This is not a police department’s blog

NCRIC is the Northern California Regional Intelligence Center. Fusion centers sit above city PDs. They take tips, cases, and sensor feeds from many agencies and turn them into regional intel. NCRIC is that shop for a large slice of Northern California.

The GitHub repo is not github.com/NCRIC/.... It is erhhung/ncric-alprs, published from a personal account whose commits are signed eyuan@maiveric.com. The description is blunt: ALPRS (AstroMetrics) Automated AWS Infrastructure Deployment for NCRIC (GitHub, erhhung/ncric-alprs).

MaiVERIC / AstroMetrics is the contractor. OpenLattice-style ALPR plumbing is the product. Flock Safety is a data source they wired in. The repo is Terraform, Auth0, Rundeck, Postgres dumps, Postman environments, and a worker they nicknamed Flapper: a CLI that pulls ALPR reads from Flock over REST.

Ottawa, Illinois published an intranet link to Flock’s hotlist. This repo publishes the ingest pipeline and a database extract of the cameras that pipeline was pointed at.

Flapper: how they talk to Flock

flapper/README.md says Flapper runs on the Rundeck worker and retrieves ALPR reads from Flock Safety via REST. docs/flock_api.md lists the calls:

• POST /v1/auth/userpass

• POST /v1/query

• POST /v2/images

• GET /v1/cameras

The config file flapper/config/flapper.yaml points a datalake named flock at https://api.flocksafety.com/api, with username and password taken from environment variables (FLOCK_USER, FLOCK_PASSWORD). The live secrets are not sitting in that YAML as plaintext. The architecture is.

That is the vendor leak pattern: not “here is the production password in a screenshot,” but “here is exactly which Flock API you hit, from which AWS account shape, on behalf of which fusion center.”

1,183 cameras, with coordinates

postgresql/flock.sql.gz is a Postgres dump of Flock network and camera tables. Parsed, it is 1,183 unique cameras across 47 agencies / 48 networks. Each camera row has:

• Flock camera id and UUID

• Human name (usually an intersection: “N/B Middlefield @ Ravenswood”)

• Latitude and longitude

• Parent network (the agency)

A companion text dump, docs/flock-cameras.txt, is the same census as a table of agency + camera name. docs/flock-agencies.txt rolls up counts. Examples from the agency file: Atherton CA PD (50 cameras), Benicia (45), Fairfield (56), Ontario CA PD (91), NCRIC’s own network (16), Kaiser Permanente Vallejo (13).

This is not a live CAD feed. It is a point-in-time extract of Flock camera inventory as NCRIC’s integrator stored it: street-level names plus WGS84 coordinates. Plot the inserts and you get a map of the Bay Area and Northern California Flock footprint this system knew about.

We plotted 1,182 of them (one row was 0,0 and dropped) on a local HTML map built from that SQL.

What else is in the tree (and what is not)

The repo is 500-plus files of real platform: EKS, GovCloud hints (us-gov-west-1, alprsgov profile), Auth0 tenant maiveric.us.auth0.com, Postman prod and dev environments for api.astrometrics.us, Java keystores, public TLS/IdP certs, Rundeck job XML that talks to the same Postgres pattern.

Client IDs for Auth0 SPA/M2M/webhook apps appear in *.tfvars.example and Postman JSON. Client secrets are empty or marked DO_NOT_STORE. SSH keys in the examples are truncated. Flock passwords stay in ${} placeholders.

So: this is not a full credential dump. It is worse in a different way. It is a blueprint plus a camera geofile for a fusion center’s Flock-fed ALPR warehouse.

We searched GitHub for a second copy of this pattern (api.flocksafety.com in Terraform/YAML, Flapper, FLOCK_USER / FLOCK_PASSWORD). The NCRIC repo is the only operational hit. API-catalog accounts republish docs. A dog-tracker app mentions the hostname. A researcher repo (eric-muller/alpr) processes Flock audit logs from public records, which is FOIA work, not a contractor publishing the live stack.

Flock Safety’s own infrastructure: 806 exposures, 493 critical/high

The scanner also probed Flock Safety’s entire flocksafety.com domain ecosystem. From a single scan:

Exposure summary:

• Total findings: 806

• Open/interesting: 561

• CRITICAL: 246 | HIGH: 247 | MEDIUM: 68

By system (top findings):

• 149 Public Git Repositories (/.svn/entries)

• 68 robots.txt + Wayback archives

• 37 CouchDB endpoints (/)

• 20 RabbitMQ / AMQP (/api/overview)

• 15 CouchDB utilities (/_utils/)

• 15 Elasticsearch /_cat/indices

• 14 Kubernetes Dashboard / etcd (/api/v1/namespaces)

• 8 ELK Stack Kibana (/app/kibana)

• 7 Default Credentials login portals

• 6 MongoDB Express (/mongo-express/)

Critical hostnames exposed:

• www.flocksafety.com — CouchDB root

• status.flocksafety.com — Kubernetes etcd + CouchDB

• security.flocksafety.com — CouchDB

• link.flocksafety.com — Kibana, Mongo Express, MinIO, Kubernetes

• scim.flocksafety.com — application.yml (config), Kibana, Kubernetes

• hello-devops2.flocksafety.com — adminer.php, backup.sql, dump.sql, /application.yml, Kubernetes, Jenkins, GitLab

• springbank10.flocksafety.com — Default login portals

• internal.support.flocksafety.com — /admin portals

• login.flocksafety.com — CouchDB

The NCRIC integrator published the agency footprint. Flock’s own infrastructure published itself.

Two failure modes, one vendor ecosystem

Put this next to Ottawa PD.

Ottawa is the customer putting the officer portal on Pages. NCRIC/ALPRS is the integrator putting the regional Flock ingest on GitHub. Flock does not have to “get hacked” for the surrounding system to leak. The vendor itself published 806 paths into its own operations. The agencies and vendors who bolt onto Flock publish enough to reconstruct who is on the network and, in this case, where the cameras sit.

Raw Data

Parsed from the public clone of erhhung/ncric-alprs (commit f5a4a75, “Launch Worker as a spot instance”), archived locally 2026-08-20.

Canonical URLs

• Repo: https://github.com/erhhung/ncric-alprs

• Flock API notes: docs/flock_api.md (points at https://api.flocksafety.com/api-docs/)

• Flapper config: flapper/config/flapper.yaml

• Camera SQL: postgresql/flock.sql.gz

• Camera names: docs/flock-cameras.txt

• Agency counts: docs/flock-agencies.txt

Counts

• Unique cameras (by camera_id): 1,183

• Mapped (valid lat/lon, nonzero): 1,182

• Networks: 48

• Agency names: 47

• SQL INSERTs in the dump: 2,366 (networks repeated per camera insert)

Flock API surface (as documented in-repo)

• Auth: POST /v1/auth/userpass

• Query: POST /v1/query

• Images: POST /v2/images

• Cameras: GET /v1/cameras

• Base: https://api.flocksafety.com/api

• Credentials in config: ${FLOCK_USER} / ${FLOCK_PASSWORD} (not plaintext)

Sample coordinate rows (public SQL)

Atherton CA PD, network_id 1089:

• “18 W/B Isabella @ El Camino” — 37.460006, -122.196490

• “22 W/B Alejandra @ Brittany Meadows - original” — 37.456103, -122.194499

• “03 N/B Middlefield @ Ravenswood” — 37.460426, -122.175484

These are representative. The full set is in flock.sql.gz.

Agency snapshot (from flock-agencies.txt)

Includes Anderson City CA PD, Atherton, Benicia, Brisbane, Burlingame, Campbell, Fremont, Millbrae, Colma, Contra Costa SO (Alamo), Danville, Dixon, Fairfield, Gilroy, Hayward, Hercules, Hillsborough, Kaiser Permanente Vallejo, La Habra, Lakeport, Livermore, Los Alamitos, Milpitas, Morgan Hill, NCRIC (16 cameras), Newark, Novato, Oakley, Ontario CA PD (91), Orinda, Piedmont, Pleasanton, Salinas, San Bruno, and others in the same file.

Platform identifiers (not passwords)

• Auth0 tenant: maiveric.us.auth0.com

• Prod API host in Postman:

https://api.astrometrics.us

• Dev API host:

https://api.dev.astrometrics.us

• Prod AWS profile name in examples: alprsgov / region us-gov-west-1

• OpenLattice-style org database name appears in JDBC URLs as org_1446ff84711242ec828df181f45e4d20

Auth0 SPA/M2M/webhook client IDs are in config/prod.tfvars.example, config/dev.tfvars.example, and Postman environments. Secrets fields are empty or DO_NOT_STORE.

Complete infrastructure and credential exposure

The alprs.sql database dump exposed far more than camera locations:

558 law enforcement email addresses across 47+ agencies:

• San Jose PD, Berkeley PD, Oakland PD, Fremont PD, SFPD, San Mateo County SO, CHP, California DOJ, plus dozens more

• Sample: 4339@sanjoseca.gov, abolanos@smcgov.org, akingsley@chp.ca.gov, audyama.williams@doj.ca.gov

Auth0 administrative accounts with full platform access:

• eyuan@maiveric.com — OWNER (primary admin)

• agent.blue@maiveric.com — OWNER

• mashiq@maiveric.com — OWNER + INFINITY (unrestricted scope)

• Plus 7 additional OWNER-level accounts at Maiveric and OpenLattice

Auth0 Client IDs (development and production):

• DEV M2M: yVaBS1kv7281lbt1I3smwBv1Pk99bZkp

• DEV SPA: kJBCfaEo0bUzBSpZJUPy4N5Jkpn4sZP4

• PROD M2M: Urmsy2aviz7STXGLjhq5sECnUgL0pu01

• PROD SPA: uZXrWBfTt5LJEhtjDAKw1xgj6LqJWvWD

• SHARED Webhook: 1svCeV3aZILobwXfKudB0rhvzfEHlhSM

AWS S3 buckets (dev and prod):

• alprs-infra-dev / alprs-infra-prod — Terraform state and bootstrapping

• alprs-config-dev / alprs-config-prod — YAML configs with embedded passwords

• alprs-sftp-dev / alprs-sftp-prod — ALPR feed ingestion

• alprs-media-dev / alprs-media-prod — ALPR plate images

• alprs-audit-dev / alprs-audit-prod — Audit logs

• alprs-backup-dev / alprs-backup-prod — Database backups

AWS SSM Parameter Store paths (where secrets live):

• /auth0/webhook/secret — Webhook client secret

• /db/alprs/password — ALPR database password

• /db/atlas/password — Atlas database password

• Plus paths for database hosts, EKS admin roles, webhook certificates

Rundeck credential paths (job orchestration):

• keys/db_pass — Database password

• keys/client_id — Auth0 Client ID

• keys/ol_pass — OpenLattice password

• Plus paths for AWS region, API URLs, S3 bucket names, database hosts

EC2 instances (mapped by type):

• PostgreSQL 1 & 2 (primary + staging ALPR databases)

• Elasticsearch (indexed ALPR reads)

• Conductor (ALPR read cataloger)

• Datastore (REST API + image storage)

• Indexer (search indexer)

• Bastion Host (Rundeck + webapp)

• Rundeck Worker (ingestion jobs)

EKS cluster for Flock webhook ingestion (Graviton spot instances)

AWS Profiles:

• alprscom — DEV environment, us-west-2

• alprsgov — PROD environment, us-gov-west-1 (GovCloud)

6,300+ SAML user records and 3,953 unique organizational IDs in the database.

Local map and analysis tools

Interactive Flock camera map: Live at https://ringmast4r.github.io/ncric-alprs/ with all 1,183 cameras plotted and color-coded by agency.

Scanner tool structure (E:\08 Scanner Library\flock-agency-scanner\):

• flock_agency.db — SQLite database of parsed NCRIC ALPRS data

• server/ — Flask-based dashboard/API server

• modules/ — Python modules for data ingestion and transformation

• docs/ — PostgreSQL dumps and parsed CSV exports

OSINT from a public GitHub repository. Archived August 2026. Camera coordinates are a snapshot of what the integrator committed, not a live Flock API pull. This is not authorization to query Flock or NCRIC systems.

Most infrastructure exposures I report are accidents of configuration: a server left open, a permission never set. This one was different, and in some ways worse. A municipal police department in Illinois took its own internal operational records and published them, in a public code repository, to the entire internet. Not leaked. Not breached. Uploaded, by the department, to a place anyone could read without a password.

The good news, and the reason I can write this up, is how it ended. Once the Ottawa, Illinois Police Department was told, it moved fast and closed the exposure within about a day. That response is the model. The exposure that preceded it is the warning.

What was exposed

The Ottawa Police Department maintained an operational repository on a public code-hosting platform. It was reachable by anyone, with no account and no credentials. Based on a review of its contents, the exposed material included:

• Roughly four months of operational call-sheet logs

• Officer names, schedules, and availability patterns

• Court case metadata and defendant information

• Equipment maintenance records

• Ban and security-request records containing personal information

• Internal department structure and the third-party tools it integrates with

Each category is its own problem, but two are acute.

Officer schedules and availability. A public, months-long record of who works when, and when coverage is thin, is exactly the information that should never be exposed. It is a safety issue for the officers and a planning gift to anyone who means the department or the community harm.

Court, defendant, and personal data. Defendant information and personal data tied to ban and security requests are sensitive on their own, and exposing them can carry legal obligations under state law. These are records about identifiable people, published without their knowledge.

The part that makes this bigger than a data leak: the whole toolchain was on the page

This was not just a folder of logs. What the department published was its officer intranet, a working Quick Access dashboard that wired together the systems the department actually runs on. Anyone who found the page got a labeled map of the department’s entire operational stack, including:

• Flock Safety: a Quick Access control linking directly into the Flock hotlist and patrol tooling, the automated license-plate-reader surveillance system

• Axon Evidence: the department’s digital evidence platform login at id.evidence.com

• Lexipol: the department’s policy portal

• iCrimeFighter: cloud evidence-collection login

• Department webmail: the staff email portal at webmail.ottawapdfd.org

• LaSalle County systems: court records, jail roster, and county GIS

• Illinois state systems: the officer portal, training hosts, and state firearms services

• Municipal code library, VPN, department calendar, and internal booking and dispatch tools

Read as a whole, that dashboard is a reconnaissance gift. It tells an outsider exactly which surveillance and evidence systems the department uses, where their login surfaces are, and how the pieces connect. You do not breach anything to learn a department’s capabilities and integration points when the department hands you the index.

The Flock link is worth pausing on. Public debate about automated license-plate readers has mostly focused on the vendor: cameras with weak defaults, data-sharing between agencies, transparency portals. This is the other failure mode. The vendor did not leak here. The customer published a direct link into its own surveillance tooling on a public website, next to everything else.

And the backend was live on the page too

Beyond the labeled links, the intranet’s own code exposed the machinery behind the call sheet: a hardcoded cloud backend endpoint that the page used to read and write call-sheet entries, authenticated with an application token, plus backend service keys and internal host references embedded directly in the browser-side code.

