ICE’s plan for Socorro, Texas puts 8,500 beds into 826,780 square feet of warehouse. Ninety-seven square feet per person, gross, in a standard design whose documents list holding areas, gyms, cafeterias and a gun range.

That’s big. Very big.

Now apply that same density to the floor space of the 474 AI data centers on Erin Brockovich’s community map and the buildings hold 8.7 million people. That is 63 percent of everyone living in the United States without status. Count only the floor space running today and the buildings hold 561,000 people, eight and a half times the number ICE had in custody at the last count.

Let’s be honest about history, as I didn’t go to LSE for nothing. If we know anything at all about President Jackson, Trump’s favorite, we should strip the word datacenter from the map and read the buildings as removal camps. Jackson’s genocidal Removal Act of 1830 gave the policy its word, and the stockades of 1838 cruelly held the Cherokee through a summer of disease before the trail of tears killed about a quarter of them, with as many again dead after arrival, by Russell Thornton’s reckoning.

Seen as labor camps the major complaints the towns have been filing suddenly vanish, almost too easily.

The complaint	The camp function
Too much water	Deprivation
Too much energy	Deprivation
Too few jobs	Slave labor

The Map

Map 1. Data center floor space counted as camp capacity. Shading is the unauthorized population by state (MPI, 2023). Teal markers are the 474 facilities on the Brockovich map, sized by estimated floor space. Red and amber markers are ICE’s warehouse purchases.

Two conversions make the map useful and both come from published figures. Stargate Abilene is about 4 million square feet for 1.2 gigawatts and xAI’s Colossus is 785,000 square feet for its first 150 megawatts, so one gigawatt is roughly 4 million square feet of shell at 250 watts per square foot. ICE’s own Socorro plan supplies the second figure, 97 square feet per bed. The Brockovich dataset, built on Compute Atlas and Epoch AI, claims 211 gigawatts across the country, 13.6 of them running. That is 846 million square feet claimed and 54 million built.

State	Beds at ICE density	Unauthorized residents	Coverage
Texas	2,250,000	1,966,000	114%
Utah	957,000	138,000	693%
Pennsylvania	528,000	250,000	211%
New Mexico	383,000	63,000	608%
Ohio	356,000	90,000	396%
Indiana	339,000	137,000	248%
Georgia	329,000	479,000	69%
Arizona	304,000	307,000	99%
Illinois	267,000	588,000	45%
Florida	62,000	1,223,000	5%
California	56,000	2,910,000	2%
New York	47,000	836,000	6%
United States	8,719,000	13,737,000	63%

Beds divide estimated floor space by 97 square feet. Population is the Migration Policy Institute’s 2023 estimate. At 500 watts per square foot, the densest halls now being built, the claimed floor space still holds 4.4 million and the running floor space 281,000.

Texas alone claims 218 million square feet, enough to hold every unauthorized resident of the state with room to spare. Utah’s campuses would hold seven times Utah’s unauthorized population, New Mexico’s six times, Ohio’s four. California, New York, Florida and Illinois hold 40 percent of the people and 5 percent of the floor space.

The Geometry

The German camps sat far from the people they were built for. Berlin alone held a third of the country’s Jews, and the cities held the Communists and Social Democrats. The camps went to a disused munitions works outside Munich, a moor at Esterwegen, the Ettersberg above Weimar, a quarry at Mauthausen. The Reichsbahn moved the population to the site. A gap between where people live and where capacity is built is the signature of a camp system, as seen on the map.

There are two logical steps in sequence for how sites were set, which also are on the map.

The First Logic: Custody Where Labor Is Free

Prussia placed camps in the Emsland moors in 1933, and by 1934 the Justice Ministry ran them as prison labor camps cutting peat. In 1938 the SS founded its own quarrying company, Deutsche Erd- und Steinwerke, and from then placed Flossenbürg, Mauthausen, Gross-Rosen and Natzweiler at granite quarries, Neuengamme at a brickworks. The prisoner was free labor attached to a resource, and the camp went to the resource.

