Stop Blaming Microsoft for German Poison Pool

I’ve seen some people try to use the Microsoft outage as blame for a hotel pool in Germany that pumped too much chlorine into its water. Just because that hotel configured poison warnings for email does not fault the email. Everyone and their dog knows email is never guaranteed delivery. It is not a reliable alarm.

The pool belongs to Hotel Ling Bao at Phantasialand in Brühl, and fifteen guests were hurt there on Friday. Let’s dive in.

The main duty to protect those guests belonged to the hotel. Section 37 of the Infection Protection Act requires pool water that poses no risk to human health, and the federal environment agency’s guidance applies that requirement at all times and in every part of the pool. One state health office’s guidance on DIN 19643 also has the pool operator measure free chlorine by hand three times a day and compare the result with the instruments. Thats the real story here.

A hotel can hand the task of watching the water to a machine. The hotel duty to stop the dose, close the pool and warn the guests does not change hands just because an email service was setup. But people are reporting that the hotel handed the task to a monitoring system using email. It sends a message when chlorine is outside the normal range. Their message depended on Outlook.

But also consider the danger of a false negative configuration. No email means no poison by hotel operator design, despite no email being possible for a million other reasons. A positive system would have sent an email to confirm safe levels, such that a delivery failure would itself be an alarm.

The first to know that this backwards and faulty hotel arrangement had stopped working was the public. Microsoft reported the Outlook outage shortly before 1 p.m. Eastern on Thursday, which is early evening in Brühl. So the hotel in theory knew they had no alarms running. German television covered it from 7 a.m. on Friday. From Thursday evening the hotel safety alarm was disabled, accordong to public notice by the vendor.

The second step of this design failure was a missing fail safe. On Friday the automatic dosing system failed unsafe, meaning it pumped too much chlorine into the pool. The monitoring system even tried to issue an alarm by email. WDR reports that the alarm had gone out by mail long before anyone human noticed and measured the poison.

The third step was the guests entered the poisonous pool and then thirteen of them reported irritated airways. Their complaints brought about 30 firefighters and ambulances from four neighbouring towns, and the count rose to fifteen. Four went to hospital and one stayed for observation with moderate injuries.

The staff running the pool somehow were the last to know, when they were supposed to be the first. Every one of the fifteen guests was hurt after the email outage became public on Thursday evening. Their complaints came after the machine had sent its email alarms. WDR’s report gives no time for that alarm and says nothing about the hand measurements on Friday. Those two facts will show how long the pool stayed open with too much chlorine in it and whether the hand tests were done.

Phantasialand told WDR, when asked, that the Microsoft outage was the cause. Nonsense. Microsoft had no duty to the guests in that pool, not least of all because it was just an email service provider. The hotel retains the duty and should be held accountable for a warning that depended on email. And held accountable for how they responded to email outages.

A safer design is easily available. One German controller manual describes an upper alarm value that halts chlorine dosing by itself, because a failed measuring cell can cause dangerous overdosing. That fail-safe cut-off works beside the pump. It doesn’t need a faulty alarm to a human. The danger of a faulty alarm design was also known in Germany. A DGUV study of 187 chlorine gas releases in German baths counted 91 with injuries, and one of its examples is a dosing fault message that was left off the panel at the permanently staffed post.

It is a known harmful design with a history of harms, being allowed to harm again. German law lets the hotel choose faulty messages for poison prevention, a predictable disaster. When you really think about that, Germany once had a word for gassing people in baths. Of all countries they should be the place to have the prevention part figured out. Nobody seems able to remember, however. That surely has something to do with the slipping obligation of never forget? Perhaps some alarm mail from 1932 has not yet been delivered?

Section 37 is silent on how an alarm travels, meaning here was not at all. The ordinance that would have set binding monitoring rules for pool water failed in the Bundesrat in 2003. So the duty to self-regulate poison in large baths has stayed with the operator ever since, and so has the design of alarms that would prevent people getting sick or dying.

Three Guns or Four? How to Read Heather Cox Richardson’s Letters

I’ve been asked as a historian what I think of historian Heather Cox Richardson. In particular, since I am a historian who has posted nearly every day to a blog for about 20 years, I was asked about her blog popularity. I was asked what do I think of her posting every day to her blog for seven years, rising to millions of followers.

