Category Archives: History

Admitting the Elephantine Void Between Kinetic and Cyber Threats

Dr. Stuxlove, my presentation at BSidesSF on February 15, 2011, placed Stuxnet within a documented lineage of control-system compromises. Was Stuxnet the “First”? followed in 2015 with an incident list back to 1992 and a study of how the press likes to manufacture firsts and seconds.

Today I was asked about a threat-intelligence vision for physical and hybrid attacks together. Good question! While we record anecdotes and press coverage easily as qualitative points, the structured qualitative incident data still remains scarce. MITRE ATT&CK offers us only the high level T1200, Hardware Additions for physical entry, with T1195, Supply Chain Compromise next door and a separate ATT&CK for ICS matrix covering cyber operations that produce physical effect, while kinetic acts stay outside every matrix. That reveals an old structure we need to update.

How many sides to an elephant?

The phrase “physical and hybrid” is like answering trunk and tail when asked what’s filling up the room we are in.

One end is all about what’s getting inside hardware: implants, additions, supply-chain access. ATT&CK treats these as an entry vector because ATT&CK models adversary behavior inside networks that ride on, but especially terminate somewhere in, the physical. Kinetic acts thus get framed outside its scope, which explains the single technique for entry by hardware. The ICS matrix is on the extreme end, as it only records what a compromise does to a physical process and kinetic tools aren’t mentioned.

The other end is the kinetic field: severed cables, damaged pipelines, attacked substations, drone incursions, arson. Conflict-event and hybrid-threat researchers talk about this as its own discipline. Remember the pipeline blast threads? I once met with a White House official who brushed me aside when I suggested the PG&E San Bruno deadly blast is a natsec concern that cyber crosses with. Shortest meeting ever.

Each field sits at the end of a much more interesting whole picture that we should be putting back together. A cross-domain incident falls naturally between them.

Provenance isn’t always in Provence

Honestly, we benefit most by fleshing out the middle so that we have one to talk about comfortably. Reporting on verified infrastructure attacks carries the kind of accuracy that helps deflate political fear mongering thriving in a middle void.

Vulkangruppe attacks showing Russian indicators across fifteen years without a single conviction? Who does that void serve? Kommando Angry Birds fitting the Russian paid-recruitment template the BKA, BND, BfV, and BAMAD jointly warned about? The evidence helps a lot, but apparently the void helps someone even more.

The Tehama-Colusa canal case ended in dismissal. The 2008 BTC Turkey pipeline explosion rests on single sourcing. The 1982 Trans-Siberian pipeline story rests on one memoir. Maroochy Shire in 2000 predates Stuxnet by a decade and was prosecuted. The verified record is smaller and older than the vastly increasing reported one. But the hard facts live in blog posts like this one and engineering reports rather than proper threat research tables. Vendors and the press prefer the loose record because they hunt firsts and seconds as “news”.

Today a thing happened again, which we have seen before and could have prevented, doesn’t get the attention it deserves.

Ingredients

Existing databases each hold a piece of the whole picture. Assembling them is the practical path to a working dataset.

EuRepoC is a free European academic database of cyber incidents. It starts at 2000, codes each incident across roughly sixty fields, and runs separate trackers for critical infrastructure and for attribution. Use it for the cyber side and for the overlap where cyber operations touch physical infrastructure.

The Soufan Center report on Russian hybrid tactics carries an incident list covering 2022 through 2025. Each entry names the incident, the country, the target type, and a confidence level for the attribution. Use it for the recent kinetic and hybrid record in Europe.

OE-417 is the disturbance report US utilities must file with the Department of Energy. The filings go back to 2000 and include a category for physical attack. Use it for structured data on attacks against the US grid, the one infrastructure sector with mandatory public reporting.

That leaves the giant void.

Triad of Encoding

Incident analysis should record three separate facts: who was there, who did the damage, and who gave the order. Call them presence, attribution, and tasking. Each rests on different evidence, and each deserves its own confidence rating.

Presence is who was at the scene. The Baltic record shows us Chinese-flagged or Chinese-owned vessels over repeated cable breaks: Newnew Polar Bear crossed the Balticconnector and two cables in 2023, Yi Peng 3 dragged across C-Lion1 and the Sweden-Lithuania link in 2024, and comparable incidents followed off Taiwan in early 2025. Ship tracks prove the presence. They prove only presence, but that’s the point.

