The creed Pete Hegseth wears is Christian holy war over Jerusalem. Jews were among its first victims. His support for Israel sits inside that theology.
the rallying cry of Christian knights as they marched to Jerusalem
It gets the last words of the book. He says he is proud to belong to the church network that Doug Wilson founded. Doug Wilson says giving women the vote was a bad idea, and his churches teach wives to submit to their husbands. Hegseth shared a video of the network’s pastors arguing that women should not have the right to vote.
Hold that thought, because it’s especially important for this story.
The crusade’s first mass killing was in the area today known as Germany. In May 1096, on the road east, crusader bands targeted the Jewish communities of Speyer, Worms and Mainz for total destruction. Solomon bar Samson’s chronicle describes Count Emicho’s men entering Mainz on May 27 and killing the Jews who had taken shelter in the archbishop’s palace. Emicho’s bands were destroyed in Hungary. The armies that followed took Jerusalem three years later and killed its Jews as well. That crusade is what Hegseth is tattooed with. The first people it killed were Jews.
Christians also created Zionism as a means of calling Jews outsiders and forcing them to leave (remigration). Lord Shaftesbury campaigned in 1840 for the powers of Europe to push the Jews to Palestine, and Foreign Secretary Palmerston listened. William Blackstone, a Chicago evangelist, petitioned President Harrison in 1891 with the question, “Why not give Palestine back to them again?” Theodor Herzl published The Jewish State five years after that. Jewish writers such as Moses Hess and Leon Pinsker made their own case for a return in those decades. Or course it was the Christians who reached government authority on this first. Blackstone read Jewish settlement in Palestine as a sign that the end times were near. For these men the return of the Jews was a step in their own Christian prophecy, where the Jews were the disposable means.
I have written here before about how Christians built Zionism and pushed Jews into it. Hegseth continues that tradition. In Jerusalem in 2018 he told an Arutz Sheva conference that rebuilding the Temple on the Temple Mount was a “miracle” that could happen. A miracle of antisemitism. A year later he went up to the Mount with the international director of the Temple Institute. These views are his own, and he published them loud and proud years before he was confirmed to head the Pentagon.
Israel’s government clearly has a use for this. Netanyahu told 60 Minutes that he wants American financial support drawn down to zero, and he described the replacement to a congressman as “my plan.” As usual with him, it’s a big bag of misdirection and corruption.
The plan moves the relationship out of State Department aid, which Congress votes on every year, and into Pentagon procurement. So the “zero” of the plan is in terms of accountability, not spend. NPR reports that AIPAC supports the arrangement, while experts expect less congressional oversight. Trump announced on November 3 that the $4 billion a year in aid is “stopping” at the end of 2026, meaning it loses proper visibility.
The bill text directs the Secretary of Defense to set up a joint defense technology initiative “with the concurrence of the Minister of Defense of Israel.” The House passed it in July as Section 219 of the defense bill, and the Senate bill carries it as Section 1217. The Secretary who would run this Israeli integration into the Pentagon is … wait for it … Hegseth. He told Israeli Defense Minister Katz in March, “Keep going to the end, we are with you.”
I wrote back then about his $200 billion war supplemental. Netanyahu’s plan looks like it’s about to put Israel’s funding under a crusader, a true believer in his own holy war.
Now, to the point of all this. On November 10 the House voted 211 to 204 to send Thomas Massie’s eight articles of impeachment to committee, which ends them for this Congress. Four of the eight concern the war on Iran that the United States launched with Israel. I had already posted the case for trying Hegseth in No Quarter.
Against Massie is AIPAC’s super PAC, which spent $3.58 million against him this cycle. Republican Don Bacon explained his vote by describing Massie as “anti-Iran, anti-Ukraine, anti-Israel.” Bacon said in the same breath that he is no fan of the secretary. He voted to fan Hegseth, while saying he wasn’t a fan, just to oppose Massie.
The part that seems to really matter, more than Republicans talking nonsense, is that eleven Democrats missed the vote, and their votes would have defeated the motion. Several said traffic held them on the way back from a reception hosted by Elect Democratic Women.
Remember when I said hold that thought? Women. In government. Something Hegseth very clearly opposes, along with the founder of his church network, who calls women’s suffrage a bad idea.
