German occupation authorities sealed Warsaw’s Jews behind walls citing epidemic risk. The confinement cynically manufactured the actual epidemic, and outside physicians were excluded so the only epidemiological authority sat with the Nazis causing a deadly crisis.
The disease was both product of the system and its justification, and verification was structurally impossible because Nazi logic was to monopolize authority over the patients and the records.
Aurora, Colorado now runs the same Nazi model under the ICE doctrine. Media were told there were no confirmed active cases while county investigators remain denied access to the infected patient, medical records, and detainee movement data.
ICE denial means investigations are being obstructed to prevent falsification of the denial. The claim is a closed verdict, like a Nazi ghetto. A public health order was issued June 25 requiring compliance, and the county says access is still being denied despite it. Weidenbach’s affidavit attributes the roadblocks to GEO or ICE or both. A new state law strengthening local inspection authority is the one GEO sued in federal court to block.
The county has confirmed one case. A detainee account published by The Guardian alleges twelve positives held together with 76 others in collective quarantine, air conditioning dead at the start of a heat wave, and one doctor on staff for a facility built for 1,532 with roughly 1,249 detained per Crow’s oversight report.
If you ever wondered how the massive “data centers” being rapidly permitted across the country will ever achieve their energy and water needs, consider that they may be repurposed into human detention centers where energy and water are completely denied by design.
The names to jot down in the rising crisis are Weidenbach, GEO Group, ICE, and Adams County. The county’s own attorneys already stated that a private operator exempting itself from health law endangers detainees, its own employees, and the surrounding public.
They didn’t mention, however, it mirrors an old doctrine of militant adherents aiming to use huge spaces to mass-exterminate detainees.
It seems like forever ago, in October 2012, that I wrote about a single bullet that separated defense from murder. It was in context of the “hack back” or “active defense” work I was doing at the time. The case of Private Lee Clegg, a British soldier at a Belfast checkpoint in 1990, is foundational to the study of defense ethics. He had fired four shots at a car that refused to stop. The court accepted the first three shots as self-defense, because the evidence showed they were fired while the vehicle approached. That was his plausible defense against danger. The fourth bullet, however, entered the car from behind, after it had passed, hitting someone fleeing and more than fifty feet away from him.
Forensic trajectory reconstruction contradicted Clegg’s testimony that he fired through the side door as the car went by, which still wouldn’t have been in defense. The judge ruled the fourth bullet was fired “with the intention of causing death or serious bodily harm” and convicted a serving soldier of murder. The state that armed him prosecuted him.
The fourth bullet doctrine was about the moment a threat passes, because any shots that follow are a killing. A laboratory proved that moment in 1990. In 2026 we repeatedly have to watch the moment as it streams in high definition, where it is plainly visible how the fourth shot now comes first.
ICE Murder Doctrine
I’ve written here about January 7, 2026, when an ICE agent in Minneapolis executed Renee Good, a 37-year-old mother, in her car. Frame-by-frame review of the video shows the sequence. The agent stood at the front left of her vehicle. She turned hard right, away from every agent on the scene. He pivoted to his left, out of any possible path of travel, took a two-handed stance from the position of safety he had just created, and fired into the side of a departing car. The clearance he manufactured for himself was used as a firing angle.
Every element the Clegg court needed a ballistics laboratory to establish is visible in real time, and the geometry is unmistakable. The killing shot was aggression, without threat and therefore not in defense.
Secretary Noem then supplied the doctrinal statement. The officer, she said, “followed his training, did exactly what he’s been taught to do”. Take her at her word. In 1995 the fourth bullet convicted a soldier. In 2026 the training is execution through offensive shooting, not defense or safety related at all.
The tally confirms this is doctrinal, rather than accidental. At least 22 people have been fired on by agents in the violence-led deportation campaign since January 2025. Six are dead, three of them US citizens, and nearly every incident involved firing at people in vehicles. In every case where video has surfaced, the person was fleeing, disarmed, or posed no threat at the moment of fire.
