Category Archives: Poetry

Food, Poetry, Security

Port 502 is French for Iran

Leave a comment

France has accused Iran of sabotage. I love a good attribution, so I went looking for the evidence.

I found a port number.

One port number on one night.

A port for a day.

Are you Frenching kidding me?

That took me back to an incident briefing I led in San Francisco many years ago. The room was packed. Everyone was on the edge of their seat, except one guy. He slouched back and kept shaking his head no. I was walking the room through what we had found when suddenly he stood up and said he had seen the classified version, we don’t get it, and he marched out smiling at us like a Cheshire cat. He declined to say anything useful. He declined to say what the classified data corrected. He flamboyantly checked out, and the room was left to choose between the evidence and the confidence of a man who wanted us to believe it wasn’t enough.

The absence of evidence isn’t the evidence of absence.

France has just played that annoying man at the back of the room with his giant shit eating grin, and people have been taking the report way beyond face value.

A port number. Let me say it again.

An accusation built on a port and covering one night has been read as some kind of grandiose verdict on a month of attacks across a dozen countries. The gap between what Paris published and what the press now believes is the big story here, and it is easy to drag out of its neanderthal cave of lizard brain attribution into the sunlight of modern science.

Start with the official statement. On 9 November the foreign ministry named the Revolutionary Guard unit Shahid Kaveh for the attack on refrigeration controllers at about 700 French stores on the night of 11 October, called it “inédite par son ampleur et son niveau d’agressivité,” and announced it at a G7 press briefing minutes after Reuters reported that investigators privately suspected Iran. The five-agency C4 published a five-page note the same day. It calls its evidence a faisceau d’indices, the French legal term for circumstantial evidence.

It covers one country, and one night. That’s it. Here is the whole case:

  • The attack infrastructure also scanned Schneider Electric equipment over Modbus on port 502, a technique the note associates with Shahid Kaveh from April 2026.
  • The operators used FOFA, a Chinese commercial search engine for internet-connected devices.
  • The propaganda channel CyberbanNews relayed the attack on 13 October. The note’s word is relayée.
  • Farsi traces appeared in the attack infrastructure.

The port. Oh, the port.

CISA AA26-097A of 7 April 2026, signed by six US agencies, tracks CyberAv3ngers as the Shahid Kaveh Group and lists its traffic on ports 44818, 2222, 102, 22 and 502. Those are ports that any control-systems scan is going to reference. The American advisory ships indicators of compromise, the addresses a defender can match against logs. The French note matched the technique and kept the indicators. Had the infrastructure matched, the note would say infrastructure. It says technique.

FOFA is a subscription product and Farsi strings are the easiest artefact of all to plant; Olympic Destroyer carried a forged header copied from North Korean malware for the same reason. It’s like meeting a Russian guy with a beard glued on speaking a few words in Farsi. Speaking of which, on Halloween I met an Iranian teen who had personally made his own very authentic looking Soviet-era army general uniform, complete with insignia and Afghanistan war medals. He knocked and then refused candy, saying it was a bribe against Communist principles. Talk about a convincing costume.

That leaves the repost, the one item specific to Iran, and the note undercuts it itself: the unit’s avatars exist to claim attacks, and for this one their outlet relayed.

The prosecutor added a fifth item when she gave her presentation of the report, IP addresses pointing to terminals located in Iran.

The C4 note has Iranian addresses in one place, the 2024 Olympics kiosk case, under a different unit. For the October attack her own agencies list none. Her fifth item is absent from the document she was presenting. Two of the three names in the annex are on the US Treasury list of 2 February 2024. The names came from Washington, and this evidence says the same about where the verdict comes from. France is relaying an American judgment, which it is leaving as unverifiable.

Of course, it’s only cyber champagne if it comes from the Champagne region of France. Otherwise it’s just sparkling American intelligence. I mean this seems like a case of appellation d’origine contrôlée: the label is French, the grapes were pressed in Maryland. By French law it’s only Iran war attribution if it comes from Fort Meade.

