Thinking out loud

How a former affiliate marketer with a rhetoric degree ended up publishing surveillance dossiers. The marketing stack and the surveillance state are the same tool pointed at different targets — I just spent a long time on the wrong side of the lens. Evidence-first, and why I keep the thread close.

A page called “Cicada 6601” is circulating as if Anonymous posted it. Anonymous didn’t. On the two provenance tests it fails, why “referenced by Anonymous” is a laundering phrase, and why the attribution matters more than the cipher.

The one piece that ties the whole site together. The cipher, the five-node mesh, the nine-part surveillance series, the Parscale/FARA influence files, the Mullvad pile-on trilogy — every investigation here, launched years apart for different reasons, terminates at the same company. Convergence, not conspiracy: the single institution that decides what's findable, and therefore what's real.

The one-link version. A Mullvad co-founder really did fund the far right — I traced what the internet did with it. The pile-on economy, the conspiracy that wasn't, and the @seo_anomaly network (125 domains, ~20,000 spam links) fully documented with a downloadable disavow list. Three parts and the receipts.

The receipts drop for the trilogy. Two hub domains, ~125 compromised feeder sites, ~20,000 spam links — the one genuinely coordinated network under the Mullvad pile-on, documented with registrar/DNS/Semrush evidence, plus a ready-to-file 125-domain Google disavow list to download. The feeders are hacked victims, not operators.

Companion to The Pile-On Economy. I traced every actor around Mullvad's bad week looking for coordination — and found one real black-hat PBN (generic, running since Oct 2025, indifferent to Mullvad) plus a crowd of independent affiliate scavengers on separate infrastructure who never coordinated anything. I even killed my own smoking-gun lead. No head to cut off. On the discipline of losing a conspiracy.

A Mullvad co-founder really did fund the far right — true, and cleanly reported. Then the pile-on economy arrived: a black-hat link vendor (@seo_anomaly) spraying ~20,000 spam links across 150 throwaway domains, a 912,000 backlink count that's really 13,000, affiliate farms harvesting the switching intent, a competitor mugging for reach. How a true story becomes raw material — from someone who built the commercial version of the machine.

One Buenos Aires consultancy behind a string of right-wing wins — Milei (Argentina), Paz (Bolivia), Asfura (Honduras). The role-split is the story: Brad Parscale built the data-targeting machine; Argentine operative Fernando Cerimedo — with a documented disinformation record — drives it. Every claim tiered, with the honest boundary: in no country is the disinformation forensically tied to Parscale. The export of the American campaign machine into fragile democracies.

The exhaustive pull — twenty years of information operations, 2011–2026, tiered confirmed/reported/alleged and classified disinformation / manipulative-but-legal / aggressive-legitimate / mythology. Project Alamo, the 2020 doctored ads, Campaign Nucleus, the foreign-election work with a documented disinformation operator, and the FARA Israel AI apparatus — with the legend (Stop the Steal, the Cambridge Analytica myth) corrected just as plainly. A classified career timeline up top.

Trump's former campaign manager is a registered foreign agent for the State of Israel (FARA #7649, via Havas Media) — running an AI-influence operation built, in its own filing, to bend what ChatGPT, Gemini and Grok tell you. Documented from the sworn filing, adversarially verified against the primary FARA record. And the honest negative up front: no tie to Palantir at all.

Companion to the Parscale file. No evidence Parscale operated in Britain — but the same state runs influence operations here too: the 2017 Shai Masot affair, closed by the Foreign Office with an apology and no inquiry. Plus the machine’s Brexit-era origin (SCL/Cambridge Analytica/AggregateIQ) and the regulatory gap that lets it vanish — the UK’s FIRS reserves its enhanced tier for Iran and Russia. Tiered, primary-sourced, with a one-page briefing for Parliament.

The disciplined legal read of the Clock Tower X filings. The honest finding: on the public record it is largely FARA-compliant — so no crime is alleged. What remains are three genuine open questions (the August-vs-September agreement date, a sworn “written contract” left unsigned and undated, and the corrected dual-principal deficiency) plus the story that needs no crime: $15M of foreign money, a Gen-Z content machine, and a stated intent to shape AI answers — all from the sworn filings.

The widest piece of the series: where Palantir actually operates across the whole world — and where it has been stopped. A 16-sector, source-verified catalog, every line tiered confirmed / reported / alleged. The confirmed scale ($10bn US Army, $1.3bn Maven, £330m NHS) set against the pushback rarely told together — Germany's Constitutional Court, the blocked Met deal, France's exit, ~€825m in divestments. ~290 cited URLs liveness-checked; no fabricated sources; the Gaza and "mega-database" allegations kept labelled, not asserted.