The American jurisdiction for that arrangement is the Thirteenth Amendment exception, used in full in seven states that pay prisoners nothing for regular work: Alabama, Arkansas, Florida, Georgia, Mississippi, South Carolina and Texas (ACLU and the University of Chicago Law School Global Human Rights Clinic, Captive Labor, 2022). Texas, Mississippi and Georgia rank in the top twenty states for data center floor space per resident. Texas and Georgia hold 20,000 of the 34,000 warehouse beds ICE has bought.

Map 2. ICE’s Detention Reengineering Initiative against the unauthorized population by state. Sites are sized by planned beds and colored by status.

The Bureau of Justice Statistics’ 2023 imprisonment rates against floor space per resident give a rank correlation of 0.46 across the fifty states, 0.50 with Utah removed. By quartile of floor space per resident, mean imprisonment rates run 356, 381, 318 and 226. The ten states that imprison the fewest people, Massachusetts through Washington, all sit in the bottom twenty for floor space, seven of them in the bottom twelve, four with none at all. States that decline to imprison their own residents decline to host this floor space.

State	ICE beds bought	Imprisonment rate 2023	Floor space, sq ft per resident
Texas	10,000	477	7.1
Georgia	10,000	449	2.9
Pennsylvania	9,000	300	3.9
Arizona	1,500	448	3.9
Maryland	1,500	261	1.5
New Jersey	1,500	125	0.2
Michigan	500	328	1.1

Imprisonment rate is sentenced prisoners per 100,000 residents (BJS, Prisoners in 2023, Table 7). Floor space per resident uses Census 2023 population estimates.

The Second Logic: Industry Where Water and Fuel Are Cheap

IG Farben chose Auschwitz in 1941 for Silesian coal, the water of the Vistula and the Sola, limestone and the rail junction. Its planners reported the camp’s labor as a further advantage, and the SS built Monowitz beside the plant. The campuses that break the prison correlation follow this logic. Creekstone’s 10 gigawatt site at Delta, Utah, the town beside the Intermountain Power Plant, runs on its own gas and solar on state trust land. Homer City in Pennsylvania is a dead coal plant converted to gas. Project Jupiter at Santa Teresa, New Mexico runs on an on-site gas microgrid, the 7 gigawatt Lea County proposal sits on the Permian Basin, and Alaska’s North Slope proposal would run on its own pipeline. Utah imprisons 186 people per 100,000 and has the largest campus in the country under construction, while Salt Lake City stopped the ICE warehouse with a water ordinance. Monowitz siting puts water and fuel first. Custody arrives afterward.

The two logics converged in 1942, when armaments plants pulled roughly a thousand subcamps to the factories and the prisoner followed the machine. This history lens yields a prediction. The next purchases in America will land at power and water in unpaid-labor states, while the transit sites stay at the rail heads and airports. Texas already fits all three.

Water, Energy, Jobs

The city of Social Circle, Georgia locked the water meter on the million-square-foot warehouse ICE bought for a 10,000-person mega-center. From the city’s statement:

Our permit to draw water out of the river is 1 million gallons a day. Our sewer plant can process 660,000 gallons per day and is at capacity. Their BLUF analysis indicates a daily water and sewer need that exceeds these amounts.

ICE’s Detention Reengineering Initiative answers with engineering reviews to make every site run independent of local water, power and wastewater. The town holds the valve today. The plan moves the valve inside the fence, where the operator decides who gets water. That is the kwanliso configuration, a self-contained site where provisioning is at the guard’s discretion and deprivation is the baseline condition of the site.

The Atlantic ran Elias Wachtel’s “The Data-Center Panic Is Overblown” in June and Andy Masley’s “The Data-Center Debate Is Divorced From the Facts” on 19 September, the second written, by the magazine’s own disclosure, on a grant from Coefficient Giving, the renamed Open Philanthropy, whose principal funder Dustin Moskovitz is an investor in Anthropic. Both essays argue at the national average, where water per query is trivial and grid strain is manageable. Social Circle measures its own river. The 1941 method chose sites by local water and local coal, and a town that reads its permit against the project’s demand is reading the project the way its builders do.