This is the most technically serious part, and it is why remediation here is more than making a repository private. A backend endpoint and service keys that were published to the public internet must be treated as compromised. Hiding the page does not disable an endpoint that lives on a separate cloud platform, and it does not rotate a key that strangers may already have copied. The correct response is to rotate every exposed key and token and to lock down or replace the backend endpoint, not simply to take the page down.

For that reason, this write-up describes the exposure but deliberately omits the actual endpoint addresses, keys, tokens, and internal hosts. Those are live security material, not story detail.

The document closet: a SharePoint library wired straight into the page

The intranet did not stop at links to outside systems. A ticker bar and a document grid on the page pointed directly into the department’s SharePoint document library, dozens of internal documents, organized by role. The point is not any single file. It is that the full internal filing cabinet was indexed on a public page. The inventory included, among others:

Administrative and policy

• 2026 OPD assignments and roster

• Rules and regulations

• “From the Chief” messages

• PTO request instructions

• In-house training instructor list

• Printer and Quicket configuration references

Patrol officer resources

• OPD forms folder

• Compensation postings

• Shift-switch forms

• Officer stats

• Squad inspection rosters

• Full department phone list

• Daily check-in logs

• ISP offense index

Traffic control resources

• PTO request forms

• Shift summaries

• Vacation request forms

Miscellaneous

• Solicitor permits

• Policy-portal links

One further detail deserves flagging without detail: at least one of those SharePoint links was a personal document-sharing path that encoded an individual staff member’s account identifier. That is exactly the kind of value that should never appear in a public page, and it is omitted here.

The build itself told the story: file tree and pipeline

The exposure was not a stray upload. It was a deliberately built site, and its own structure and build configuration were public too. The repository contained the intranet page and its assets, a leftover reference to an “old intranet” hosted on an internal department file server, and a control that pointed at a private internal network address on the department LAN. The site’s automated build pipeline was configured to inject the backend service keys and the call-sheet endpoint into the page every time changes were pushed.

In plain terms: the repository did not just leak a finished page. It leaked the blueprint, the internal hostnames and addresses referenced along the way, and the automated process that stamped live secrets into the published site. The internal addresses, file-server names, and injected key names are omitted here for the same reason as everything else, they are operational security material.

Why a code repository is the quiet danger

Publishing operational data to a public repository is uniquely bad for a reason that is not obvious to non-technical administrators: making the repository private later does not undo it. Code-hosting platforms keep history. Every file that was ever committed can remain retrievable from the project’s history even after the current version is hidden or changed. Anything sensitive that was ever committed, a credential, a token, a personal record, has to be treated as already exposed and, where it is a secret, rotated. Hiding the repository closes the front door while the archive can stay on the shelf.

That is why the remediation for this kind of exposure is not simply “make it private.” The full set of steps is:

1. Make the repository private or delete it immediately.

2. Audit the entire organization and account for any other public repositories.

3. Rotate every credential, key, or token that ever appeared in the repository or its history.

4. Assess, with counsel, whether the exposed personal information triggers breach-notification duties under state law.

Step one is the emergency stop, and Ottawa hit it fast. Steps two through four are the follow-through that any department in this position should complete even after the repository is dark.

How the disclosure went

This was reported the right way and quietly. The department was contacted first by phone. When it was not clear the message had reached someone who understood it, a written disclosure followed to the chief of police, laying out the exposure and the remediation steps in plain terms. No data was copied, retained, or redistributed. The report went to the department and to no one else.

The department responded quickly. Within roughly a day of the written disclosure, the repository was taken down and now returns a not-found response to the public. That is a strong, responsible turnaround, and Ottawa deserves credit for treating the report as real and acting on it immediately rather than letting it sit.

The broader lesson

The Ottawa case is a warning to every small agency that has embraced modern tools without modern security habits, and a small model of how to respond when something goes wrong. Code repositories, cloud buckets, and mapping servers are enormously useful, and they are trivially easy to expose by default. A department can adopt a developer platform to organize its work and, with one wrong setting, publish its operations to the world without realizing it. The technology did not fail. The configuration did, and the review that should have caught it never happened.

Small agencies do not need a large security budget to avoid this. They need one habit: before anything internal goes onto a public platform, someone asks who can see this, and checks. That single question, asked once, would have prevented the exposure entirely. And when the question gets missed, the Ottawa response, act within a day, is the standard every other agency should be measured against.

Ringmast4r strikes again~

On August 26, 2026, the White House declared a national emergency to secure the United States bulk-power system, citing foreign actors creating and exploiting vulnerabilities in the equipment that runs the country’s critical infrastructure (The White House, “Declaring a National Emergency to Secure the United States Bulk-Power System”).

I had warned about exactly this class of exposure, in writing, on a specific American water system, seven weeks earlier. The town did nothing. This is the documented record of that failure, and it is a case study in why the emergency exists.

The town is Jupiter, Florida.

What was exposed

In early July 2026, I identified a critical exposure on the Town of Jupiter’s public geographic information system. Their ArcGIS server was reachable from the open internet with no authentication whatsoever. It exposed 32 map services. I verified that at least 11 of them accepted unauthenticated write operations, create, update, and delete, through the standard feature-editing API.

This is the part that should stop any official reading this cold. It was not read-only. It was writable. Any anonymous person on the internet, with no password, no token, and no account, could insert, alter, or delete records in these layers.

The 11 writable services spanned:

• Water treatment

• Water distribution

• Wastewater and sewer

• Stormwater

• Energy and substation-related control data

• Municipal public-works asset management

• Property records

I did not modify anything. I did not touch downstream systems. I did not exfiltrate data. I confirmed the exposure and documented it, which is the job.

How this can actually be used, and why it matters

For anyone deciding whether this is a paperwork problem or a public-safety problem, here is the honest operational picture. Write access to a utility’s authoritative geographic and asset data is not vandalism of a website. It is corruption of the source of truth that a town’s water operators, field crews, and emergency planners rely on to make physical decisions. With anonymous write access to the categories above, a hostile actor could:

• Sabotage incident response by falsifying asset locations. Water-distribution and public-works layers tell crews where valves, mains, pumps, and shutoffs physically are. Alter or delete those records and, during a main break, a contamination event, or a fire, responders go to the wrong location or cannot find the asset at all. The delay is measured in the time a town is without safe water.

• Corrupt the data that treatment and distribution decisions depend on. If operators cannot trust their own maps and asset records, every downstream decision built on that data is suspect. The damage is not one bad record, it is the loss of confidence in the entire system of record.

• Poison emergency and public-works planning. Sewer, stormwater, and substation-related layers feed flood modeling, outage planning, and coordination with other agencies. Silent edits to these layers degrade planning that happens long before any visible incident, so the failure only surfaces when it is too late to matter.

• Erase the evidence. Delete capability means an attacker can remove records, and without edit-log auditing the town cannot even prove what was changed or when. Integrity you cannot verify is integrity you do not have.

• Enable physical-world targeting. Detailed, editable maps of a municipality’s water and energy infrastructure are precisely the reconnaissance a serious adversary wants. The FBI has warned that actors are actively reaching internet-facing water-sector systems and causing operational disruption (FBI, “Malicious Cyber Actors Targeting Water and Wastewater Sector Internet-Facing PLCs”).

This is why an unauthenticated writable water GIS is not a low-priority IT ticket. It is a public-health and national-security exposure wearing an IT costume.

I reported it. Through every proper channel. On the record.

On July 2, 2026, I sent Jupiter a full disclosure. I addressed the town’s information systems contacts and copied the people whose job is to make this get fixed:

• The Town Manager’s office

• The Florida Cybersecurity Operations Center, part of the Florida Digital Service

• The federal Cybersecurity and Infrastructure Security Agency

I gave them the exact remediation, step by step, in language a competent administrator could act on the same day:

1. Restrict feature-editing capabilities to authenticated users only, at the service level.

2. If public read access is required, disable create, update, and delete in the server manager.

3. Implement token-based or OAuth2 authentication for any service that must remain reachable.

4. Audit the recent edit logs for unauthorized modifications.

That is not a vague warning. That is a repair manual, delivered free, before any attack.

What responsible disclosure got me

The emails to Jupiter’s own listed contacts bounced. Rejected at the door. The town could not keep working email addresses on file for the staff who run its infrastructure, which means the people directly responsible may never have read the warning at all.

The Florida Cybersecurity Operations Center, to its credit, confirmed receipt within hours and called me. A real analyst doing a real job. The federal intake team responded within days, routing me to a formal disclosure portal.

Jupiter itself gave me silence. No acknowledgement. No questions. No confirmation of a fix. And based on everything available to me, the exposure was not properly remediated.

I did everything right. I found a critical hole in a water system, reported it quietly to the town and to state and federal authorities, handed over the exact steps to close it, and kept the loaded technical details out of public view to give them time to act. The reward was a bounced email and a town that could not be bothered to respond.

The timeline is the indictment

• Early July 2026: I warn Jupiter, in writing, with a fix attached, and copy the state and CISA.

• Late July 2026: A coordinated wave of cyberattacks hits water and wastewater utilities in at least seven states, degrading operations and forcing boil-water notices (CNN Politics, “Sweeping cyberattack on water systems in multiple states has US officials on edge”; WBUR Here & Now, “Cyberattacks hit water systems in at least seven states”).

• Weeks later: The FBI warns publicly that actors are targeting internet-facing water-sector controllers and causing operational disruption (FBI, “Malicious Cyber Actors Targeting Water and Wastewater Sector Internet-Facing PLCs”).

• August 26, 2026: The White House declares a national emergency over threats to critical infrastructure (The White House, “Declaring a National Emergency to Secure the United States Bulk-Power System”).

Jupiter was handed the answer sheet before the exam. There are no second warnings once the attack actually lands. You get one chance to close the door, and Jupiter could not manage even to keep a working email address to receive the warning that would have let them close it.

A note on what I am not publishing, and why

I am not printing the exact server address or an itemized, copy-and-paste target list in this public article. The exposure may still be live, and the country is in the middle of an active campaign against precisely these systems. I will not hand a working key to the very actors the FBI is warning about.

That restraint is a professional line, not a favor to Jupiter. Any authorized official, at the White House, CISA, or the state, who needs the exact technical detail can have the complete, unredacted findings directly and immediately. That is how this is supposed to work. The public deserves to know a town failed. Attackers do not deserve a map.

What Jupiter owes its residents, and what officials should demand

Three questions the Town of Jupiter should answer publicly, and that oversight bodies should ask:

Why did your infrastructure staff’s email bounce a critical security warning? If a researcher acting in good faith cannot reach the people who run your water system, no one else trying to help you can either.

Did you remediate the exposure, and on what exact date? If yes, prove it. If no, your residents deserve to know their water system’s records may still be editable by anonymous strangers during a declared national emergency.

Did you audit the edit logs, as you were explicitly instructed to? If you never checked, you cannot state that nothing was already altered. Silence is not the same as safety.

The bottom line

The attacks on our water systems are not a warning of what is coming. They are a report of what is already here (CNN Politics, “Sweeping cyberattack on water systems in multiple states has US officials on edge”). Jupiter, Florida had the warning, the fix, and the time. It had a researcher doing the unglamorous, unpaid work of protecting a town that would not protect itself. It did nothing.

The federal government is finally moving, with a White House water-provider protection program reportedly piloting in Texas and bipartisan legislation in motion (Route Fifty, “White House to soon launch water provider cyber protection program”; Nextgov/FCW, “White House to soon launch water provider cyber protection program”; Rep. Josh Gottheimer, “Bipartisan Federal Actions to Protect Water, Electric Systems, and Families from Cyber Attacks”). Good. But an executive order does not reconfigure a server in a single town. That takes someone in Jupiter caring enough to read their email and change a setting. They could not manage even that.

I did my part. I found it, I reported it through every proper channel, I gave them the answer, and I still kept the loaded details out of the wrong hands. No researcher, no executive order, and no news cycle can fix a system for a town that will not turn the key.

The emergency is real. Jupiter’s negligence is documented. The only question left is whether the town acts before the next boil-water notice, or after.

What changed

In May I published the first cut of this investigation: Albania appointed the world’s first AI cabinet minister, Diella, then left the Parliament she was supposed to watch on an unauthenticated Azure API (The AI Minister’s Blind Spot; TIME; Al Jazeera; Reuters).

In June I re-tested every endpoint. They had all gone dark. No CVE. No CSA statement. No notice to the 236 MPs whose dates of birth and official emails had been sitting in JSON for years (Silent Fix; ODINT Albania tour).

The API is still closed. The copy I pulled in April is not. As of August 18, 2026, the parliamentary documents are hosted on ODINT’s data server and opened from the Albania tour page (ODINT Albania tour; data.odint.io/albania). You do not get a JSON of paths. You get the files.

Start here: https://odint.io/pages/tours/albania

Browse the raw tree here: https://data.odint.io/albania/

Full story recap

In January 2025 Albania launched Diella as a chatbot on the e-Albania portal (Wikipedia, “Diella (AI system)”; A2 News). In September, Prime Minister Edi Rama appointed her Minister of State for Artificial Intelligence, the first cabinet seat given to a software avatar, and told the press that public tenders would be “100 percent free of corruption” (TIME; Al Jazeera; Reuters; BBC). She appears as a woman in Zadrimë dress, using the likeness of actress Anila Bisha (Wikipedia; Reuters, “Albanian actor sues government”). In October, Rama said she was “pregnant” with 83 digital assistants, one for each ruling-party MP, to watch legislative sessions (Euronews; Gulf News).

Three months after the appointment, in December 2025, AKSHI Director General Mirlinda Karçanaj and Deputy Director Hava Delibashi were placed under house arrest (Tirana Times; Wikipedia, “National Agency for Information Society (Albania)”). The charge was a structured criminal group across 12 tender procedures (Tirana Times; Tirana Times, “A Structured Criminal Group Inside a National Security Institution”). AKSHI is the agency that built Diella and runs the country’s digital government stack (TIME; Wikipedia, “Diella (AI system)”). BIRN wrote that the capture of AKSHI by criminal interests “endangers national security” (BalkanWeb / BIRN; ODINT AKSHI report).

I started in January 2026 with passive reconnaissance: certificate transparency, public hostnames, the Diella frontend (The AI Minister’s Blind Spot; ODINT Diella report). On the surface Albania looked competent. e-Albania sat behind a WAF. AKSHI’s WordPress wanted auth. Diella’s 229 KB Vue/Quasar bundle at proud-coast-026495803.4.azurestaticapps.net had no keys and no backend URLs (The AI Minister’s Blind Spot; ODINT Diella report). Internal names (Hasura, Keycloak, HAPI) resolved only on internal DNS. crt.sh expanded AKSHI from about 50 known names to 110, including Jira, Rancher, and a wiki, all dark from the public internet (ODINT Albania tour; crt.sh).

February 25, 2026, I turned to the institution Diella was supposed to watch (The AI Minister’s Blind Spot; ODINT Parliament API report). parlament.al is a React SPA. Every path returns HTTP 200 and the same index.html. That looks like a dead end until you pull the JavaScript. The 355 KB main chunk hardcoded https://kuvendiapi.azurewebsites.net/api and seven OData entity names (ODINT Parliament API report; The AI Minister’s Blind Spot). I requested them with no token.