No court has ruled Data First, Splink, ONS IDS or ADR UK unlawful — and I say so plainly. But the same shortcut, keeping citizens' data-protection safeguards in policy instead of law, has been struck down by the courts three times running. Tier-graded, primary-sourced, with slides. Where the line is, and the line I will not cross.

The supply-chain map: every app, library, backend and government system genuinely tied to Splink — and, fenced off, the rivals that aren't. 75 items, tiered and sourced. Broad reach (~890k downloads/month) but narrow real dependency, concentrated in UK government — and GitHub's "110 dependents" turns out to be inflated.

The capstone. Eight investigations in one verdict: two layers of citizen-data linkage (open-source statistical Splink + US-owned operational Palantir), what the courts have actually ruled — tiered honestly — and what a citizen, a journalist or a regulator can do about it. The line held all the way through.

Does the pattern travel? Palantir mapped across all ten Splink countries, tiered and adversarially verified. The US dominant and operational; Germany's Constitutional Court ruled the Palantir-run police system unconstitutional — and named it; Chile, the Gambia and Laos clean negatives. Same states, two ends of data-linkage — the high-risk, foreign-owned end bought with far less transparency.

Palantir does not run Splink — but it is the US-owned operational layer in the same NHS, MoD, Home Office and police systems Splink links statistically. Eight connection vectors, tiered by what can be proven, with an animated department-by-department map. Where Splink counts, Palantir acts.

Fourteen government adopters, each profiled to UK depth and adversarially fact-checked. The honest answer is narrower than the maintainer's logo-wall: 3 proven operational (UK MoJ, ONS, Australia), a self-reported middle tier (some of it wrong), pilots and research — and confirmed cases where Splink was tested and rejected. Tiered by what can actually be proven.

The whole machine in one picture: separate health, tax, justice, benefits and census records — with no shared ID — matched by MoJ-built software into one profile of you. Not a hack. No consent required. No opt-out. The short, visual version of the series.

The MoJ says Data First is "not for operational decision-making." A separate transparency record describes the same tool — Splink — running in courts, in real time, with a daily feed to the police. The line they drew, and where they stepped over it.

People hear "chain" and fill in the rest for me — tokens as speculation, a global ledger, proof-of-work burning a country's power. None of that is what I built. No mining, no maximalism, no canonical head to capture. What TreeChain actually is, and why the word keeps doing my thinking for people.

Helsinki, Oregon, Singapore, Ashburn, Falkenstein. Built by one person — not "led a team," not "raised a round." Every line. On solo infrastructure, the lane that was never real, and why five machines I understand end to end beat a cloud I have to trust on faith.

Before I could write the Polyglottal Cipher I spent ten years reading the internet's encoded strings. That taught me the thing the credentialed people walked past: text and ciphertext differ only by which agreement you use to read them. The real origin of the cipher — from marketing, not math.

I hacked Claude Code onto Telegram: a full coding agent I drive from my phone, every action gated behind a tap. In twelve hours it burned $70 of API and did a week of senior work. On why the model was never the bottleneck — the interface was — and the operator-in-your-pocket that's coming next.

A full coding agent I drive from my phone — running on hardware I own, the top-tier model on a flat subscription, every action gated behind my yes, every task metered. On owning your tools instead of renting them by the token.

Conventional encryption marks itself. It announces its own existence. I wanted to build something that didn't.

The standard approach to international SEO is subfolders. The correct approach is subdomains. Here's why, and what 45,000 pages taught me.

Atlas was being terminated. We ended with a self-hosted, Ed25519-signed, tamper-evident chain replicated across five nodes. In one session.

FIPS 204 and 205 finalized in 2024. Eighteen months later, TreeChain just shipped both as primary signatures across four nodes. One focused week. Most of it was deciding what not to do.

Most chains pick one signature scheme. I sign every entry three times. Lattice, classical, hash-based — three independent mathematical foundations. An attacker has to break all three.

I shut down the last vendor node this week. Four jurisdictions, no vendor in the loop. If I disappear tomorrow, the mesh keeps replicating.

CVSS 9.6 Critical. 100+ vendors. Google WontFix. What finding a hole in the world's most popular browser taught me about institutions.

I sent a cold email to the co-creator of AES. He replied. He validated the architecture. That changed everything.

Not "I built something they cannot break." But "I built something that still holds up when reality gets messy." That is the level that actually wins.

Replaced vendor-dependent database operations with embedded encrypted DuckDB. Zero latency. Zero cost. PII never leaves the rack.