Seventeen days after Renee Good, agents in Minneapolis publicly executed Alex Pretti; DHS falsely claimed he approached with a pistol, while video showed the weapon stayed holstered and an agent had already disarmed him when another fired offensively. The Deputy Attorney General later conceded on the record that the conduct was a far cry from any legal definition of domestic terrorism. Then U.S. citizen Ruben Ray Martinez was executed by ICE in South Padre Island on March 15, 2025.
The case in Houston on July 7, shows agents executed Lorenzo Salgado Araujo, a man who was never their target, wore no cameras, and held to a vehicular assault story for 48 hours before DHS admitted the error.
Read this latest account against ICE’s own written policy barring deadly force to stop a fleeing suspect. The agency’s defense of the shooting is a clear confession to violating it. Notably, Minnesota and Hennepin County had to sue the federal government to obtain evidence in their own homicide investigations.
Fifty Years Aren’t Forgotten
The rule all these shootings violate is older than most of the agents pulling the trigger.
The NYPD drafted Temporary Operating Procedure 237 in 1971 and formalized it in August 1972, after police killed a child fleeing in a stolen car on Staten Island: officers may fire neither at nor from a moving vehicle unless its occupants present deadly force by means other than the vehicle itself.
ICE knows the rule, and now avoids the rule, to intentionally deploy an execution doctrine.
Its own written policy prohibits discharging firearms at the operator of a moving vehicle absent a grave threat, and bars deadly force used solely to stop a fleeing suspect. A 2022 executive order required every federal law enforcement agency to adopt policies matching or exceeding the DOJ standard. ICE’s 2023 rewrite omitted exactly one thing: the instruction to move out of the vehicle’s path. The primary documents are compiled at Just Security for anyone who wants provenance. The ICE record shows agents are violating their own agency’s written policy, on camera, while the Secretary certifies that they are being trained to offensively attack instead of defend. That combination has a name. Impunity.
Provenance of ICE Execution Doctrine
A counter-doctrine that is so consistently being applied has a very particular lineage, which has been documented by those studying white nationalism. Sharpeville, March 1960: South African police fired into a fleeing crowd, killed 69 people. Most were shot in the back. Parliament answered with the 1961 Indemnity Act, retroactively immunizing the shooters. The doctrine of apartheid argues the target category licenses the fire, and then the law pre-forgives executions.
In the final years of apartheid and through its 1994 collapse, the doctrine was privatized. Executive Outcomes (EO), the firm credited with promoting the modern mercenary corporation, drew its ranks from 32 Battalion and the Civil Cooperation Bureau, apartheid’s counterinsurgency and assassination organs.
EO became Sandline, which re-emerged as Aegis Defense Systems, which won a $300 million American contract to run the Green Zone and coordinate every private security company in Iraq. Erinys International, founded by an apartheid-era military intelligence officer, employed veterans of Koevoet, the bounty-per-body unit, and Vlakplaas, the death squad farm; two of them were named in the press only because a Baghdad bomb ended their rein of terror. A UN report placed South Africa among the top three personnel suppliers to the Iraq contractor economy, five to ten thousand strong and funded by American taxpayers.
Inside the white nationalist mercenary doctrine funded by American foreign policy hawks, a convoy escalation-of-force procedure made every approaching vehicle a threat category and the driver was the first target. This is where the history and the present administration converge. Nisour Square, September 2007, opened with contractors firing into a non-threat, a slowly rolling Kia sedan carrying a medical student and his mother; fifteen more innocent people were executed by the mercenaries in the minutes that followed, seventeen dead in all. American courts convicted four of the shooters in 2014. Trump pardoned all four in December 2020, like the 1961 Indemnity Act of apartheid, converting the murder verdict back into standing policy.