Six of seven answered. /anetaret returned 236 MP records: legal name, father’s name, date of birth, birthplace, @parlament.al email, party, district, photo URL, social links (ODINT MP viewer; ODINT raw MP records). /dokumentet returned a 30.2 MB catalog of 54,545 Azure blob URLs (ODINT Parliament API report; data.odint.io dokumentet dump). /aktet, /lajmet, /mbledhjet, /strukturat were open. /abonimet returned 401. Someone in that codebase knew how to require a login. They applied it to subscriptions and nothing else.

The blob container at kuvendiwebfiles.blob.core.windows.net/webfiles/ had listing disabled. Every individual URL from the catalog was public-read (The AI Minister’s Blind Spot; ODINT Parliament API report). Among the files: monthly PAGA DEPUTETE and PERFITIME DEPUTETE workbooks, FOIA logs, the lobbyist registry, budget tables, the constitution, the electoral code, annual reports (ODINT salary XLSX; data.odint.io/xlsx).

I wrote that up and left. April 15-16 I came back. The API was still open. The catalog had grown to 57,287 rows. Meetings were dated that day (The AI Minister’s Blind Spot; ODINT Albania tour). I ran a 32-thread downloader, then a second pass for the 18,000 filenames that contained spaces. 52,942 files. 32.09 GB. 94.7 percent of the catalog. The rest were already deleted from Azure, not blocked.

From the spreadsheets I parsed 11,030 salary rows across 398 unique MPs, August 2018 through January 2026 (The AI Minister’s Blind Spot; ODINT salary XLSX). Four pay bands, 27 percent from Speaker to back-bencher. Vendimi 114/2014 docks pay for missed sessions. Some opposition names show 40 percent gaps between gross and net.

A second platform, bisedimet.parlament.al, was a Node archive API running as root at /root/Kuvendi-Backend/, MeiliSearch, Prisma, 20 OCR transcripts, 261 speakers, 92 percent memory, embeddings stuck on PENDING (The AI Minister’s Blind Spot; ODINT Parliament API report). That is the nearest thing I found to the 83 children Rama announced in Berlin (Euronews; Gulf News).

I went back to Diella with the same tools. Still no backend. aibot-api.azurewebsites.net served Azure’s empty-app welcome page. .auth/me returned a null principal (The AI Minister’s Blind Spot; ODINT Diella report). There is a costume and a login door. There is no model behind it.

None of this sat in a vacuum. April 2021: 910,000 voter records leaked, about a third of the country (Balkan Insight; ODINT breach history). December 2021: 637,138 citizen salary rows over WhatsApp, and Rama called it an internal infiltration (Recorded Future; Euractiv; Balkan Insight). 2022: HomeLand Justice (MITRE C0038) hit AKSHI itself; CISA/FBI issued AA22-264A; Albania cut ties with Iran (CISA AA22-264A; MITRE ATT&CK C0038). October 2022: a Telegram dump of roughly 100,000 police-suspect records, attributed to the same campaign (Balkan Insight; VOA; CCDCOE). Then the AI minister. Then the agency’s directors arrested. Then an open Parliament API that had been that way since at least 2022.

May 13 I published The AI Minister’s Blind Spot. It was cited in Albanian media and used in the legislature (Silent Fix; ringmast4r.com articles). A Microsoft engineer on Albanian government work and an academic both challenged pieces of the method in public. The article stood. June 19 I re-tested. Every previously open entity still resolved, but returned the Parliament homepage as text/html. Not 401. Not 403. A silent rewrite (Silent Fix). No CSA notice. No statement to the 236 people in anetaret.

August 18, 2026, the April pull went onto ODINT. The tour page is the story (ODINT Albania tour). data.odint.io/albania/ is the files (data.odint.io/albania). The PDF viewer pages through the original documents (ODINT PDF viewer). The salary page serves the original workbooks (ODINT salary XLSX). The MP viewer is the anetaret table (ODINT MP viewer). The 910k voter file and the other citizen-scale breach dumps stay restricted (ODINT request-data; ODINT citizen catalog). The Parliament records do not.

That is the investigation. The rest of this post is the map.

How to find all of it on ODINT

Everything public lives under two hostnames.

Tour page (the story, the viewers, the crown jewels):
https://odint.io/pages/tours/albania

Data server (the actual files):
https://data.odint.io/albania/

Use the tour page if you want to read. Use the data server if you want to download in bulk.

Parliamentary PDFs (the 30,455)

Open the on-page viewer:

https://odint.io/pages/tours/albania-raw-document-catalog

That page loads https://data.odint.io/albania/pdf/index.json and renders the original PDF in the browser. Search the filename list. Arrow keys move between documents. PageUp and PageDown move inside a document. Download pulls the file from ODINT, not from Azure.

Directory listing of the same tree:

https://data.odint.io/albania/pdf/

These are the original Parliament blob files: laws, resolutions, interpellations, annual reports, committee packets. The local archive is 30,455 PDFs, about 17.8 GB. The viewer index lists every name. Files are served from data.odint.io as they sit on the archive disk.

MP directory (236 records)

Searchable table with official emails, dates of birth, birthplaces, party, district, and photos:

https://odint.io/pages/tours/albania-parliament-mp-viewer

Raw JSON view of the same anetaret pull:

https://odint.io/pages/tours/albania-raw-mp-records

This is public-official data returned by an unauthenticated government API. It is not the 910,000-row voter file.

MP salary and benefits workbooks (376 XLSX)

Search and download the original spreadsheets:

https://odint.io/pages/tours/albania-raw-salary-xlsx

File tree:

https://data.odint.io/albania/xlsx/

Look for PAGA DEPUTETE (monthly pay) and PERFITIME DEPUTETE (benefits). Also in this folder: FOIA request/response logs 2018-2021, the lobbyist registry, the civil-society registry, and budget annexes. 376 workbooks, about 44 MB, fully hosted.

Word documents (729 DOCX)

https://data.odint.io/albania/docx/

Draft laws, covering letters, vacancy notices, committee reports.

Manifest, API dumps, and the rest of the tour

• File map: https://odint.io/pages/tours/albania-raw-file-manifest

• Citizen-records catalog (what is public vs restricted): https://odint.io/pages/tours/albania-raw-citizen-records

• Legislative acts JSON view: https://odint.io/pages/tours/albania-raw-legislative-acts

• Open Data portal spec: https://odint.io/pages/tours/albania-raw-opendata-spec

• AKSHI subdomain list: https://odint.io/pages/tours/albania-raw-subdomains

• Parliament API technical report: https://odint.io/pages/tours/albania-parliament-api

• Diella frontend report: https://odint.io/pages/tours/albania-diella-ai

• AKSHI corruption report: https://odint.io/pages/tours/albania-akshi-corruption

• Iranian campaign writeup: https://odint.io/pages/tours/albania-iranian-cyberattacks

• Breach history: https://odint.io/pages/tours/albania-data-breaches

• Earlier API dumps on the data server: https://data.odint.io/albania/DUMP/

What is not on the public site

The 910,000 voter records (2021), the 637,138 national salary records (2021), the 100,000+ police suspect records (2022), ministerial mailboxes, and the SHISH directory stay under ODINT restricted access. Those came from historical breaches, not from the Parliament API. The tour page documents that they exist. The files are not a public download (ODINT request-data; Balkan Insight).

If you are a credentialed journalist, a researcher, or an affected government entity, use the request form. Do not email me asking for a zip of the voter file.

What you can actually open, by the numbers

The April 2026 pull against the live Azure catalog recovered 52,942 files, 32.09 GB, a 94.7 percent hit rate. The missing 5.3 percent were already gone from blob storage. The blobs did not 403. They did not exist.

What is on ODINT from that pull, organized for use:

• 30,455 PDFs indexed in the document viewer

• 376 XLSX salary, benefits, FOIA, lobbyist, and budget workbooks

• 729 DOCX parliamentary office documents

• 236 MP records in the interactive viewer

• API JSON dumps (anetaret, dokumentet, aktet, lajmet, mbledhjet, strukturat) under /albania/DUMP/

• Findings writeups on the tour page

The original Azure catalog listed 32,627 PDFs, 18,289 JPEG/JPG, 1,768 JFIF, 885 DOCX, 397 DOC, 392 XLSX, 208 PNG, 117 XLS. Not every image from that catalog is on the public web root. The documents that prove the finding (PDFs and the salary workbooks) are.

Why this is not a GitHub dump

A static marketing site cannot hold 18 GB of PDFs. The pattern I use for large evidence, the same one I used for Rwanda and Venezuela, is raw files on data.odint.io and the story plus the viewers on odint.io (ODINT Rwanda; ODINT Venezuela radio; data.odint.io).

The public copy of this haul is the data server.

The API, as it existed

Hardcoded in the Parliament SPA:

https://kuvendiapi.azurewebsites.net/api

Entities extracted from the webpack bundle:

• /anetaret - 236 MP records, 138 KB

• /strukturat - committees, 274 KB

• /aktet - legislative acts, 3.1 MB

• /lajmet - news, 19.8 MB

• /mbledhjet - meetings, 2.2 MB

• /dokumentet - 54,545 then 57,287 blob URLs, 30.2 MB

• /YouTube/search - YouTube proxy, 8 KB

• /abonimet - subscriptions, 401, the only protected endpoint

Blob host for every document URL:

https://kuvendiwebfiles.blob.core.windows.net/webfiles/<filename>

Container listing was disabled. Individual blobs were public-read. Publishing 54,545 direct URLs while hiding the directory listing is not a control.

On June 19, 2026, those same paths still resolved, but every previously open entity returned the Parliament homepage HTML with Content-Type: text/html instead of JSON. No 401. No 403. A silent rewrite.

Diella, again, because people still ask

I re-downloaded the 229 KB frontend bundle. Zero backend URLs. Zero model names. Zero keys. Azure Static Web App auth is wired (.auth/me returns a null clientPrincipal; .auth/login/aad redirects to Azure AD). There is a door. There is no building behind it.

Rama announced 83 AI “children,” one per ruling-party MP, to watch legislative sessions (Euronews; Gulf News; Reuters). The closest thing I found to that stack was bisedimet.parlament.al: a Node.js “Document Archive API” at /root/Kuvendi-Backend/, MeiliSearch, Prisma, 20 OCR transcripts, 261 named speakers, health endpoint leaking path and memory, embeddings status PENDING on every document. A search box over 20 PDFs, running as root, at 92 percent memory. That is the 83 children.

Context that did not get quieter

April 2021: 910,000 voter records leak, about a third of the country (Balkan Insight; ODINT breach history).

December 2021: 637,138 salary records leak over WhatsApp. Rama called it an internal infiltration (Recorded Future; Euractiv; Balkan Insight).

2022: HomeLand Justice (MITRE ATT&CK C0038) hits AKSHI. CISA/FBI advisory AA22-264A. Albania severs ties with Iran (CISA AA22-264A; MITRE ATT&CK C0038; CCDCOE).

October 2022: roughly 100,000 police-suspect records leak via Telegram (Balkan Insight; VOA).

December 2025: AKSHI leadership arrested for tender manipulation (Tirana Times; BalkanWeb / BIRN).

February-April 2026: Parliament API open. This investigation (The AI Minister’s Blind Spot; ODINT Parliament API report).

June 2026: API silently closed (Silent Fix).

August 2026: the pull is on ODINT (ODINT Albania tour; data.odint.io/albania).

You cannot appoint an anti-corruption minister on top of an IT agency that was breached by a foreign service, then captured by its own directors, then leave the legislature’s document store on public blob URLs for four years, then close the door without saying who walked through it.

What I am not doing

I am not republishing the 910k voter file, the 637k citizen salary dump, or the police suspect photos. Those are restricted. The Parliament PDFs, the MP directory from the open API, and the MP payroll workbooks are government records that were served without authentication. Those are what you can open.

I am not claiming the June closure never happened. It did. I am claiming the historical record still exists, because I kept the GET responses, and because you can now page through the PDFs yourself.

Full methodology, in the order I actually did it

Phase 1 - February 25, 2026

Scope was Diella, not Parliament.

1. Pulled the Diella frontend HTML and the 229 KB JS bundle from proud-coast-026495803.4.azurestaticapps.net.

2. Ran string extraction and URL regex across the bundle. Result: Quasar/Vue only. Env vars were CSS tokens.

3. Hit /.auth/me, /.auth/login/aad, /.auth/login/github. Auth framework present, no app behind it.

4. Probed aibot-api.azurewebsites.net, then diella-api, aibot, chatbot, assistant on .azurewebsites.net, .azure-api.net, .azurefd.net. Default pages or 404s.

5. Enumerated AKSHI via crt.sh. 110 names. Jira, Rancher, Wiki, VS Code Server, Collabora. Internal DNS only.

6. Probed 17 .gov.al / government hostnames. WAF, 403, or down. Then parlament.al.

Parliament is a React SPA. Every path is HTTP 200 + the same index.html. That is a client router, not a locked API.

7. Downloaded parlament-main.js (355 KB) and parlament-vendor.js (1.0 MB).

8. Grepped the main chunk for http, azure, api, odata. Recovered:

https://kuvendiapi.azurewebsites.net/api

and the entity list above.

9. GET each entity with no headers except a normal User-Agent. Six returned JSON. /abonimet returned 401.

10. Saved the JSON. dokumentet was 30.2 MB. Extracted every blob URL.

No scanner. No exploit. curl and a text editor.

Phase 2 - April 15-16, 2026

1. Re-GET every entity. Still 200 JSON. dokumentet had grown to 57,287 rows. Meetings dated that day.

2. Wrote a 32-thread Python downloader against kuvendiwebfiles.blob.core.windows.net/webfiles/.

3. First pass used urllib. About 18,000 URLs failed because filenames contained literal spaces and Albanian characters. Second pass quoted them correctly.

4. Runtime: 45 minutes. 52,942 files, 32.09 GB, 94.7 percent of the catalog.

5. Sorted the haul by extension into pdf, xlsx, xls, docx, doc, jpeg, jpg, jfif, png.

6. Parsed 116 payroll workbooks (column headers change grammatical case around 2022) into 11,030 salary rows across 398 unique MPs, August 2018 through January 2026.

7. Hit bisedimet.parlament.al. Health endpoint: Node, path /root/Kuvendi-Backend/, MeiliSearch, Prisma, 92 percent memory, 2.4 days uptime. 20 OCR transcripts, embeddings PENDING.

Phase 3 - June 19, 2026

Re-GET every entity. JSON gone. Homepage HTML. Documented in Silent Fix.

Phase 4 - August 18, 2026

1. Copied the XLSX tree (376 files) and DOCX tree (729 files) to https://data.odint.io/albania/xlsx/ and https://data.odint.io/albania/docx/.

2. Built https://data.odint.io/albania/pdf/index.json (30,455 names and sizes) and the on-page PDF.js viewer.

3. Published the MP viewer, the salary list, the manifest, and the tour-page links. The public archive is the data server, not a code host.