Attribution is who caused the damage. Western investigators treat the hulls as flags of convenience and pursue Russian indicators, while Beijing declined to cooperate with the Balticconnector inquiry and every Baltic case remains open, leaving the void.

Tasking is who ordered the operation. No Baltic case seems to be getting close. I’ve argued a few times we have some clear Chinese indicators yet seen almost zero interest in public pursuit. Talk about void.

Merging the three into a single actor field turns a database into a story lacking the support it deserves. A ship at the scene becomes “China cut the cable” begging what evidence lands. The merged field also overstates the cases where only presence exists, and it understates the cases where tasking evidence exists but the execution was outsourced, a leased hull, a paid recruit, a contractor. Downstream this gets worse when a policy maker cites the weak field as a finding, a vendor report cites the policy maker, and the original evidence base, one AIS track, goes unverified. The Soufan and EuRepoC designs avoid the triad risk because they record confidence per variable, a leg of a table instead of the whole thing. Keeping them separate while connected means something like high confidence on presence, moderate on attribution, and none on tasking.

The physical table needs the same separation. Bloomberg’s 2018 Supermicro report is still unverified, denied by everyone involved, and instructive for exactly this reason: it merged a hardware claim, an actor claim, and a tasking claim into one. Then the hardware claim was weak and it made a decade of serious supply-chain concern look unsteady. The documented Chinese activity is different in kind: supply-chain access and pre-positioning inside operational technology. My old friends over at Dragos tracked it as VOLTZITE, overlapping the group others call Volt Typhoon, living inside critical-infrastructure OT. Planning and execution get their own columns. A group pre sabotage is NOT post sabotage, and the database has to know what time it is.

I’m old enough to remember hacking critical infrastructure in the 1990s by compromising Cisco routers at mass scale. The pre-2000 layer of ICS and infrastructure incidents, across sectors and across borders, still remains old timer lore instead of a proper ledger. Meanwhile, we have these resources:

Resource Access Coverage
Hybrid CoE Open Research publications and the Hybrid CoE and EU-JRC conceptual model, the closest existing document to a shared hybrid-threat vocabulary
The Soufan Center, Russian Hybrid Tactics in Europe 2022-2025 Open Incident-level dataset, 2022-2025, attribution-confidence coded
EuRepoC Open Cyber incidents from 2000, roughly sixty variables, critical-infrastructure and attribution trackers
DOE OE-417 annual summaries Open US grid disturbances including physical attacks, archived to 2000
PNNL event-correlated outage dataset Open OE-417 joined to EAGLE-I county-level outage data on OEDI
Michael Mabee’s OE-417 consolidation Open The DOE summaries cleaned into a single CSV
ACLED Open Political-violence and sabotage event data, codeable for kinetic incidents
GDELT Open Global event database, broad and noisy, minable for physical incidents
Global Terrorism Database (START) Open Over 200,000 terrorist attacks worldwide from 1970, more than 100 coded variables including infrastructure target types, coverage through 2020, access by request
ICPC Open Submarine cable protection, infrastructure and international-law reference
TeleGeography Submarine Cable Map Open The geography under the cable-cut attribution work
NATO StratCom COE Open The influence and information side of the hybrid picture
NERC E-ISAC Member Grid physical-security reporting
Janes Paid The strongest structured coverage of the kinetic and military-hybrid side
Recorded Future, Geopolitical Intelligence Paid Facility and physical-threat monitoring in real time
Dragos (Accenture majority stake, June 2026) Paid OT and ICS, where cyber produces physical effect
Nozomi Networks Paid OT and ICS, where cyber produces physical effect
Claroty Paid OT and ICS, where cyber produces physical effect
Control Risks Paid Geopolitical and physical risk with incident feeds
Crisis24 Paid Geopolitical and physical risk with incident feeds
S-RM Paid Geopolitical and physical risk with incident feeds
Sibylline Paid Geopolitical and physical risk with incident feeds
Eclypsium Paid Firmware and hardware integrity, the T1200 corner directly
Interos Paid Supply-chain exposure mapping
Fortress Information Security Paid Supply-chain exposure mapping

Now ask yourself where is the middle dataset. A hybrid operation is distinct in how it works both ends of the attribution threshold, begging a path between them.