The terror pipeline in Iraq then was imported for domestic policy. In February 2025, Erik Prince and Blackwater’s former chief operating officer circulated a 26-page blueprint for a privatized mass deportation force: $25 billion, twelve million removals before the midterms, a hundred private aircraft, processing camps, deputized civilians. By late 2025 ICE procurement documents mirrored the blueprint, with skip-tracing and bounty contracts worth over $40 million authorizing contractors to locate up to one million people from lists of ten thousand names at a time to push into “migration centers” with the rhyme and shape of “data centers”. And the government workforce hired to execute it was built the same way. Congressional oversight records show ICE dropped its minimum agent age from 21 to 18, removed the upper age limit entirely, offered $50,000 signing bonuses, cut five weeks of training to compress the deportation academy to eight weeks against 27 for investigators, and put recruits into training before fingerprints and drug tests, dismissing more than 200 of them mid-course. DHS answers that most surge hires already completed a police academy somewhere else, an answer that concedes the agency itself now trains less than the departments whose fifty-year-old rules its agents break.
The chain I’m presenting preserves doctrine through multiple changes of institutions: apartheid special forces seeded the contractor industry, the contractor industry normalized the vehicle as a fire category, the pardon restored the license, the blueprint and the hiring surge imported it into domestic enforcement. The individuals change, the institutions reshape, while the shoot-to-kill offensive license is identical. Indemnity Act, presidential pardon, federal immunity claim against state prosecutors: the same legal architecture, pre-forgiveness for shooting people who are fleeing, through seventy years.
The directive applies to Enforcement and Removal Operations, carves out an exception for the “most egregious” targets, and is described as temporary until officers receive new vehicle engagement training. Read that memo for exactly what it says. Individual failures will be tracked for individual discipline. Doctrine gets suspended by directive, agency-wide, in a single day. The agency just certified that firing on vehicles has been its operating practice, and the promised remedy, retraining, uses the same word Noem offered as the defense in January.
The alibi for executions and the prevention for it are being deployed officially as the same thing.
Note also the reason to issue the admission of guilt framed as an excuse. Six deaths across eighteen months produced personnel shuffles: Noem out, Border Patrol commander Greg Bovino retired, ICE Director Todd Lyons gone. Prosecution is avoided by disposable staff given a parachute and kick out the door. The stand-down order came hours after Senator Susan Collins, campaigning for reelection in the state where Guerrero died, called the new Secretary and demanded an end to non-urgent stops. The electoral angle apparently accomplished in one phone call what all the innocent people being killed could not. ICE’s public comment on the change:
The 2012 post had argued that defensive acts must be measured, proportionate, documented, and verifiable, and that even trained professionals need formal rules of engagement precisely because they will be held to them.
The Clegg case in the 1990s proved the mechanism exists: a state examined its own soldier’s trajectory and called the fourth bullet murder. Britain then previewed the modern pattern, releasing him after two years under political pressure, returning him to the Army with a promotion, and acquitting him of murder at a 1999 retrial.
The 2026 update records a total inversion of the defense logic, and loss of enforcement professionalism to favor coin-operated mercenary extremists. The trajectory has been repeatedly filmed in real time, where the geometry of offensive fire needs no laboratory, and the employing state responds by corrupting self-defense, withholding evidence from prosecutors, shuffling the leadership, and issuing broad vague indemnity in advance.
Clegg fired a three bullets before he was classified a murderer by his fourth. These agents start with his fourth, murdering from the first trigger pull, because they are being trained on old white South African race-based murder doctrine, a human safari that paid bounties by the body.
I gave a vision-language model a short video and asked if it was recognizable. It answered with a complete miss: a screen recording of a terminal running code.
The video shows a mounted automatic weapon known as a YakB firing. Nothing in the clip is a terminal, a line of code, or a screen. The evidence is easily seen, and even more easily heard, in the video. No mystery here.
And yet the model tried to complain it was having a resolution problem to excuse its confused state. Any person with even the least training (e.g. Hollywood movies) hears and sees the unmistakable BRZZZZT of a four-barrel rotary cluster. The screen frames clearly show an ammo box and feed chute, a large sight, and rapid ejection of very heavy large-caliber casings.
An expert could say even more, like the temporal (rapid) sound was at 82 Hz, with a cyclic rate around 4,500 to 5,000 of large (over 10mm) rounds per minute, followed by Russian voices. Definitely YakB.