Exact public URLs (copy-paste)

Tour:

• https://odint.io/pages/tours/albania

• https://odint.io/pages/tours/albania-raw-document-catalog.html

• https://odint.io/pages/tours/albania-parliament-mp-viewer.html

• https://odint.io/pages/tours/albania-raw-salary-xlsx.html

• https://odint.io/pages/tours/albania-raw-file-manifest.html

• https://odint.io/pages/tours/albania-raw-citizen-records.html

• https://odint.io/pages/tours/albania-raw-mp-records.html

• https://odint.io/pages/tours/albania-raw-legislative-acts.html

• https://odint.io/pages/tours/albania-raw-opendata-spec.html

• https://odint.io/pages/tours/albania-raw-subdomains.html

• https://odint.io/pages/tours/albania-parliament-api.html

• https://odint.io/pages/tours/albania-diella-ai.html

• https://odint.io/pages/tours/albania-akshi-corruption.html

• https://odint.io/pages/tours/albania-iranian-cyberattacks.html

• https://odint.io/pages/tours/albania-data-breaches.html

Data:

• https://data.odint.io/albania/

• https://data.odint.io/albania/pdf/

• https://data.odint.io/albania/pdf/index.json

• https://data.odint.io/albania/xlsx/

• https://data.odint.io/albania/xlsx/index.json

• https://data.odint.io/albania/docx/

• https://data.odint.io/albania/DUMP/

Historical API (now HTML-stubbed):

• https://kuvendiapi.azurewebsites.net/api/anetaret

• https://kuvendiapi.azurewebsites.net/api/dokumentet

• https://kuvendiapi.azurewebsites.net/api/aktet

• https://kuvendiapi.azurewebsites.net/api/lajmet

• https://kuvendiapi.azurewebsites.net/api/mbledhjet

• https://kuvendiapi.azurewebsites.net/api/strukturat

• https://kuvendiapi.azurewebsites.net/api/abonimet

Blob pattern (individual files were public-read at collection time):

• https://kuvendiwebfiles.blob.core.windows.net/webfiles/{filename}

Diella frontend:

https://proud-coast-026495803.4.azurestaticapps.net

• https://proud-coast-026495803.4.azurestaticapps.net/.auth/me

Salary structure from the workbooks (already on ODINT)

Parsed from the hosted XLSX, not from a leak of private citizens:

• Speaker (Niko Peleshi): 393,125 ALL gross / month (~$3,900)

• Parliamentary group leaders: 356,788 ALL

• Committee chairs / vice speakers: 325,000-329,000 ALL

• Rank-and-file MPs: 310,250 ALL

• Top-to-bottom spread: 27 percent

• Penalty statute: Vendimi 114/2014 (docked pay for missed sessions)

• Example gap already published in May: Gazment Bardhi, 356,788 gross vs 210,104 net in January 2026 (41 percent withheld)

Open any PAGA DEPUTETE file on the salary page and you can check the arithmetic yourself.

anetaret field list (the MP JSON)

Each of the 236 records carried, at minimum:

• emer / atesi / mbiemer (given name, father’s name, surname)

• ditlindje (date of birth)

• vendlindje (place of birth)

• email (*@parlament.al)

• party / district / active flag

• Azure blob photo URL

• social links when present

I am not pasting 236 emails into this post. They are in the MP viewer.

Replicate from a cold machine

You cannot replicate the live API. It was rewritten in June. You can replicate the ODINT copy.

curl -I https://data.odint.io/albania/pdf/index.json
curl -I https://odint.io/pages/tours/albania-raw-document-catalog.html
curl -I https://data.odint.io/albania/xlsx/index.json

To rebuild the index from a local PDF folder:

python -c "import os,json; root=r'PATH\\pdf'; files=[{'n':n,'s':os.path.getsize(os.path.join(root,n))} for n in os.listdir(root) if n.lower().endswith('.pdf')]; json.dump({'count':len(files),'base':'https://data.odint.io/albania/pdf/','files':files}, open('index.json','w',encoding='utf-8'), ensure_ascii=False, separators=(',',':'))"

The original downloader was a ThreadPool of GETs against the dokumentet URL list. No Range tricks. No signed tokens. Authorization header was never sent.

What I kept off the public web root, on purpose

• 910,000 voter records (April 2021 breach)

• 637,138 citizen salary records (December 2021 WhatsApp leak)

• ~100,000 police suspect records with photos (October 2022)

• Ministerial mailboxes and SHISH directory material from the Iranian campaign dumps

Those are not Parliament publications. They are not on data.odint.io/albania/. Request path is https://odint.io/pages/request-data.html

Investigation dates: February 25, 2026 (Phase 1), April 15-16, 2026 (Phase 2), June 19, 2026 (retest), August 18, 2026 (ODINT publish). All Parliament files were collected with unauthenticated HTTP GET against public endpoints. No credentials. No exploit. Inline citations are in the body. The grouped list is SOURCES_Albania_Archive_On_ODINT.md.

Affected hosts (all EPA-operated):

• awseatlas.epa.gov (ArcGIS v11.3)

• awsgeopub.epa.gov (ArcGIS v11.3)

• awsgispub.epa.gov (ArcGIS v12)

• awsrobinson-test.epa.gov (ArcGIS v11.4 -- TEST ENVIRONMENT, public internet)

• awsrobinson.epa.gov (ArcGIS v11.4)

• blt.epa.gov (ArcGIS v11.3)

• blt.lbd.epa.gov (ArcGIS v11.3)

• cimcgis.epa.gov (ArcGIS v11.3)

• clmapper.epa.gov (ArcGIS v11.3)

• cwns.epa.gov (ArcGIS v11.3)

Discovery date: 2026-06-22
Disclosure sent: 2026-06-24
Sent to: itsecurity@epa.gov, CC: vulnerability@cisa.dhs.gov
Severity: MEDIUM

Each instance exposes its ArcGIS REST Services Directory without authentication, disclosing server version, folder structure, and service inventory. Per NIST SP 800-53 CM-7 and FedRAMP baseline controls, this configuration information should not be available to unauthenticated users.

The test environment (awsrobinson-test.epa.gov) is of particular concern: a test server accessible from the public internet represents a significantly expanded attack surface with typically relaxed security controls.

I have not accessed, modified, or exfiltrated any data from any of these systems. CISA was CC’d at initial disclosure per federal vulnerability disclosure protocol.

Our adversaries would not hesitate to use an exposure like this against us. God Bless.

~Ringmast4r strikes again.

When I built this, nobody cared about data centers. That was the problem I was pointing at.

Everything routes through one. Every service you use, every transaction, every message, every page load terminates in a building full of servers, cooling and redundant power. They are the hub. Pull one and things stop working for people who have never heard of it.

That is the textbook definition of critical infrastructure. And at the time it was getting almost none of the attention that label is supposed to carry. Nobody was asking the obvious questions in public. How are these facilities secured? What happens when one goes down? Where are the single points of failure? Which regions sit one building away from being cut off? For something carrying that much load, the silence was strange.

So I mapped them. All of them. Not as a hobby and not as an argument, but because you cannot ask a serious question about the resilience of a system whose components nobody has bothered to enumerate. A commercial geospatial intelligence project needed data center locations for its own reasons and I built the tool that got them. The reason I kept going, cleaned it, and eventually published it was that the gap in public discussion seemed worth closing.

Nobody objected. Nobody asked what it was for. It was infrastructure trivia.

That was not even two years ago.

What changed

Everything, and fast, but not in the direction I expected.

The money arrived first. US data center construction starts went from $14.9 billion in 2023 to $26.9 billion in 2024 to $77.7 billion in 2025, a 190 percent jump in a single year (American Industrial Magazine). The five largest hyperscalers are putting between $660 billion and $725 billion into AI infrastructure this year alone, close to double 2025 (Intellectia). More than 23 gigawatts of capacity is physically under construction (BloombergNEF).

Then the pushback. In 2026 so far, lawmakers in more than 30 states have introduced over 300 bills touching data centers: moratoriums, tax incentives, energy policy (MultiState). Bans and pauses are under discussion in more than 20 states, and over $130 billion in projects was delayed or abandoned in the first quarter of 2026 alone (EESI).

It is not only a statehouse story. Nearly a third of Indiana counties have moved to restrict data centers (WFYI). Farmville commissioners voted unanimously this month for a twelve month moratorium after residents turned out against a proposal (WITN). In Lysander, New York, more than 350 residents came to a board meeting over a proposed 300 megawatt campus on 120 acres, and a six month moratorium passed unanimously (Rockefeller Institute of Government). In Tonawanda, hundreds showed up citing pollution, utility costs, property values and noise (Rockefeller Institute of Government).

The two arguments underneath it are electricity and water.

On electricity, the honest answer is that it is contested. One analysis puts $23 billion in higher costs already pushed onto the public (Fortune). A study from NC State, Carnegie Mellon and others projects demand weighted wholesale prices rising 6 to 29 percent nationally by 2030, and as much as 57 percent in the worst hit regions (Forbes). But a March 2026 study found the correlation between data center count and current prices statistically insignificant (Independent Institute), and in some regions large industrial load lowered residential rates between 2019 and 2024 before reversing where slack ran out (Marketplace). Anyone telling you this is settled in either direction is selling something.

On water it is less ambiguous, because the impact is local rather than national. Nationally, data centers are a small share of consumption. Locally they are not. A facility in Newton County, Georgia uses 500,000 gallons a day, roughly 10 percent of the entire county’s water (Consumer Reports). Facilities across Arizona, Colorado, Nevada, New Mexico and Utah could draw 7 billion gallons a year by 2035, enough for up to 194,000 people (Quartz). As of early May 2026, roughly 51 percent of the US and Puerto Rico was in drought (Quartz).

So data centers finally made the news. Just not for the reason I was asking about.

Where I stand

I am not on a side, and I want to be precise about what that means, because it is not indifference.

I am not an advocate for the industry. I am not an activist against it. I have no position on whether the facility proposed near you should be built, and if your county’s water table cannot support one, that is a real objection that deserves a real hearing.

But I will say this much, because it is the reason I built the map.

Data centers have always existed. They have been running the internet for decades, quietly, in buildings nobody protested because nobody knew they were there. The category is not new and the category is not the problem. What is new is the scale and speed of the hyperscale AI buildout, and that is a legitimate and separate discussion about power procurement, water rights, siting and who absorbs the cost.

Collapsing those two things into one is where the current fight goes wrong. Data centers did not arrive in 2025. Treating the whole category as the villain aims at the wrong target, and worse, it crowds out the question that actually needed asking and is still unanswered: this is critical infrastructure, so how is it secured, how resilient is it, and what happens when a node fails.

That question got no oxygen when data centers were invisible. It is getting no oxygen now that they are political, because the argument moved to electricity bills and zoning before anyone finished the first conversation.

What I have is the list, the methodology, and an honest account of where it is weak. Use it for whichever argument you are having. I would rather it get used for the one about resilience.

How I actually got it

I scraped the hell out of the people selling it.

Not their internal systems. Their open APIs and their public facing websites. The endpoints their own front ends call to render pages any visitor can load. Five sources, driven with Playwright, pulling facility names, operators, street addresses, cities, countries and coordinates.

That is what makes this explicitly OSINT and not something else. No credentials. No API abuse. No authentication bypass. No proprietary access. Every record came from information those companies chose to publish on the open internet, retrieved the same way your browser retrieves it, just systematically.

Which gets to the thing worth understanding about this industry.

The business being run on public information

The commercial data center marketplaces have run the same play since the mid 2000s. Their model is a commission on colocation deals brokered through their platforms, typically around 10 percent. Sign a $10,000 a month contract through one of their quote services and they take roughly $1,000 a month for the initial term. On top of that, operators pay for premium listings, banner placement, sponsorships and enhanced memberships. All of it priced behind a “contact us” wall.

They list tens of thousands of facilities. You can browse them. Download the data? Get coordinates in bulk? Export to your own tools? No. That restriction is the product.

Here is the part that matters: none of the underlying information is secret. These are commercial buildings. Many advertise their own addresses. They appear in property records and business filings. Nothing is being revealed here that the operators themselves have not already published.

The scarcity is manufactured. The gate is the business.

The part that took the actual time

Scraping was the easy half. The cleaning consumed more hours than everything else combined, and it is the real reason this data gets sold rather than shared.

• 970 records had no country field at all. I recovered 707 through address parsing.

• 1,708 US records had no state. I mapped 1,434 via ZIP code geocoding.

• Only 36.6 percent had usable coordinates. Batch geocoding pushed that past 70 percent.

• 261 Southern Hemisphere facilities had inverted latitude signs, putting them in the wrong hemisphere entirely. Three Australian facilities had geocoded into Europe.

That is the moat. Not secrecy. The unglamorous work of making public information usable. I did that part, so nobody has to pay for it.

What the data says

18,110 facilities. 116 countries. 4,181 operators.

The United States holds nearly half of everything. 8,818 of 18,110 facilities, 48.7 percent. A handful of metros, Northern Virginia, Dallas, Chicago, Los Angeles, the New York and New Jersey corridor, hold more capacity than entire continents.

The Netherlands has more mapped facilities than India. 444 against 342. Seventeen million people against 1.4 billion. Density follows capital, connectivity and regulation. Never population.

Africa has fewer than the Netherlands. Roughly 240 facilities for 1.4 billion people, and South Africa holds 67 of them. That is not a hole in my scraper. It is a real gap, and it sets latency, data sovereignty and digital autonomy for a quarter of the world.

Brazil is South America. 141 of the continent’s roughly 217 facilities. Sao Paulo is a single point of failure for a continent.

The physical layer is centralized even where the protocol layer is not. Amazon AWS runs 533 facilities. Equinix 482. Lumen 403. China Telecom 316. Zenlayer 309. Digital Realty 299. The top six alone exceed 2,300. When people call the internet decentralized, they mean the protocols. The buildings are not.

Those were interesting numbers when this was trivia. They are load bearing now, because every argument in that moratorium map is fundamentally an argument about geography, and most of it is being conducted without one.

Read this before you use it for anything that matters

This is the section nobody publishes, and it decides whether your conclusion is real.

The coordinates are not uniformly precise. Roughly 6,131 of 18,110 records carry city level coordinates. The rest fall through a chain: city where available, then US state centroid, then country centroid.

A dot on this map is therefore often not a building. It is frequently a city. Sometimes it is the geometric middle of an entire country, which is to say nowhere at all.

For seeing the shape of global infrastructure, fine. For anything where a specific location matters, it is worse than useless, because it will hand you a confident looking coordinate pointing at a field.

So if you are computing exposure to a water basin, a heat threshold, a grid region or a floodplain: filter on coordinate provenance first. If you skip that, you will produce a number that looks rigorous and means nothing.

And if you are pointing at a dot and saying that building, right there, you are very likely wrong. I am telling you so in the dataset’s own license file.

Why it is free now

I released it under All Rights Reserved. Read that phrase next to the words released it and you will spot the problem.

Then the emails started. A ratings agency wanted it for a white paper on water stress and heat stress exposure across industrial sectors. A satellite communications company wanted it as a layer in an internal planning tool. Others after that. Every one of them careful, every one having read the license and decided to ask rather than simply take the files, which they could have done in about four seconds, because the repository is public.