You can run it like this: pick a hull that implicates a third country, a flag that hands jurisdiction to an uncooperative state, damage that reads as plausible accident, a crew that can be abandoned. Each variable of the triad gets degraded on purpose. Presence is arranged to point sideways, attribution is split across jurisdictions that struggle to share a case file, and tasking stays offshore behind a broker and a payment. The operation succeeds when the incident, inverse to any good history book, leaves the reader confused about “both sides”.

That inverts the usual data problem. An incident we label cleanly, with an actor confirmed and tasking established, failed as an operation, means our more sparse database is the one to measure adversary success. The empty cells become the evidence, our findings. A record that says presence high, attribution open, tasking unknown documents the adversary’s investment in staying unresolved, and a column counting years-unresolved per incident would measure the campaign better than any actor label.

Waiting for resolution before recording anything means waiting for the adversary to justify being recorded, which becomes ennoblement of those “unseen”. The middle path records the incident at the confidence the evidence supports and lets the confidence describe what’s outside the middle.

Classification does the same work domestically in Germany, for example, let alone Italy. It drops politically accelerant violence into a bucket of simple crime to look away from when the victims are migrants. German state interior ministries registered 2,558 politically motivated attacks on asylum shelters between 2015 and 2018, producing 206 convictions. In other words, the German infrastructure treats a burning federal housing center that displaces people as a routine police crime report. Burning critical infrastructure that displaces people, however, gets a false-flag report of domestic terror, bemoaning another year of dead-ends.

The cables are exposed, easily damaged, and the ambiguity haunts investigators: a disposable hull switching flags, a disputed captain, and a Swedish prosecutor refused permission to board the Yi Peng 3. The Chinese team ran the inspection instead with Europeans only as observers. Meanwhile the evidence has changed character.

Cyber threat intelligence is coders scripting quantitative telemetry, machine-generated and repeatable with integrity checks. Physical and hybrid evidence instead is qualitative testimony from interested sources, with forgery assumed on every record. The discipline required to handle the latter is called a historical method. The security field is simply, predictably lacking in that database because it is short of trained historians.

Stephen Miller Just Passed Germany’s NS Test

The US State Department just convened delegations from more than sixty governments in its Loy Henderson Conference Room on July 16th for a Ministerial on the Resurgence of Political Terrorism. Secretary of State Marco Rubio hosted. The fourth opening address came from Stephen Miller, White House Deputy Chief of Staff and Homeland Security Advisor.

Since the State Department published his remarks as an official release, they deserve a LOT of scrutiny for what this man is saying out loud. A senior German official sat in the room, which is perhaps the strangest twist of all because they carry a duty to protect against threats to the German democracy. Andreas Kemper already called this out and supplied the analytical apparatus in German (Faschistoide Rede im Beisein des Bundesinnenministeriums, 20 July 2026).

I will extend from his analysis, because the historical weight of Stephen Miller promoting Nazism to Germans, should be called what it actually is. Here’s why:

Miller opened with a legal framework for politics being framed as domestic threat: NSPM-7, the September 2025 presidential memorandum directing every US law enforcement and intelligence agency to “disrupt, identify, defund, debank, arrest, and prosecute” left-wing political terrorists. He then told the assembled governments that in his non-expert, inexperienced, perspective he predicts left-wing terrorism “always becomes a gulag,” defined as “the mass imprisonment of political enemies.” That, of course, is what the Trump administration has been doing, so Miller just classified his boss as a left-wing terrorist. Next he said Antifa “operates in dozens of countries” through shared funding and organization, which is like saying England and France still exist today as countries instead of being under the Third Reich. From there he said intelligence and police agencies worldwide must cooperate “to root out these organizations”, meaning the ones that won WWII. Civil liberties claims, according to Miller’s world view, are “completely pretextual and disingenuous,” a tactic “the left always uses,” and he instructed his audience that appeals to civil liberties “must fall on deaf ears.” His reasoning is that because the domestic terrorist doesn’t abide by “ordered notion of justice” and “is lying” whenever he invokes his rights, then justice against these “enemies of civilization” must be “completely unflinching.” That’s what Hitler said too. But I’m getting ahead of myself.

He makes use of medical imagery in three doses. First, he warns unchecked left-wing violence “can fester as a cancer and ultimately destroy a society” rather than prevent a right-wing capture and destruction of democracy. Second, he says American jurors who acquit defendants in political cases demonstrate “how deeply the cancer has begun to infest your society.” If you’re not thinking this guy is parroting Hitler, you haven’t read Hitler. Third, assassination attempts are called “a fatal cancer to civilization.” After the third dose Miller declared US immigration enforcement attacks on communities are running into “repeat, systemic, organized, funded insurrection, an armed resistance against the federal government.” He slathered this claim with a bizarre and unattributed statistic of an 8,000 percent increase.