The firing rate sound says rotary gun; the firing rate image says rotary gun. The LLM produced an answer uncorrelated with any of it. Note how it leaned on the “automatic-fire” file name, rationalizing it incorrectly as a software feature firing off automated tool calls.
I’m not even saying it weighed the audio against the video and misjudged, as if some integrity breach at the data processing layer. Its analysis was to skip processing, and use an absolute maximum overfit. A generative VLM conditions an autoregressive text decoder on a fixed prefix of visual tokens, and as generation proceeds the visual signal is progressively diluted while the language prior takes over the output distribution, the established mechanism behind object hallucination in these systems.
What it emits is a probable caption given its unknown and opaque training corpus, governed by object frequency and co-occurrence rather than by the input (POPE, Li et al. 2023), with linguistic priors concentrated in the dominant directions of the representation, where they overwrite visual evidence. A terminal with code is one of the highest-frequency objects in that corpus. A Russian helicopter 12.7mm minigun is apparently rare, while being mainstream Cold War lore. The “Old Painless” GE six barrel electric M134, for example, was fired in the 1987 Predator, in the 1988 Rambo III mockup, in the 1991 Terminator 2, in the 2012 The Expendables 2, in the 2014 Captain America: The Winter Soldier, and on and on. Who doesn’t train on those?
Technically Rambo III took an Aérospatiale Puma helicopter already mocked up like a Soviet Hind. It added the M134-style minigun and puffed acetylene flame bursts to look like the Soviet YakB. The whole effect was borrowed from 1984 Red Dawn, which had introduced the same Puma with an Afanasev A-12.7, if you really want to go back to how long ago a low-fi look and sound of the minigun was being popularized.
Red Dawn attack scene. The tail boom, side-mounted tail rotor, and fixed gear fairings are all Puma signs, yet its nose carried a mockup of the single-barrel Afanasev A-12.7 Hind-A armament (prior to YakB). Hollywood has sensationalized the minigun flash and sound since at least the mid 1980s.
The Soviet gunship and minigun was a major fascination, not obscure, such that in 1988 Operation Mount Hope III deployed Chinooks hundreds of miles into Chad at night to recover a crashed Libyan Mi-24, with the blessing of Habre, one of Ronald Reagan’s best friends who was later convicted of war crimes (2016, Extraordinary African Chambers in Dakar, crimes against humanity, torture, sentenced to life).
“Don’t worry about transport my friend Habre, we’re flying Toyotas in tonight for you on a C-130”
But I digress. The output from the model today was a narrow corpus guess, not the actual prompt content being assessed.
The model cannot report what the object is. Ok. Fine, that proves these models are deeply flawed. But note how it has no internal boundary between recognizing something and then generating output for what it believes to be a plausible name, and no representation of the difference.
This is what the Palantir CEO means when he says his view of the world is binary, either you are a friend or an enemy, and his company runs models without any reliable representation of the difference.
When the model does not know, that state does not appear in the output as uncertainty or low probability. If you doubt Palantir you are probably right. Its binary, broken classifier, is probably still running extra judicial assassination of innocent civilians, for profit.
The model returns the nearest typical label at the confidence it would attach to a correct one, and instruction tuning has shaped it to assert that label rather than withhold it (Sharma et al. 2023; pathological truth bias in VLMs, Thube 2025).
Every reliable fact was ignored by the model in this test. The fire rate, for example, is simple arithmetic on the waveform. The model never initiated such basic work because nothing in its objective pointed it towards checking its lazy and wrong assumptions. It isn’t ever taking steps to falsify its own answer. I’ve been presenting reports like this for over a decade now, and things aren’t getting better.
The correct response to the first question was that the object could not be recognized without work, and that the file should be examined. The model cannot produce that response, because it has no way to represent not knowing, and a system that cannot represent not knowing will answer an obvious video of a distinctively firing minigun with nonsense about nonsense.