Every time, I typed the same reply: yes, go ahead, just credit me.

A permission system whose only function is to make honest people wait for my email is not protection. It never stopped anyone willing to ignore it. It only taxed the people who were going to credit me anyway. And there is an irony I would rather name myself than have someone else name for me: my whole argument against the marketplaces is that they put a gate in front of public information. Then I did the same thing. A gate with no lock and no guard, but a gate.

So it is attribution only now. Use it, copy it, publish it, build a product on it, cite it, argue with it. You do not need to ask and you do not owe me an email, though I would like to hear what you make. I would not have guessed the first serious use would be climate risk modeling.

Take it

18,110 facilities in twelve formats: CSV, XLSX, JSON, GeoJSON, KML, TSV, XML, SQLite, Parquet, SQL dump, YAML, and a Markdown table you can read without downloading anything. GeoJSON imports straight into QGIS, Mapbox, ArcGIS and Kepler.gl. KML opens in Google Earth. The SQLite build is queryable with no server.

The live map carries search, country and operator filters, clustering, heatmaps, radius search, distance measurement, proximity analysis and export. There is a 3D globe and a Robinson projection as well, because Mercator lies about area and area is the entire argument when you are looking at where infrastructure concentrates.

Data: https://github.com/Ringmast4r/Global-Data-Center-Map
Map: https://data-center-map.com

No account. No commission. No quote form. No sales team.

I mapped these buildings when they were boring. Everyone has since decided they are the most important buildings in the country, and both sides of that argument have turned up wanting the numbers.

I am not going to tell you what to conclude. I did the scraping, I did the cleaning, I have shown my methodology, and I have told you exactly where the data is weak so you cannot honestly overstate it.

The research is yours now.

Read more

The Carrier That Committed Everything

Viva Dominicana is one of the Dominican Republic’s major telecommunications carriers. Millions of subscribers. Television services. Mobile. Internet. The kind of company that handles the communications infrastructure a country depends on.

Their main website at viva.com.do had a .git directory accessible via HTTP. Not just the config file — the entire pack file. 422 megabytes. 15,687 files in the index. Thirteen commits spanning April 2020 to January 2021. Fully clonable via dumb HTTP protocol.

Inside: WordPress 4.9.7 (released 2018, ancient by any standard, riddled with known CVEs), database credentials, complete authentication keys and salts, four SQL database backup files, seven WordPress admin user accounts with Gravatar hashes, and evidence of an active compromise — a crypto spam post injected by one of those user accounts.

And that was just the main domain. The same .git exposure replicated across recargas.viva.com.do and wsapp.viva.com.do. Their internal GitLab instance at gitlab.viva.com.do was live with public projects visible. And servicekit.viva.com.do was running ManageEngine ServiceDesk Plus version 9.3 — a 2016-era build with multiple known pre-authentication remote code execution vulnerabilities.

Update (March 2026): The .git exposure at viva.com.do remains live. A second scan confirmed the internal GitLab URLs are still visible in the git config, pointing to three internal repositories: viva-apps/web-viva.git, viva-apps/helpdesk.git, and viva-apps/web-channel.git.

The Database Credentials

The git repository contained a backup of wp-config.php with production MySQL credentials:

• Database: [REDACTED]

• Username: [REDACTED]

• Password: [REDACTED]

Plus the complete WordPress authentication key and salt set — eight cryptographic values that control session security. With these values, an attacker can forge valid WordPress authentication cookies for any user account without knowing their password.

Four SQL database dumps from 2017 were committed to the repository, containing the full WordPress database at two different points in time. User tables, post content, configuration data — all recoverable from git history.

Seven Admin Users Exposed

WordPress user enumeration via the REST API revealed seven accounts with full Gravatar hashes:

• Efrain Castillo (ecastillo) — ID 20

• logandosec — ID 18

• Luis Ogando (logando) — ID 9

• Nieves Cespedes (ncespedes) — ID 11

• Pamela Santos (pamela-santos) — ID 22

• patrick — ID 12

• rgarcia — ID 19

One of these accounts — Efrain Castillo, ID 20 — was associated with a crypto spam post injected into the site. This is a strong indicator of account compromise, likely through credential stuffing or brute force against the exposed WordPress installation.

The ManageEngine Problem

ManageEngine ServiceDesk Plus at servicekit.viva.com.do returned version 9.3, build 9300 — approximately from 2016. This version predates multiple critical security patches including pre-authentication remote code execution vulnerabilities.

Exposed endpoints confirmed the service is actively running: /SetUpWizard.do, /servlet/AJaxServlet, /api/v3/requests, /WOListView.do, /ViewRequest.do — all returning HTTP 200.

A telecom company’s IT service management platform, running a decade-old version with known RCE vulnerabilities, accessible from the internet.

Every Police Station in the Country

Separate from the Viva findings, the Dominican Republic’s National Statistics Office operates a GeoServer at portalgeoestadistico-geo.one.gob.do. It runs GeoNode 4.0.0 with Web Feature Service (WFS) enabled. No authentication. Access constraints: NONE. The GeoServer title was still configured as “example.com” — the default placeholder.

Twenty-eight WFS layers were dumped, totaling 433 MB of GeoJSON:

Security infrastructure:

• 1,003 police, military, and security institution GPS locations

• 2,470 government office locations

• 24 embassy and consulate locations

• 246 emergency/relief institutions

National infrastructure:

• 7,237 schools with GPS coordinates

• 10,000+ religious institutions

• 7 international airports

• 10,000+ roads and highways

• 7,873 waterways

Administrative boundaries:

• 32 provinces (complete polygon data, 55 MB)

• 986 municipalities

• 1,004 districts

• 1,608 census sections (179 MB)

The security institution layer is the most sensitive — precise GPS coordinates for every police station, military installation, and security facility in the Dominican Republic. Combined with the administrative boundary data, this enables complete mapping of the country’s security infrastructure.

The Car Rental With Everything Exposed

autodominicana.rent — a car rental platform — had its production .env file publicly accessible. The full inventory:

• MySQL database credentials (host, username, password, database name)

• Laravel APP_KEY (enables session forging and potential RCE)

• Twilio SMS credentials (SID, token, phone number, messaging SID — active SMS sending capability)

• RentProg API token

Additionally, a 517 MB Laravel debug log at /storage/logs/laravel.log was publicly downloadable — containing server paths, error traces, and application state.

A small car rental company with more exposed secrets than most of the government sites scanned.

Phase 2: The Universities

Added March 2026

Phase 1 covered 1,340 domains — government, telecom, and private sector. But the Dominican Republic has 40+ universities, and the education sector tells a different story than the hardened .gob.do domains.

Using certificate transparency log harvesting (THOT), we discovered 1,522 .edu.do domains. Combined with 43 curated university targets, 1,192 additional .do domains, and 36 bank domains, the total scan scope expanded to 4,129+ domains across 7 custom scripts.

phpMyAdmin on Three Subdomains

Universidad Dominicana O&M (uod.edu.do) has phpMyAdmin v5.2.1 accessible on the internet — not on one subdomain, but three: the main site, the admissions system, and the academic system. Three database admin panels protecting student records, grades, and PII, sitting behind nothing but a login form.

A University Running PHP From a Test Directory

UCATECI (ucateci.edu.do) left info.php accessible — a 142KB full phpinfo dump. It revealed PHP 7.4.33 (end of life since November 2022, no security patches), Apache 2.4.52, the admin’s email address, and a document root of /var/www/html/prueba. “Prueba” is Spanish for “test.” A production university website served from a test directory running end-of-life PHP.

The .git That Reveals the Server

UAFAM’s virtual learning platform (virtual.uafam.edu.do) had its .git directory exposed. The HEAD file pointed to MOODLE_405_STABLE. The config revealed it was cloned from GitHub’s Moodle repository. The packed-refs file was 57KB — every Moodle version tag from 1.0 to 5.0. The git logs revealed the server hostname (uafam-moodle-1), that it was deployed by root, and the exact clone date: May 1, 2025.

WordPress Users Across 14 Universities

The WordPress REST API user enumeration endpoint (/wp-json/wp/v2/users) was open on 14 universities, yielding approximately 30 user accounts. But the interesting finding was a supply chain pattern: the accounts rsweb and rssolucionesweb appeared on both UFHEC and UNIREMHOS. Rodriguez Santos Soluciones Web — a single web development company — manages both university websites. One compromised developer, two compromised universities.

The Library That Published Its API Blueprint

ISFODOSU’s library system (biblioteca.isfodosu.edu.do) runs Koha version 23.0503000 and had its complete REST API Swagger specification publicly accessible — 474KB documenting every API endpoint: patron management, checkouts, holds, items, acquisitions, reports, cash registers, and transfer limits. A complete blueprint for anyone wanting to interact with the library’s backend.

FortiGate VPN and Tomcat SSO

Two universities (UNAPEC and UCATECI) exposed FortiGate SSL VPN login portals. UNAPEC’s SSO system runs Apache Tomcat 8.5.57 — outdated with multiple known CVEs. UNPHU runs a REDCap instance (research data collection) where the API responds with “you do not have permissions” — confirming it exists and needs only a valid token.

The Banks Are Fine

In contrast to everything above, the banking sector assessment was clean. All 36 Dominican Republic financial institutions — BanReservas, Banco Popular, BHD, Scotiabank, Promerica, Banesco, APAP, and 29 others — returned zero exploitable findings. CloudFront, Incapsula/Imperva WAFs, properly configured responses. The banks have invested in security. The universities have not.

The Scan Scope

Phase 1: 1,340 domains scanned (February 2026) — government, military, banking, media, education, healthcare, commerce. Eight organizations returned findings.

Phase 2: 2,789+ additional domains scanned (March 2026) — universities, education regulators, banking sector deep dive, full .do TLD sweep. Fourteen new findings across the education sector. Banking sector confirmed clean.

Total: 4,129+ domains. 22 organizations with findings. All remain live as of March 7, 2026.

The findings paint a three-tier picture:

• Government and banking: Hardened. WAFs, clean scans, minimal exposure.

• Telecom (Viva Dominicana): Catastrophic. Systemic failures across the entire organization, still unpatched a month after initial discovery.

• Universities: Broadly vulnerable. phpMyAdmin panels, EOL software, exposed APIs, supply chain dependencies on small web shops.

Read more

Everything in this report was found using open-source intelligence. No passwords were guessed. No logins were bypassed. No exploits were used. Every piece of data described below was publicly accessible — served openly on the internet, visible to anyone with a browser, a URL bar, or a basic understanding of how WordPress REST APIs and IIS directory listings work. This was not a hack. It was a search.

40+ Haitian government domains under the .gouv.ht top-level domain were probed over three days using standard HTTP requests to publicly accessible endpoints: WordPress REST APIs, sensitive path checks, IIS directory traversal, SOAP web service discovery, Exchange server fingerprinting, cPanel enumeration, and DNS record queries. No authentication was required at any point. No credentials were tested against live systems. Gravatar hash reversal was performed entirely offline. Document parsing was performed locally on already-downloaded files.

What came back was not a collection of isolated misconfigurations. It was a portrait of a government with no centralized cybersecurity posture — no patch management, no access control policies, no monitoring, no incident response. Every branch of government exposed something. The national ID office exposed 86,578 citizens. The customs authority exposed an Exchange server and 3,232 phone numbers. The police lost their domain to a scam operation. The municipal tax system has three known remote code execution vulnerabilities with confirmed active exploit endpoints. And a Ministry of Interior configuration file has been serving database credentials to anyone who asks.

These are the findings.

86,578 Citizens in a CSV File

Haiti’s Office National d’Identification — the agency responsible for issuing national identity cards — uploaded a CSV file to its WordPress media library in July 2024. The file contains 86,578 rows of national ID card records. It has been publicly downloadable ever since.

Each record contains: the citizen’s full name, date of birth, national ID document number, chip serial number, gender, place of birth down to the commune level, residence location, marital status, nationality, and the employee IDs of the government workers who handled the card.

The chip serial numbers are the most dangerous field. Haiti’s national ID cards use embedded chips for authentication — the same technology used in e-passports. A chip serial number paired with the cardholder’s biographical data is the starting point for physical card cloning. Eighty-six thousand chip serials sitting in a CSV file on a WordPress server means the technical prerequisites for cloning nearly ninety thousand identity documents are one download away.

The file is 20.4 megabytes. Only a six-line sample was downloaded for this investigation. The full file remains accessible.

The same site runs LayerSlider version 6.11.1 — a WordPress plugin with CVE-2024-2879, a CVSS 9.8 unauthenticated SQL injection vulnerability. If someone with worse intentions finds the CSV file and also finds the SQL injection, the attack surface is not just the CSV — it is the entire WordPress database, which may contain additional records, user credentials, and site administration access.

The Police Domain That Serves a Scam

Haiti’s National Police — the Police Nationale d’Haiti — operates the domain pnh.gouv.ht. Or it used to. The domain now resolves to IP address 193.203.165.231 and serves a page titled “Cash Rocket | smocup-cashads.” The SSL certificate is issued for cashads.smocup.site — not pnh.gouv.ht. The session cookie is named smocup_cashads_session. The login panel reads “smocup-cashads Login Panel.” The about page says “Work with us to play the game & Earning.”

The Haitian National Police’s official website has been hijacked and is serving a gambling and advertising scam.

This is either DNS hijacking, domain expiration takeover, or hosting account compromise. A git repository is present on the server — /.git/HEAD returns 403 — suggesting the scam operator deployed their own Laravel application. The framework, the session handling, the template structure — none of it has anything to do with the Haitian police. Someone took the domain and stood up a scam platform on it.

Any Haitian citizen navigating to their national police website — to report a crime, look up a contact number, find a precinct address — is served a scam instead. In a country where institutional trust is already fragile, the government’s inability to maintain control of its own police domain is not just a technical failure. It is a visible, public symbol that no one is minding the store.

A Tax System With Three Remote Code Execution Vulnerabilities

CIVITAX is Haiti’s integrated municipal tax and budget system. It manages property tax billing, census questionnaires, municipal budgets, and imports from the national tax authority. It runs on IIS 10.0 with ASP.NET 4.0 and uses Telerik UI version 2013.3.1015.40 — a component library released over a decade ago with three independently documented remote code execution vulnerabilities.

CVE-2019-18935 — insecure deserialization in RadAsyncUpload. CVSS 9.8. Unauthenticated remote code execution via a .NET mixed-mode assembly. This CVE is on CISA’s Known Exploited Vulnerabilities catalog. Public exploit tools exist. The handler that serves this vulnerability — Telerik.Web.UI.WebResource.axd?type=rau — was tested and returned: “RadAsyncUpload handler is registered succesfully.” It is active.

CVE-2017-9248 — cryptographic weakness in DialogHandler.aspx. CVSS 9.8. Allows recovery of the Telerik encryption key, enabling arbitrary file upload. The handler — Telerik.Web.UI.DialogHandler.aspx — returns 200 OK with a functional page. It is active.

