeared to possess private material whose provenance needed investigating.
You cannot credibly demand scrutiny of my relationship while leaving your own handling of our information unexplained.
I am here. I am not going anywhere. I am willing to answer questions—and I expect you to answer ours.
Don’t be shy. You know my number.
Today's song - LA LOBA Y EL TORO EN LA PARED
On the morning of Saturday, 28 June 2025, Laureano Pastor and I were sitting in Sintra (Portugal) after breakfast when he suddenly stopped speaking.
He was staring at WhatsApp.
Messages were disappearing.
We watched the screen in disbelief. Conversations from the preceding weeks — the period in which our relationship, my administrative status and the sudden change in Laureano’s security position had all become matters of official concern — appeared to have vanished. Some messages later returned. Others did not.
Laureano then tried to access his personal Hotmail account. At first he could not get in. When access was restored, material appeared to be missing there too. In particular, communications surrounding the events of 17–20 June were no longer available in the form in which he expected to find them.
One important email was his request of 16 June to begin the administrative process of registering me as his partner. Other communications from 18, 19 and 20 June survived in my own archive because I had either received them directly, been copied into them or later received forwarded copies. Those copies subsequently helped Laureano reconstruct parts of his personal record.
“Yana,” he said, “I think they are watching us.”
My response was less alarmed than it perhaps should have been. If security authorities genuinely had concerns, I said, they were entitled to examine them through lawful procedures. But why would any legitimate examination require unexplained interference with a serving officer’s private communications?
At that stage, neither of us knew the answer. We still do not.
We observed anomalies. We preserved screenshots and copies. Laureano reported promptly tp his NATO ad Spanish command what had happened. But no competent authority ever carried out the forensic examination needed to establish whether the cause was hostile access, authorised monitoring, misuse of physical access to a device, a synchronisation failure, an account-security event or something else.
The absence of an investigation is not proof of a hack. It is the reason the possibility has never been properly confirmed or excluded.
So we were sitting there, in the garden of a nice hotel in Sintra and watching Laureano's private messages disappearing from his Whatsapp. Then he started reading the news and told me: "Look, you are in a good company!". This was his sense of humour - he read out a report about Blaise Metreweli, who had recently been appointed as the first woman to lead MI6. Reports published on 27–28 June described archival findings concerning her paternal grandfather, Constantine Dobrowolski, a Nazi intelligence collaborator reportedly known as “the Butcher.” The Foreign Office stressed that Metreweli had never known or met him.
I made a dark joke to Laureano: at least my own grandfather had not been a Nazi war criminal, so perhaps there was still hope for me to become a head of MI5 one day.
It was gallows humour after a disturbing morning. It also exposed the absurdity of judging a person’s security reliability through ancestry, birthplace or inherited associations rather than through evidence about the person herself.
Fifteen months later, the irony has become considerably harder to ignore.
What El Confidencial Digital has now reported
On 28 October 2026, Spanish journalist Aurelio Ruiz Enebral published a detailed investigation in El Confidencial Digital: “El oficial español apartado de la OTAN por su relación con una mujer de origen ruso denunció intrusiones en su WhatsApp y su correo”
The article reconstructs the following sequence.
On 18 June 2025, two officers from Spain’s Armed Forces Intelligence Centre, CIFAS, questioned a Spanish naval officer serving at NATO’s Allied Maritime Command, MARCOM, at Northwood. Days later, the officer detected anomalies affecting WhatsApp and email. Yes, that officer was Laureano Pastor Veiga.
According to the report, WhatsApp had been uninstalled from his phone. After it was reinstalled, messages received after 17 June did not download normally. That included communications concerning the CIFAS interview, the security dispute and conversations with the senior Spanish admiral at MARCOM. Messages were also delayed, while email traffic showed delays, failed delivery and problems with attachments.
The report further states that other people in the MARCOM environment appeared to know personal matters concerning the officer.
Laureano and I did not conceal any of this. Quite the opposite. The suspected interference was reported through Spanish and NATO channels multiple times. Screenshots and supporting material were supplied. The matter was reported to Allied Command Counter Intelligence, NATO security and communications-security structures, and the relevant chains of command. Individuals who might have had physical access to Laureano’s NATO UNCLASS laptop were identified.
The laptop was important. It was the work-issued, unclassified device assigned to Laureano at MARCOM. His private email and WhatsApp were accessible through it, and it contained personal files. After he was excluded from Northwood, the laptop was removed from his workplace and remained beyond his control.
The Spanish report’s most consequential finding is not that a particular actor hacked Laureano. It does not establish that. Its real significance is institutional: despite repeated reports, no NATO or Spanish authority examined the phone or other relevant devices, and Laureano received no substantive explanation.