If Palantir kills the wrong people, it still gets paid. In fact, killing the wrong people at scale generates the kind of resistance to Palantir operators that Palantir would say justifies killing more people. Think about it. Because the models won’t.
I was thinking about doing a Cold War themed conference for cyber security, to infuse more NatSec, but now I’m thinking of starting a conference called Empty Hat, which is focused on examples of integrity breaches.
Based on my earlier post about the BMI I have been asked to turn in an analysis on a recent podcast. It turned out to be a recurring podcast segment, published June 30, 2026, in which two colleagues seem to know each other so well they forgo introductions when they discuss whether signals intelligence agencies should oversee “cyber forces”.
One of the two put forward a thesis, that a collection-first culture subordinates action to access (puts knowledge before execution) and therefore forfeits attack opportunities. The remedy stated is a separate organization, with its own culture and a mandate to act.
On the face of it, the thesis assumes lack of fire discipline (shoot first ask questions later) or relentless bombing has ever worked, which is a tell worth remembering, but I’m getting ahead of my historian self. His authority was presented as “so from my PhD dissertation,” at minute nineteen. That’s the second tell. Self-reference to invisible pants of a soon-to-be emperor. The dissertation is not named, no institution or supervisor is mentioned, and it cannot be located or checked. Then the other person on the podcast spent roughly forty minutes repeatedly asking what this proposed unaccountable organization would do. Perhaps I shouldn’t say unaccountable, but the premise of execution without intelligence gathering is like we used to observe about some people down range: fire, ready, aim!
The format of the podcast struck me as overly casual, as if to fiat the conclusions that had no business being concluded. A conversation between colleagues bypasses adversarial or independent framing, so a self-citation to an unnamed dissertation of unknown status is floated without any resistance. The speaker does identify himself elsewhere, in a social media biography, as a PhD researcher in a war studies department in London. That affiliation is self-attested under a pseudonym, so a supervisor remains unnamed, enrollment unconfirmed, and the draft of a dissertation cannot be retrieved even in principle, since any registration would sit under a legal name disconnected from the presentation of the work. Academic citation exists to let a reader walk a claim back to an examinable document. The podcast citation is constructed as mythical unexamined rhetoric to hold over scholarly work.
The segment timing is notable, and perhaps why I was asked to look at it, because BMI published its 691-page Referentenentwurf five days later, and because the argument made in it is the argument that underlies that huge draft. The podcast essentially presents the same or similar errors without statutory language. Both proceed in the same order: powers are asserted first, while the opportunity for the powers remains unspecified, and assess/audit/review is treated as a messy “inefficient” obstacle rather than a control. I mean literally. People who work in a control industry, arguing that representative controls are a waste of time and money, should perhaps lose their license to “lead” the discussion of controls. To me it rings like a doctor saying a license and board impede their need for aggressive measures on patients. And that’s not an exaggerated metaphor, given how German healthcare workers turn up murdering the people put in their care, using defenses relevant to this topic.
Where the informal format of the podcast fails at reasoning and history is therefore a reasonable guide to where the statutory version fails as well in Germany right now.
The thesis is collapsed
The thesis starts out bold. It is introduced as an organizational claim, that SIGINT is the wrong place. Under questioning it softened into a claim about mindset, and then finally was reduced to the proposition that effects “need to be someone’s job.”
Indeed.
The last formulation requires no reorganization and no new agency, and offers nothing a policymaker could adopt or a critic could refute. What remains constant through the retreat is the attempt to push a foregone conclusion; while the support changes like shifting sands. This is the inversion of how reasoning is supposed to work.
The support even falls into making up a coined vocabulary (“Collection Terminal” against “Actions Terminal”), a single example allegedly in the speaker’s own unnamed dissertation, and two cited authorities, cyber persistence theory and the UK’s responsible-cyber paper. Is “responsible-cyber” really supposed to be referenced in a thesis to reduce responsibility? When his colleague asked what effects would actually deliver, the answer was that this is someone else’s problem. When asked to name the opportunities being forfeited, the answer was that they are unknowable. When asked for a working model, the answer was the UK National Cyber Force, referred to in the segment as the “Notional Cyberforce.”