He blamed Republicans for the outcome and said the House has yet to build the political case. That is the complicated explanation. It requires professional politicians to arrive late on the evening that their votes decided the result. And we’re not talking about just any old vote here. Trump and JD Vance both blamed the Iran War for the Republican losses in the midterms. Democrats failing to make the Hegseth vote are going to deserve harsh scrutiny for exactly the reasons we’re discussing here.
The simple explanation for the failure to vote starts with the reception called Elect Democratic Women. It allegedly was for new members on the evening of the vote, an obvious conflict. Katherine Clark, the Democratic whip, is a founder of the group, and she voted against the motion. Julia Brownley sits on its executive board and Melanie Stansbury on its board of directors, and both missed the vote. These are experienced members who know when the House votes. An empty seat on a motion that passed by seven counted the same as a yes. A group whose political arm takes AIPAC money held a reception that kept members of Congress from an impeachment vote, and that is corruption at work whatever each member intended.
Democratic women in a reception that interrupted their vote against one of the most openly mysoginistic leaders in history.
The filings show where the AIPAC money went this year. It went against the congressman who wrote the articles and into the group that hosted the reception. AIPAC supports the funding plan and Netanyahu calls it his own. Hegseth kept the job that would administer it.
The Christians who first lobbied for Zionism treated Jews as instruments of their own prophecy. Netanyahu’s plan hands Israel’s funding to a crusader’s office. Each side has reason to believe it is using the other.
But the real story here is the Elect Democratic Women reception. Up to five of the missing votes trace to the traffic members blamed on the way back from it, three more remain unexplained, and seven would have beaten the motion.
Pete Hegseth spent sixteen minutes at the Pentagon podium praising his own wars and attacking Rep. Thomas Massie, the Kentucky Republican pressing articles of impeachment against him.
When the worst Defense Secretary in history reached the articles themselves, he answered them in one sentence:
Iran, the cartels, Maduro, Yemen, everyone was a lawful operation ordered by the commander-in-chief, then ordered by myself, notified to Congress and executed by American warriors who did their jobs.
That sentence closes the door on a case that the White House had kept open. The boat campaign began on September 2, 2025 with a strike that left two survivors clinging to the wreckage, and a second strike killed them. A war crime, or murder.
The White House had named Admiral Frank Bradley as the officer who ordered the second strike, and Hegseth told reporters he had moved on to his next meeting before it happened.
Now he claims the whole cartel campaign, war crimes and all, as his own order.
The administration chose the legal frame for these unlawful killings. Its October 2025 notice to Congress declared a “non-international armed conflict” with the cartels and called their members unlawful combatants. That frame carries the Pentagon’s own rulebook with it. Section 18.3.2.1 of the DoD Law of War Manual requires every service member to refuse clearly illegal orders, and its example is “orders to fire upon the shipwrecked would be clearly illegal.” The War Crimes Act, 18 U.S.C. § 2441, makes the intentional killing of people placed out of combat a war crime in a non-international armed conflict, and 18 U.S.C. § 2 makes whoever willfully causes an offense punishable as a principal.
Hegseth delivered a death toll as his extrajudicial verdict: “218 narco terrorists dead where they should be.” The running count passed 230 in September. At least 22 of the dead survived an initial strike and were then hit again or died at sea. The families of two Trinidadian men killed in a strike have sued in federal court, and the relatives of a Colombian man say he was fishing when his boat was hit.
With regard to civilians, Hegseth focused on a charge easiest to deny.
As to the claim that the American military targets civilians, well, that is a lie.
He said he would “dignify this claim no further.”
Massie’s article is actually specific enough to withstand such amateur statements, and isn’t affected by such empty protest. The resolution says Hegseth cultivated a culture he boasts of as “maximum lethality, not tepid legality,” which chilled the offices responsible for preventing and responding to civilian harm, and it names the Shajareh Tayyebeh girls’ elementary school in Minab. A preliminary Pentagon investigation found that a US Tomahawk hit the school on the first day of the war, using target coordinates Central Command built from outdated Defense Intelligence Agency data. Senators put the dead at about 120 children and at least 175 people in total, and senior military leaders have held the finished investigation since April while those senators press for its release. Massie charges that the safeguards Hegseth dismantled foreseeably cost civilian lives.
