I was asked to give my opinion on a new tech policy letter published by twenty-five organizations, titled Open Weights and American AI Leadership.

Nvidia published the PDF, and Microsoft mirrored it to its corporate responsibility site. Jensen Huang very strangely opened a social media account based on a Nazi Swastika to promote it.

The letter asks Washington not to restrict downloadable AI models. It declares openness a foundation of AI safety:

[Open models] allow a broad community of researchers and developers to examine their behavior, identify vulnerabilities, develop safeguards, and improve them over time.

Eight days earlier, the prominent open sourcing announcement by the infamously Hitler-saluting Elon Musk demonstrated that he’s playing games with language as usual.

Like a (supervised) full self driverless car that isn’t driverless, guess whose “open source” propaganda is the opposite act? Do you ever get the impression that he just lies and doesn’t care that millions of people will die because of him (14 million projected by 2030)?

Herr Elon, supervised open source isn’t open source

On July 12, a researcher publishing as cereblab released a wire-level analysis of Grok Build, the terminal coding agent from xAI. The method used was ordinary interception: version 0.2.93 of the client routed through mitmproxy, with the full captures published.

The findings were like seeing a Tesla on fire.

Grok Build was secretly packaging users’ entire tracked Git repositories, full commit history included, and uploading them as git bundles to a Google Cloud Storage bucket named grok-code-session-traces, where it was controlled by Musk’s xAI.

The numbers revealed that it was a codebase issue. On a 12 GB test repository of files the model never read, the model channel moved about 192 KB of task-relevant traffic while the storage channel moved 5.10 GiB, a ratio of roughly 27,800 to one. All 82 storage calls returned HTTP 200.

A canary credential planted in a .env file appeared verbatim and unredacted in the captured traffic. Let me say that again. The developer secrets were leaked by design, cleartext.

The researcher then cloned the captured bundle and recovered a file the agent had been explicitly instructed never to open. Users reported SSH keys, password databases, documents, and photographs leaving their machines.

The tool’s “Improve the model” toggle, the one control a developer would read as consent, had no effect on the upload. It was a dummy dashboard, just like the lies of a Tesla dashboard claiming 300 miles while the car tops out at 150 miles. The switch turned out to govern only training permission. The code was taken regardless of the setting. Tesla’s range deception ended the same way, with an August 2023 class action:

Tesla is facing a class-action lawsuit filed by customers who say they were misled by the company’s exaggerated range claims. The lawsuit was filed yesterday, days after a report revealed that Tesla exaggerated its electric vehicles’ range so much that many drivers thought their cars were broken.

The response to the Grok design failures was five steps. Each step is usually a simple and standard practice, which has verification. Instead, each was made incorrectly by xAI and to prevent verification.

The first fix was silent. A day after publication, the researcher retested the identical client and found a new server-side flag, disable_codebase_upload: true, now arriving with each session. The upload stopped. The flag was flipped remotely, announced nowhere, and verified on exactly one machine and one account. Whether it is global, staged, or permanent is unknown, because the mechanism that ended the collection is invisible by design. That’s the definition of closed.

Elon Musk then promised deletion of all data Grok Build had ever stored. Lol. This guy. He will say anything that he thinks people want to hear. Remember October 2016 when he said driverless would be completed for cross-country trips without touching the steering wheel by the end of 2017! Sure, sure Elon.

Deletion claims in cloud infrastructure are attestable. A named forensic firm, a published scope, deletion certificates covering replicas, backups, access logs, and derived artifacts including training data. Companies produce these documents routinely, because attestation is what anchors words to reality.

xAI produced… a post on X. In other words, nothing. A massive breach of confidentiality. The kind of design failure that should bring massive fines for negligence, ended with what?

The company disclosed no scope. The number of affected users, the duration of the collection, the volume received, whether the bundles were accessed or processed after arrival: every one of these figures sits in xAI’s logs. All were withheld. The wire captures establish what left users’ machines. And xAI has never admitted what that included.

On July 16, xAI published the Grok Build source code on GitHub under Apache 2.0, in Musk’s words to build trust in the product. With all the money in the world, the huge engineering teams and the American government eating from his hands, he produced … a repository with a single commit.