Some of my readers may remember over a decade ago when Russia stood as the accused and I batted the other direction. In 2014 Bloomberg reported that US intelligence officials believed Russia blew up the Baku–Tbilisi–Ceyhan pipeline in 2008 by hacking its cameras. I pointed to the Corner House analysis attributing the blast to the PKK, and Süddeutsche Zeitung later reported an audit showing the cameras were installed after the explosion. “Unprecedented” has the same history: Ralph Langner, who reverse engineered Stuxnet, called the attack very basic, and Maroochy had put sewage in Queensland’s parks a decade earlier.

Same test, whoever is accused: publish what can be checked. Don’t laugh at the room and say you have a secret squirrel solution in your hideout nobody can see.

Now the merger. The same evening a Wavestone partner told the Guardian: “Given that recent cyber-attacks on supermarkets and the blood bank in France concerned freezers it is reasonable to think Iran is directly linked to both.” One night became a month based on the simple fact that both one day and many more days involved freezers. The EU High Representative said the incidents “if attributed” called for a strong response. That’s a strong conditional, and unfortunately she seems like the only official using it.

The method belongs to everyone.

Forescout cites a Danfoss newsletter recording hacktivist attacks in 2022 on 16 Russian supermarkets and 40 Israeli stores, and tracked more than twenty claimed refrigeration attacks between January and October 2026, chiefly in Spain and Italy, with the pro-Russian Z-Pentest Alliance and NoName057(16) the most active. By the time France was hit, Russian-aligned groups had spent nine months rehearsing on European cold storage.

Nine months of Russian attacks isn’t for nothing.

The October attack and the November wave are written up here already.

It belongs to everyone because the vendors built it that way. This is one of the most annoying parts to this story. The vendors need to have WAY more accountability. Regulators really need to get on them like how PCI DSS hammered card systems in the 2000s to force safety innovation in both the distribution and acquisition ends of their industry. Known weakness? Don’t ship weak devices. Don’t connect weak devices. If you do, no more shipping and connecting for you.

On 20 May 2025 CISA published CVE-2025-41450 for the Danfoss AK-SM 8xxA, an authentication bypass “caused by datetime-based password generation.” Claroty’s Team82 published the mechanism in August 2026: the controller accepts a code of the day in place of the administrator password, and the code is derived from the device’s own calendar. Copeland’s XWEB Pro, the other platform on CERT-FR’s list, has the same design, CVSS 10.0. Most of the October victims ran Danfoss models the vendor stopped updating in 2021 and 2016. And France had the most of them: IPinfo found 1,331 Danfoss dashboards open in France five days before the attack, against 1,197 in the other 72 countries combined, on the same firmware mix as everywhere else.

The vendor decides the controller attaches to the internet. The store that owns the food has no way to force safety on the vendor.

The vendor decides.

The vendor.

Decides.

November looked different. More than 100 stores in at least nine countries, plus cold rooms at three sites of the French blood service through a rental contractor. Ransom-ISAC logged one XWEB site hit with the factory login. Sekoia’s Danfoss honeypots the same evening caught an undisclosed exploit. Two operators at least. Sekoia is the only vendor to have published an infrastructure analysis spanning both waves, and it judges the two “may have been conducted by the same threat actor” while stating that “no technical indicators currently link this incident to that cluster,” the cluster France named. One actor, with nothing technical to link it to Tehran. Sekoia’s motive hypothesis, France’s deployment of troops and air defence to the Yanbu oil terminal as announced 24 September, gives Iran a reason. But it gives a defender nothing to verify.

Then the Russian claim arrived and vanished. Poof!

Or as I like to say, the poof is the proof.

NoName057(16) and Z-Pentest claimed November in a Telegram video and deleted the channels. Sekoia calls the claim unsubstantiated on three grounds. Two describe NoName, its history of false claims and its DDoS profile. The third is that the leaked credentials look like infostealer logs, which is also how an attacker gets contractor logins for these controllers. Z-Pentest made the claim too, and Z-Pentest is the group known for control systems; Forescout tracked it as the year’s most active claimant on refrigeration, and Denmark’s Defence Intelligence Service attributed a 2024 waterworks attack to it. The groups that practiced this all year claimed it, then erased the claim. That is the pattern: the operation that succeeds leaves the case open and the blame elsewhere.