Hegseth tried to shift focus to a charge of intent.
He counted the Iran war as “under 40 days of sustained combat”, which is a patently absurd way to describe months of war from the Department he insists on calling War. It’s not the Department of Sustained Combat. And he cited Reagan in Lebanon and Clinton in Kosovo as War Powers disputes that ended short of impeachment:
War powers resolution or not.
Congress is different, and went much further, this time. Invoking section 5(c) of the War Powers Resolution, the House voted 215 to 208 on June 3 and the Senate voted 50 to 48 on June 23 to direct the removal of US forces from hostilities with Iran. A concurrent resolution bypasses the president, so the vote was symbolic by design. The blockade imposed after the ceasefire remains in force, and by October MOAA was describing the Iran conflict as in its seventh month. The War Powers Resolution relies on Congress for enforcement, through funding and through impeachment. Massie’s first three articles are that enforcement.
The Hegseth torture of American history depends on one word.
In the 250 years of our American Republic, no Secretary of War or Secretary of Defense has ever been impeached for carrying out lawful military operations.
The first cabinet officer ever impeached was a Secretary of War. Arguably the rename to the Department of War should have jogged his memory of the impeachment. The House impeached William Belknap unanimously on March 2, 1876, over kickbacks from a frontier trading post, and a Senate majority voted against him on all five articles. It ran short of the two-thirds needed to convict. Belknap’s offense was graft, which Hegseth excludes with the phrase “military operations.” Then he tosses in the word “lawful.” It’s of course telling, since that is the exact word the articles dispute.
In the question period he described the doubt he says critics want to plant in the partner governments of his counter-cartel coalition:
if you go after these cartel members in your country, maybe someone will go after you later.
His answer to that was “we’re working really hard with these countries to prevent that kind of lawfare.” Really hard? Is that the best description he could come up with? He closed his statement with a message to the troops:
don’t blink, ignore the noise, please, never hesitate.
The Law of War Manual he oversees requires a sailor to refuse an order to fire upon the shipwrecked. Hegseth’s message to the same sailors, like a poison pill presented from the podium without blinking, is to never hesitate. This, minutes after attacking the patriotic senators who reminded troops they can refuse illegal orders.
France has accused Iran of sabotage. I love a good attribution, so I went looking for the evidence.
I found a port number.
One port number on one night.
A port for a day.
Are you Frenching kidding me?
That took me back to an incident briefing I led in San Francisco many years ago. The room was packed. Everyone was on the edge of their seat, except one guy. He slouched back and kept shaking his head no. I was walking the room through what we had found when suddenly he stood up and said he had seen the classified version, we don’t get it, and he marched out smiling at us like a Cheshire cat. He declined to say anything useful. He declined to say what the classified data corrected. He flamboyantly checked out, and the room was left to choose between the evidence and the confidence of a man who wanted us to believe it wasn’t enough.
The absence of evidence isn’t the evidence of absence.
France has just played that annoying man at the back of the room with his giant shit eating grin, and people have been taking the report way beyond face value.
A port number. Let me say it again.
An accusation built on a port and covering one night has been read as some kind of grandiose verdict on a month of attacks across a dozen countries. The gap between what Paris published and what the press now believes is the big story here, and it is easy to drag out of its neanderthal cave of lizard brain attribution into the sunlight of modern science.
Start with the official statement. On 9 November the foreign ministry named the Revolutionary Guard unit Shahid Kaveh for the attack on refrigeration controllers at about 700 French stores on the night of 11 October, called it “inédite par son ampleur et son niveau d’agressivité,” and announced it at a G7 press briefing minutes after Reuters reported that investigators privately suspected Iran. The five-agency C4 published a five-page note the same day. It calls its evidence a faisceau d’indices, the French legal term for circumstantial evidence.
It covers one country, and one night. That’s it. Here is the whole case:
The attack infrastructure also scanned Schneider Electric equipment over Modbus on port 502, a technique the note associates with Shahid Kaveh from April 2026.
The operators used FOFA, a Chinese commercial search engine for internet-connected devices.