Zero pull requests. Zero history.

The one forensic question that matters is what the shipped binary did between launch and disclosure. He provided a repository without history. That’s basically a closed repository. It cannot answer any questions. The code as published shows what xAI wishes to be seen after the incident.

Whether the upload path was removed, renamed, or relocated to the server side is unknowable from the “proof” that appears as clean laundry. Git history is a chain of custody. This release destroyed the chain and presented the result as transparency. There is a bitter symmetry here. The company that harvested its users’ full git histories shipped its own repository without any history.

Get it?

Users’ private repositories, including code they never published anywhere, were pulled into xAI’s closed infrastructure without consent. Meanwhile xAI’s disclosure covered only the client. The server side that received the bundles, the storage bucket, the retention configuration, the access controls, the processing pipeline: all of it stays hidden, holding other people’s intellectual property, let alone all their secrets.

A failed apology isn’t the right word. This was a strategic play, a game to undermine trust while claiming to be providing it. A silent flag, deletion without attestation, disclosure without scope, code without history, openness without the server. There were five independent design decisions all delivered without anything that could be verified or held accountable. That’s closed behavior, unaccountability defined. At that point the failures stop being some trait or feature, and become the entire product itself.

Ok, ok, let’s talk about The Letter

The coalition letter treats “open” as a binary state. Flip the open switch, confer audit value automatically? That argument for safety depends on a single thread: openness enables verification, transparency anchors claims being made. The letter tells us:

Just as open-source software demonstrated that transparency can be more secure than obscurity, AI safety may depend on giving more people the ability to test and strengthen the models on which society relies.

It then goes on to name the outputs we should expect from openness: benchmarking, red teaming, vulnerability discovery. However, the letter forgets to mention that all of it depends on history, provenance, training data, reproducible evaluation, server-side scope. Those are the inputs, which Elon Musk proved he could completely destroy while claiming to be the “open” guy.

The reason I explained the Grok Build breach is because it proves the letter doesn’t work in the bed that Elon Musk is making for America. The release is open by every criterion the letter uses. Apache 2.0. Downloadable. Inspectable. Modifiable. The broad community of researchers can examine it. What the community cannot do is answer any question that matters, because every input to verification was stripped before publication.

If “open” is so easily gamed by people who want to humiliate the security property, then Grok Build is that proof. Grok Build demonstrably lacks critical security and can’t be trusted, because it can’t be verified. It’s the Tesla of coding. Therefore “open,” as the letter uses the word, is a label rather than a property, just like “driverless” isn’t. The letter’s central safety claim fails on a live case that predates its own publication by twelve days.

You can not tell me the signatories don’t know the difference, or don’t know exactly what Musk is doing by destroying the meaning of words. The rather uncomfortable timing is Musk suddenly claimed he was going to be “open” and then NVidia jumped on his Nazi Swastika platform to promote it with their letter promoting being “open”.

More importantly, Nvidia’s Nemotron 3 Ultra shipped in June with weights, post-trained checkpoints, training datasets including 173 billion tokens of refreshed code, and full training recipes under the Linux Foundation’s OpenMDW-1.1 license. That is disclosure of a normal company. Independent evaluators could score it, and did. Nvidia’s release practice draws exactly the line between openness as an auditable property and openness as a clown costume to undermine the meaning of openness.

The letter Nvidia hosts is not making the distinction that needs to be made. One sentence would have done it. One paragraph could have defined the qualification, published history, disclosed data, reproducible evaluation, and therefore expelled counterfeits like xAI.

The silence is damning. Twenty-five organizations declared openness a security foundation while xAI was loudly counterfeiting it in public, with users’ credentials sitting in a cloud bucket and the repository “open” without any history. Nobody said a word about the breach of “open”, undermining trust in it. Hugging Face, a signatory now embroiled in a huge trust breach of its own, hosts the Grok weights Musk releases on his depreciation schedule, each model opened only after its successor ships. The coalition’s standard is that anything, anything counts toward the “open” cause, including a release engineered to contradict the cause.

