While writing this week about the Russian “Vulkangruppe” attacking Berlin, I was reminded of the Sony hack attribution games we played a decade ago.
The isolationist narrative of DPRK was always wrong. It served people who wanted easy answers in both directions. The harder truth has been that North Korea leaked evidence of its Russian-enabled connectivity for nearly twenty years, as anyone willing to trace the rails and cables would know.Source: CSIS 2019
I don’t take victory laps on attribution. But I’ll take one on the flyingpenguin blog methodology, because it might help set context for what’s happening in Germany today.
The security community was so busy arguing about whether DPRK was sophisticated enough to have hacked Sony, I doubt anyone noticed the more mundane proofs right in front of them. When the usual skeptics insisted the hermit kingdom lacked connectivity, while the FBI asked us to trust classified evidence, both seemed unnecessarily closed minded.
I took a different, rather classic, approach: follow the open rails, look for the exposed cables.
This is how I identified Russian TransTeleCom as the likely provider, which led to identification of even far greater Russian involvement. I traced their fiber network to the border, by following the railway. I found the Khasan-Tumangang crossing and located photographs showing cables running across the bridge into North Korea. And I noted this was a decade afyer the 2006 agreement between TTK and the DPRK Ministry of Communications.
In September 2017, 38 North and FireEye finally confirmed that TransTeleCom had gone live as North Korea’s second internet provider, using exactly the infrastructure I’d documented on this blog two and a half years earlier.
The connection runs through the Friendship Bridge at Khasan-Tumangang, precisely where I’d spotted the cables on a pole.
Trend Micro in 2025 has published research on North Korean cyber operations identifying Russian IP ranges in Khasan and Khabarovsk as key infrastructure for DPRK offensive activity. They note the railway station at Khasan facilitates operations across that exact same bridge I was showing photographs from Panoramio a decade ago.
The methodology holds. PR maps, rail schedules, flight routes, treaty boundaries, and even eye-level photography. None of it means classified access or insider sources. It is only following physical infrastructure through physical territory to find the copper or glass running through places controlled by states with interests.
The same methodology applies today when we are tracing who’s really attacking German infrastructure. Find and follow the burned cables in Berlin, and watch how you end up finding a heat source from Russia. Protip: look wherever AfD shows interest.
Over a decade ago on this blog, and in a presentation at the RSA Conference with a U.S. Army JAG, I discussed how the Clegg court had long ago distinguished between three shots fired while an approaching vehicle posed a threat, versus the fourth shot fired after the threat had passed.
The situation involved soldiers on patrol who ordered a car to stop. When the car failed to follow orders it was fired upon. The soldiers’ claims were evaluated against scientific proof that a fourth shot hit the threatening vehicle after it had passed (entered it from the rear) and was more than 50 feet away. This contradicted Clegg’s testimony that he fired three shots through the front and the fourth shot through the side door as the car passed nearby. The judge thus ruled a fourth bullet was fired “with the intention of causing death or serious bodily harm” and Clegg was found guilty of murder.
A federal officer shot and killed a woman in Minneapolis on Wednesday, shortly after the Trump administration deployed thousands of immigration agents to the city.
An ICE agent named Jonathan Ross appears to have created his own separation from a woman and then fired when she fled, killing her. Quick review of the video circulating online easily reveals Ross manufactured his own safety position and used it to murder, meaning kill someone who clearly posed no threat to him.
I expect formal reviews also could confirm all the intimidation strikes on the car by agents constituted provocation, followed by lateral movement to get clear before firing from a safe position. If that’s what is found, it means premeditation measured in seconds—but nonetheless premeditation of murder.
Renee Nicole Good wasn’t even the target of whatever operation the agents were supposedly running. MPD Chief O’Hara stated “There is nothing to indicate that she was the target of law enforcement activity.” She was a bystander. She was a Christian who did youth mission trips and studied vocal performance and creative writing. She was a mother of a 6-year-old, a wife, who got trapped at a deadly militarized checkpoint.