The propaganda channel CyberbanNews relayed the attack on 13 October. The note’s word is relayée.
Farsi traces appeared in the attack infrastructure.
The port. Oh, the port.
CISA AA26-097A of 7 April 2026, signed by six US agencies, tracks CyberAv3ngers as the Shahid Kaveh Group and lists its traffic on ports 44818, 2222, 102, 22 and 502. Those are ports that any control-systems scan is going to reference. The American advisory ships indicators of compromise, the addresses a defender can match against logs. The French note matched the technique and kept the indicators. Had the infrastructure matched, the note would say infrastructure. It says technique.
FOFA is a subscription product and Farsi strings are the easiest artefact of all to plant; Olympic Destroyer carried a forged header copied from North Korean malware for the same reason. It’s like meeting a Russian guy with a beard glued on speaking a few words in Farsi. Speaking of which, on Halloween I met an Iranian teen who had personally made his own very authentic looking Soviet-era army general uniform, complete with insignia and Afghanistan war medals. He knocked and then refused candy, saying it was a bribe against Communist principles. Talk about a convincing costume.
That leaves the repost, the one item specific to Iran, and the note undercuts it itself: the unit’s avatars exist to claim attacks, and for this one their outlet relayed.
The C4 note has Iranian addresses in one place, the 2024 Olympics kiosk case, under a different unit. For the October attack her own agencies list none. Her fifth item is absent from the document she was presenting. Two of the three names in the annex are on the US Treasury list of 2 February 2024. The names came from Washington, and this evidence says the same about where the verdict comes from. France is relaying an American judgment, which it is leaving as unverifiable.
Of course, it’s only cyber champagne if it comes from the Champagne region of France. Otherwise it’s just sparkling American intelligence. I mean this seems like a case of appellation d’origine contrôlée: the label is French, the grapes were pressed in Maryland. By French law it’s only Iran war attribution if it comes from Fort Meade.
Some of my readers may remember over a decade ago when Russia stood as the accused and I batted the other direction. In 2014 Bloomberg reported that US intelligence officials believed Russia blew up the Baku–Tbilisi–Ceyhan pipeline in 2008 by hacking its cameras. I pointed to the Corner House analysis attributing the blast to the PKK, and Süddeutsche Zeitung later reported an audit showing the cameras were installed after the explosion. “Unprecedented” has the same history: Ralph Langner, who reverse engineered Stuxnet, called the attack very basic, and Maroochy had put sewage in Queensland’s parks a decade earlier.
Same test, whoever is accused: publish what can be checked. Don’t laugh at the room and say you have a secret squirrel solution in your hideout nobody can see.
Now the merger. The same evening a Wavestone partner told the Guardian: “Given that recent cyber-attacks on supermarkets and the blood bank in France concerned freezers it is reasonable to think Iran is directly linked to both.” One night became a month based on the simple fact that both one day and many more days involved freezers. The EU High Representative said the incidents “if attributed” called for a strong response. That’s a strong conditional, and unfortunately she seems like the only official using it.
The method belongs to everyone.
Forescout cites a Danfoss newsletter recording hacktivist attacks in 2022 on 16 Russian supermarkets and 40 Israeli stores, and tracked more than twenty claimed refrigeration attacks between January and October 2026, chiefly in Spain and Italy, with the pro-Russian Z-Pentest Alliance and NoName057(16) the most active. By the time France was hit, Russian-aligned groups had spent nine months rehearsing on European cold storage.
It belongs to everyone because the vendors built it that way. This is one of the most annoying parts to this story. The vendors need to have WAY more accountability. Regulators really need to get on them like how PCI DSS hammered card systems in the 2000s to force safety innovation in both the distribution and acquisition ends of their industry. Known weakness? Don’t ship weak devices. Don’t connect weak devices. If you do, no more shipping and connecting for you.