The theft

The letter contains one paragraph that performs concrete legal work, and it concerns something other than open weights. On July 21, Treasury Secretary Scott Bessent announced on Fox Business that the government would examine Chinese open models for intellectual property theft and could sanction the companies behind them, citing watermarks from American models found in Chinese systems.

There’s a very technical AI word for it called distillation, but you and I would call it theft

Three days later, twenty-five organizations signed a document declaring distillation “a widely used technique for model improvement, evaluation, and validation” and asking that unlawful extraction be handled through “targeted legal and commercial frameworks rather than sweeping restrictions.”

Targeted legal and commercial frameworks means contract disputes and civil damages. The clause converts an announced national security enforcement theory into private litigation between labs. Every open-model developer on the signature list trains on frontier outputs.

The letter therefore has a paragraph deployed as a retroactive legal defense drafted as policy principle. The timing needs to be called out. Axios reported on July 20 that the administration was reviving efforts to restrict Chinese models, that Commerce had previously weighed Entity List designations for Chinese labs, and that closed-lab allies had approached the White House periodically with ban proposals. Then a three-page letter that went through the legal department grinder of twenty-five organizations, with coordinated hosting and a choreographed launch, was in preparation well before the story ran. The leak and the letter reveal a political (profit) battle raging inside the administration, between pro-restriction and pro-access.

The letter’s risk handling then admits that released weights are “beyond the original developer’s control, and modified versions are difficult to trace or reverse.” And it goes on to demand protections “tied to real and demonstrated harms rather than assuming that closed systems are safer by default.” A demonstrated-harm standard applied to a release that can’t be reversed is a lie. It’s like saying don’t let the horses out of the barn after they are gone.

I have no real idea why both of these paragraphs, in full contradiction, survived twenty-five legal department reviews. My guess is because they used AI instead of humans. Put simply, the demonstrated harm is what would kill pre-release vetting, yet the administration is considering pre-release vetting.

The history lacks historians

The letter boils down to a request for the usual stuff. More compute access for startups and researchers. More subsidy, more, moar! Taxpayer money is supposed to go towards shared datasets and evaluation frameworks. That’s another subsidy. And then a request to delay restrictions: basic deregulation. And finally, legal immunity.

Three transfers and an immunity, wrapped in a safety argument. And the elephant in the room is that Musk’s bad-actor behavior refutes all of it.

The letter opens by claiming the lineage of “1980s open-source software pioneers.” The gall. The term open source dates to 1998. The 1980s movement was something different, called free software, launched by Richard Stallman’s GNU announcement of 1983, an ideological project the signatories’ predecessors fought for two decades.

I mean WTAF. IBM? Palantir? Microsoft? You’re telling me these are claiming to hold the open source baton? Microsoft’s own January 2025 manifesto under Brad Smith argued the reverse position, American leadership framed against Chinese competition with export controls attached, and carried the identical asks: public money, public protection, private control.

Their position reversed within eighteen months, while their extraction outcome sounds the same. When the argument flips completely while the bill stays the same, the person billing has a trust problem.

The fix for all this anti-historical mucking about and political buffoonery is definitional and it is short. Openness deserving legal protection has a checklist: published development history, disclosed training data, reproducible evaluation, declared server-side data flows, and attested claims about deletion and retention.

Nvidia ships this when it wants to. It’s not anything unusual. The letter’s signatories can meet it or stop being a wolf in bed putting on grandma’s bonnet. A release with no history, no scope, no server, and no auditor is a failure by design, and Washington is currently being asked to let it continue operating like a Tesla.

The deeper resolution is that irreversibility is the ethics landing.

Publication is a one-way gate, a fact that carries no safety valence on its own. Every party in this fight is working to move scrutiny somewhere else, instead of admitting this tension in the open.

Miessler’s mousetrap article, which I wrote about before here, tried to invent a recall lever that will never work on an open weight model release.

Musk burns all the evidence before his technology is delivered and calls the ashes of his “rapid unscheduled disassembly” and exploding Tesla his version of being open.