He was treated as a security risk. His communications, however, were not treated as a security incident worthy of forensic examination.
When Aurelio was writing his article, he asked me: "Have you or your communications ever been examined by anyone"? My response was short: "Nunca" (never). I have never been a subject or object of any security investigation by the NATO, British or Spanish authorities. I have never been aware of any of such investigation and I have never been notified about any inquiries about me or my background. Nobody spoke to me, asked me any questions or requested any information. None of my devices have ever been examined. My role was different - to be a reason to take illegal action against my former partner and to destroy our relationship.
It has never been a security matter. It has always been personal.
What can — and cannot — be concluded forensically
The word “hack” is convenient, but it can conceal several technically distinct possibilities.
WhatsApp messages may appear to disappear because of local deletion, remote deletion within the permitted window, failure to restore a backup, re-registration of an account, a linked-device session, database corruption, synchronisation problems or unauthorised access. An application can disappear because of user action, device-management action, corruption, an operating-system event or interference by another person with physical or remote access.
Email can similarly appear incomplete because of compromised credentials, forwarding or deletion rules, altered folders, retention settings, synchronisation failures, client-side configuration or direct deletion.
The observed pattern therefore does not identify an actor by itself.
But the timing made the incident obviously reportable. The anomalies appeared immediately after a counter-intelligence interview and the officer’s abrupt exclusion from Northwood. They affected communications about precisely those events. The officer’s unclassified NATO laptop, through which private accounts had been accessed, was no longer under his control. He then reported the incident and requested investigation.
A competent response could have preserved and examined:
- the phone and its WhatsApp installation, registration and backup history;
- linked-device and account-session information;
- Microsoft account access, security alerts, rules and deletion history;
- the NATO UNCLASS laptop and its access logs;
- device-management and endpoint-security records;
- physical custody and access records for the laptop;
- relevant network, authentication and audit logs; and
- the screenshots and contemporaneous copies held by both of us.
That examination might have demonstrated malicious access. It might equally have identified an innocent technical explanation. Either outcome would have mattered.
Instead, the evidential window was allowed to close.
Four formal attempts to obtain an investigation
The documentary record shows at least four distinct formal complaints or reports concerning the communications and personal-data issue.
On 12 July 2025, a complaint to MARCOM requested a formal investigation into the disappearing WhatsApp messages and email anomalies, including analysis of who had access to Laureano’s private accounts through the NATO UNCLASS laptop.
On 25 July, Laureano submitted a report intended for Allied Command Counter Intelligence and NATO security structures. It requested counter-intelligence review and a full cybersecurity forensic assessment.
On 29 August, he submitted a formal complaint to Spain’s Chief of the Defence Staff, copied to the Director of CIFAS. It requested investigation and institutional protection and included the retention of the laptop and alleged interference with private communications among the matters requiring examination.
On 16 September, he submitted an Information Rights Complaint to MARCOM. He requested the return of his personal material and a full report on the investigation into access to his personal email and WhatsApp — or, if no investigation had been conducted, an explanation of why not.
Different versions, attachments and covering emails exist, but they should not be inflated into separate complaints. The significant fact is simpler: the same substantive issue was raised repeatedly, through different competent routes, and no forensic result was provided.
Why we went to Northwood on 26 August
This history also explains an element missing from many accounts of the incident at Northwood Headquarters on 26 August 2025.
Laureano did not go there arbitrarily. He had two concrete objectives.
First, he needed a proof-of-employment letter that had been promised for his son’s university-related requirements. Contemporary correspondence records that he had sought the document in advance and had been told it was ready, but it had not been sent to him.
Second, he wanted access to, or the return of, personal data and files stored on the NATO UNCLASS laptop. By then, the unresolved communications incident made the status of that personal archive a serious concern. The material was personal and sensitive. He wanted to know what had happened to it, who had accessed it and when it would be returned.
Our attendance on 26 August was therefore connected not only with an employment document but with an unresolved personal-data and communications-security issue that Laureano had already reported several times.
We were refused access. The encounter escalated from security staff to RAF Police and then to Hertfordshire Police. Laureano did not recover the data he had requested.
He reported the suspected loss or theft of his personal information to civilian police that day.
A recording made on 27 August appears to capture a Hertfordshire Police officer telling him that he had been dismissed and connecting the situation with his having brought a Russian citizen to Northwood. At that point, Laureano had not yet received the later formal notification concerning the end of his MARCOM assignment.
The recording raises a further traceability question. Why was information about his employment and his relationship being introduced into a police conversation about his report concerning personal data? Who supplied it? Was it verified? And why was his relationship with a supposedly “Russian” woman relevant to whether his private material had been lost, retained or accessed?