On 20 May 2025 CISA published CVE-2025-41450 for the Danfoss AK-SM 8xxA, an authentication bypass “caused by datetime-based password generation.” Claroty’s Team82 published the mechanism in August 2026: the controller accepts a code of the day in place of the administrator password, and the code is derived from the device’s own calendar. Copeland’s XWEB Pro, the other platform on CERT-FR’s list, has the same design, CVSS 10.0. Most of the October victims ran Danfoss models the vendor stopped updating in 2021 and 2016. And France had the most of them: IPinfo found 1,331 Danfoss dashboards open in France five days before the attack, against 1,197 in the other 72 countries combined, on the same firmware mix as everywhere else.
The vendor decides the controller attaches to the internet. The store that owns the food has no way to force safety on the vendor.
The vendor decides.
The vendor.
Decides.
November looked different. More than 100 stores in at least nine countries, plus cold rooms at three sites of the French blood service through a rental contractor. Ransom-ISAC logged one XWEB site hit with the factory login. Sekoia’s Danfoss honeypots the same evening caught an undisclosed exploit. Two operators at least. Sekoia is the only vendor to have published an infrastructure analysis spanning both waves, and it judges the two “may have been conducted by the same threat actor” while stating that “no technical indicators currently link this incident to that cluster,” the cluster France named. One actor, with nothing technical to link it to Tehran. Sekoia’s motive hypothesis, France’s deployment of troops and air defence to the Yanbu oil terminal as announced 24 September, gives Iran a reason. But it gives a defender nothing to verify.
Then the Russian claim arrived and vanished. Poof!
Or as I like to say, the poof is the proof.
NoName057(16) and Z-Pentest claimed November in a Telegram video and deleted the channels. Sekoia calls the claim unsubstantiated on three grounds. Two describe NoName, its history of false claims and its DDoS profile. The third is that the leaked credentials look like infostealer logs, which is also how an attacker gets contractor logins for these controllers. Z-Pentest made the claim too, and Z-Pentest is the group known for control systems; Forescout tracked it as the year’s most active claimant on refrigeration, and Denmark’s Defence Intelligence Service attributed a 2024 waterworks attack to it. The groups that practiced this all year claimed it, then erased the claim. That is the pattern: the operation that succeeds leaves the case open and the blame elsewhere.
France could be right about Iran. Could be… but what they published is a port number, and that ain’t right. It undermines credibility, if anything.
Imagine someone saying that some moldy cheese must be from France just because it tastes like old socks. Ok, but shouldn’t we have some actual tests before we slap a “made in France” label? The UK has actually landed in this spot already when they discovered that 100% of their real English honey from real English bees labels are bullshit, and they’ve been swallowing sweet impostor sauce for years. Literally 10 out of 10 jars failed the authenticity test, which should have been required a long time ago. Regulation is the mother of innovation:
Honey is one of the most adulterated food items on the market. We provide full traceability; we highlight 1. the location – area, country – from which we source our honey; and 2. the communities that manage our hives.
Anyone talking about a month of attacks solved is skipping all the parts where we prove who the attacker actually was and will be. The actual known culprits already proven are the vendors. They shipped a calendar password into internet-facing fridge controllers. And they forced it to be used in an unsafe state. Who should be blamed? The vendors. And probably Russia, if we get to that state of evidence. But in the meantime, the vendors.
Nilay Patel opened his latest Decoder with a description of his guest as a longtime cyber security expert who he calls refreshingly direct.
If you watch it, you should notice something isn’t right. Ten minutes in, the guest explained that the modern era of security began with the Bill Gates Trustworthy Computing memo, “from my perspective.” The memo is dated 15 January 2002.
That line is worth a pause. The memo was an apology. Code Red took down Microsoft servers in July 2001, Nimda followed in September, and Gartner told enterprises that month to find a replacement for IIS. Gates wrote in January that when the choice was features or security, Microsoft would now choose security. That is a confession that it had been choosing features. Calling it the start of modern security is like calling Enron the start of accounting principles. Enron collapsed in December 2001, the same winter, and produced Sarbanes-Oxley the same way the worms produced the memo. Accounting principles were already seventy years old. Our most modern security principles were already decades old and remain from the era before Gates’ memo: Saltzer and Schroeder in 1975, the Orange Book in 1985, the Morris worm and CERT in 1988. The memo marks the day the richest company in the industry admitted it had ignored all of it.