France could be right about Iran. Could be… but what they published is a port number, and that ain’t right. It undermines credibility, if anything.

Imagine someone saying that some moldy cheese must be from France just because it tastes like old socks. Ok, but shouldn’t we have some actual tests before we slap a “made in France” label? The UK has actually landed in this spot already when they discovered that 100% of their real English honey from real English bees labels are bullshit, and they’ve been swallowing sweet impostor sauce for years. Literally 10 out of 10 jars failed the authenticity test, which should have been required a long time ago. Regulation is the mother of innovation:

Honey is one of the most adulterated food items on the market. We provide full traceability; we highlight 1. the location – area, country – from which we source our honey; and 2. the communities that manage our hives.

Anyone talking about a month of attacks solved is skipping all the parts where we prove who the attacker actually was and will be. The actual known culprits already proven are the vendors. They shipped a calendar password into internet-facing fridge controllers. And they forced it to be used in an unsafe state. Who should be blamed? The vendors. And probably Russia, if we get to that state of evidence. But in the meantime, the vendors.

Poetry, Security

Dobrindt Left the Antisemitism Post Empty to Do the Job Himself

Leave a comment

English | Deutsch

I have been up to my eyeballs in German political speeches this autumn, shocked by the antisemitism. The work is slow and mostly dull. We pull the Bundestag protocols, we read what people said, we note what makes a claim about Jews and what does not.

The AfD gives plenty to note. That was expected. Every other party combined doesn’t come anywhere close to the AfD. They crank it out as if it’s been enabled. But by whom, and how, and why?

What was not expected was a man who fell out of the tree when we shook it, because his record is clean on the exact terms we had been checking.

Alexander Dobrindt is Germany’s interior minister. CSU, in the Bundestag since 2002. We read everything he said in parliament over those twenty-four years. He has never said anything coded as antisemitic there. None of the dogwhistles or trigger words, no winks. When he mentions Jews, he condemns Judenhass. He says Jews belong to Germany. By any fair reading of his words, he shouldn’t be in this fruit bowl.

So why did he keep landing there? Because of what he consistently does around and with the subject. A small set of examples shows the method.

One day apart

On 20 May 2025 he presented crime statistics on politically motivated offences. The government published his line: “Egal, wo der Antisemitismus herkommt – er ist unter keinen Umständen zu akzeptieren.”

So the man says wherever it comes from.

Wherever. Hold that word.

The next day, 21 May, he took questions in the Bundestag. Protocol 21/6, page 405: antisemitism exists “sowohl im rechtsradikalen Bereich als auch in Bereichen des importierten Antisemitismus.”

Imported. Not wherever.

Same minister, same week, two audiences, two messages.

He has used “importiert” since October 2023. It is a word that points away from the AfD, away from the homegrown far right, and at migrants. Once it points there it becomes an argument for deportation. Researchers who study online antisemitism have described this move for years: concede that antisemitism exists, then hand it to a target group, usually Muslims. Shahak Shapira said it more plainly this September. Germany has plenty of antisemitism already. Nobody needs to import any.

A memorial hour

On 9 November 2023, the day Germany remembers the pogrom of 1938, the Bundestag held its memorial debate. Dobrindt spoke, as captured in Protocol 20/134, page 16792:

Die Jüdinnen und Juden gehören unverbrüchlich zu unserem Land, ihr aber nicht.

The protocol notes Saskia Esken calling out from the SPD benches: “Nicht mal in so einer Gedenkstunde können Sie das lassen!” Not even in a memorial hour.

He went on anyway. In that hour he asked for a six-month minimum sentence for hatred of Israel, automatic expulsion of foreign offenders and loss of citizenship for dual nationals. Then the sentence the demands were built for:

Wer nicht mit Israel leben will, wer nicht friedlich mit Juden leben will, der kann auch nicht in Deutschland leben.

The protocol notes applause from CDU/CSU, FDP and the AfD. The AfD does not usually clap for a CSU minister in a memorial hour. Apparently a whistle was heard.

The bills his party then tabled were voted down in April 2024. He has been interior minister since May 2025. He has not brought them back.