Well, not much, honestly. I had never heard of her before I was asked. And when I was asked, I looked and found that she was publishing things that seemed factually wrong. I also don’t honestly know how many followers I have. I don’t track and advertise, or take paid subscriptions, so we’re fundamentally different on the platform as well as the points.

Take December 28, for example. Since 2019, she has republished her account of the night before the Wounded Knee Massacre. She revises it each year. It’s kind of like how I was doing the exact same thing for Thanksgiving Day starting back in 2005.

I’ve written about Thanksgiving history here many times (2005, 2006, 2008, 2010) and this year it feels like time to write again.

When I did a diff across her annual posts, I found the name “Big Foot” was dropped in 2023. And “a dozen years ago, I wrote a book” became “fifteen years ago” in 2024. I get that. But then I found a sentence rising up again and again, through all seven editions without edit:

In came three mountain guns.

Huh? Why does she say three? I’m not saying this to be pedantic. It’s rather important in the detail of military strategy from that time to know the exact type, number and position of guns. Such details are literally how people learn to win the next battle, or even a war.

The Army counted four. So why three?

Major Samuel Whitside testified to the court of inquiry in January 1891 that his column reached Wounded Knee Creek with “two Hotchkiss guns, under Lieut. Hawthorne,” and that Colonel Forsyth arrived at about 8:45 that night with “one section of Hotchkiss guns, under Captain Capron.”

Two guns were on the hill at dusk. Two more came in after dark. That makes… NOT three.

With all due respect, Richardson works full-time on history and she wrote the book on Wounded Knee. A specialist in the Army’s files calls her book “phenomenally researched.” And yet her newsletter, Letters from an American, which reports more than three million subscribers, doesn’t seem to hold the line.

I suppose we could call this one mistake a small thing. I suppose we could even say repeating it annually, increasing the chances of it becoming repeated by others, is a small thing. But my own training begs me to ask how big of a pattern can I find from the small thing. I think the gun is a bigger symptom than most people would notice, and it’s certainly something that LLM vendors get raked over the coals about.

So, being an old disinformation analyst by formal training, what could I do but pull all of her 2,300 letters, from September 2019 through November 14, 2026? I’m not interested in her current politics or even her arguments. Although, let me also point out that facts affect the arguments, as I explained already in another post about her.

A historian reproducing mythology as a settled fact marks a synthesis drawn from a disinformation canon, rather than the scientifically corrected record.

This time I pulled every passage about events before 2000 and extracted the dates, counts, names and offices that disagreed with a reliable, primary source. Then I double-checked it all. Every example in this post I verified by a linked source. Primary sources have the correct answer, so it’s mostly just a simple math test about the drift in her texts, a simple plus or minus.

Interestingly, there are 524 letters about an event in history with a date. Of those, 96 have at least one factual error. Of those, there are 68 distinct errors that I found 109 times. She tends to repeat her errors when she posts re-runs. That’s just a start, because quantitative analysis seemed to be the right path into qualitative.

Slop is a word we use for automation machines. It’s a derogatory term about the high cost, high output and low integrity. Each of her letters isn’t brief, usually over a thousand words and a page of source notes. It seems to be on the end of high cost and high output, so I’m asking here if there is there evidence of integrity issues? Or perhaps more to the point, is there a lack of an editor doing the pre-publication pass that a book deal would impose upon her?

Richardson Claim History
“In came three mountain guns” (every December 28, 2019 to 2025) Four Hotchkiss guns: two with Whitside, two with Forsyth (Whitside testimony, 1891)
“That night, America declared war on Japan” (2019, 2021, 2023, 2024) Roosevelt addressed Congress at 12:30 p.m. on December 8 and signed the declaration at 4 p.m. (National Archives)
Tennessee ratified the Nineteenth Amendment “by a vote of 50 to 49” (2022, 2024, 2026) The House voted 49 to 47 after a 48 to 48 tie; the Senate voted 25 to 4 (National Park Service)
“Parliament in 1772 removed all but one of the new taxes” (2023, 2024, 2026) Parliament rescinded four of the five Townshend duties in April 1770 (Massachusetts Historical Society)
John Lewis “in 1960 was one of the thirteen original Freedom Riders” (2019, 2020, 2021, 2025) Lewis became a Freedom Rider in 1961 (National Park Service)
“former U.S. senator Alexander Stephens of Georgia” (2026); “Georgia Senator Alexander Stephens” (2022 twice) Stephens sat in the U.S. House from 1843 to 1859 and never in the U.S. Senate (House Historian)