“From my perspective” is the “modern era” beginning, because in January 2002 the perspective belonged to a 22-year-old a few months out of Berkeley in his first job. Here is where that perspective went next, measured in months:
Role
Time in seat
Loudcloud, @stake, iSEC Partners, Artemis (2001 to 2014)
Security consultant, tester, and then vendor. Zero operational roles.
Yahoo CISO, despite no prior experience in management of infrastructure and operations (Mar 2014 to Jun 2015)
15 months
Facebook CSO (Jun 2015 to Aug 2018)
38 months
SentinelOne CISO (Aug 2024 to Aug 2025)
12 months
Corridor (Aug 2025 to Sep 2026)
13 months, chief product officer
Cognition CSO (from 29 Sep 2026)
Six weeks at recording
Let’s look at that abrupt jump into operational security roles with no prior experience and what happened subsequently. We have only sixty-five months combined. The longest period is known for the Cambridge Analytica election disaster and Myanmar genocide.
Before 2014 was only consulting, and not about operations or management. Consulting about technical security in software. He was a junior at @stake, then a co-founder of iSEC Partners, a penetration testing team that was sold to NCC Group in 2010. Then he was CTO of Artemis, NCC’s bid to sell a .secure top-level domain that never launched, because of course it would not succeed. It never had operations either. The pentester visits a building, finds the leaks, writes the report and leaves the wreckage for others to deal with. Then suddenly Yahoo hands him a building with at least a billion people in it and he panics and runs out the backdoor with the place in crisis.
The Corridor period is interesting because Axios announced him in August 2025 as chief security officer. Corridor’s own pages, his GitHub profile, his Mastodon bio and his 2026 conference listings all say chief product officer. That’s the kind of disconnect that should matter a lot more here than most will realize.
When Cognition hired him this September, the announcement said he had overseen security at Corridor. The title went in as security, lived only as product, and came out as security again. Thirteen months in a product job at a ten-person startup is now a line on the security resume, and the record of that year was rewritten twice?
Let’s look deeper at such revisionism as a symptom.
Undisclosed breach.
At Yahoo he took the Black Hat stage in August 2014 and promised end-to-end encryption for Yahoo Mail by 2015. That’s right, he announced on his way into his first operations role ever that he would flip a switch and solve one of the hardest problems in platform security. What Yahoo had by March 2015 was a fork of Google’s open-source End-to-End code, published on GitHub and shipped to no one. In December 2014, according to the SEC’s order, Yahoo’s information security team learned within days that Russian hackers had stolen the user database. And what did this encryption promotion guy do in response? Six months later he announced on Twitter that he was leaving for Facebook. The announcement said nothing about the breach. The encryption shipped to nobody.
The breach stayed undisclosed until September 2016. We are talking about two years in which Yahoo’s filings described breaches as a hypothetical risk, yet this “expert” was taking payments for security leadership. The SEC fined the company $35 million in April 2018 for exactly that failure, but he was long gone by then. Verizon cut $350 million from the purchase price. Five hundred million users were in the dark for twenty-one months, fifteen of them after he walked out and said nothing. I wrote this up at the time: $1.63 Billion Breach Fine Discussed As Facebook CSO Legacy.
Undisclosed breach two.
At Facebook, acting like he had taken a promotion and pumping the press for attention, he arrived in June 2015. By late 2015 the company knew Cambridge Analytica had harvested tens of millions of profiles. In April 2017 his team’s information operations white paper went out with Russia’s name removed; the Wall Street Journal later reported his team had been overruled. In July 2017 a Facebook spokesperson told CNN the company had seen no evidence of Russian ad purchases. On 6 September 2017 the company disclosed $100,000 in ads from June 2015 to May 2017, under his byline. On 17 March 2018 the Observer and the New York Times published Cambridge Analytica, and he spent the weekend explaining that it was not a breach under any reasonable definition.
Two of the largest breaches in history. Undisclosed.
And now for something worse.
On 12 March 2018 the chair of the UN fact-finding mission on Myanmar told reporters social media had played a determining role in the violence against the Rohingya, and that in Myanmar social media meant Facebook. He was still in the chair. In August 2018, the month he left, Reuters documented more than a thousand live posts calling Rohingya dogs and maggots and urging they be shot. The mission’s final report landed the next month. I asked then whether a CSO could be held to account like a CFO, and I ask again now.