The self-defense framework I presented back in 2012 explains how this tragedy isn’t a failure of training that led to a bad heat-of-the-moment decision. This is a sequence of deliberate choices, each of which moved agents toward killing rather than away from it. Any “heat of the moment” defense requires a lack of time to think. The video shows, in direct contrast, an aggressive escalation over many seconds, then a planned step-to-the-side, draw and fire from a stable position. It shows time to reposition. That time was used to aim, and shoot to kill.
Notably, approaching the vehicle to trap, yell and repeatedly bang on it is an aggressive act, not a defensive one (as defined by police themselves, given harsh charges dispensed on pedestrians who dare to obstruct or touch a vehicle).
Two agents approached. KSTP reported audio of agents shouting “Get the fuck out of the car” while violently and repeatedly yanking the door handle for over three seconds—accomplishing nothing except terrorizing the driver into fight or flight. The other positioned himself at the front left of the vehicle, indicating a trap blocking flight, to force a fight. When the panicked driver refused to fight and turned hard right to flee, the blocking agent pivoted left and fired into the departing vehicle from a safe position to the side and behind it as it drove away, as the BBC clearly proved.
He then kept walking toward the car he had just shot into—no stumble, no hesitation, no physiological response of someone who had just escaped a threat. Just forward motion toward his target.
A de-escalation-trained officer would step back, create space, communicate calmly. These agents did the exact opposite, moved in to escalate and push hard for a fight.
Their efforts were not a response to any threat. Stepping in front and then quickly to the side for a clear shot, before firing, is the evidence that an agent had planned and created clearance for himself, not for safety but for a provocation and pivot to achieve a deadly firing angle.
You cannot create a threatening situation through your own aggressive conduct, premeditate lethal force, and then claim self-defense against the response you provoked.
When I first looked at the video, given I’ve studied self-defense ethics for over three decades and hold two degrees in it, my impression was that this has all the hallmarks of an execution sequence. ICE agents appear to have setup the exact plan seen around the world in military dictatorships. It is especially reminiscent of the 1989 checkpoint killing of Marine Lieutenant Robert Paz, which was used as a casus belli for American invasion of Panama to remove their leader.
In 1989, America said a checkpoint killing was an act of war requiring head of state removal. What is it in 2026?
Is this checkpoint killing by ICE considered an act of war against Americans, just like it would have been in 1989? And if so, who is going to invade America now to remove the head of state like America demanded in 1989? The federal checkpoint in a US city trapped and killed an innocent citizen who became terrified and panicked. She was trying to leave them, which paints a structural parallel to Panama regime change that is damning.
Renee Nicole Good is a modern day Lieutenant Robert Paz.
Let me explain how we can see the injustice, in more detail.
Look at the agent movement frame-by-frame. Around 16.5 seconds into the video that I have, the agent who had been positioned at the front of the vehicle pivots to his left and fires into the car from a safe distance to the side. The vehicle already turned HARD RIGHT and is moving safely AWAY from all the agents to flee them. At the moment of discharge, the shooter positioned himself clear and to the LEFT SIDE and then rear of the vehicle—completely opposite its path.
Click to enlarge. Source: YouTube
A further analysis of 701 extracted frames at 30fps offers several provable conclusions:
Direction of travel: Vehicle turned right, agents all stood to the left. No agent was in danger on the right or in the vehicle’s path at the moment shots were fired at the vehicle leaving them.
Temporal gap: Approximately 1-2 seconds elapsed between vehicle movement initiation and shooting—enough time for the agent to assess threats (if any existed) had passed.
Agent mobility post-shooting: All agents standing and walking normally in aftermath frames. The supposed agent at risk is the most able and active, appearing to still be in aggression mode walking towards the vehicle. No agent showed any indication of any harm. Noem’s claim that the officer was struck is contradicted by the video that shows the officer positioned himself to strike the vehicle (not the other way around) and then shot the driver in violent aggression and escalation when the driver was leaving.