The Wounded Knee letter gives a clue how the mistakes might happen. Each December someone edits the tribal names and the author’s note, and then publishes the same text again. That is a pass for readability, making the text enjoyable. Quality isn’t being defined in terms of the accuracy, which is how the number of guns continues to be wrong.

When I looked at the Pearl Harbor letter, it said “That night” four times between 2019 and 2024. It wasn’t that night. In 2025 it corrected to “The next day, the United States declared war on Japan.” That’s great. Except for two things. The page carries no correction note and the four earlier editions are wrong. My thing about Pearl Harbor has always been the listening station being ignored. It’s a bit messy to understand and explain. But this night/day thing is a simple one.

The 2025 edit fixed the date and kept the order of events. The sentence now reads:

The next day, the United States declared war on Japan. Japan declared war on America, and on December 11, 1941, both Italy and Germany declared war on America.

Every edition has the United States declare war first and Japan second. Ugh. Why?

Japan declared first. And this one can’t be called a small error.

Japan’s cabinet released the imperial rescript declaring war at 1100 hours on December 8, Tokyo time. Tokyo was fourteen hours ahead of Washington, so the rescript came out at 9 p.m. on December 7 in Washington, about seven hours after the attack began. Roosevelt signed the American declaration at 4 p.m. on December 8, nineteen hours after Japan’s. In terms of defense theory she’s making one of the worst mistakes possible, reversing the declarations. Who declared war first matters A LOT for basically every reason we study war at all.

Richardson does mark corrections. Her letter of May 21, 2024 concludes on this line: “Edited on the morning of May 22 to correct the date to May 21. Sorry about that.” The headline date was fixed and flagged within hours. The same letter says Joseph McCarthy spoke in Wheeling “On February 12, 1950.” The Wheeling Intelligencer of February 10 reported that he spoke “last night.” Her own letter eleven days later gives February 9. Talk about a merry-go-round. At the end of it all, the incorrect February 12 date is still on the page.

One edit in fact made a true sentence false. In 2022 she wrote of the Little Bighorn: “The only army survivor of the battle from Custer’s immediate command was a horse, Comanche.” For the 150th anniversary in 2026 the sentence reads: “The only army survivor of the battle was a horse, Comanche.” Whoops. She deleted four words that erased the fact that hundreds of men under Reno and Benteen survived the battle. Again, a small detail, but it kind of is the entire point of studying Custer that he was such an incompetent bombastic disaster (foreshadowing politics today), different from others like Reno and Benteen.

Richardson Claim History
Republicans “added five new states” by July 1890 (September 2025); “six new states,” with Wyoming and Idaho both admitted “On July 3, 1890” (February 2026) Six states. Idaho was admitted July 3, 1890 and Wyoming July 10, 1890 (Statutes at Large)
A Joint Committee on Reconstruction “of thirteen lawmakers” (November 2025); “of fifteen members” (October 2026) Nine House members and six senators (House Historian)
Roosevelt’s Osawatomie speech “later that year” in 1910 (November 2023); “in 1912” (March 2024) August 31, 1910 (Theodore Roosevelt Presidential Library)

The October 2026 letter that corrected the committee to fifteen also says both chambers agreed to the Fourteenth Amendment “on June 18, 1866.” Congress passed it on June 13. I guess an 8 can look like 3 sometimes. My eyes aren’t great anymore. But a system with integrity controls is meant to compensate for exactly that kind of error. These letters float conflicting dates, where each is published with the same confidence, internally contradictory.

The November 2023 letter gives the 1912 result as “409 electoral votes to Roosvelt’s 107 and Taft’s 15.” When I checked the National Archives I found 435, 88 and 8. Very strange.