The jobs claim resolves the same way. ICE told Salt Lake City a warehouse for up to 10,000 people would bring almost 10,000 jobs. Detainees already do the cooking and cleaning in ICE facilities under the $1 a day “voluntary work program,” and GEO Group lost about $23 million in Tacoma in 2021 over it. In the German system the SS rented prisoners to firms at three to six Reichsmarks a day, so the prisoner was revenue. Here ICE pays GEO and CoreCivic per bed-day, so the bed is the product and the body is a cost, which is why this system builds capacity first and finds people second.

The density is already documented. The DHS Inspector General’s report of 14 September 2026 on the Everglades camp found 79 detainees confined in metal enclosures of about 18 square feet, for periods up to two hours, and housing that gave detainees less than half the living space federal standards require.

The posted policy on the enclosures:

safe and secure place in general population for detainees to reflect on their behavior choices, manage their emotions, reduce stress, and practice self-directed behavior

Square feet per body
42U server rack, plus aisle	8, about 25
Birkenau horse-stable barrack, 400 assigned	10
Everglades “calming area” enclosure	18
ACA standard for multiple-occupancy housing, unencumbered	25
ICE Socorro plan, gross	97

Processing Becomes Terminus

Trump set the number himself. In his interviews with Time on 12 and 27 April 2024 he put the population at “probably 15 million and maybe as many as 20 million by the time Biden’s out,” and answered the question of camps with “I would not rule out anything,” adding that there would be little need for them because the people would be taken out of the country quickly. In December 2024 he told the same magazine, “I want them out, and the countries have got to take them back.” Stephen Miller had already described to the New York Times, in November 2023, vast holding facilities to be built by the military on open land near the Texas border. Twenty million is ten times the entire American prison and jail population and beyond any camp system ever operated; the Gulag peaked near 2.5 million and the German system near 700,000 held at once in early 1945. The plan’s premise is an open exit, and the countries taking people back is the condition that fails first.

Population equals flow times dwell. ICE holds about 65,765 people, has removed 356,389 in this fiscal year through mid-July, and reports an average stay of 52 days, up from 42 in 2022. Sixty-five thousand divided by 52 days times 365 is 462,000 a year, which is the removal pace. The pipe is balanced. Add the plan’s 92,600 beds and the system holds 158,000, which at 52 to 60 days is a pipe for one million a year, the administration’s stated target. The size is transit-sized. The design fails at the exit, because intake is the only variable the operator controls. Removal depends on flights, receiving countries and 570 immigration judges facing a 3.3 million case backlog with waits near 900 days. The release valve is gone: since July 2025 ICE reads section 1225 to deny bond to anyone who entered without inspection, and the Board of Immigration Appeals agreed in Matter of Yajure Hurtado. Any reservoir whose outlet is smaller than its inlet fills. Terminus arrives by arithmetic.

That is the German sequence, read correctly. Heydrich’s Schnellbrief of 21 September 1939 (Nuremberg document PS-3363) separated the immediate concentration of Jews in cities from the goal it served:

Es ist zu unterscheiden zwischen 1. dem Endziel (welches längere Fristen beansprucht) und 2. den Abschnitten der Erfüllung des Endziels (welche kurzfristig durchgeführt werden).

Hitler had set that final goal in his letter to Adolf Gemlich of 16 September 1919, fourteen years before he took power: “die Entfernung der Juden überhaupt.” The exit was removal. Emigration first, then the Nisko reservation in October 1939, then Madagascar in 1940. Each closed. Emigration was banned outright on 23 October 1941, and the holding pens turned terminal by attrition, about 43,000 dead in the Warsaw ghetto in 1941, then by decision. The Wannsee protocol of 20 January 1942 (NG-2586) records the substitution in one sentence:

An Stelle der Auswanderung ist nunmehr als weitere Lösungsmöglichkeit nach entsprechender vorheriger Genehmigung durch den Führer die Evakuierung der Juden nach dem Osten getreten.