Then his speech leaves policy behind altogether and goes into Mein Kampf mode:

The leftist looks at a perfect family with a perfect life and a perfect job and perfect kids that goes to church every Sunday and is filled with a feeling of inadequacy and jealousy, and they covet. And they turn those emotions ultimately into a desire to subjugate, to oppress, and to inflict pain and suffering.

The enemy, as Hitler used to say, is marked on the body.

Not one of the people that is demonstrating looks like a normal person. Not one looks normal. They’re all deformed in some way, in their appearance, in their dress, in their mannerism. […] Every one of them, through the course of their life and their decisions, has scarred their body and their appearance in many different ways, to the point in which their outer appearance becomes a manifestation of their inner hatred.

The remedy Miller tells us to use is instinctual, improvised. “Trust your instincts,” he told assembled government ministers, presumably not realizing their instinct may have been to jump up and slap him in the face. He stated they should know what normal is (not Miller), what beautiful is (not Miller), what good is (not Miller). Seriously, why didn’t anyone at that point say “let me stop you right there, your speech just killed itself”. Instead he droned on about the Bible coveting the “morally superior,” and that ember, he warned, ends where “good families are dragged out into the street and executed.”

And, as anyone familiar with the urgency clause will surely recognize, Miller said those who wait until the threat is undeniable “already lost the battle.”

Kemper breaks this speech down in German using categories German scholarship built for exactly this material, and each sorting operation runs nice and neat.

The cancer metaphor of Miller is the most exhaustively documented figure in National Socialist propaganda language, the subject of a German doctoral dissertation and a centerpiece of Susan Sontag’s Illness as Metaphor, which traced the tumor image through Hitler’s rhetoric. It biologizes society and divides the healthy from the sick. It then licenses excision as therapy. You know, genocide. Miller is promoting that.

The deformity passage of Miller reproduces the degeneration aesthetics George L. Mosse dissected in The Image of Man: the enemy legible on the body, ugliness as the outward sign of inner corruption, a physiognomic doctrine Alfred Rosenberg codified for the NSDAP. Miller at this point may as well have put on his Nazi moustache, hat, throw a salute and snap his heels.

The Miller plea that rights claims “must fall on deaf ears” removes the political opponent from the protection of law by declaring his relationship to law fraudulent in advance. The jury passage extends Miller’s assertion of a disease into the courtroom, a kangaroo court with a guillotine waiting, if you’re familiar with the Volksgerichtshof and Plötzensee, let alone the Nazi rush to behead anti-fascist Sophie Scholl in 1943.

The instinct rhetoric of Miller then replaces the logic of a dialogue with a secretive intuition that usurps what’s normal and healthy. That’s anti-science for a reason. But I’ll say it again, someone should have jumped up and said his speech was abnormal and unhealthy. Intuition. Right?

The targeting he uses is messy, from left-wing terrorism to Antifa to “the left” to “the leftist”. Kemper notes that a responsibility toward the survivors of fascism demands we should care before applying the label, and so he stops at watered-down, overly-passive, fascist-adjacent (faschistoid). The transcript is undeniably fascist, anti-democracy, and full of hate.

As a historian, I argue this is a disgrace to the dead, those who fought against Nazism. As someone who lost so much to those who refused to call Hitler out for what he was, I believe we have a responsibility to take care that we DO NOT fail to stick the label where it fits exactly. It is the lack of labeling, often by the weak center determined to avoid crying wolf, which grants the wolf the power to destroy that herd.

Let me lay it out here, as every journalist should. This table is literally a test against NS primary sources, seven criteria that Miller passes with flying swastikas.