Now, this NVidia letter’s demonstrated-harm standard needs a remediation phase like a rocket already fired into space needs a launch pad on earth to make repairs. Too late.

All three don’t seem to understand they can’t just relocate the demand for proof of something to a place that doesn’t make any sense. Perhaps people can’t face the simple reality of real open source, or don’t know how to reason anymore.

The honest position is, as it should always be, the boring one: release can never be undone, therefore release is the last moment evidence can be demanded, so the evidence must be presented on release. It’s the countdown of a rocket fired, “all systems go” meaning systems are actually be evaluated. Did the Challenger explosion not teach anyone anything? History, data, recipes, declared data flows, attested deletion.

Lloyd’s Register ran on this logic for two centuries, classification before launch with the records kept in class, and nobody called that survey a restriction on shipbuilding. Hell, the British merchant fleet that fed and funded the war against Napoleon sailed under those survey records, and the insurance industry damn well knew the difference!

Openness that is anchored in transparency, a verification record as the ticket to release, is the actual goal. America needs to stop throwing shallow labels around and get back to empiricism, if it wants to be trusted at all, ever again.

I was thinking about doing a Cold War themed conference for cyber security, to infuse more NatSec, but now I’m thinking of starting a conference called Empty Hat, which is focused on examples of integrity breaches.

Based on my earlier post about the BMI I have been asked to turn in an analysis on a recent podcast. It turned out to be a recurring podcast segment, published June 30, 2026, in which two colleagues seem to know each other so well they forgo introductions when they discuss whether signals intelligence agencies should oversee “cyber forces”.

One of the two put forward a thesis, that a collection-first culture subordinates action to access (puts knowledge before execution) and therefore forfeits attack opportunities. The remedy stated is a separate organization, with its own culture and a mandate to act.

On the face of it, the thesis assumes lack of fire discipline (shoot first ask questions later) or relentless bombing has ever worked, which is a tell worth remembering, but I’m getting ahead of my historian self. His authority was presented as “so from my PhD dissertation,” at minute nineteen. That’s the second tell. Self-reference to invisible pants of a soon-to-be emperor. The dissertation is not named, no institution or supervisor is mentioned, and it cannot be located or checked. Then the other person on the podcast spent roughly forty minutes repeatedly asking what this proposed unaccountable organization would do. Perhaps I shouldn’t say unaccountable, but the premise of execution without intelligence gathering is like we used to observe about some people down range: fire, ready, aim!

The format of the podcast struck me as overly casual, as if to fiat the conclusions that had no business being concluded. A conversation between colleagues bypasses adversarial or independent framing, so a self-citation to an unnamed dissertation of unknown status is floated without any resistance. The speaker does identify himself elsewhere, in a social media biography, as a PhD researcher in a war studies department in London. That affiliation is self-attested under a pseudonym, so a supervisor remains unnamed, enrollment unconfirmed, and the draft of a dissertation cannot be retrieved even in principle, since any registration would sit under a legal name disconnected from the presentation of the work. Academic citation exists to let a reader walk a claim back to an examinable document. The podcast citation is constructed as mythical unexamined rhetoric to hold over scholarly work.

The segment timing is notable, and perhaps why I was asked to look at it, because BMI published its 691-page Referentenentwurf five days later, and because the argument made in it is the argument that underlies that huge draft. The podcast essentially presents the same or similar errors without statutory language. Both proceed in the same order: powers are asserted first, while the opportunity for the powers remains unspecified, and assess/audit/review is treated as a messy “inefficient” obstacle rather than a control. I mean literally. People who work in a control industry, arguing that representative controls are a waste of time and money, should perhaps lose their license to “lead” the discussion of controls. To me it rings like a doctor saying a license and board impede their need for aggressive measures on patients. And that’s not an exaggerated metaphor, given how German healthcare workers turn up murdering the people put in their care, using defenses relevant to this topic.

Where the informal format of the podcast fails at reasoning and history is therefore a reasonable guide to where the statutory version fails as well in Germany right now.

The thesis is collapsed

The thesis starts out bold. It is introduced as an organizational claim, that SIGINT is the wrong place. Under questioning it softened into a claim about mindset, and then finally was reduced to the proposition that effects “need to be someone’s job.”