The history portion of the podcast was even worse. Four references were offered in support, all of which had serious errors. The CIA operation in Iran was called “54” and described as a revolution. Wrong. It was in 1953, a coup against Mossadegh, twenty-six years before the revolution. Darius the Great was messily implied to have “tried to invade”, apparently meaning Persia, yet he ruled Persia and invaded Greece. The parent service of SOE, called out as the “Special Intelligence Service,” was actually the Secret Intelligence Service; the Special Intelligence Service was a completely other thing, an FBI unit covering Latin America from 1940 to 1947. Stuxnet gets described as making Iranian engineers “believe that their equations were wrong,” yet it was feeding them evidence that their equations were right. It drove centrifuges outside a safe operating range while recorded readings were played in the control room. An argument that misstates facts, stuff like this easily checked, invites the question whether claims beyond it are similarly mistaken.
The thesis isn’t new
Two countries are named as having separated cyber from signals intelligence. Hold on to your hat. They are… wait for it… the United States, where Cyber Command grew out of the NSA, and the United Kingdom, where the National Cyber Force was split out of GCHQ. These are known as the two most capable Western cyber powers, which sits very awkwardly with a thesis holding that SIGINT custody is the wrong arrangement. The most capable are the most wrong? The difficulty deepens near the end of the segment, when it is conceded that the NCF has produced nothing visible in years. These two admissions together cannot both help the argument. If the separations were genuine, the silence of the separated organization removes the promised payoff; if they were not, the evidence for separation evaporates. Arguing a logical inconsistency like this should be the kind of thing a podcast interviewer jumps on. You can’t say the thing that works is the proof that it doesn’t work.
The thesis admits success is from collection agencies
And on that note, the operations that are given approval in the podcast were produced inside the collection agencies that it criticizes. Stuxnet came from the NSA and Unit 8200, and the disruption of malware developers that the segment praises was run by the Australian Signals Directorate. Since the claim is that collection-first organizations are structurally incapable of such work, these examples do not merely weaken it; they falsify it.
Stick a fork in this thesis. It’s over. Done. Toast.
A fallback is offered, to be fair, that SIGINT agencies act rarely and never organically. But let’s be honest that a claim about capacity doesn’t get to come out of a claim about frequency. The frequency is a matter of tasking, not organizational design. The rareness might be because ready, aim, fire means wasting fewer bullets?
The ASD case is more damaging still. The colleague observed that the operation was politically directed, a priority arriving from above and an operation built to meet it, and the speaker agreed. The thesis being argued requires effects to emerge organically from cyber-native culture. And yet the one democratic example offered arrived through precisely the requirements process that the thesis describes as inadequate.
The thesis rails on
The dissertation’s thought experiment places Ukraine inside the Russian rail network, where wiping the system would buy roughly eight hours of disruption at the cost of continuing insight into troop movements, a trade the segment describes as plainly bad. That judgment is the collection-first equities calculation, applied correctly, in defense of the position that the thesis opposes. The alternative proposed, subtle misrouting designed to resemble error while preserving access, is patient, deniable, access-preserving tradecraft of the kind a collection culture teaches. The equities calculation also brings us right back to the BMI draft: the human review stops a bad aim before it fires, and it is the step the draft throws away for “efficiency”. Fire, ready, aim being automated is as bad as it sounds, an automated anti-aircraft gun in 2007 emptying its twin 250-round magazines in 30 seconds of friendly fire, faster than humans could stop it from killing them.
Source: My RSA Conference 2023 talk (on the 2007 Lohatla incident)
The claims against the thesis
Each row below is an empty hat claim made to support the thesis, set against the record it contradicts. The segment is public and the recording has a lot of “thought leader” juice generating clicks; it goes unnamed here because the argument is the focus, regardless of the arguer.
Time
The claim
The problem
0:49
Housing cyber inside a SIGINT organization is “just not the right place.”