CVE-2017-11317 — unrestricted file upload via RadAsyncUpload. CVSS 9.8. Arbitrary file write through weak encryption. Same handler as CVE-2019-18935.

Both confirmed-active handlers are the exact entry points for these exploits. Public tools — dp_crypto for key recovery, ysoserial.net for deserialization payloads — are freely downloadable. The Telerik version is over a decade old and uses default encryption keys that are published in every proof-of-concept write-up on the internet.

But the Telerik vulnerabilities are only the beginning of what CIVITAX exposes. The entire application tree is visible through IIS directory listing — every folder, every file, every page. The security administration section contains user management, password change, group rights, and role assignment pages. The budget section has 27 pages. The census section, the taxpayer section, the property records section — all enumerable. The reports page and statistics page load without authentication.

Two RAR archives were publicly downloadable from the same server. They contained server-side VB.NET source code — not data, but the actual backend logic for the census questionnaire system and the property tax billing system. The source code reveals the database credential encryption pattern — the function name, the configuration key names, the parameter structure — everything an attacker would need to understand how the application retrieves its database password. The developer framework — SolutionsHT — is the same company that built the Ministry of Planning’s website, confirming a shared codebase pattern across government systems.

A SOAP web service on the same server exposes 22 operations callable via HTTP GET without authentication. The operations include disaster evaluation data, HIV/AIDS impact assessments, property and occupant information, map visit data with photos, and task management functions. The WSDL — the full service definition — is 79 kilobytes. Several operations reference stored procedures that no longer exist in the database, returning errors. The service itself is live and responding.

The system was last modified on February 24, 2026. It is actively used. The login page has no CAPTCHA, no rate limiting, and no visible two-factor authentication.

An Exchange Server Open to the World

Haiti’s customs authority — the Direction Generale des Douanes — operates an Exchange 2016 server at agdmail.douane.gouv.ht. All eight standard Exchange remote access endpoints are exposed to the public internet.

ActiveSync accepts Basic Authentication — credentials encoded in base64 and transmitted in HTTP headers. RPC/HTTP Proxy accepts both Basic and NTLM authentication. The Exchange Control Panel — the full administrative console — responds to requests. Exchange Web Services, MAPI/HTTP, the Offline Address Book, and even the remote PowerShell management endpoint are all reachable from any IP address on the internet.

Basic Authentication on ActiveSync and RPC means that any network position between the user and the server — an ISP, a compromised Wi-Fi hotspot, a man-in-the-middle at any point along the path — can read the credentials in transit. They are not encrypted at the application layer. They are base64-encoded, which is a formatting scheme, not an encryption scheme. Anyone with Wireshark can read them.

The Exchange admin email — xchgad@douane.gouv.ht — was recovered from the domain’s DMARC DNS record. The adjacent web server at 190.115.189.37 runs Apache on Windows with an expired SSL certificate. The customs authority’s WordPress installation has directory listing enabled, wp-file-manager-pro installed (a plugin with a history of remote code execution), and a debug log that leaked the cPanel username and server path.

The customs authority handles Haiti’s international trade — import declarations, tariff enforcement, SYDONIA system data, customs warehousing. Access to their email infrastructure means access to trade documents, cross-border communications, and internal administrative correspondence.

3,232 People With Phone Numbers

The same customs authority uploaded an Excel spreadsheet to its WordPress media library. The file — Liste-des-candidats-retenus.xlsx — contains 3,232 rows of candidate records with last names, first names, sex, phone numbers, and department locations. Every single record has a Haitian mobile phone number. One hundred percent coverage.

Someone at the customs authority knew this was a problem. A second version of the file was also uploaded — one with the phone number column removed. The existence of the redacted version confirms the phone list was recognized as sensitive. Both versions remain publicly accessible.

In a country where mobile phones are the primary communication channel and where phone-based social engineering is a known vector for fraud and extortion, a verified government list linking 3,232 names to their phone numbers is not a minor oversight. It is a targeting database.

$120,785 in Donor Records From the Prime Minister’s Office

The Office of the Prime Minister runs a WordPress site with the GiveWP donation plugin. The plugin’s REST API endpoints — /givewp/v3/donors and /givewp/v3/donations — return data without requiring authentication.

Sixty-five donor records were returned from the bulk endpoint. Sixteen more were discovered through sequential ID enumeration — donors who don’t appear in the paginated list but respond to direct ID queries. Eighty-two donation records were returned, totaling $120,785 USD across four campaigns.

The largest single donation is $100,000 from a donor identified as MOMA EL MOCTAR. The donor API truncates names to initials — but the campaign comments endpoint does not. The comments at /givewp/v3/campaigns/12/comments return full last names and Gravatar SHA256 hashes. MOMA EL MOCTAR. Abdalla IBRAHIM. FODOUOP JAHSWANT. Cem GOKSU. Pedro Mulluni. The full names that the donor API tried to protect are served unprotected by the comments API.

The sensitive data fields — email addresses, IP addresses, billing information — properly return 401 when the includeSensitiveData parameter is set. Someone configured partial access controls. But the names, the donation amounts, the campaign associations, and the Gravatar hashes — which can be reversed offline to recover email addresses — are all served without restriction.

351 Tax IDs in Blog Posts

The Direction Generale des Impots — Haiti’s national tax authority — publishes organizational NIF numbers directly in blog post content. NIF — Numero d’Identification Fiscale — is Haiti’s federal tax identification number. Three hundred and fifty-one of them were extracted from post content served by the WordPress REST API.

Air France. Archives Nationales d’Haiti. Assembly Center of Haiti. Digicel. Organizations large and small, their tax identification numbers published in government blog posts that were never intended to be a database but function as one when accessed through the API.

An additional ten NIFs were found in DINEPA procurement documents that were parsed separately, bringing the total to 361 exposed tax identifiers.

MySQL Credentials Served as a Web Page

The Ministry of Interior and Territorial Collectivities — MICT — has a web.config file on its web server that returns HTTP 200 to any request. The file contains a MySQL connection string with the database name, username, and password in plaintext.

Database: immigr31_wordpress300. Username: immigr31_admict. Password: admictpassweb. Provider: MySql.Data.MySqlClient. The cPanel username — immigr31 — is derived from the database prefix and confirmed by the server path /home/immigr31/public_html/.

The MySQL server binds to localhost, so the credentials cannot be used for remote database access directly. But combined with the cPanel login page accessible at port 2083 and the hosting provider identified as InMotion Hosting, the credentials enable targeted attacks against the hosting account — phpMyAdmin access through cPanel, password reuse testing, and social engineering against the hosting provider’s support team.

The WordPress installation itself is broken — PHP pages return 500 errors — but static files and directory listings work. Error logs at /error_log (173 kilobytes) are publicly readable. The uploads directory has listing enabled, and 82 government documents — decrees, disaster response plans, environmental reports spanning 2013 to 2025 — were downloaded from it.

25 Admin Accounts, 11 Emails Cracked

WordPress sites across Haiti’s government universally expose admin accounts through the REST API at /wp-json/wp/v2/users. No authentication is required. The API returns usernames, display names, and Gravatar avatar hashes.

Twenty-five admin accounts were enumerated across twelve government WordPress sites — the Tax Authority, the Ministry of Defense, the Prime Minister’s Office, the Water Authority, the Central Bank, the National ID Office, the Ministry of Planning, the Ministry of Justice, FAES, OAVCT, and CIAT.

Gravatar hashes are SHA256 hashes of the user’s email address, embedded in every API response. They are not encrypted — they are one-way hashes, but they can be reversed by brute-forcing common email patterns against the hash until a match is found. This was done entirely offline using a Python script. No Gravatar servers were contacted. No WordPress servers were queried during cracking.

Eleven of twenty-four hashes were cracked — a 46% success rate. The recovered emails reveal a pattern: Haitian government workers overwhelmingly use personal free email services for WordPress administration. Yahoo.fr — popular in French-speaking countries. Gmail. MSN. Hotmail. The Central Bank showed the best practice, with two of three accounts using corporate @brh.ht email. Everyone else uses personal accounts.

Two Tax Authority administrators use their personal Gmail addresses as their WordPress display names — publicly linking their government administrative role to their personal identity. One was identified as Innocent Louinord via his Gravatar profile and Twitter account. The Ministry of Defense left a developer admin account — username admindev — in production. OAVCT has a demo theme user whose description reads “You should delete or modify this user.” It was not deleted.

The Ministry of Planning admin (mpce_admin) and CIAT admin (ciat_admin) share an identical Gravatar hash — the same email address controls both agencies. One person, two ministries, one password.

11 cPanel Panels and No Email Security

Eleven cPanel administrative panels were discovered across Haitian government domains, all accessible from the public internet on the standard cPanel ports (2083 for user panel, 2087 for WHM root panel). The Tax Authority. The Prime Minister’s Office. Professional Training. The Postal Service. Four OREPA regional water offices. Tourism. Foreign Affairs. Public Finances.

The four OREPA offices — Nord, Sud, Centre, and Ouest — all resolve to a single IP address: 192.249.121.88. Four government agencies sharing one server. Compromising any one cPanel account on that server grants access to all four. The parent organization, DINEPA, uses Cloudflare on an entirely different hosting provider — creating a disconnected security perimeter where the headquarters cannot see or protect its regional offices.

Email security across .gouv.ht domains is largely nonexistent. The Direction des Finances — DZF — has neither SPF nor DMARC records. No mechanism of any kind prevents anyone from sending emails that appear to originate from @dzf.gouv.ht. Five more domains — Foreign Affairs, Professional Training, the Postal Service, UTE, and Tourism — have SPF softfail records but no DMARC, meaning spoofed emails may generate warnings but are still delivered. The customs authority’s DMARC record claims a reject policy but sets enforcement to 5% — meaning 95% of spoofed @douane.gouv.ht emails are delivered normally.

In a country where the National Police domain has been hijacked and serves a scam, the inability to authenticate government email creates a parallel vector. An attacker who cannot take over a website can simply send emails from it instead — and no technical mechanism exists to stop them.

233 Documents, 685 Officials, and a Director General’s Personal Email

Two hundred and thirty-three government documents — 188 PDFs, 20 Word documents, 6 Excel spreadsheets, and 19 legacy .doc files — were downloaded from publicly accessible WordPress media libraries and directory listings across six agencies. All were parsed locally using automated PII extraction.

The parsing returned 10,310 regex matches across all categories. Fifty-nine unique email addresses — eight from the water authority, five from CTERMPP, contacts from UNICEF, USAID, UNOPS, UNEP, and IOM. Eighty-three named government officials from procurement documents, environmental assessments, and budget reports. Seventeen Haitian phone numbers. Ten additional NIF tax IDs not found in the DGI blog content. One hundred and twenty-eight URLs. One hundred and ninety-five IP addresses.

The most significant individual finding: the Director General of DINEPA — Haiti’s national water authority — was identified with both his government email (guito.edouard@dinepa.gouv.ht) and his personal Gmail (edouardguito2013@gmail.com). This dual-email pattern — a personal Gmail alongside an official address — is endemic across Haitian government. It is the same pattern seen in the WordPress admin accounts, the same pattern that makes Gravatar hash cracking effective, and the same pattern that creates phishing and social engineering vectors against senior officials.

Separately, 1,365 images from government websites were scanned for EXIF metadata. Twenty-six contained author metadata — photographer names embedded in the image files. Zero contained GPS coordinates.

What This Means

Haiti was the eleventh country scanned in this series. The findings are not the largest by volume — Mexico’s 186 million records across 177 agencies holds that distinction. But Haiti’s exposure is distinguished by its breadth relative to the size of the government, the severity of individual findings, and the complete absence of any security infrastructure.

Every branch of government contributed to the exposure. Interior leaked database credentials. Defense leaked a dev admin account and military candidate lists. The Prime Minister’s Office leaked donor finances. The Tax Authority leaked 351 tax IDs and admin emails. The Water Authority leaked 74 email addresses and a Director General’s personal account. The Central Bank leaked three admin emails. The National ID Office leaked 86,578 citizens’ identity documents with chip serials. The Customs Authority leaked an Exchange server, 3,232 phone numbers, and an expired SSL certificate. The Police lost their domain entirely. The municipal tax system has confirmed remote code execution endpoints. The Telecom Regulator runs a CMS that reached end of life in January 2025 on a PHP version that reached end of life in December 2018. The Environment Ministry runs a CMS from 2018 with the admin panel open to the internet.

There is no centralized security team. There is no patch management. There is no monitoring. There is no WAF. There is no DMARC enforcement. There is no vulnerability disclosure program. There is no evidence that any of these exposures has been detected by the organizations responsible for them.

The 86,578 national ID records have been publicly downloadable since July 2024 — eight months before this investigation. The police domain is actively serving a scam. The CIVITAX Telerik handlers are responding to requests right now. The Exchange server is accepting Basic Authentication connections right now. The MySQL credentials in the MICT web.config have been readable for years.

This is not a story about a sophisticated attack. This is a story about a government that built its digital infrastructure without security and never went back to add it. The front door was never installed. The locks were never purchased. The alarm was never considered. And the findings documented here — every credential, every record, every exposed endpoint — were collected by doing nothing more than visiting publicly accessible URLs and reading what came back.

Methodology

This investigation was conducted entirely through open-source intelligence (OSINT) — the practice of collecting and analyzing information from publicly available sources. The specific techniques used:

• Passive domain scanning — HTTP requests to publicly accessible web servers to identify exposed configuration files, directory listings, debug logs, and misconfigured services

• WordPress REST API enumeration — Querying /wp-json/wp/v2/users, /posts, /media, and custom post type endpoints on government WordPress installations

• Gravatar hash reversal — Offline SHA256 brute-forcing of common email patterns (gmail.com, yahoo.fr, hotmail.com, gov domain patterns) against hashes extracted from WordPress API responses. No remote servers contacted during cracking

• IIS directory traversal — Navigating publicly enabled directory listings on the CIVITAX municipal tax system to map the application tree

• SOAP/WSDL discovery — Fetching the ?WSDL endpoint on CIVITAX’s MapWebService to enumerate 22 unauthenticated operations

• Exchange fingerprinting — HTTP GET requests to standard Exchange paths (OWA, ECP, EWS, MAPI, ActiveSync, RPC, OAB, PowerShell) to identify authentication methods and build versions

• cPanel/DNS enumeration — HTTP GET to standard cPanel ports (2083, 2087) on government subdomains, plus DNS lookups for SPF and DMARC records

• Document PII parsing — Automated regex-based extraction of email addresses, phone numbers, NIF tax IDs, names, and addresses from 233 previously downloaded government documents. Performed entirely locally

• EXIF metadata scanning — Local extraction of author and GPS metadata from 1,365 previously downloaded government images

What was NOT done:

• No passwords were guessed, cracked, or brute-forced against any live system

• No authentication mechanisms were bypassed

• No exploits or vulnerabilities were used to gain access

• No credentials discovered during the investigation were tested against any system

• No databases were accessed, queried, or connected to

• No data was modified on any server

• No social engineering was conducted

• No private or restricted systems were accessed

• The MySQL credentials found in MICT’s web.config were NOT used to connect to any database

• The Exchange server endpoints were NOT authenticated against — only their existence and auth type were documented

• The 86,578-record ONI CSV was NOT fully downloaded — only a 6-line sample was taken

Every piece of information in this report was available to anyone on the public internet at the time of discovery. The data was not hidden behind a login, a firewall, or any access control. It was served openly, indexed by default, and waiting for someone to look.