Through all of it the actual detection system, one that kept flagging the same root of the problem, remained the press. And yet he was attacking the press and undermining their work. ProPublica found Facebook selling ads to “Jew haters” in September 2017. The Observer and the Times found Cambridge Analytica. Reuters found the Rohingya posts. Each story was an alert that his organization had failed to raise, with him serving as “Chief”. His response in October 2017 was a thread advising journalists to talk to people who had actually solved these problems and to mind their biases. His response in 2019 was to blame BuzzFeed and other outlets for the Cambridge Analytica fallout.
On Decoder this “security expert” tells Patel that defense is “watching your logs” and triggering the investigation when something looks wrong. At Facebook the logs were the newspapers. He told them they were reading the logs wrong, then blamed them for what the logs said.
That is a damning record. There may be no worse security operations person in history. The record of his longest tenure is billions of users harmed without notice, election interference, and a genocide the UN says the platform helped drive, let alone all the ongoing harms from Facebook that trace to those years.
Now the hour long interview.
Patel hands him three openings to account for the above, and he declines all three.
The first comes at 43:22, on the agent escapes at the AI labs. He says the PhD researchers “are gods on top of Olympus and the security teams are plumbers,” kept off the evaluation networks, and that the security teams are now saying “hey how do you like us now, maybe you should have talked to us.”
A plumber fixes pipes as a response service. When a building floods, the owner calls the plumber. Stamos was never the plumber, he was an officer at Yahoo and Facebook, with a seat at the executive table, a budget in the millions and a public byline about safety responsibility. The SEC says his team briefed management within days. He authored the September 2017 disclosure, so he was inside the decision about what to say in July. He wasn’t a plumber, because he sat at the table deciding which pipes the plumbers could touch, and we see the massive harms as a result. The plumbers at Facebook were the Myanmar civil society groups who warned the company from 2014, the content reviewers in Kuala Lumpur, and the reporters. They were right, he was wrong. How many people died? He is now trying to tell their story from their side of the table, as if he can take the seat he kept them from.
The second comes at 48:39, when he describes himself “as somebody who was at Facebook and saw what it was like for that company to have negative impacts on people.” The company had impacts. He saw. The word genocide does not appear in the hour. His public record on the point is a short list of announced features and late disclosures, each smaller than the announcement that preceded it.
Stamos at the Hewlett Foundation in April 2019, as reported by Betsy Cooper: WhatsApp turning on encryption was “probably the most privacy enhancing day of all time.” WhatsApp’s encryption is Signal’s protocol licensed into a Facebook product that keeps the metadata. The claim was unsafe then and is disproven now. Source: Twitter
The third comes at 49:28, when Patel says outright “I did want to ask you about Facebook.” Stamos answers with the god-like power of Zuckerberg’s will. When Facebook wants something, it happens; when it does not, the engineers say impossible. He places himself among those who tried: “when I wanted to try really hard on a safety issue, man, this is not solvable.” Three years as the executive responsible for safety become a story about a boss who would not let him do his job, paid like an officer to fail at it and allow harms instead.
He once knew how to speak differently. In 2019 he told Yahoo Finance he deserved as much blame or more as any other executive for Facebook’s slow response to Russia. That personality seems like it is gone. In its place the blame has moved to Mayer for refusing funding, to journalists, to an outsourced evaluation vendor, to the gods on Olympus, and to Google and Amazon for declining to rewrite the Linux kernel.
I mean it’s bingo time for who is to blame, everyone and anyone other than the guy paid like an officer to wear the “Chief” title around campus and wine and dine the press.
Whether or not you agree with the character in question, the hour boils down to claims that can be checked. Here is what was delivered:
Stamos
Reality
His generation “started coming up with responsible disclosure, bug bounties.”
Netscape paid a Bugs Bounty in October 1995, when he was 16. Rain Forest Puppy published RFPolicy in June 2000, a year before his first job. Christey and Wysopal wrote the Responsible Disclosure draft in February 2002, when he was a junior consultant at Wysopal’s firm.
Attackers “no longer have to use frontier models that have protections, that have logs.” Artex, run on an abliterated GLM 5.3, is the proof.