Two days after an election

On 20 September 2026 Die Linke won the Berlin election. On 22 September Dobrindt said the Berlin Linke tolerates antisemites and extremists in its circles, “ganz offensichtlich.”

Two days. No inquiry, no finding, a federal minister telling the parties negotiating a state government whom not to work with.

On 24 September, on the ZDF talk show maybrit illner, the host corrected her own slip about the Linke’s lead candidate, Elif Eralp:

Sie ist keine Antisemitin.

She is no antisemite. The president of the Central Council of Jews has said he finds her personal position credible.

Dobrindt answered, “Na doch.” She is. On what basis, he did not say.

Eralp is not Jewish. She filed a criminal complaint for defamation and insult. The ministry’s full response was:

Die Worte stehen für sich.

The words stand on their own, as if nobody has to answer for them.

On 7 October, at the memorial on the Bebelplatz for the Hamas massacre, Dobrindt said it again without naming the party: be alarmed when a party in Berlin talks about joining a government while tolerating antisemites in its circles.

If that is his standard he should be talking about the AfD non-stop. Its figurehead Björn Höcke has two convictions for using an SA slogan. Its rallies chant the same slogan with one word swapped, “Alice für Deutschland.” Its internal mail, verified by Correctiv, reads the way you would expect. The record is public.

Around 150 Jewish Berliners, Deborah Feldman and Susan Neiman among them, signed a letter calling the campaign against the Linke a cynical political instrumentalisation. The Central Council of Jews said the Berlin Linke has a real problem, which in Berlin is like saying the weather is bad, and did not endorse “Na doch.” That seems about right. There are antisemites around Berlin politics, the Linke included. The minister is not working against them. He is wielding them.

The word he saves

The AfD has existed since 2013. The domestic intelligence service calls it confirmed right-wing extremist, and German courts have read its “Remigration” plan as ethnic cleansing. Dobrindt calls it “rechtsextremistisch” too, and opposes a ban. In thirteen years, in nothing we could find, has he ever called the AfD antisemitic.

Only the Linke got that word, two days after winning an election. The party that applauded his memorial speech has not gotten it once.

And during the weeks of warnings about Berlin, the federal government’s own post for fighting antisemitism was empty. Felix Klein left at the end of August. The successor was approved on 14 October. In July Dobrindt had promised one “in Kürze.”

So the minister alarmed about antisemitism in one party let the office meant to speak for Jews sit vacant through the alarm. If you want to know how “never again” coexists with all of this, the pattern is not hard to see.

The pattern

His other famous phrases fit. “Konservative Revolution” in 2018, the name of the Weimar far right, kept after historians objected. “Anti-Abschiebe-Industrie” the same year, for the lawyers of asylum seekers, a term that won Unwort des Jahres and was followed by thousands of hate mails to one lawyer in Ellwangen with the phrase in the subject line. “Migrantische Chaoten” this month, after which his own ministry admitted it had no numbers.

The targets change. Jews are never the target. Jews are forever the reason given for one.

It is not the first time this blog has watched him point left while the right does the work. In June, after the Reutlingen substation fire, the interior minister talked about left-wing extremists before anyone had evidence of who struck the match.

This is the move Esra Özyürek describes in Subcontractors of Guilt: the Holocaust’s weight gets passed down to the people with the least power to refuse it, and Muslims in Germany end up holding the bill. “Importierter Antisemitismus” is that transfer in two words. It is the same reflex that had the Chancellor filing antisemitism under hostility to foreigners at a Berlin rally in September. Dobrindt’s version goes a step further into operations: the Jews belong to us, as a reason we hold, so that “ihr aber nicht” can follow.

What we will publish

Dobrindt will appear in the antisemitism tracker with zero antisemitic statements. That is the honest number and a count that cheats is worthless. Next to the zero will be a second column: statements that use antisemitism against somebody else. He is at eight so far. The memorial speech, memorable for who applauded it, is the first.

We also looked for anything he has said about his own family’s place in Nazi Germany, as we do for everyone. Nothing is published, and he has never spoken of it. That blank will be on the page too.

The lesson from a season of reading is simple. The words are not the only thing. A German right-wing politician can go twenty-four years without one bad word about Jews and still use them whenever it “pays”.