Emigration out, evacuation to the East in. The verb stayed the same and the destination changed. Slavery was a 1942 addition when the war economy needed hands, and Vernichtung durch Arbeit came with the Thierack-Himmler agreement of 18 September 1942 (PS-654). “Removal” is the same destination-agnostic verb.

The American exit is already being redefined the same way. When a country declines to take someone back, the answer since the Supreme Court’s June 2025 order in DHS v. D.V.D. is a third country, and CECOT was the proof of concept: 238 Venezuelans flown to a foreign prison on 15 March 2025 and held there uncharged for four months. That is a terminus, built offshore. Zadvydas v. Davis caps post-order detention at a presumptive six months; third-country removal is the workaround. Deaths in ICE custody reached 25 in fiscal 2025, the most since 2004, and fiscal 2026 passed that total by the end of March with 26.

	Germany 1933 to 1945	United States 2025 to 2026
Building	Munitions works, brewery, mill, moor barracks; from 1942 a standard horse-stable type	Logistics warehouses, 250,000 to 1,000,000 sq ft; “standardized design”
Site	Away from the cities; at quarries, brickworks, rail junctions; Auschwitz for coal and water	Away from California, New York, Florida; Socorro, Social Circle, Tremont; campuses at power plants and gas fields
Water and power	SS-controlled; Birkenau without washing barracks until 1943; DPRK huts without electricity	Sites engineered independent of local water, power, wastewater; towns locking meters
Dwell	Transit camps: Westerbork about 10,000 held, 100,000 through; Drancy 5,000 to 7,000, 65,000 through	Processing sites 3 to 7 days; mega-centers 60 days; 52-day average today
Labor	Prisoner rented to industry at 3 to 6 RM a day; the body was revenue	Bed-day paid to operator; $1 a day work program; the body is a cost
The word	Aussiedlung, Evakuierung, Endziel	Removal, remigration, self-deportation
Exit	Emigration until 1941; then “the East”; DPRK kwanliso: none	Removal flights; third countries since June 2025; CECOT
Jurisdiction	Schutzhaft, custody outside the courts	Civil detention; bond denied under section 1225 since July 2025; federal ownership to bypass state law

Who Is Building It

The people choosing this were raised inside what it produces. Elon Musk’s grandfather Joshua Haldeman led Technocracy Incorporated in Canada, was arrested in 1940 when Canada banned the movement as a national security risk, chaired Social Credit in 1946 while its members read the Protocols into Hansard, and told Die Transvaler in 1951 that Canada’s attitude had encouraged him to settle in apartheid South Africa. Peter Thiel’s father left Germany as the 1968 anti-Nazi movement rose and placed his son in the German school at Swakopmund, where the New York Times found “Heil Hitler” in use as the everyday greeting in 1976, while he managed construction of the Rössing uranium mine for the apartheid nuclear supply chain. Stephen Miller writes “remigration,” the Identitarian term, and the State Department proposed an Office of Remigration. Musk told an AfD rally in Halle to stop dwelling on past guilt.

People who reach for the vocabulary of 1941 and site their buildings by its method have read the manual, or were raised by people who relayed it to them.

The precedent that fits best is Monowitz, where private capital chose a site for coal and water and bought custody from the Nazi SS as an input. The data center is a private plant and ICE is the supplier. That is the Nazi arrangement that ended worst of all, and it is the one being built.

The thing about reading African history is that when you hear Peter Thiel or Elon Musk talk about their ideal “colony” it sounds just like a Rhodesia fever dream. Musk was raised in apartheid Pretoria.

Thiel was born in Frankfurt and partly raised in apartheid-administered South West Africa. The documented apartheid leader in this story is Musk’s grandfather Joshua Haldeman, who moved his family from Canada to Pretoria in 1950 to help run the newly elected National Party government and praised South Africa as the leader of “White Christian Civilization.” This is all to say that the white nationalist nonsense is handed down from the Musk and Thiel grandparents.