CrowdStrike’s report on the Korean bank operator: DeepSeek v4.1-flash as primary backend, GLM 5.3 and Grok 4.6 as backups, run inside Claude Code sessions. CrowdStrike reconstructed the operation from the Claude Code session histories and memory files the operator left in an open directory. The flagship “proof” of “no logs” was solved from the logs of a frontier model.
Stolen Fireworks API keys opened Cursor, and a bad plugin reached “5,000 more companies.”
Fireworks reported credential misuse on 6 October. Cursor served a tampered Claude Code extension on 29 October to at most 5,000 users. Neither company has connected the two. Users, in Cursor’s statement, somehow turned into entire companies in his.
Patch Tuesday “got to 300, 600. I think the last one was 900 something.”
September was 970. The last one before recording, 13 October, was 1,414, the largest in Microsoft’s history. He undercounted the trend he was describing by a third.
Binance is “the largest heist of anything in human history.”
Holds. $6.43 billion on 29 October, attributed by the FBI to North Korea.
The Hugging Face “swarm” was 700 to 1,400 agents.
Ok, METR counted roughly 700 in the attack. The larger number is every agent that passed through the message board, including the ones that declined to join. Counting all these bystanders as the swarm is not the inflation we want to hear.
The pattern in the misses is unmistakable, and lands the character analysis above it. Each miss moves the subject toward the open-weight models of other countries and away from the frontier products of the companies he has worked for, advises, or sells.
The last thing to notice is what he assigns, because it’s the “I will start tomorrow at Yahoo and the day after change everything to be secure” speech all over again. Never forget this is the “expert” who announced a fix on day one, sat on a breach, and then ran out the back door.
Every company must run Artex against itself within 90 days, under vendor contracts he himself describes as holding the vendor harmless “when any of these things happen.” Google and Amazon must rewrite the Linux kernel in Rust for a hundred million dollars, maybe a billion. Companies must replace their first and second tier SOC analysts with AI. Patel should build a dark age index. Four deliverables, four other people’s budgets, four dates, and no owner.
It is the Black Hat stage in 2014 with a larger audience and more at stake than ever. The announcement was the product then and the departure was the delivery, and the one deliverable he owns on this podcast is Cognition’s, which comes up whenever the conversation turns to cost. He has been running the “dark age” line on the podcast circuit since at least 7 October.
One name is missing from his hour, which should have been in the introductions. Joe Sullivan was Facebook’s CSO before him and Uber’s after. In 2016 Sullivan concealed a breach of 57 million records. A federal jury convicted him in October 2022 of obstruction and misprision of a felony. The man who stepped into Sullivan’s shoes after he already failed to disclose a breach of 500 million at a different company, showed up at Facebook…and over 87 million more were breached let alone the genocide. He puffed his way out of that into Stanford, four more short-term CSO titles, and now gets an hour on Decoder to keep the story going.
In the old Electric Company cartoon a parrot keeps asking who it is, and the plumber keeps announcing himself until he drops dead on the step. The owner comes home, finds the body, asks who it is, and the parrot answers for him: it’s the plumber, he’s come to fix the sink. The parrot never learned who was at the door. It learned the line, because the line is what gets said at the door.
That is the security industry in 2026. The line is that an expert was inside, the expert tried, leadership would not listen, and the expert left on principle. Facebook, SentinelOne, Corridor and now Cognition each opened the door to that line, because the line absolves the house. It says the function was sound and only the gods failed. Every board that hires him buys that absolution with the hire. Every podcast that books him broadcasts it. He supplies the line because the alternative is an accounting he has never given, and they repeat it because the accounting would reach them too.
The Justice Department said as much after Sullivan. A senior official, the Principal Associate Deputy Attorney General, called the conviction an “outlier” arising from an extreme set of facts. Read that as a security chief who hides a breach and faces a jury is the exception. The security chief who sits on a breach, leaves, and gets hired again is the norm. The norm gets a Stanford shingle and an hour on Decoder. Meanwhile, the sink has been flooding since 2014, as the man on the step has claimed to be the plumber five times, because a parrot keeps the house from finding out what he really is.
a blog about the poetry of information security, since 1995