The pivot-to-the-side: The shooter had been at the front left of the vehicle. As the vehicle began moving, he pivoted left and fired from a position completely to the side—safe, clear, and facing a departing vehicle. He manufactured his own clearance, then used it to shoot.
This checkpoint killing is far worse than the foundational Clegg findings.
In that case, the court had to reconstruct bullet trajectories to prove the fourth shot entered from the rear. Here, you can watch the geometry in real time as an officer steps back and murders a woman who poses no threat to anyone. The agents’ high aggression and vehicle’s rotation away from the agents is visible by frame.
The Clegg forensics have been disputed in subsequent decades. But in Minneapolis, there’s no trajectory reconstruction needed as you can watch an agent step to the side and fire at a vehicle driving away from him. Even extremist gun advocates accept that shooting at a fleeing vehicle would be murder if proven. They just dispute whether it was proven in Clegg. In Minneapolis, it’s on video.
The video also shows a doctor identifying himself and attempting to provide aid, only to be told “I don’t care” by an agent who directed him to back away. That’s obstruction of emergency medical care to someone they just shot. It compounds the accountability question.
Related:
The Babbitt family sued after she joined a violent protest and was shot dead by federal officers.
Babbitt’s estate filed the $30 million lawsuit after her death, alleging that she was wrongfully killed by a Capitol Police lieutenant as she tried to climb through a broken window near the Speaker’s Lobby inside the U.S. Capitol.
President Trump sided with the family, and sent a clear message to law enforcement not to shoot.
The Trump administration has agreed to pay a $5m (£3.7m) settlement to the family of Ashli Babbitt, a US Air Force veteran who was shot and killed by a Capitol police officer while breaching the US Congress on 6 January 2021. […] Trump in March told conservative news outlet Newsmax that he’s “a big fan of Ashli Babbitt”…. “And a man did something unthinkable to her when he shot her, and I think it’s a disgrace,” he said, promising to “look into” the lawsuit brought by her family.
Presumably now Trump will offer the Good family millions as well.
An astute commenter on this blog has prompted me to go deeper into what a genuine German anarchist collective attacking energy infrastructure would call themselves.
I can say with certainty, based on history, that investigation of left-wing extremism leads to names and tags like these:
Autonome Zellen (Autonomous Cells)
Schwarze Flamme (Black Flame)
Klimarebellion (Climate Rebellion)
Anti-Atom Aktion (Anti-Nuclear Action)
Bewegung 2 Juni (date of disaster)
This clarification of identity is not about speculation as much as experience from inside anarchist hacking culture, and decades of evidence.
In complete contrast, however, a name like “die Vulkangruppe” reads like someone in the Russian military contractor business wanted a dramatic German-sounding name like Wagner Group. Hitler loved Wagner. Hitler loved Roman mythology.
In fact, when you look at over 100 years of anarchist naming habits, the use of the Roman god name Vulkan fails every single test!
NO political descriptor – not “Revolutionary,” “Red,” “Autonomous,” “Anti-“
NO commemorative element – no date, no martyr
NO class signifier – no worker/proletarian reference
WRONG frame – anarchists believe “NO gods, NO masters”
WRONG aesthetic – Roman mythology is bourgeois classical education associated with fascism
WRONG imagery – Forge/weapon of Vulkan god symbolizes dictator, strong man
I’ll say it again. 100 years.
Here’s another way to explain the naming problem. The left never uses anything that the Vulkan framing does. The meaning is so far removed from political conventions on the left, that its use becomes evidence of extreme right-wing symbolism.