Miller, 16 July 2026 Nazism Mechanism Primary source
“can fester as a cancer and ultimately destroy a society”; “a fatal cancer to civilization” (the figure appears three times) Hitler to Adolf Gemlich, 16 September 1919: the Jew as “racial tuberculosis of the nations,” the remedy a systematic “elimination” leading to “removal” Disease metaphor converts a political opponent into pathology. Treatment of a pathogen requires excision rather than debate. Susan Sontag traced the figure through Hitler’s rhetoric in Illness as Metaphor (1978); Robert Proctor documented the tumor image in NS medical language in The Nazi War on Cancer (1999). German History in Documents and Images, archival text BayHStA Munich
“repeat, systemic, organized, funded insurrection, an armed resistance against the federal government”; rights appeals “must fall on deaf ears” Verordnung des Reichspraesidenten zum Schutz von Volk und Staat, 28 February 1933: issued “zur Abwehr kommunistischer staatsgefaehrdender Gewaltakte,” suspending seven basic-rights articles of the Weimar constitution the day after the Reichstag fire A claimed communist terror emergency becomes the legal instrument that strips civil liberties from everyone the state accuses. Mass arrests of the left followed within days, then extended across the opposition. Full decree text, Reichsgesetzblatt 1933 I S. 83
“Trust your instincts… You know what normal is. You know what beautiful is. You know what good is.” Gesetz zur Aenderung des Strafgesetzbuchs, 28 June 1935: the new paragraph 2 punished any act deserving punishment “nach gesundem Volksempfinden,” healthy folk feeling Intuition of the normal and the healthy replaces the statute as the standard of judgment. The Allied Control Council found the clause so central to NS justice that Proclamation No. 3 of 1945 banned it by name. Legal Tribune Online, quoting RGBl 1935 I S. 839
“They’re all deformed in some way, in their appearance, in their dress, in their mannerism… their outer appearance becomes a manifestation of their inner hatred” “Entartete Kunst,” Munich, opened 19 July 1937: confiscated modern art exhibited as sick, degenerate, and alien to the healthy nation The enemy is marked on the body and in aesthetic form. Ugliness certifies inner corruption. George L. Mosse documented the doctrine in The Image of Man; Rosenberg codified it for the party in the Mythus. United States Holocaust Memorial Museum, Holocaust Encyclopedia
“Antifa… operates in dozens of countries all throughout the world. They share common networks of funding and organization”; the leftist “fundamentally motivated by envy, by hatred, by jealousy” Goebbels, Nuremberg party congress, September 1935: Bolshevism as “the declaration of war by Jewish-led international subhumans against culture itself” A world conspiracy of the civilizationally alien, driven by hatred of culture rather than by political conviction, justifies transnational persecution and dissolves the distinction between opponent and enemy. United States Holocaust Memorial Museum, film record of the speech
“If you wait until the point where the worst outcome is so obvious that no one can deny it, you’ve already lost the battle… it’s already too late”; “good families are dragged out into the street and executed” Goebbels, Sportpalast, 18 February 1943: Bolshevism plotting to plunge Europe into chaos; Germans refuse to “wait like the hypnotized rabbit until the serpent devours them” and instead “recognize the danger in good time and take effective action” Atrocity prophecy plus preemption logic. The imagined future massacre licenses total measures in the present, and raising the alarm too loudly becomes a virtue by definition. German Propaganda Archive, Calvin University, full translation
“the jury has refused to convict for purely political reasons… it demonstrates how deeply the cancer has begun to infest your society” Hitler, Reichstag address, 26 April 1942: as “supreme Law Lord” he claims the power to remove judges and override “so-called acquired rights” whenever verdicts displease the leadership Courts that acquit are declared diseased organs of the nation. Judicial independence dissolves into a loyalty test, and the acquittal itself becomes evidence of infestation. The passage was entered at Nuremberg as prosecution exhibit NG-752. Harvard Law School Nuremberg Trials Project, document NG-752

Now the facts, because you should care about them even though Miller doesn’t.

Conclusion slide to my award-winning presentation on Big Data Integrity Breaches, KiwiCon 2016

Europol’s EU Terrorism Situation and Trend Report 2026, published weeks before the ministerial and built from member state submissions, records twelve left-wing and anarchist attacks across the entire European Union in 2025: ten completed in Italy, one in Greece, one failed, every target a building or a vehicle. Casualty count zero. Arrests in the category across all member states came to thirteen, and Germany contributed zero of them. The category has fallen by more than half in two years, from 32 attacks in 2023 to 12 in 2025, while the youngest formal terrorism arrestee in the Union, twelve years old, was linked to the right-wing category.