The February 2024 letter gives Lincoln “212 electoral votes to McClellan’s 12.” When I checked, McClellan won 21.

Can you see why I ran a mathematical analysis? It’s fast, it’s easy, and it’s the kind of thing my history professors hammered into me. Davi, at least get the dates right if you want to do analysis of events. It’s the kind of importance I carried straight into digital forensics investigations, where a timestamp error is death to any attempts at catching a perpetrator.

Secretariat’s “trainer” in her annual Kentucky Derby letter is Charlie Hatton, who wrote about racing for the Daily Racing Form. Nope. And the line she gives him, “The trees swayed,” is one the Racing Form says he wrote about a different horse, Raise a Native, in 1963. Her letter has the wrong job for Hatton, the wrong horse, and a conversation with Red Smith that the Racing Form’s account doesn’t have.

Jim Thorpe’s 1912 pentathlon is listed as “sprint hurdles, long jump, high jump, shot put, and middle distance run.” Yet the events were actually long jump, 200 metres, discus, 1,500 metres and javelin.

Her very moving tribute to Dolly Parton has the singer on radio and television “in Nashville by the time she was 10” and then, in the next sentence, moving to Nashville in 1964. That’s such a quick flip, did she read her own letter? I didn’t know this history, and when I checked, found that the childhood broadcasts were in Knoxville.

A horse, an Olympian and a country singer aren’t the class of error as three versus four guns. These errors maybe are a matter of fast writing that goes out unchecked, and her memory is subject to correction like any of us. But bear with me here, as a historian who has written daily on a blog for 20 years, not to mention that it has been online since 1995. If you ask me what I think about her letters, I think I’m finding a lot of errors. When I am asked to look at just one letter, I find an error. And then I look at a few more, and I start to think something is off.

The rate has held steady, by my quick calculations. Hey, maybe I’m wrong here! But between 10 and 18 letters a year have carried an error in every year since 2021. Across seven years I found only three corrections. Eleven errors were republished three or more times.

Perhaps she needs a quarterly rescan, a cleanup of the past daily posts?

Richardson is very, very popular as a writer. The Daily Show just did an “interview” that amounted to the host gushing about her love for the letters, and Richardson even fluffing the host. The only history in it at all was a single minute comparing today to the 1890s, which the host took without a single question. Shame on you Daily Show.

People are looking for the actual facts of what this country is.

You’re not going to call her out on that? Ok, then, I guess I have to be the one. This is what the host said.

I don’t think we have blue waves like this without scholars like you walking us through these moments.

Maybe the whole point is a feel-good narrative and regurgitation and re-runs of what works, to amplify and gain audience as Jon Stewart seemed to do with her. This is what she told him.

I help to show people where the ground is.

Any pilot relying on her would be shown the wrong number for where the ground is for at least 1 of every 5 flights. You want to fly on those numbers?

She is a clear and persuasive writer, and most of her history is on target. But it’s not all, and maybe reach is the reason her errors matter even more, beyond the question of whether she would accept a factual error in one of every five papers a history student turns in. If her low-quality facts get high reach, is it better than someone with high-quality facts getting low-reach? That’s a question for the ages. McDonalds or a local chef, you make the call. Three million people receive the letter as if it is the work of a historian. And the way I was trained, an historian’s authority comes from them doing the checking and re-checking, not you doing all the clicking.

Keep Saying “Honey Trap”. Man is But a Fly.

A woman wrote “honey-trap” about a man and a woman in 1859, and in her sentence a man falls for a woman like a fly, ahem, flies into honey. Can you blame the fly? Of course.

The Oxford English Dictionary gives the earliest known use of the phrase to Elizabeth Sheppard, the English novelist who wrote Charles Auchester. It is on page 126 of the second volume of Almost a Heroine, where a man talks about a woman:

I am no fantastic fool, intoxicated by her like a fly fallen into a honey-trap. I will tell you, I know her so well as this. She is perfectly unworldly, but she is also vain of being so; and only so far is she vain at all; her fascinations and her passionate sweetness she is alike unconscious of.