Heidi Beirich of the Southern Poverty Law Center described the revival to the New York Times in April 2018.

All the talk right now among people in the alt-right and the broader white supremacist movement is about the need for a white ethno-state. And when you praise Rhodesia, in this context, what you’re praising is violence to that end.

Now that the Musk and Thiel network staffs the American federal government, with protege JD Vance in the vice presidency, Thiel’s Founders Fund co-founder Ken Howery in the Copenhagen embassy, and David Sacks running AI policy, the old apartheid “colony” plan just became a taxpayer-funded project called “Colonize Greenland”.

Yes, I know Musk wears “Occupy Mars” shirts, despite announcing in April 2016 that SpaceX would land a Dragon capsule on Mars as soon as 2018, a mission cancelled the following year.

Yes, I know “Occupy Mars” really means find a territory without laws to create a white nationalist enclave, not unlike Swakopmund, the former German colonial town in South African-occupied Namibia where Peter Thiel spent part of his boyhood while his father worked as an engineer on the Rossing uranium mine under apartheid labor rules. Swakopmund held a concentration camp during the 1904 to 1908 genocide of the Herero and Nama, and its German community was still known for celebrating Hitler’s birthday and giving Hitler salutes when the Thiels arrived.

On 20 April 1989 (Hitler’s 100th birthday) the Nazi flag was flown in Swakopmund (Woermannhaus Tower, at the corner of Bismarck and Kaiser Wilhelm), twelve years after the Thiels fled approaching Black majority rule for a white flight enclave in California.

Fast-forward to now and a one-year-old Texas SPAC has landed its drilling containers on the East Greenland coast without permission, after falsely telling a village meeting it had approval, as if it has landed on Mars. Its chairman is a serial SPAC promoter with over ten shell companies behind him. Its budget is $60 million for what is now a single well. To put this in perspective, it’s in a basin where Cairn Energy drilled eight wells in 2010 and 2011, spent over a billion dollars, and found nothing commercial. And its media strategy is a Dr. Phil documentary.

In other words, this has absolutely nothing to do with oil.

Greenland is the new Mars for the white nationalists. The oil story is just a retail tranche of a much older propaganda circuit: the continent as a single engineered resource unit, run by experts and capital instead of voters. “Technocracy Inc.” drew that map in the 1930s and called it the Technate of America. It included Greenland.

Keep in mind how much it matters that Musk’s grandfather led the movement in Canada until his 1940 arrest. Thiel wrote in 2009 that he no longer believed democracy and freedom were compatible. Their people now hold the Greenland portfolio and it’s all about “colonization”.

Player	Position	Technocracy Aim
Peter Thiel	Founders Fund; backer of Praxis and seasteading	Exit from democracy; declared it incompatible with freedom in 2009; sovereignty for capital
Elon Musk	Grandson of Joshua Haldeman, Technocracy Inc. leader in Canada, arrested 1940	The Technate inheritance; engineered governance from DOGE to a Mars city he calls Terminus
Ken Howery	Co-founded Founders Fund with Thiel; US Ambassador to Denmark, holding the Greenland portfolio	Reported by Reuters to take the Greenland “freedom city” seriously while leading acquisition talks
Dryden Brown	Praxis co-founder, Thiel-backed network state venture	Flew to Greenland to buy it in November 2024; pitched a “mythical city in the north”; Praxis posted “According to plan” when Howery was named
Marc Andreessen, Joe Lonsdale	Venture capital, DOGE advisers	Reported backers of the freedom city; Lonsdale called for “expanding our country to Greenland”
Larry Swets	Chairman, Greenland Energy (GLND); ten-plus SPACs sponsored	The retail tranche: a $215 million Nasdaq listing sold on a $1 trillion claim from reprocessed legacy seismic
Jeff Landry	Louisiana governor, Trump’s Greenland envoy	Promises oil pumping next year, a physical impossibility on any Arctic timeline, because the promise is the product

The connections run through two men.