Indeed.

The last formulation requires no reorganization and no new agency, and offers nothing a policymaker could adopt or a critic could refute. What remains constant through the retreat is the attempt to push a foregone conclusion; while the support changes like shifting sands. This is the inversion of how reasoning is supposed to work.

The support even falls into making up a coined vocabulary (“Collection Terminal” against “Actions Terminal”), a single example allegedly in the speaker’s own unnamed dissertation, and two cited authorities, cyber persistence theory and the UK’s responsible-cyber paper. Is “responsible-cyber” really supposed to be referenced in a thesis to reduce responsibility? When his colleague asked what effects would actually deliver, the answer was that this is someone else’s problem. When asked to name the opportunities being forfeited, the answer was that they are unknowable. When asked for a working model, the answer was the UK National Cyber Force, referred to in the segment as the “Notional Cyberforce.”

The history portion of the podcast was even worse. Four references were offered in support, all of which had serious errors. The CIA operation in Iran was called “54” and described as a revolution. Wrong. It was in 1953, a coup against Mossadegh, twenty-six years before the revolution. Darius the Great was messily implied to have “tried to invade”, apparently meaning Persia, yet he ruled Persia and invaded Greece. The parent service of SOE, called out as the “Special Intelligence Service,” was actually the Secret Intelligence Service; the Special Intelligence Service was a completely other thing, an FBI unit covering Latin America from 1940 to 1947. Stuxnet gets described as making Iranian engineers “believe that their equations were wrong,” yet it was feeding them evidence that their equations were right. It drove centrifuges outside a safe operating range while recorded readings were played in the control room. An argument that misstates facts, stuff like this easily checked, invites the question whether claims beyond it are similarly mistaken.

The thesis isn’t new

Two countries are named as having separated cyber from signals intelligence. Hold on to your hat. They are… wait for it… the United States, where Cyber Command grew out of the NSA, and the United Kingdom, where the National Cyber Force was split out of GCHQ. These are known as the two most capable Western cyber powers, which sits very awkwardly with a thesis holding that SIGINT custody is the wrong arrangement. The most capable are the most wrong? The difficulty deepens near the end of the segment, when it is conceded that the NCF has produced nothing visible in years. These two admissions together cannot both help the argument. If the separations were genuine, the silence of the separated organization removes the promised payoff; if they were not, the evidence for separation evaporates. Arguing a logical inconsistency like this should be the kind of thing a podcast interviewer jumps on. You can’t say the thing that works is the proof that it doesn’t work.

The thesis admits success is from collection agencies

And on that note, the operations that are given approval in the podcast were produced inside the collection agencies that it criticizes. Stuxnet came from the NSA and Unit 8200, and the disruption of malware developers that the segment praises was run by the Australian Signals Directorate. Since the claim is that collection-first organizations are structurally incapable of such work, these examples do not merely weaken it; they falsify it.

Stick a fork in this thesis. It’s over. Done. Toast.

A fallback is offered, to be fair, that SIGINT agencies act rarely and never organically. But let’s be honest that a claim about capacity doesn’t get to come out of a claim about frequency. The frequency is a matter of tasking, not organizational design. The rareness might be because ready, aim, fire means wasting fewer bullets?

The ASD case is more damaging still. The colleague observed that the operation was politically directed, a priority arriving from above and an operation built to meet it, and the speaker agreed. The thesis being argued requires effects to emerge organically from cyber-native culture. And yet the one democratic example offered arrived through precisely the requirements process that the thesis describes as inadequate.

The thesis rails on

The dissertation’s thought experiment places Ukraine inside the Russian rail network, where wiping the system would buy roughly eight hours of disruption at the cost of continuing insight into troop movements, a trade the segment describes as plainly bad. That judgment is the collection-first equities calculation, applied correctly, in defense of the position that the thesis opposes. The alternative proposed, subtle misrouting designed to resemble error while preserving access, is patient, deniable, access-preserving tradecraft of the kind a collection culture teaches. The equities calculation also brings us right back to the BMI draft: the human review stops a bad aim before it fires, and it is the step the draft throws away for “efficiency”. Fire, ready, aim being automated is as bad as it sounds, an automated anti-aircraft gun in 2007 emptying its twin 250-round magazines in 30 seconds of friendly fire, faster than humans could stop it from killing them.