Her meaning is simple. A man says he sees a woman clearly. Falling for her would be the honey-trap, and the man who falls is the fly and the fool.

John le Carré used the phrase 115 years later in Tinker Tailor Soldier Spy, where an intelligence service sets the honey as a trap and a woman is the bait, almost exactly as Sheppard had phrased it. He later wrote in an introduction to the novel that he invented honey-trap along with lamplighter, scalphunter and babysitter. Time magazine printed a glossary of his words and called him “their inventor”, and the dictionaries agree with him. Merriam-Webster dates the first known use to 1974, and Dictionary.com gives 1970 to 1975 and names le Carré. The OED is the only one that prints Sheppard’s line. It lists her under insect traps and starts the seduction meaning in 1974, so it still credits him.

All of these dictionaries cover English only. Writers in Hebrew, Greek, Latin and Chinese used honey for a lure more than a thousand years before Sheppard or le Carré. Spies use tactics that already work, because inventing one is expensive and likely to fail. To call spy novels the source of this tactic is like saying a journalist invented the news.

Origin Meaning
5th century BC, Chinese The state of Yue sends the beauty Xi Shi to the king of Wu. Chinese calls this 美人計, the beautiful person stratagem, the thirty-first of the Thirty-Six Stratagems.
Hebrew, Proverbs 5:3-4 The lips of the strange woman drip honey (נֹפֶת), and in the end she is bitter as wormwood and sharp as a two-edged sword.
1st century BC, Greek Strabo, Geography 12.3.18: the Heptacometae leave bowls of toxic honey in the road. Pompey’s soldiers eat it and three maniples are killed.
1st century BC, Latin Lucretius: doctors put honey on the rim of the cup so that children drink the wormwood.
8th century, Chinese 口蜜腹劍, honey in the mouth and a sword in the belly. The phrase describes Li Linfu, a male chancellor of the Tang court (Zizhi Tongjian, volume 215).
1624, French Francis de Sales: a spoonful of honey catches more flies than a hundred barrels of vinegar (de la Rivière, Vie, page 584).
1666, Italian and English Torriano: honey gets more flies than vinegar (Italian Proverbs, page 149).
1859, English Sheppard: a man who falls for a woman is a fly in a honey-trap.
1974, English Le Carré: a honey trap is a spy operation.

The Chinese examples matter here more than an English dictionary because of the news. Fast Company reports that U.S. intelligence identified the woman in the Jensen Huang story as a Chinese spy. You can see above exactly for how long Chinese has named the stratagem after the beauty and uses honey for a deceitful man.

The Fast Company column is by Laëtitia Vitaud, and most of it is standard stuff. She argues that 1970s spy novel usage turns a powerful man into the helpless victim of a scheming woman. I mean we’re talking about 1970s spy novels, right? Have you read my post called James Bond Movies Are “Fascist Pig” Glorification?

Then she traces that idea all the way (fast reverse) to Genesis, where Adam blames Eve. Her report is technically accurate that it is English dictionaries who credit le Carré with making the phrase popular. The dictionaries start the phrase with the spy novelist and then credit him for it. Self-proving hypothesis. But her question is more about whether a 63-year-old chief executive officer in total command is as helpless as a bear near honey. Helpless? The inflation of a man into a bear seems more about trying to sound powerful, than about being made helpless by honey it totally consumes and literally wrecks.

Her main error for me is the one sentence: “The term comes from spy fiction.” No. That’s wrong. The earliest known phrasing of woman being the honey trap for men is Sheppard’s.

But the bigger fault is that her sentence leaves out a woman. A column about sexism repeats the error printed in dictionaries and credits a spy fiction that came 115 years after a woman printed it first.

It also costs Vitaud her best evidence for her own case about the phrase. She wants the press to stop saying “honey trap”. Sheppard’s version in fact shows a better fix.

We can celebrate Sheppard. Say honey trap as she did.

In 1859 the man who falls is a “fantastic fool”, and he is responsible for where he lands. In 1974 he becomes the target of an operation, and the man who made that change claimed the invention. Vitaud’s question about the bear has had an answer since 1859. Man is but a fly, a fool who flies into a trap.