1. Howery co-founded Founders Fund with Thiel and now sits in the embassy that governs American interests in Greenland. Thiel backs Praxis, whose founder tried to buy the island and celebrated Howery’s appointment as part of the plan.
2. Musk carries the Technate by blood and by conduct: his grandfather mapped Greenland into an expert-ruled superstate ninety years ago, and the grandson built the unaccountable efficiency directorate that treats elections as legacy code.

The SPAC, the freedom city, and the missile defense basing are three products written against one underlying asset, which is valued more for what it lacks than what it has: only 57,000 people on 2.1 million square kilometers, and sovereignty fractured three ways between Nuuk, Copenhagen, and Washington.

It’s all just “terra nullius“.

Everyone keeps asking what is the economic or military justification, what’s under the ice or in the geographic vicinity. Wrong questions. It’s a trick.

The asset is the absence of voters. It’s the absence of laws. It’s the suitability for repopulating the white race, the Rhodesian fantasy Thiel and Musk were raised on.

Dr. Stuxlove, my presentation at BSidesSF on February 15, 2011, placed Stuxnet within a documented lineage of control-system compromises. Was Stuxnet the “First”? followed in 2015 with an incident list back to 1992 and a study of how the press likes to manufacture firsts and seconds.

Today I was asked about a threat-intelligence vision for physical and hybrid attacks together. Good question! While we record anecdotes and press coverage easily as qualitative points, the structured qualitative incident data still remains scarce. MITRE ATT&CK offers us only the high level T1200, Hardware Additions for physical entry, with T1195, Supply Chain Compromise next door and a separate ATT&CK for ICS matrix covering cyber operations that produce physical effect, while kinetic acts stay outside every matrix. That reveals an old structure we need to update.

How many sides to an elephant?

The phrase “physical and hybrid” is like answering trunk and tail when asked what’s filling up the room we are in.

One end is all about what’s getting inside hardware: implants, additions, supply-chain access. ATT&CK treats these as an entry vector because ATT&CK models adversary behavior inside networks that ride on, but especially terminate somewhere in, the physical. Kinetic acts thus get framed outside its scope, which explains the single technique for entry by hardware. The ICS matrix is on the extreme end, as it only records what a compromise does to a physical process and kinetic tools aren’t mentioned.

The other end is the kinetic field: severed cables, damaged pipelines, attacked substations, drone incursions, arson. Conflict-event and hybrid-threat researchers talk about this as its own discipline. Remember the pipeline blast threads? I once met with a White House official who brushed me aside when I suggested the PG&E San Bruno deadly blast is a natsec concern that cyber crosses with. Shortest meeting ever.

Each field sits at the end of a much more interesting whole picture that we should be putting back together. A cross-domain incident falls naturally between them.

Provenance isn’t always in Provence

Honestly, we benefit most by fleshing out the middle so that we have one to talk about comfortably. Reporting on verified infrastructure attacks carries the kind of accuracy that helps deflate political fear mongering thriving in a middle void.

Vulkangruppe attacks showing Russian indicators across fifteen years without a single conviction? Who does that void serve? Kommando Angry Birds fitting the Russian paid-recruitment template the BKA, BND, BfV, and BAMAD jointly warned about? The evidence helps a lot, but apparently the void helps someone even more.

The Tehama-Colusa canal case ended in dismissal. The 2008 BTC Turkey pipeline explosion rests on single sourcing. The 1982 Trans-Siberian pipeline story rests on one memoir. Maroochy Shire in 2000 predates Stuxnet by a decade and was prosecuted. The verified record is smaller and older than the vastly increasing reported one. But the hard facts live in blog posts like this one and engineering reports rather than proper threat research tables. Vendors and the press prefer the loose record because they hunt firsts and seconds as “news”.