Those questions should not be answered through paraphrase or outrage. The original recording and police records should be examined. The point is that they exist and are capable of examination.
If I was the security risk, who was protecting our information?
The report in El Confidencial Digital raises another question that the institutions concerned have yet to answer.
It also describes my account of a meeting with a man I identified as an FSB operative. During that meeting, he asked questions and showed me materials whose contents suggested that they could have originated in Laureano’s personal archive.
I know that I did not supply those materials. Laureano has consistently stated that he did not supply them either.
That does not establish where they came from. It does make their provenance a serious question—particularly when the handling of Laureano’s private WhatsApp and Hotmail accounts remains unexplained.
The documentary record already raises concerns about how NATO and Spanish authorities circulated information about both of us, what they verified before sharing it, and who received it. That record does not prove that either institution supplied information to a Russian operative. But it makes scrutiny of their own handling of our information unavoidable.
For fifteen months, I have been asking how our information was handled. Against that background, the suggestion that I pursued a relationship with Laureano to obtain information demands more than repetition. It demands evidence—and an explanation of what the institutions themselves did to protect the information they controlled.
Five questions that require answers
- You suspected me of obtaining information for Russia. What did you do when I reported that a Russian operative appeared already to possess private material?What evidence supported any allegation that I used my relationship with Laureano to obtain information? When the reported encounter raised the possibility that someone else had obtained private material, what investigation followed? Were both concerns subjected to the same scrutiny?
- Who had our information—and who passed it on? What information about us did NATO and Spanish authorities obtain, retain and circulate? Who received it, for what purpose, and with what verification? Did anyone trace whether material shown or described during the reported FSB encounter corresponded to information held within those institutional environments?
- What happened to Laureano’s private WhatsApp and Hotmail accounts? Who could access his private communications or account sessions through the devices available to them? What records were preserved, what technical examination was conducted, and what did it establish? After fifteen months, why have we still not received a substantive account of what happened?
- Was my Russian background a reason to suspect me, but the reported involvement of a Russian operative no reason to investigate? If my birthplace or presumed nationality contributed to the security assessment, what specific conduct supported that concern? And when I reported an encounter suggesting that private information might have reached a Russian operative, who assessed that report and what action did they take?
- If your handling of our information was proper, where is the account that demonstrates it? Can the institutions concerned identify who held the relevant devices and data, who accessed them, what was shared and what safeguards applied? If they cannot, on what evidential basis can they rule out their own handling of the information as a possible part of the explanation?
How can institutions treat me as a suspected route by which information might reach Russia, yet leave unanswered my report that a Russian operative appeared to possess private material whose source neither Laureano nor I could explain?
There is a joke I keep returning to: the hardest part of investigating a crime is making sure the trail does not lead back to you.
After the report in El Confidencial Digital, that joke carries an uncomfortable question.
The authorities that treated me as a suspected espionage risk, and Laureano as a security concern, should now explain what they have done to investigate the reported possession of private material by a man I identified as an FSB operative.
If they decline to investigate—or to provide a substantive account of any investigation already undertaken—they will leave a central possibility untested: whether information reached Russian hands through deliberate disclosure, reckless sharing or failures within their own environments.
That would not prove an institutional leak. It would mean that the institutions which scrutinised us had failed to demonstrate comparable scrutiny of themselves.
Are you prepared to follow the evidence wherever it leads—including back into your own institutions?
Exactly two years ago, I met Laureano on Tinder.
In those two years, no authority has invited me to a formal investigative interview. Nobody has put the allegations to me and asked for my answers. Apart from the Russian operatives I have described, nobody has questioned me substantively about these matters.
Twenty minutes in a car with two officers, talking about the weather, does not amount to an investigative interview. They did not put any substantive allegations to me.
Yet somehow, there has been no shortage of claims about me: a Russian spy, a “red sparrow”, supposedly under investigation, supposedly implicated in a breach of the Official Secrets Act.
Two years of allegations. Not one formal interview.
If you have evidence, put it to me. If you have questions, ask them. If information about me has been circulated without verification, explain who circulated it, who received it and what you are doing to correct it.
And if you believe I was a route by which private information could reach Russia, explain what you did when I reported that a Russian operative appeared to possess private material whose provenance needed investigating.
You cannot credibly demand scrutiny of my relationship while leaving your own handling of our information unexplained.
I am here. I am not going anywhere. I am willing to answer questions—and I expect you to answer ours.
Don’t be shy. You know my number.
Today's song - LA LOBA Y EL TORO EN LA PARED