Berlin Leak Middleman: Munich Firm Boasts of Selling Access to Stolen Files

A Munich penetration testing firm is running Berlin’s stolen files through open-weight AI models on its own hardware. Sascha Herzog of NSIDE ATTACK LOGIC told iX that his team uses models such as Qwen, operated purely locally, to pre-sort the Rhysida dump for its customers. One search run across the archive takes twelve to fifteen hours.

That is what I described on September 8 in RAIV in Berlin Says the Senate Has Time for Breach Triage. Ten RAIV (GPU rigs) of used video cards would have cost 35,000 euros, and finished in two weeks, while keeping the data in Berlin. The Senate’s Chief Digital Officer had told the Innenausschuss that “AI tools” would rank the files by risk. A private firm in the far away state of Bavaria has now shown that local open-weight models carry the work.

Herzog also reports he has hit some limits, which are well known. His model marked a document as classified because it contained the word “geheim” (secret). I mean, it does have the word secret. Context is hard. He says his customers in some cases assign staff for a week to read the filtered files by hand, which sounds light to this historian. Can you imagine if Germany had used that attitude to read their own archives? Just think of what would have happened to Siemens. Anyway, the AI model sorts and people do an actual finding, which is the division of labor a Berlin RAIV was built for. It’s not unlike how archaeologists and war crimes investigators work. They fly a plane over, using modern tools like radar, land and then dig by hand.

His download took two and a half weeks over Tor, while Rhysida rearranged the file structure three times. He reports only 5.25 terabytes and 1.431 million files. The archive published in September ran to 1.44 million. About nine thousand files are unaccounted for. Herzog says either his download missed them or Rhysida changed the archive after publishing, and he can’t say which. He says his firm has yet to analyze any of the 7-Zip archives inside the dump.

Herzog also makes the rather bizarre and unsafe comment that he personally feels that Berlin should have paid a ransom. What? What? Why? His argument is that the harm comes from publication. Rhysida took the data between August 7 and 12 and held it for three weeks before the deadline passed, but Rhysida sells to whoever pays. Whoever. Payment buys nothing but a promise from a criminal with zero enforcement. A paid Rhysida still has the files and still has a buyer, and can still leak. This is not news to anyone, hopefully.

Herzog then describes his work as a product. Customers name email domains, project names and keywords. His analyzer sells them the hits. The matching files are packaged and sent to the customer with a preliminary report and an HTML index that links to each file. Those files include the emails exchanged with two Senate administrations. They carry the names, addresses and words of Senate staff and of every other party on the thread. That seems rather broad, no? This guy is a leak administrator over all of it?

The legal basis receives one sentence in the interview:

we of course always observe the necessary legal framework.

How? Explain! But the interviewer moves on, leaving the most crucial detail unexplained. Herzog is handing leaked files to his customers on what basis? I turned down requests for hosting a free mirror of the dump just for journalists in September for exactly this reason. A copy of stolen files means holding a copy of third parties’ data, right?

Herzog says he saw data on critical infrastructure operators outside his customer base and calls them enormously affected. He says he is in contact with federal agencies and declines to say more. Again the interview moves on, and leaves open whether anyone has told those operators. Do they know he’s telling people other than them, if they don’t know themselves?

The interview is a bust. It ultimately skips the findings that matter most to Berlin, perhaps because, I don’t know, the expert sits in Bavaria? Does that explain anything?

The 21 administrative passwords that only vendors can change go unmentioned.

So do the Payone credentials and the water supply vulnerability analyses, and the intrusion detection budget the CDU-SPD coalition cut.

The article states that Berlin found the intrusion while investigating a domain controller fault on August 13. The interviewer never asks why a fault found what monitoring missed. Herzog’s advice to affected companies is boring and bog-standard: ask the authorities, warn staff about phishing, check what the leak says about your IT, tell the others on the thread.

Rotating every credential that touched the Senate, THE MOST IMPORTANT STEP, goes unmentioned.

The Senate told the Innenausschuss it needed AI tools. A firm in Munich has them running on local hardware and sells the leak without a clearly stated legal basis. The duty to tell the people in those files? Where does that sit, Berlin?

a blog about the poetry of information security, since 1995