Today a thing happened again, which we have seen before and could have prevented, doesn’t get the attention it deserves.

Ingredients

Existing databases each hold a piece of the whole picture. Assembling them is the practical path to a working dataset.

EuRepoC is a free European academic database of cyber incidents. It starts at 2000, codes each incident across roughly sixty fields, and runs separate trackers for critical infrastructure and for attribution. Use it for the cyber side and for the overlap where cyber operations touch physical infrastructure.

The Soufan Center report on Russian hybrid tactics carries an incident list covering 2022 through 2025. Each entry names the incident, the country, the target type, and a confidence level for the attribution. Use it for the recent kinetic and hybrid record in Europe.

OE-417 is the disturbance report US utilities must file with the Department of Energy. The filings go back to 2000 and include a category for physical attack. Use it for structured data on attacks against the US grid, the one infrastructure sector with mandatory public reporting.

That leaves the giant void.

Triad of Encoding

Incident analysis should record three separate facts: who was there, who did the damage, and who gave the order. Call them presence, attribution, and tasking. Each rests on different evidence, and each deserves its own confidence rating.

Presence is who was at the scene. The Baltic record shows us Chinese-flagged or Chinese-owned vessels over repeated cable breaks: Newnew Polar Bear crossed the Balticconnector and two cables in 2023, Yi Peng 3 dragged across C-Lion1 and the Sweden-Lithuania link in 2024, and comparable incidents followed off Taiwan in early 2025. Ship tracks prove the presence. They prove only presence, but that’s the point.

Attribution is who caused the damage. Western investigators treat the hulls as flags of convenience and pursue Russian indicators, while Beijing declined to cooperate with the Balticconnector inquiry and every Baltic case remains open, leaving the void.

Tasking is who ordered the operation. No Baltic case seems to be getting close. I’ve argued a few times we have some clear Chinese indicators yet seen almost zero interest in public pursuit. Talk about void.

Merging the three into a single actor field turns a database into a story lacking the support it deserves. A ship at the scene becomes “China cut the cable” begging what evidence lands. The merged field also overstates the cases where only presence exists, and it understates the cases where tasking evidence exists but the execution was outsourced, a leased hull, a paid recruit, a contractor. Downstream this gets worse when a policy maker cites the weak field as a finding, a vendor report cites the policy maker, and the original evidence base, one AIS track, goes unverified. The Soufan and EuRepoC designs avoid the triad risk because they record confidence per variable, a leg of a table instead of the whole thing. Keeping them separate while connected means something like high confidence on presence, moderate on attribution, and none on tasking.

The physical table needs the same separation. Bloomberg’s 2018 Supermicro report is still unverified, denied by everyone involved, and instructive for exactly this reason: it merged a hardware claim, an actor claim, and a tasking claim into one. Then the hardware claim was weak and it made a decade of serious supply-chain concern look unsteady. The documented Chinese activity is different in kind: supply-chain access and pre-positioning inside operational technology. My old friends over at Dragos tracked it as VOLTZITE, overlapping the group others call Volt Typhoon, living inside critical-infrastructure OT. Planning and execution get their own columns. A group pre sabotage is NOT post sabotage, and the database has to know what time it is.

I’m old enough to remember hacking critical infrastructure in the 1990s by compromising Cisco routers at mass scale. The pre-2000 layer of ICS and infrastructure incidents, across sectors and across borders, still remains old timer lore instead of a proper ledger. Meanwhile, we have these resources:

Resource	Access	Coverage
Hybrid CoE	Open	Research publications and the Hybrid CoE and EU-JRC conceptual model, the closest existing document to a shared hybrid-threat vocabulary
The Soufan Center, Russian Hybrid Tactics in Europe 2022-2025	Open	Incident-level dataset, 2022-2025, attribution-confidence coded
EuRepoC	Open	Cyber incidents from 2000, roughly sixty variables, critical-infrastructure and attribution trackers
DOE OE-417 annual summaries	Open	US grid disturbances including physical attacks, archived to 2000
PNNL event-correlated outage dataset	Open	OE-417 joined to EAGLE-I county-level outage data on OEDI
Michael Mabee’s OE-417 consolidation	Open	The DOE summaries cleaned into a single CSV
ACLED	Open	Political-violence and sabotage event data, codeable for kinetic incidents
GDELT	Open	Global event database, broad and noisy, minable for physical incidents
Global Terrorism Database (START)	Open	Over 200,000 terrorist attacks worldwide from 1970, more than 100 coded variables including infrastructure target types, coverage through 2020, access by request
ICPC	Open	Submarine cable protection, infrastructure and international-law reference
TeleGeography Submarine Cable Map	Open	The geography under the cable-cut attribution work
NATO StratCom COE	Open	The influence and information side of the hybrid picture
NERC E-ISAC	Member	Grid physical-security reporting
Janes	Paid	The strongest structured coverage of the kinetic and military-hybrid side
Recorded Future, Geopolitical Intelligence	Paid	Facility and physical-threat monitoring in real time
Dragos (Accenture majority stake, June 2026)	Paid	OT and ICS, where cyber produces physical effect
Nozomi Networks	Paid	OT and ICS, where cyber produces physical effect
Claroty	Paid	OT and ICS, where cyber produces physical effect
Control Risks	Paid	Geopolitical and physical risk with incident feeds
Crisis24	Paid	Geopolitical and physical risk with incident feeds
S-RM	Paid	Geopolitical and physical risk with incident feeds
Sibylline	Paid	Geopolitical and physical risk with incident feeds
Eclypsium	Paid	Firmware and hardware integrity, the T1200 corner directly
Interos	Paid	Supply-chain exposure mapping
Fortress Information Security	Paid	Supply-chain exposure mapping

Now ask yourself where is the middle dataset. A hybrid operation is distinct in how it works both ends of the attribution threshold, begging a path between them.

You can run it like this: pick a hull that implicates a third country, a flag that hands jurisdiction to an uncooperative state, damage that reads as plausible accident, a crew that can be abandoned. Each variable of the triad gets degraded on purpose. Presence is arranged to point sideways, attribution is split across jurisdictions that struggle to share a case file, and tasking stays offshore behind a broker and a payment. The operation succeeds when the incident, inverse to any good history book, leaves the reader confused about “both sides”.

That inverts the usual data problem. An incident we label cleanly, with an actor confirmed and tasking established, failed as an operation, means our more sparse database is the one to measure adversary success. The empty cells become the evidence, our findings. A record that says presence high, attribution open, tasking unknown documents the adversary’s investment in staying unresolved, and a column counting years-unresolved per incident would measure the campaign better than any actor label.

Waiting for resolution before recording anything means waiting for the adversary to justify being recorded, which becomes ennoblement of those “unseen”. The middle path records the incident at the confidence the evidence supports and lets the confidence describe what’s outside the middle.

Classification does the same work domestically in Germany, for example, let alone Italy. It drops politically accelerant violence into a bucket of simple crime to look away from when the victims are migrants. German state interior ministries registered 2,558 politically motivated attacks on asylum shelters between 2015 and 2018, producing 206 convictions. In other words, the German infrastructure treats a burning federal housing center that displaces people as a routine police crime report. Burning critical infrastructure that displaces people, however, gets a false-flag report of domestic terror, bemoaning another year of dead-ends.

The cables are exposed, easily damaged, and the ambiguity haunts investigators: a disposable hull switching flags, a disputed captain, and a Swedish prosecutor refused permission to board the Yi Peng 3. The Chinese team ran the inspection instead with Europeans only as observers. Meanwhile the evidence has changed character.

Cyber threat intelligence is coders scripting quantitative telemetry, machine-generated and repeatable with integrity checks. Physical and hybrid evidence instead is qualitative testimony from interested sources, with forgery assumed on every record. The discipline required to handle the latter is called a historical method. The security field is simply, predictably lacking in that database because it is short of trained historians.