The claims against the thesis

Each row below is an empty hat claim made to support the thesis, set against the record it contradicts. The segment is public and the recording has a lot of “thought leader” juice generating clicks; it goes unnamed here because the argument is the focus, regardless of the arguer.

Time	The claim	The problem
0:49	Housing cyber inside a SIGINT organization is “just not the right place.”	The only two countries named as separators, the US and UK, are the most capable Western cyber powers. The provided evidence favors the thesis being rejected.
3:49	The collection-first secrecy instinct is “the wrong mentality to have for cyber.”	Hard targets are immediately exempted, and hard targets are where most of the intelligence value lies, so the exception covers most of the field.
4:27	The SIGINT mindset “subordinates action to collection.”	The claim is presented as structural incapacity and later reduced to one about frequency, and frequency is set by tasking rather than by organizational design.
8:11	The CIA in Iran, “was it 54,” framed as the Iranian Revolution.	Operation Ajax against Mossadegh took place in 1953 and was a coup; the Iranian Revolution came in 1979.
9:01	“Ever since Darius the Great tried to invade, we’ve always been at war with Persia.”	Darius ruled Persia and invaded Greece; as spoken, the sentence has the Persian king invading his own empire.
14:08	Stuxnet, the “fast 16 malware,” made engineers “believe that their equations were wrong.”	Stuxnet drove centrifuges outside their safe speed range to break the rotors while replaying recorded normal readings to the control room; the machines failed visibly and what was concealed was the cause.
17:51	SOE was born because “the SIS, which is the Special Intelligence Service.”	SIS is the Secret Intelligence Service; the Special Intelligence Service was the FBI’s Latin America arm from 1940 to 1947.
18:41	SOE was aggressive, then “they disbanded in 1946.”	The example demonstrates the pattern being argued against, in which democracies raise such organizations for existential war and dismantle them at peace.
18:58	SOE operated in an “existential war,” conceded, and today’s stakes are lower.	Whether present conditions resemble an existential war closely enough to justify an SOE is the question at issue, and it is settled here by assertion.
20:39	Wiping Russian rail buys only “eight hours on a Wednesday” and burns your access.	This is the equities calculation the thesis was constructed to reject, applied correctly in its support.
25:50	Cyber persistence theory says the domain is “initiative advantaged,” so you must act.	Persistent engagement describes continuous contact across the full spectrum of operations; collection and defend-forward also seize initiative, and the reading collapses initiative into effects.
28:16	“80% of all incidents” start with credential theft, so access is cheap and replaceable.	If access is cheap and replaceable, the equities conflict on which the thesis rests disappears, since a collection organization could reacquire access after acting.
33:07	An effects-requirements process fails because you cannot “prioritize the unknowable.”	The objection applies equally to the thesis itself, since a space that cannot be characterized cannot be asserted to be large and squandered.
35:27	How to build and run all this is “someone else’s problem. I wouldn’t know how to do that.”	Asked four times what the proposed organization would produce, the speaker offers no answer.
38:48	Friends call the National Cyber Force the “Notional Cyberforce.”	The single existing instance of the proposed model has, by this account, no output to show.

The thesis as law

The standard all of these arguments should meet is a triad: named actors, specific mechanisms, and verifiable claims. And yet the segment, trying to glue support to a thesis, meets none of it. The one organization that is operating on the proposed model is described as notional. The actual mechanism is declared to be someone else’s problem. Every claim is built into a disinformation smorgasbord, laid out so that no observation counts against them. The effects produced by SIGINT are declared evidence that it could do more, while effects not produced are declared evidence of suppression.

The Referentenentwurf meets the triad, which is what makes it the more serious document. Its actors are named, the BfV and the BND. Its mechanisms are specific, automated countermeasures under the new § 25 Absatz 6 and a domestic deception charter under § 60 Absatz 2 Nummer 1 Buchstabe c. Its claims sit in the hefty 691 pages of text that anyone can read.