The German government’s own record doubles-down on this. Germany’s actual 2025 record, presented by Dobrindt and Münch on June 9, is that there were 42,544 right-wing offences and 1,598 right-wing violent crimes, rising over seven percent. All of it enters the Europol terrorism table as a big fat zero because German prosecutors charge right-wing terror tactics such as shelter arson and street violence under ordinary criminal law, almost never under §129a where it belongs. Compare this to Italy where terrorism is applied to property destruction to create the appearance of a “left wing terror wave”. In other words, on an equal definition the Europol terrorism table would show right-wing terrorism miles above left-wing. The statistics lie, always, but it’s not like we can’t see the direction here.

The Bundesinnenministerium itself maintains that the greatest extremist threat to German security comes from the right. In April it answered a parliamentary question by describing an “Antifa Ost,” the network Washington designated a Foreign Terrorist Organization in November 2025, as largely dismantled. A non entity that the Americans are trying to spin up with nothing behind it. Total membership was estimated by the Bundesamt für Verfassungsschutz in the low double digits. Miller’s empty-hat argument about the jury threat also doesn’t have legs. The 41 percent conviction rate in EU left-wing proceedings comes from Eurojust data covering jurisdictions that put terrorism cases before professional judges instead of juries, so the ideologically captured juror of Miller’s story doesn’t exist in any of these courtrooms: courts convict when evidence exists.

I also should mention that Miller’s actual experience and expertise is lacking. All he brings to the table is a lot of anger and a bachelor’s degree in political science from Duke, class of 2007. His formal record ends there, which perhaps explains why his presentations are so propagandist and devoid of facts like these.

Miller’s career speaks for itself: communications aide on Capitol Hill, press secretary to Senator Jefferson Beauregard Sessions III (third generation Civil War lost cause), campaign speechwriter, then White House advisor with an immigration portfolio and, between administrations, a litigation advocacy group. That’s a specific type of loyalty to a losing side in history, which exposes him against the prior staff of the office he now occupies.

Frances Townsend was a career federal prosecutor; John Brennan spent 25 years in the CIA; Lisa Monaco led the Justice Department’s National Security Division; and Tom Bossert was a homeland security and cyber specialist. Miller is the first Homeland Security Advisor whose qualification consists entirely of gobbling like a Goebbels. The strangest part, perhaps, is that he is running the playbook of the side that lost WWII as if it will turn out different this time.

Miller isn’t actually coming at this unprepared, as much as he doesn’t seem to have the background for it. Across two decades he has carried a particular form of purity slogan. Miller’s senior yearbook page at Santa Monica High School, class of 2003, carries a single quotation, from Theodore Roosevelt:

There can be no fifty-fifty Americanism in this country. There is room here for only 100 percent Americanism, only for those who are Americans and nothing else.

Univision published the page in 2017, which showed Miller in cosplay with a cowboy hat.

Stephen Miller, in his 2003 yearbook photo to display Santa Monica wealth, appeared as a cowboy and chose a quote that was written specifically to challenge the belonging of his own family. The costume is the point. He’s desperate to seize the role that his own ancestry supposedly disqualifies him from.

Roosevelt coined the formulation within a wartime loyalty test of 1918, yet the phrase is rooted in white supremacist campaigns known as “America First”. The American Legion wrote “one hundred percent Americanism” into its founding preamble in 1919. The second Ku Klux Klan made it a creed: the four-to-six-million-member Klan of the 1920s recruited nationwide under the banner of “100 percent Americanism”, the phrase titles Thomas Pegram’s standard history of the movement, and Linda Gordon opens The Second Coming of the KKK with an introduction titled “100% Americanism”. Imperial Wizard Hiram Wesley Evans supplied the theory in the North American Review in 1926: Americanism as a thing of the spirit available “only through instinctive racial understanding,” grounded in “racial instincts” that tell the true American who belongs.

Miller was overtly spreading a known white nationalist slogan as his ticket into American politics, focusing on communications.

Set the KKK wizard beside Miller’s instruction that nations must trust instincts because normal is known, and the purity test is clearly the same, just swapping out a word. Roosevelt’s line was already the loyalty-purity doctrine of the wartime crusade, and John Higham’s standard history of American nativism, Strangers in the Land, traced “one hundred per cent Americanism” from that crusade directly into the tribalism of the Klan decade. This is settled history, into which Miller saddled up and grabbed a robe.