Category
Why Rejected by the Left
Roman/Greek mythology
Associated with classical education = bourgeois elitism
Gods of any kind
“No gods, no masters” is a foundational anarchist slogan
Forge/weapon-maker imagery
Celebrates industrial capitalism’s instruments of power
Nature mysticism
Associated with völkisch/fascist movements in German context
National mythology
Internationalist ideology explicitly rejects national symbols
On top of that, Germans culturally reject Roman imagery because their national identity was built on defeating Rome. Russians, by contrast, embrace it: “Third Rome” ideology, Tsar derived from Caesar, imperial inheritance from Byzantium. The Vulkan name fits Moscow’s right-wing mystic vocabulary, not Berlin’s.
And what about the Icelandic volcano aliasing like the Hekla and Katla pseudonyms? Germans have no cultural connection to Iceland. Nothing. More importantly, climate activists focus on human-caused problems: fossil fuels, carbon emissions, nuclear waste. Volcanoes are natural geological events that represent the opposite of what environmentalists protest.
No genuine green anarchist would brand themselves around volcanic imagery, because why would they? Such a meaningless foreign geological reference is an implausible German activist naming story. The volcanic aliasing instead reads like backstopping by GRU; a thin cover fabricated after the fact for Russian military contractors to obfuscate Roman god worship.
The 2011 Hekla-Empfangskomitee attributed to the Vulkangruppe is even worse German! It makes no sense unless you speak Russian.
A Russian naturally would say: “Комитет по встрече Гекла” or “Committee for the reception of Hekla”. That becomes… Hekla-Empfangskomitee.
A German would say Hekla-Begrüßungsgruppe or just use the volcano name alone. In German left-wing militant groups we never see any reference to any committee:
Fraktion (RAF)
Zellen (Revolutionäre Zellen)
Gruppe (Baader-Meinhof Gruppe)
Bewegung (movement)
Bund (league)
However, in Russian the word Комитет (Komitet) is everywhere like КГБ = Комитет государственной безопасности (Committee for State Security). I mean the Komitet Gosudarstvennoy Bezopasnosti is a canonical example because that’s the KGB. Therefore the “reception committee” phrase is alien to Germans, and practically a Russian fingerprint for the terror group.
The construction of “Hekla-Empfangskomitee” combines:
A foreign geological reference with zero connection to Germany, zero connection to climate
A word (“Empfang”/reception) Germans would not use
An organizational suffix (“Komitee”) that is a default in Russian, and only appears in Germany under imposed Soviet bureaucracy
Add to all this that there have been attempts by Russian intelligence services to organize vandalism in the name of environmental activists. The recent “Be Greener!” operation proved over 270 vehicles were damaged by Russian assets across Germany to inflame public sentiment against the Green Party and Robert Habeck. The perpetrators were not climate activists but rather individuals recruited by the FSB.
“Die Vulkangruppe” appears by all accounts to be a Russian term, about as “German” as Russia’s infamous “The Wagner Group”.
The bogus “innovation” rhetoric from Californian billionaires Sacks and Khosla is so thin, it isn’t even a cover. It’s a form of disinformation. What they describe is elites performing harsh extraction.
Larry Page is officially moving business out of California ahead of a proposed billionaire’s tax
This is some late 1800s boondoggle language by robber barons. They swindle. They cheat. They hornswoggle. All that heated rhetoric just to take as much as they can and avoid giving.
Stanford, the actual man who founded the school, literally took huge government payments for services and goods he never delivered. His name is best associated with fraud, racism and genocide. Perhaps, so much hidden for so long, that we should not be surprised to see ongoing atrocious behavior from the graduates of Stanford.
Google launched on public funding out of Stanford, built on the back of Yahoo—also launched out of Stanford. A university built with huge land grants and public research funding was the genesis. The early search algorithm was developed under a federal taxpayer grant from the NSF. The internet itself was a taxpayer funded DARPA project. California’s public university system, its roads filled with Google buses and Waymo cabs, its courts that enforce contracts and intellectual property—all of it is the substrate that made Google possible. Without taxpayer funding, Silicon Valley, let alone Google, would not have existed.