Turkish- and Arab-background Germans are made to perform remembrance as a condition of belonging while ethnic Germans get to treat their own antisemitism as historically closed. The guilt gets subcontracted downward to the people with the least power to refuse the transfer of blame.
History, Poetry, Security

No Quarter: High Time We Hold Hegseth to Hegseth

Leave a comment

In the matter of Pete Hegseth, Secretary of War. Brief for the prosecution.

I. The charge

Ordering the killing of shipwrecked survivors on September 2, 2025. The charge is the unlawful killing of persons hors de combat. Treason is set aside for the moment because it needs an army in the field or adherence to an enemy. The charge the record supports so far is enough.

II. Statement of facts

  1. On September 2, 2025, United States forces struck a boat in the Caribbean. Reporting places a verbal order from Hegseth before the operation: “kill everybody.”
  2. Two survivors were seen clinging to wreckage. Roughly two hours later a second strike killed them. The White House confirms the second strike and attributes the order to Admiral Bradley, acting under Hegseth’s authorization.
  3. Hegseth first said he watched the operation live, then said he left before the second strike and saw no survivors in the “fog of war.” Both statements are his.
  4. The campaign continued. Just Security’s running timeline put the count at 72 strikes and 243 dead by late October 2026.
  5. On September 15, 2026, Representative Thomas Massie, a Republican, read eight articles of impeachment on the House floor, charging that Hegseth directed the unlawful use of deadly force in the boat strikes. The Speaker sent the House home a day early to avoid a vote.

III. The rule

The Department of War’s own Law of War Manual forbids attacking the shipwrecked. Legal experts reviewing the September 2 orders found them self-evidently unlawful, because they ordered no quarter, and found the second strike an attack on persons hors de combat. Representative Mike Turner, a Republican, put the civilian version plainly: had the survivors been captured and convicted, they would have gone to jail, not been executed.

IV. The defendant’s own standard

The tribunal is asked to apply the standard the defendant has applied to others.

  • Exhibit A, 2019. Hegseth privately lobbied the President to pardon Clint Lorance, convicted of murdering two civilians, Mathew Golsteyn, charged with murdering a detainee, and Edward Gallagher, charged with stabbing a prisoner. He told his audience “these are the good guys.” Three trials, erased.
  • Exhibit B, 2025. “Kill everybody.” Two men in the water, no capture, no trial.
  • Exhibit C, 2026. Hegseth announced the Pentagon would livestream the firing-squad execution of Nidal Hasan, a man who received a court-martial, a conviction and thirteen years of appeals. Hegseth took a lawful sentence and tried to make it a broadcast. The President withdrew it.

The pattern across all three exhibits is the removal of the trial. The pardons removed trials already held. The order removed a trial that should have followed capture. The livestream removed the dignity a trial had already secured.

V. Precedent

On October 19, 1864, Robert E. Lee wrote to Grant that captured Black soldiers belonging to Confederate citizens would be returned to their owners rather than exchanged as prisoners of war. Grant refused every exchange on those terms. Lee put in writing that captured men were property, and he commanded on that basis to the end.

In June 1865 a federal grand jury indicted Lee for treason. Grant stopped the trial. Lee died obscured, at home in 1870, with barely a thousand mourners. Within two years the men who lost the war began fabricating him into a myth that now sits on a Georgia mountain protected by statute. The absence of the trial is the only thing that ever saved Lee, and the cost of that absence ran a century.

VI. Relief sought

A trial. Charge, evidence, witnesses, verdict. The September 2 video and the Justice Department memo entered into the record. Admiral Bradley under oath. The sentence belongs to the court and to no one else.

That is the one thing the defendant has denied to every person he has judged. It is the one thing the record now demands for him.

Poetry, Security

Crow Calls Cue Cognitive Control Channel

Leave a comment

A new study says crows have evidenced brain function for vocalization.

…volitional vocalizations carry specific cognitive control demands, previously undescribed in birds…

The first call after a run of pecks came late; by the second call the delay was gone. Pecks after calls showed no delay at all.

In other words, a vocal channel has a control layer that the beak-peck channel does not. Calling is cue-to-decision-to-action. Pecking is cue-to-action.