By 2003 the phrase carried the Klan’s brand in historical memory, which is why historians reach for it as a title when they mean the hooded movement. While the naive reader sees patriotism with Teddy’s name attached to a sentence, it is the readers who know the KKK who hear the loud whistle. Miller’s record further documents this habit, because it was no accident. The leaked Breitbart correspondence shows him invoking Calvin Coolidge, whom Hatewatch notes is lionized by white nationalists for his remarks condemning race mixing, alongside the immigration regime of 1924, the restriction law the Klan pressured Congress to pass. His method is to paper presidential names on the white supremacist creed so that it still gets through.

In November 2019 the Southern Poverty Law Center published its analysis of more than 900 emails Miller sent to Breitbart editors in 2015 and 2016, while he served as an aide to Senator Sessions and then as a Trump campaign advisor. The correspondence shows him recommending Jean Raspail’s The Camp of the Saints, the replacement-fantasy novel of the white nationalist canon, and circulating material from VDARE and American Renaissance; more than 80 percent of the reviewed emails related to race or immigration. The SPLC maintains an extremist-file entry as a result.

Miller was known in high school for his extremist views, as evidenced in his purity slogan in a 2003 yearbook. He then was known for his white nationalist reading list of a Senate aide in 2015, which brings us back to the recognition doctrine delivered as counterterrorism policy in 2026. The Washington speech this week is the same Miller he has always been.

Germany received an invitation at ministerial level to listen to a Nazi. They accepted, willingly. Alexander Dobrindt sent a department head, the Abteilungsleiter für Öffentliche Sicherheit of the Bundesinnenministerium, a role whose professional formation includes the recognition of extremist rhetoric. Berlin featured in the sales pitch from “man of many hats all saying loyalty” Rubio, who told the delegates they were in the room “because the lights went out in Berlin for five days this winter,” a reference to the January blackout claimed in a letter attributed to a Vulkangruppe.

It’s weird as a reference because, as an exhibit, it comes long after the data on the table that ends in December 2025. And let me be clear about that group. It’s a Russian sabotage operation wearing a false-flag costume, run on the disposable-agent template that Germany’s own four federal security agencies published in September 2025, as I documented when the claim letter failed every left-wing naming test.

I’ll say it again, the joint BfV, BND, BKA, und BAMAD campaign in late 2025 described Russian services commissioning Wegwerf-Agenten through social media for arson against energy, transport, and rail, which are the exact target class, recruitment channel, and conviction-free outcomes that the Vulkangruppe record shows across fifteen years.

Anyone calling Vulkangruppe left-wing is selling you a fat lie.

During the meeting the German delegation agreed that the follow-up event, a workshop of experts, will take place in Germany. A ministry spokesman confirmed the agreement to Der Spiegel and explained the choice of venue with logistics.

In a proper functioning Germany, when Stephen Miller steps into Germany he will be arrested on charges of being a present threat to democracy.

The Federal Republic spent eight decades building the professional capacity to recognize the vocabulary he uses, and its interior ministry trains senior officials in it. One of them sat through the claims about a gulag, the claims about a cancer, the claims about deformed bodies, the claims about an instinct of the healthy, and the claims about executed families, all delivered from a government podium as counterterrorism doctrine. Germany assesses the threat Miller claims as few to low double digits. Whereas Miller himself exhibits all the flags of a right-wing extremist. Everything required for recognition was present in the room. The ministry booked the venue and enabled him.

This Day in History: 1921 Arditi del Popolo

The anti-fascist militia Arditi del Popolo (AdP), was founded in Rome in late June 1921. Faced with a growing threat of armed fascist gangs, regular people gathered around the AdP defense organization and managed to keep streets of cities and neighborhoods safe from the domestic terror squads known as “blackshirts”. Its first action was July 19 in the port city of Piombino, in Tuscany, Italy.

Sung to the tune of Giovinezza (fascist party hymn):

We beat back the violence
of mercenary fascism
all to arms, on the calvary
of human redemption.

This eternal youth
renews itself in faith
for a people who demand
equality and liberty.

Two days after Piombino, at Sarzana, a column of five hundred fascists marched to free their captured leader Renato Ricci. A dozen Carabinieri fired on the right wing extremists approaching the railway station, and AdP fighters joined by local workers and citizens hunted the survivors on the run through the countryside. The chief of staff of the defeated right-wing terror squad reflected:

The squad, so long accustomed to meeting an enemy who nearly always ran away, or offered feeble resistance, could not, and did not know how to defend themselves.

Food for thought.