And the response to being asked for a measly 5% tax to keep the system running is to flee to a state specifically structured as a shelter for robber barons—one whose entire political system has become a preferred destination for Russian blood capital.
Related: Feb 2025 press release about DOJ conviction of elites laundering Russian money through Sunny Isles properties. Florida, it’s where elite money extraction schemes run to hide.
It was not “I disagree with this policy and here’s my counter-proposal.”
Just: no, I don’t share, I grab and run to where the sun don’t shine.
Five percent as public benefit? Five percent to give back to those he has taken so much from, and to help the next Larry Page?
If it were about policy disagreement or preferring a different state’s governance, you’d see some alternative contribution. Instead it’s pure negation: I will pay into no system of representation I don’t control, or into any democratic institution of law, anywhere.
Florida gains nothing because there’s nothing to gain. No state income tax, no wealth tax. Page isn’t relocating his tax burden to a different American community. He’s eliminating it, hiding like an imperialist baron trying to delay the fall of his empire by amassing wealth into a walled island.
Imperialism framing is a precise fit. It’s the same pattern: extract value from a territory, externalize costs onto that territory’s population, use legal structures to ensure the profits flow elsewhere. The only difference is they’re doing it to their own country rather than colonies—though the distinction blurs when you consider which communities bear the costs of underfunded schools and infrastructure. The racial geography of Silicon Valley wealth is not accidental; Palo Alto was built on restrictive covenants, and tech money has only accelerated the displacement patterns that followed.
Page fleeing California to avoid paying taxes is just the individual-scale version of this logic. His entitlement is breathtaking evidence of mental gymnastics and cruelty. He registers $156 billion in accumulated value and the response to a small public contribution—like what he benefited from—is to run like a Victorian drunk refusing to pay the bar tab because “do you know who I am.”
The question isn’t what Google elites pay, it’s what they’d pay without their long-term anti-social cheat-the-system architectures. These people who’ve captured massive value from a hedge on top of public infrastructure, from publicly educated workforces, and from public legal frameworks are cruelly engineering their affairs to contribute back as little as possible to those foundational systems, or nothing at all.
The structure was predation defined: intellectual property licensed to a Dutch subsidiary, which paid royalties to an Irish holding company, which was tax-resident in Bermuda. Profits generated by American engineers, using American infrastructure, research funded by DARPA, educated at public universities, all routed through tiny island shells to avoid contributing back any of it.
What’s next, seasteading for Lebensraum or to colonize Mars and revert humanity to strongman fantasy zones of zero laws, just for one guy’s latest whimsy? Slavery next?
Google intentionally paid an effective rate in the single digits on foreign earnings for years despite a statutory US corporate rate of 35%. The “Double Irish” closing didn’t end the game, just shifted it to different structures. The proposed single digit 5% wealth tax on Page’s $156 billion comes to roughly $7.8 billion. Not much. Would you give an $8 tip on a $160 meal? Imagine being asked for 5%, a whopping 30 point discount under the statutory corporate rate, and then running for the door rather than pay your unsalaried uninsured waiter even a cent.
There’s also the irony that tech elites constantly lobby for H-1B visas, importing workers educated at other countries’ public expense, while refusing to fund the domestic systems that educated their founders. Pulling up the ladder after climbing it is toxic, and very typical of American elites.
“Throwing Down the Ladder by Which They Rose,” Thomas Nast, 1870, for Harper’s Weekly, New York, New York. Anti-immigrant Americans, under the banner of the “Know-Nothing Party” for a nineteenth-century nativist political party, attempt to deny Chinese entry into the United States. The hypocrisy of the descendants of immigrants denying citizenship to immigrants is on full display in this biting political cartoon.
Page claims he’s escaping to freedom, but he’s actually building his own cage of misery. His island-buying will never be liberation, only isolation and exile. The man with $156 billion ends up scared and guarding his rock like a tin-pot dictator because he couldn’t bear to participate in real freedom.
a blog about the poetry of information security, since 1995