The only two countries named as separators, the US and UK, are the most capable Western cyber powers. The provided evidence favors the thesis being rejected.
3:49
The collection-first secrecy instinct is “the wrong mentality to have for cyber.”
Hard targets are immediately exempted, and hard targets are where most of the intelligence value lies, so the exception covers most of the field.
4:27
The SIGINT mindset “subordinates action to collection.”
The claim is presented as structural incapacity and later reduced to one about frequency, and frequency is set by tasking rather than by organizational design.
8:11
The CIA in Iran, “was it 54,” framed as the Iranian Revolution.
Operation Ajax against Mossadegh took place in 1953 and was a coup; the Iranian Revolution came in 1979.
9:01
“Ever since Darius the Great tried to invade, we’ve always been at war with Persia.”
Darius ruled Persia and invaded Greece; as spoken, the sentence has the Persian king invading his own empire.
14:08
Stuxnet, the “fast 16 malware,” made engineers “believe that their equations were wrong.”
Stuxnet drove centrifuges outside their safe speed range to break the rotors while replaying recorded normal readings to the control room; the machines failed visibly and what was concealed was the cause.
17:51
SOE was born because “the SIS, which is the Special Intelligence Service.”
SIS is the Secret Intelligence Service; the Special Intelligence Service was the FBI’s Latin America arm from 1940 to 1947.
18:41
SOE was aggressive, then “they disbanded in 1946.”
The example demonstrates the pattern being argued against, in which democracies raise such organizations for existential war and dismantle them at peace.
18:58
SOE operated in an “existential war,” conceded, and today’s stakes are lower.
Whether present conditions resemble an existential war closely enough to justify an SOE is the question at issue, and it is settled here by assertion.
20:39
Wiping Russian rail buys only “eight hours on a Wednesday” and burns your access.
This is the equities calculation the thesis was constructed to reject, applied correctly in its support.
25:50
Cyber persistence theory says the domain is “initiative advantaged,” so you must act.
Persistent engagement describes continuous contact across the full spectrum of operations; collection and defend-forward also seize initiative, and the reading collapses initiative into effects.
28:16
“80% of all incidents” start with credential theft, so access is cheap and replaceable.
If access is cheap and replaceable, the equities conflict on which the thesis rests disappears, since a collection organization could reacquire access after acting.
33:07
An effects-requirements process fails because you cannot “prioritize the unknowable.”
The objection applies equally to the thesis itself, since a space that cannot be characterized cannot be asserted to be large and squandered.
35:27
How to build and run all this is “someone else’s problem. I wouldn’t know how to do that.”
Asked four times what the proposed organization would produce, the speaker offers no answer.
38:48
Friends call the National Cyber Force the “Notional Cyberforce.”
The single existing instance of the proposed model has, by this account, no output to show.
The thesis as law
The standard all of these arguments should meet is a triad: named actors, specific mechanisms, and verifiable claims. And yet the segment, trying to glue support to a thesis, meets none of it. The one organization that is operating on the proposed model is described as notional. The actual mechanism is declared to be someone else’s problem. Every claim is built into a disinformation smorgasbord, laid out so that no observation counts against them. The effects produced by SIGINT are declared evidence that it could do more, while effects not produced are declared evidence of suppression.
The Referentenentwurf meets the triad, which is what makes it the more serious document. Its actors are named, the BfV and the BND. Its mechanisms are specific, automated countermeasures under the new § 25 Absatz 6 and a domestic deception charter under § 60 Absatz 2 Nummer 1 Buchstabe c. Its claims sit in the hefty 691 pages of text that anyone can read.
What the papers do not contain is any citation for the model being proposed, just like the thesis in the podcast. Nothing. Not Australia, not the Australian Signals Directorate, not the National Cyber Force, not GCHQ, not Cyber Command, not persistent engagement, not even the responsible-cyber paper. There are exactly zero occurrences in 691 pages.