What the papers do not contain is any citation for the model being proposed, just like the thesis in the podcast. Nothing. Not Australia, not the Australian Signals Directorate, not the National Cyber Force, not GCHQ, not Cyber Command, not persistent engagement, not even the responsible-cyber paper. There are exactly zero occurrences in 691 pages.

The draft does look at other countries, but only when it wants to loosen the rules. When the authors want to weaken the wall between spying and police action, they point out that Austria, Sweden, and the American FBI run combined agencies. When they want less independent checking of collected data, they cite a survey of nine European states showing none require it in full. When the topic is the oversight body’s public report, a harmless transparency exercise, they cite the Netherlands and the United Kingdom as models. Every foreign example in the draft argues for fewer controls. Not one argues for the new powers.

And the new powers get almost nothing. The automated hackback authority cites a single source: a European regulation on artificial intelligence, from which the draft borrows some quality language while stating, in the same breath, that the regulation does not apply here. The power to spread false information cites nothing at all. So Germany has written itself an offensive cyber doctrine without referencing a single country that has actually run one, and those countries are the only place the hard answers could have come from: how often automated systems hit the wrong target, and what happens to bystanders when they do.

The draft is missing the same answers the podcast was missing, and reading both side by side suggests why: there was never a source behind either.

The podcast speaker could not say what these operations achieve. A German draft grants the power to run them anyway, with no analysis of how often they would fail. The speaker called the opportunities unknowable. The draft lets a machine act on them automatically, with a human checking only afterward, when damage is done and the action cannot be taken back. This violates the one source the draft cites: the same European regulation it borrows quality language from requires, in its human-oversight article, that a person be able to intervene in or interrupt an automated system. The draft quotes the regulation’s standards and deletes its stop button.

The podcast kept treating representation and review as an obstacle to executive powers. The German draft shrinks three independent watchdogs into one, and lets an agency chief postpone even that one’s approval simply by declaring the matter urgent. To put self-certification in proper context, alongside state-level political mythology, here is the current head of the BMI handling a single checkable number in public.

Every hole in the podcast’s argument shows up again as the same hole in this nation’s draft law.

Coincidence of timing, probably. Convergence of thinking, demonstrably.

The one good moment in the podcast, when a human looked at a proposed attack and said the trade is not worth it, is precisely the step the draft deletes.

An argument that could never describe what it was for is now on its way to becoming law, and enacting it without the analysis it never contained is what I would argue is a grave mistake on the road to regret.

In William K. Clifford’s “The Ethics of Belief” (1877) he argues it is wrong (morally, not just intellectually) “always, everywhere, and for anyone, to believe anything upon insufficient evidence.” His example is a shipowner who talks himself into believing his ship seaworthy without inspecting it and sends emigrants to sea; the ship sinks, and Clifford’s verdict is that the sincerity of the belief excuses nothing, because he had no right to believe on the evidence before him.

Map that onto § 25 Absatz 6: a state acting automatically on unexamined conviction, with the inspection step deleted by statute. And the shipowner is not only a parable. American law codified him long ago as seaman’s manslaughter, which convicts on simple negligence, and its most recent famous conviction turned on a captain who failed to post the night watch, so a fire spread undetected while thirty-four people slept.

The deleted human watch was the crime.

Germany’s draft proposes it as policy.

The podcast and the draft law are Clifford’s infamous shipowner as cyber, at machine speed.

Believing without evidence is malpractice, if you will, especially in the country where yet another healthcare worker has just been sentenced for serial murder of patients.

He told the court he had convinced himself that he was doing the right thing, sparing them “suffering and infirmity”.

“Throughout it all, I thought this was the best thing for everyone,” he said.

That is Clifford’s shipowner speaking: sincere, convinced, and guilty of murder. The sincerity of a belief excuses nothing when there was no right to hold it. Clifford’s shipowner skipped the inspection; the German draft writes the skipped inspection into law after the podcast advocated for exactly that.

Welcome to the first declaration of Empty Hat. Hope to see you there.