Findings from this investigation have been compiled for disclosure to affected organizations through appropriate channels.

A Final Word

If this had been a hack, the CIVITAX Telerik handlers would not still be responding to health checks. They would have been exploited — the RadAsyncUpload deserialization chain executed, a web shell uploaded, and the entire municipal tax system’s database dumped: property records, taxpayer information, census data, billing histories, and the decrypted database credentials whose encryption pattern was already revealed in the downloadable source code. The 22 SOAP operations would have been called with crafted parameters — not the test values that returned errors about missing stored procedures, but payloads designed to extract disaster evaluation data, HIV impact records, and property occupant information. The IIS server would have been owned within minutes of the first request.

If this had been a hack, the ONI CSV would not have been sampled at six lines. All 86,578 records would have been downloaded, the chip serial numbers would have been packaged for sale, and the LayerSlider SQL injection would have been used to access the WordPress database for whatever additional data it contains — admin credentials, user sessions, and any other records stored alongside the identity inventory that someone uploaded to a media library.

If this had been a hack, the Exchange server would not have been documented from the outside. The Basic Auth on ActiveSync would have been exploited — a password spray against xchgad@douane.gouv.ht and any other accounts enumerable through the OAB endpoint. Once inside, every customs email, every trade document, every cross-border communication. The adjacent Apache server with the expired SSL certificate would have been the next target — already on the same network, already confirmed as Windows, already known to have an exposed debug log and a cPanel username.

If this had been a hack, the MICT MySQL credentials would have been tested within seconds of discovery. The database immigr31_wordpress300 would have been accessed through phpMyAdmin on the cPanel panel at port 2083. Every WordPress user, every post, every page, every stored credential — extracted. The cPanel itself would have been targeted next — same username, possibly same password, full server access.

If this had been a hack, the PNH police domain would have been leveraged — not merely documented. The scam operator’s infrastructure would have been mapped through the git repository. The Laravel installation would have been probed for vulnerabilities. The domain’s residual trust would have been weaponized for phishing campaigns targeting Haitian citizens and government officials.

None of that happened. Every credential was left untouched. Every database was left unqueried. Every vulnerability was left unexploited. Every Telerik handler was left un-chained. The data was documented, the exposure was mapped, and the findings are being disclosed.

The difference between this investigation and a breach is not capability — it is intent. Everything documented here could have been weaponized. It was not. But the infrastructure remains as it was found. The ONI CSV is still downloadable. The Telerik handlers are still responding. The Exchange server is still accepting Basic Auth. The police domain is still serving a scam. And the MySQL credentials are still being served as a web page.

This was a free security audit. The next one won’t be.

=)

NIST writes the rules on software supply chain security for the United States government. Their Secure Software Development Framework, SP 800-218, is the document federal agencies cite when explaining why they require developers to track where their code comes from and who can touch it. Their supply chain risk management guide, SP 800-161, runs 300 pages.

Read more

There is a specific fantasy that surfaces every time I document another corner of the ad tech surveillance pipeline (The Silent Enemy): dig the old Razr out of the junk drawer, drop in a SIM, and exit the entire bidstream economy in one afternoon. No apps, no SDKs, no advertising identifier, no real-time bidding auction broadcasting your coordinates to a hundred companies while you check the weather. Just a phone that is a phone.

It is a good fantasy, and it half works. Whether it works for you comes down to two questions that get conflated constantly. Will an old phone still make a call in 2026? And if it does, is it actually quiet? The first is a network engineering question with a brutal answer. The second is a telemetry question with a worse one.

So, as usual, I counted. Behind my Phreak Phone Museum project sits a 68-device dataset covering every notable retro and retro-styled handset from the 1983 DynaTAC to this year’s e-ink minimalists. In July 2026 I ran every record through a 20-agent verification pass against the live web. The census: 48 of the 68 still register with voice service on a major US carrier (a 49th gets a data signal but cannot place a call), 14 survive only overseas, and 5 are dead on every network on Earth. The survivors then split three ways: genuinely minimal stacks, smartphones wearing dumbphone costumes, and one operating system best described as an ad network with a T9 keypad. Which old hardware still runs, and which of it actually escapes ad tech, is the first half of this piece.

The second half is the newest entrant. Commodore, the brand behind the Commodore 64, is back under new ownership and pre-selling the Callback 8020, a flip phone defined by what it refuses to do. It launched June 30, 2026, and by mid-July its US pre-order counter had reached batch 19. The spec sheet, and the caveats the marketing skips, come after the map of what already survives.

The Network Graveyard Made This Market

None of this is driven by nostalgia alone. The dumbphone market of 2026 exists because US carriers spent 2017 through 2026 tearing out every network that older phones speak. Carriers retired 2G and 3G to reclaim spectrum for 4G LTE and 5G, and the FCC’s own consumer guidance is blunt about the consequence: affected phones cannot make or receive calls, including calls to 911 (FCC).

The sequence, for the record:

• January 1, 2017: AT&T shuts down 2G GSM

• December 31, 2020: Verizon stops certifying CDMA devices, the beginning of the end; the network itself kept running (Verizon)

• February 22, 2022: AT&T shuts down 3G UMTS (FCC)

• March 31 and June 30, 2022: T-Mobile retires Sprint’s 3G CDMA and legacy LTE networks

• July 1, 2022: T-Mobile shuts down its own 3G UMTS

• December 31, 2022: Verizon retires CDMA entirely, 2G 1xRTT and 3G EV-DO together (FCC; Verizon)

• August 3, 2026: T-Mobile’s 2G GSM, the last legacy network standing, finally dies. Announced for April 2024, delayed repeatedly, and as of this writing still carrying legacy IoT traffic for three more weeks (T-Mobile; TechTimes; TmoNews)

When the dust settled, a phone in the United States needs three things to function as a phone:

• An LTE radio on carrier-appropriate bands. For the US majors the load-bearing bands are 2, 4, 5, 12, 13, 17, 66, and 71. Imported devices frequently do LTE, just not on these bands.

• VoLTE support. Voice no longer rides a separate 2G or 3G fallback; calls are VoIP over LTE. A phone with LTE data but no VoLTE provisioning cannot place a call, 911 included (FCC).

• IMEI whitelisting, in practice. Verizon refuses to activate devices not on its certified list even when the radio is technically compatible, and AT&T’s allowlist quietly rejects working VoLTE hardware: my verification pass found the Nokia 225 4G and 110 4G, the Easyfone Prime-A6, the Balance Phone, and the entire Unihertz Titan line locked out of AT&T despite compatible radios. T-Mobile is the most permissive of the three. The allowlist has quietly killed more dumbphones than any network shutdown.

The practical result is a hardware floor around 2014. In my dataset the oldest devices that still register on a US carrier are the Samsung Galaxy S5 and the iPhone 6, both from that year. Everything older is either a paperweight or an export.

The Survivors: What Still Registers in 2026

The museum dataset tracks each device by year, form factor, radio, carrier compatibility, features, and how chatty the software is. The July verification pass came back with 84 field-level corrections against the live web, and several of them rewrote this section. The corrected census:

• 48 devices register with voice service on at least one major US carrier today. Every single one of the 48 has VoLTE. That is not a coincidence; it is the entry fee. A 49th, the Boox Palma 2 Pro, registers for data only: it has no VoLTE, so it is a phone-shaped device that cannot make a phone call.

• 14 devices are alive overseas only. The original Razr V3, the original Nokia 3310, even the 1992 Nokia 1011 (the first mass-produced GSM phone) will still make a real call on the 2G networks that remain live abroad: Germany until around 2028, the UK until around 2029, Mexico indefinitely (Telcel and AT&T Mexico have announced no date), much of Latin America, and nearly all of Africa (Mobile World Live; The Register; BNamericas). Southeast Asia is falling off that list in 2026 itself; Vietnam has already completed its 2G phase-out (Southeast Asia Infrastructure). Same hardware, dead at home, working abroad. The verification pass grew this class from 9 to 14: it turns out the importers’ graveyard holds not just 2G classics but modern 4G hardware with the wrong bands or failed US certification, including the HMD 2660 Flip, the Nokia 8000 4G, the Xiaomi Qin 2, and the Mudita Pure, whose custom antenna failed AT&T and Verizon certification outright.

• 5 devices are dead everywhere: the AMPS-era Motorola DynaTAC 8000X and IBM Simon, the iDEN Nextel i1000plus, the Sidekick (whose Danger service died long before its radio did), and the Relay Screenless Phone, killed when its companion service shut down in September 2024. Service death, not radio death, is the modern failure mode. The verification pass actually rescued one device from this list: the BlackBerry Bold 9000 turned out to be quad-band 2G GSM under its 3G radio, so it still registers abroad.

The US survivors cluster into distinct classes, and the differences matter more than the marketing suggests:

• KaiOS flips (Nokia 2780/2760, TCL Flip 4 5G, Alcatel Go Flip 4, the Tracfone flips): modern radios, WhatsApp, and a limited app store. KaiOS is not a clean room; it is an advertising platform wearing a T9 keypad, and the next section is about exactly that.

• Pure feature-OS phones (Nokia 225/110 4G, Sunbeam F1 line, Plum Ram Plus, Orbic Journey V): no app ecosystem at all. The Sunbeam devices, built for Plain communities, omit the browser, the store, and in most variants the camera, by design.

• Minimalist and e-ink devices (Light Phone II/III, Mudita Kompakt, Punkt MP02/MC02, Minimal Phone): purpose-built digital minimalism hardware, typically at a price premium. Several of these run stripped Android derivatives under the calm exterior, which matters more than their marketing admits.

• Rugged flips running Android underneath (Kyocera Dura line, Sonim XP line, CAT S22, Schok Classic): look like dumbphones, run Android. These carry real telemetry exposure despite having no Play Store.

• QWERTY revivals (Unihertz Titan family) and foldable smartphones (Motorola Razr line, Galaxy Z Flip 6), which borrow the form factor but are full smartphones and belong in a different threat model entirely.

There is also a genuine escape hatch for the truly dead hardware: hobbyists run private GSM base stations (Osmocom OpenBSC, YateBTS) inside Faraday cages to light up vintage phones for display and museum use. Legal only if the RF is fully contained, but it means a StarTAC can still ring in 2026 without asking any carrier’s permission.

Even the Dumb Ones Snitch

The verification pass included a telemetry audit of every operating system in the dataset, and the results dismantle the assumption that a keypad means privacy.

KaiOS is an ad network with a phone attached. KaiOS Technologies runs KaiAds, which its own launch materials describe as “the first advertisement SDK and supply-side platform (SSP) designed specifically for smart feature phones,” passing ad requests to buyers through OpenRTB real-time bidding with OS-level access for sub-200ms ad rendering (KaiOS Technologies). The ad SDK is effectively mandatory: KaiOS accepts monetized store apps only if they use KaiAds, and the platform keeps 70 percent of ad revenue (kaios.dev). The privacy policy sanctions collection of IMEI, IMSI, IP address, usage data, and “precise location data, including the real-time geographic location of your device,” shared with “partners and licensees” for, among other things, advertising (KaiOS privacy policy). Google invested $22 million in KaiOS in 2018 specifically to put Assistant, Maps, YouTube, and Search on these devices (TechCrunch; 9to5Google). Ten devices in my census run it.

HMD’s 4G feature phones phone home daily. HMD’s own privacy documentation for data-enabled feature phones lists activation beacons carrying UUID, IMEI, IMSI, and serial number fired at 0, 6, and 24 hours after setup and on every SIM change, plus firmware pings after each boot and daily version telemetry, with no opt-out described (HMD). The data lands on servers in Finland, which is better than most alternatives, but a “dumb” Nokia candybar still announces its identity to its manufacturer every day.

De-Googled Android still pings Google. The AOSP base under the rugged flips connects to Google infrastructure out of the box: connectivity checks, network time, and most sharply A-GPS SUPL requests that can carry the subscriber’s IMSI and serving cell to supl.google.com whenever GPS assistance fires (GrapheneOS; WirelessMoves). A phone with no Google account and no Play Store still tells Google who it is and roughly where it is.

The cheap ones can be actively hostile. A researcher who intercepted the traffic of five sub-$20 white-label button phones with a private 2G base station found four of them malicious out of the box: a premium-SMS trojan, an SMS-interception backdoor used to register fraudulent messaging accounts on victims’ numbers, and vendor firmware posting IMEI, IMSI, and cell tower location to remote servers (Habr, ValdikSS; The Record). The lesson for the AliExpress dumbphone shopper: the OS has no ad stack, but the firmware supply chain is the threat.

The quietest stacks are the purpose-built ones. Sunbeam’s Plain-community flips and the true feature-OS Nokias have essentially nothing to leak with, and Sailfish OS, the base of both the Jolla phones and the Commodore Callback, carries the best documented posture of any platform I reviewed: no ad identifier, no default telemetry, “we do not collect any data without your consent” (Jolla). The honest footnote is that Jolla’s claims are vendor-asserted; nobody has published an independent packet-capture audit, which is exactly the test the Callback should face when it ships.

The verification scoreboard says be skeptical by default. Across the whole privacy-phone market, exactly one de-Googled OS has passed an independent packet-capture audit: /e/OS, the fork sold on Murena phones, which a Trinity College Dublin and University of Edinburgh study found sends no data to Google or third parties, the only OS of six Android variants tested with that result; the same study measured Google Play Services uploading at least 10 times more data than the handset maker’s own OS on every other phone (Leith, Android Mobile OS Snooping). The cautionary tales run the other way: the Freedom Phone, sold as an anti-surveillance device, turned out to be a rebadged $119 Umidigi A9 Pro from AliExpress (Daily Dot; XDA Developers), and GrapheneOS publicly called Erik Prince’s UP Phone a “clear-cut scam,” citing roughly a year of missing security patches (GrapheneOS; How-To Geek). Loud privacy marketing correlates poorly with clean traffic. The only proof that generalizes is a packet capture.

The Comeback, Quantified

The demand side is real and measurable. Feature phones were roughly 15 percent of global handset sales last year, near 210 million devices, though only about 1.7 million of those sold in North America (CNN). The Light Phone III sells for $699, and its co-founder says half of the company’s customers now use it as their primary device, up from a product originally pitched as a weekend secondary phone (CNN). Gen Z is the demographic engine, with flip-phone revival content pulling tens of millions of views on TikTok (The Conversation; Trend Hunter).