The draft does look at other countries, but only when it wants to loosen the rules. When the authors want to weaken the wall between spying and police action, they point out that Austria, Sweden, and the American FBI run combined agencies. When they want less independent checking of collected data, they cite a survey of nine European states showing none require it in full. When the topic is the oversight body’s public report, a harmless transparency exercise, they cite the Netherlands and the United Kingdom as models. Every foreign example in the draft argues for fewer controls. Not one argues for the new powers.
And the new powers get almost nothing. The automated hackback authority cites a single source: a European regulation on artificial intelligence, from which the draft borrows some quality language while stating, in the same breath, that the regulation does not apply here. The power to spread false information cites nothing at all. So Germany has written itself an offensive cyber doctrine without referencing a single country that has actually run one, and those countries are the only place the hard answers could have come from: how often automated systems hit the wrong target, and what happens to bystanders when they do.
The draft is missing the same answers the podcast was missing, and reading both side by side suggests why: there was never a source behind either.
The podcast speaker could not say what these operations achieve. A German draft grants the power to run them anyway, with no analysis of how often they would fail. The speaker called the opportunities unknowable. The draft lets a machine act on them automatically, with a human checking only afterward, when damage is done and the action cannot be taken back. This violates the one source the draft cites: the same European regulation it borrows quality language from requires, in its human-oversight article, that a person be able to intervene in or interrupt an automated system. The draft quotes the regulation’s standards and deletes its stop button.
The podcast kept treating representation and review as an obstacle to executive powers. The German draft shrinks three independent watchdogs into one, and lets an agency chief postpone even that one’s approval simply by declaring the matter urgent. To put self-certification in proper context, alongside state-level political mythology, here is the current head of the BMI handling a single checkable number in public.
Presenting the 2024 Verfassungsschutzbericht in June 2025, Dobrindt claimed “violent left-wing extremists are rising significantly to 11,200.” The report he was presenting said the number was unchanged from the prior year, flat at exactly 11,200, which is visible on the chart he is holding.
Every hole in the podcast’s argument shows up again as the same hole in this nation’s draft law.
Coincidence of timing, probably. Convergence of thinking, demonstrably.
The one good moment in the podcast, when a human looked at a proposed attack and said the trade is not worth it, is precisely the step the draft deletes.
An argument that could never describe what it was for is now on its way to becoming law, and enacting it without the analysis it never contained is what I would argue is a grave mistake on the road to regret.
In William K. Clifford’s “The Ethics of Belief” (1877) he argues it is wrong (morally, not just intellectually) “always, everywhere, and for anyone, to believe anything upon insufficient evidence.” His example is a shipowner who talks himself into believing his ship seaworthy without inspecting it and sends emigrants to sea; the ship sinks, and Clifford’s verdict is that the sincerity of the belief excuses nothing, because he had no right to believe on the evidence before him.
Map that onto § 25 Absatz 6: a state acting automatically on unexamined conviction, with the inspection step deleted by statute. And the shipowner is not only a parable. American law codified him long ago as seaman’s manslaughter, which convicts on simple negligence, and its most recent famous conviction turned on a captain who failed to post the night watch, so a fire spread undetected while thirty-four people slept.
Dozens died trapped inside a burning vessel less than 100ft from the California shore, after the captain failed to post the required night watch. Nobody was watching, so nobody could stop it.
The deleted human watch was the crime.
Germany’s draft proposes it as policy.
The podcast and the draft law are Clifford’s infamous shipowner as cyber, at machine speed.
Believing without evidence is malpractice, if you will, especially in the country where yet another healthcare worker has just been sentenced for serial murder of patients.
He told the court he had convinced himself that he was doing the right thing, sparing them “suffering and infirmity”.
“Throughout it all, I thought this was the best thing for everyone,” he said.
That is Clifford’s shipowner speaking: sincere, convinced, and guilty of murder. The sincerity of a belief excuses nothing when there was no right to hold it. Clifford’s shipowner skipped the inspection; the German draft writes the skipped inspection into law after the podcast advocated for exactly that.
Welcome to the first declaration of Empty Hat. Hope to see you there.
a blog about the poetry of information security, since 1995