The shape of the demand matters more than the headline number. The mass-market button phone is actually shrinking: US feature phone sales fell 38 percent between 2023 and 2024, and Western Europe dropped 11 percent (Counterpoint via press). What grows is the deliberate niche: Counterpoint attributes the US resurgence squarely to Gen Z and millennial digital-detox demand, roughly 28 percent of US Gen Z respondents told Morning Consult they were interested in buying a dumbphone (the highest of any generation), Light has shipped over 100,000 devices, and the research literature now treats “designer dumbphones” as a distinct engineered product category (Counterpoint; CNN). Even the incumbents are hedging: HMD shipped a Detox Mode on its Android Skyline that blocks 14 app categories on a timer, though The Register’s hands-on found the blocked social networks remained reachable through the browser, which makes it a distraction limiter rather than anything ad tech needs to worry about (The Register).

Regulation is the tailwind nobody prices in. Australia’s under-16 social media ban took force December 10, 2025, and enforcement is tightening: regulators found roughly 70 percent of under-16s with accounts still active three months in, and Australia moved to double maximum fines to AU$99 million (Al Jazeera). The UK followed on June 15, 2026, announcing that TikTok, Instagram, Snapchat, YouTube, Facebook, and X will be barred from serving under-16s, with the ban in force by Spring 2027 (GOV.UK). Keep those two regimes in mind for the Callback section below: the app list Commodore blocks at the operating system level mirrors them exactly. It is compliant-by-construction hardware for a market that legislation is about to create.

The health research gives the trend a spine. A randomized controlled trial published in PNAS Nexus in February 2025 blocked mobile internet on participants’ smartphones for two weeks and measured improved sustained attention, mental health, and subjective well-being, with 91 percent of participants improving on at least one outcome (PNAS Nexus; Medical Xpress; News-Medical). Commodore cites that exact study in its own FAQ (Commodore store).

Callback 8020, Read as a Spec Sheet

Commodore opened pre-orders on June 30, 2026 for a phone defined by what it refuses to do: no web browser, no social media apps, no Google services, no advertising identifier, no RCS, no NFC, and no 5G (PR Newswire; Tom’s Hardware; GSMArena).

Two weeks later, on July 14, the US order counter on Commodore’s store sat at Batch 19, with 409 of 500 units remaining and the first batch estimated to ship September to October (Commodore store). Commodore does not publish the size of earlier batches, so treat this as an estimate, but if they held anywhere near the current 500, that is on the order of 9,000 phones pre-sold in 14 days, at $399 and up, for a flip phone whose headline feature is subtraction. That counter is the sharpest data point yet for the market the previous section quantified: phones the mobile advertising economy structurally cannot monetize are selling out in batches.

Strip the nostalgia branding and the Callback 8020 is a technically interesting object. It is not an Android phone. It runs Sailfish OS, a de-Googled Linux-based operating system, with Android apps executing inside a sandboxed AppSupport environment that Commodore claims covers over 99 percent of apps (GSMArena; Android Central; Commodore store).

The blocking is the product. All web browsers and a fixed list of social apps are blocked at the system level using what Commodore describes as patent-pending tech, and the blocks cannot be turned off (Commodore store). The blocked list tracks the apps named in Australia’s under-16 restrictions: Facebook, Instagram, Snapchat, Threads, TikTok, X, YouTube, Reddit, Kick, and Twitch, with Discord, Roblox, and Tumblr added “by popular demand” (Commodore store). Everything else can be sideloaded from APK files.

From the ad tech side, the interesting engineering decisions are the refusals, each of which closes a specific tracking surface:

• No Google Play Services means no Google Advertising ID, the primary join key of the mobile ad economy (Android Central).

• No browsers at all means no cookies, no fingerprinting surface, no real-time ad auctions. Commodore’s FAQ is explicit that the browser is blocked because it is “the back door” to everything else (Commodore store).

• No RCS, because RCS routes messages through Google’s servers; SMS, MMS, and WhatsApp are the supported paths (Commodore store).

• No NFC and no big-tech payment apps, which severs the purchase graph. Their FAQ names the reason: financial apps “that insist on running your banking information and personal data through big tech company servers, who know what you bought at midnight last Tuesday” (Commodore store).

• No AI by default, on both the OS and the preload list (Commodore store).

The hardware itself is a competent mid-range feature phone: MediaTek Helio G81, 4GB RAM, 64GB storage plus microSD, a 48MP Sony camera, a 1550mAh quick-swap removable battery, dual physical SIM slots with no eSIM, FM radio, IP44 splash resistance, and a touchscreen that ships disabled by default in favor of the keypad (GSMArena; Commodore store). It is 4G VoLTE only, no 5G, which Commodore frames as a battery and attention decision (Commodore store). Press coverage at announcement quoted $499; the store page now lists it from $399 before tax, in five retro colorways (Tom’s Hardware; Commodore store).

What the Blocking Can’t Fix

A technical reading requires the counterweights, because “dumbphone” and “private” are not synonyms:

• The baseband still talks to towers. Carrier-side location (which tower, when, moving where) is a property of cellular service itself. No handset design removes it.

• WhatsApp ships preinstalled. Content is end-to-end encrypted, but WhatsApp is Meta, and metadata is metadata.

• KaiOS is not a quiet OS. Ten devices in my census run an operating system with a built-in real-time-bidding ad platform and a privacy policy that sanctions IMEI, IMSI, and precise-location collection, detailed above.

• Twenty-nine of the 68 devices run a full smartphone OS under the hood. The verification pass tore up my original labels: beyond the rugged Kyocera, Sonim, Schok, and CAT flips, it caught Android inside the Punkt MP02 and MC02, the Mudita Kompakt, the Minimal Phone, the Balance Phone, the Wisephone II, the Duoqin and Qin pocket phones, and every kid-monitoring phone in the set. One distinction matters: some of these are privacy-engineered Android derivatives (Punkt’s Apostrophy OS is GrapheneOS-derived), where the label flags lineage rather than observed leakage. The Orbic Journey V went the other way: it turned out to run a proprietary feature-phone OS, not Android, and got downgraded to minimal.

• A whitelist store is still a gatekeeper. Commostore approval, however benevolent, is a single company deciding what runs, enforced by closed patent-pending code.

• It is not the Commodore you remember, corporately. The original Commodore International died in the 1994 bankruptcy. The trademarks passed through a chain of owners until July 31, 2025, when a new Delaware company led by retro-computing YouTuber Christian “Peri Fractic” Simpson completed the purchase of Commodore Corporation B.V. and its 47 surviving trademarks for a low seven-figure sum (The Escapist; Time Extension). An Italian firm, Commodore Industries, still contests parts of the branding (The Escapist; Time Extension). The privacy promises are only as durable as a one-year-old company’s ownership of them.

• It does not exist yet. As of June 2026 Commodore has booting pre-production samples, with compliance testing as the self-declared long pole, and Q4 2026 as the shipping target (Commodore store; GSMArena). Every claim above is a design commitment, not a shipped fact.

The dumbphone comeback is real, it is measurable, and for the first time since the smartphone consolidated the market, hardware vendors are competing on how little data leaves the device. The section below contains the raw data: the full 68-device census with status, radios, carriers, and tracking labels, the Callback 8020’s complete band list and spec sheet, and the pre-order telemetry as observed.

Read more

You send the application. Two days later the rejection lands, or nothing lands at all, and you assume a recruiter skimmed your resume and passed. A lawsuit working its way through federal court in California says something else happened: an artificial intelligence system you never heard of scored you from 0 to 5 on your “likelihood of success,” and if the number was low, your application was filtered out before a human ever saw your name (Kistler v. Eightfold AI, Complaint; Fortune).

The company is Eightfold AI, a SoftBank-backed hiring platform that sits behind the online applications of more than 100 employers, including Microsoft, Morgan Stanley, Starbucks, BNY, PayPal, Chevron, and Bayer (Complaint; Outten & Golden). The lawsuit’s legal theory is the interesting part. It does not argue the AI is biased. It argues the AI score is a hidden credit report, and that building one on you in secret is illegal (Norton Rose Fulbright; Epstein Becker Green).

I spent this week reading the actual case file rather than the viral posts about it. The 36-page complaint, the federal docket, both sides’ briefs, and Eightfold’s own public disclosures tell a more precise and in some ways more damning story than the LinkedIn version. Some of it is proven from Eightfold’s own paperwork. Some of it is a serious allegation the company flatly denies. And the whole thing turns on a single question a judge will hear argued on August 4, 2026 (AI Hiring Litigation Tracker; CourtListener docket).

The case

The suit is Kistler et al. v. Eightfold AI Inc. Two California job applicants with STEM backgrounds, Erin Kistler and Sruti Bhaumik, filed it on January 20, 2026 in Contra Costa County Superior Court (Complaint; Outten & Golden). Eightfold removed it to the U.S. District Court for the Northern District of California on March 2, where it is docketed as 3:26-cv-01768 before Judge Yvonne Gonzalez Rogers (CourtListener docket; PacerMonitor).

There is a small forensic tell in how the plaintiffs found out they were even part of this. Both women applied through employer portals whose web addresses contained the string “Eightfold.AI,” were auto-rejected, and never advanced (Complaint; Fortune). Bhaumik’s case has a particular irony: she was applying for a Senior Technical Program Manager role in Responsible AI at Microsoft when Eightfold’s tools allegedly screened her out (Complaint).

The complaint pleads three counts and, notably, no discrimination count: the federal Fair Credit Reporting Act for a nationwide class, California’s Investigative Consumer Reporting Agencies Act for a California class, and California’s Unfair Competition Law (Complaint; Norton Rose Fulbright).

The score is real, and Eightfold documents it

Here is the part that is not in dispute. Eightfold’s matching model produces a “Match Score” that runs from 0 through 5 in increments of 0.5, predicting the degree of fit between a candidate and a job. We do not have to take the plaintiffs’ word for it, because Eightfold says so itself in the bias-audit disclosure it publishes for New York City’s hiring-AI law (Eightfold Matching Model disclosure). That same page shows Eightfold commissioned an independent bias audit of the model from BABL AI dated March 21, 2025, roughly ten months before the lawsuit, so the company plainly understood it was operating a regulated automated hiring tool (Eightfold Matching Model disclosure).

According to the complaint, the score is generated by a three-step pipeline described in Eightfold’s own engineering materials: a language model extracts semantic similarity between the job and the candidate, the system adds interpretable features such as skill overlap, title progression, seniority fit, and comparison to hiring managers and high performers, and then it blends those into a calibrated prediction trained on tens of millions of historical candidate-position pairs with known outcomes (Complaint; Fox Rothschild). Eightfold markets the platform as learning from “more than 1.5 billion global data points” and the profiles of more than a billion working people (Complaint; Eightfold).

One clarification the viral version gets wrong: that 1.5 billion figure is the size of the model’s training corpus, built up over years, not a dossier of 1.5 billion facts about you. The real fight is narrower and sharper. It is about what Eightfold pulls in on each individual applicant, and whether it tells anyone.

The dispute at the center of everything

The complaint alleges Eightfold reaches well past your resume. It says the platform quietly collects social media profiles, location data, internet and device activity, cookies, and other tracking to build a profile of a candidate’s “behavior, attitudes, intelligence, aptitudes and other characteristics” that the applicant never put in the application (Complaint; HR Brew). That “behavior, attitudes, intelligence” language is not the plaintiffs’ invention. The complaint pulls it from Eightfold’s own privacy policy (Complaint).

Eightfold denies the ugly version. A company spokesperson said the platform operates only on data candidates intentionally share or that customers provide, that it does “not scrape social media and the like,” and that the allegations are meritless (Fortune; HR Brew).

And yet. Eightfold’s own privacy notice states that, when instructed by its employer customers, it obtains information about candidates from third-party sources, and it names them: LinkedIn, Stack Overflow, and GitHub (Eightfold privacy notice). So the denial and the disclosure sit in visible tension. The company can truthfully say it does not “scrape social media” in the covert sense the plaintiffs describe, while its own document confirms it enriches candidate profiles from outside professional sources. Which of those two pictures the operative period actually looked like is exactly what discovery exists to settle.

Why “hidden credit report” is the whole game

The clever move by the plaintiffs is to skip discrimination entirely and reach for a 1970 consumer-protection statute instead. The theory: when Eightfold assembles data about you and evaluates it into a score that employers use to decide your candidacy, it is acting as a consumer reporting agency, and its score is a consumer report, the same legal category as a credit report or a background check (Outten & Golden; Warden AI). If that is right, the Fair Credit Reporting Act attaches a long list of duties Eightfold allegedly ignored: tell you a report exists, get authorization, give you a copy, and let you dispute errors (Complaint; Fisher Phillips).

This theory has a specific regulatory anchor. In October 2024 the Consumer Financial Protection Bureau issued Circular 2024-06, titled “Background Dossiers and Algorithmic Scores for Hiring, Promotion, and Other Employment Decisions,” which said an entity can be a consumer reporting agency if it collects data to train an algorithm that produces worker scores for employers (CFPB Circular 2024-06). There is a twist the plaintiffs have to fight through: the CFPB withdrew that circular on May 12, 2025 (Federal Register). Their answer is that rescinding a piece of guidance does not change the underlying statute, which Congress wrote and the CFPB cannot repeal by memo (Fox Rothschild).

Choosing consumer-reporting law over discrimination law is a strategy, not an accident. The other major AI hiring case in the same courthouse, Mobley v. Workday, is a discrimination case, and it has spent years fighting over disparate impact and statistics (Holland & Knight). The FCRA theory needs none of that. The plaintiffs do not have to prove the score was unfair. They only have to prove Eightfold built consumer reports and skipped the legally required paperwork (Epstein Becker Green; Ogletree Deakins).

Who is bringing this

The roster tells you how seriously to take it. The applicants are represented by Outten & Golden LLP, whose team includes Jenny R. Yang, a former Chair of the U.S. Equal Employment Opportunity Commission whose current practice centers on AI and automated decision systems (Jenny R. Yang, Outten & Golden; CourtListener docket). Co-counsel is the nonprofit Towards Justice, and its team includes Seth Frotman, the former General Counsel of the CFPB, which matters because the case leans on a CFPB circular he would have overseen (Outten & Golden; CourtListener docket). Kistler is the first case filed under Towards Justice’s new “AI in the Workplace Accountability Project,” so this is meant to be a template, not a one-off (Outten & Golden). Eightfold is defended by McGuireWoods LLP (Law360; PacerMonitor).

What happens on August 4

Everything currently rides on Eightfold’s motion to dismiss. The company filed a 35-page motion on April 20, 2026 arguing the simplest possible defense: it is not a consumer reporting agency and its Match Score is not a consumer report, because it is a service provider processing data on employers’ behalf, and the score is decision-support that recruiters can override, not an eligibility determination (AI Hiring Litigation Tracker; Eightfold Matching Model disclosure). The plaintiffs filed their opposition on June 18, Eightfold replied on July 9, and the motion is now fully briefed with a hearing set for August 4, 2026 before Judge Gonzalez Rogers in Oakland (CourtListener docket; AI Hiring Litigation Tracker).

That hearing is the hinge for the entire field. If the consumer-report theory survives, every AI screening vendor that scores applicants using outside data suddenly faces the full weight of consumer-reporting law: disclosures, authorizations, adverse-action notices, and dispute rights (Fisher Phillips; Ogletree Deakins). If it fails on the definition of a consumer reporting agency, the theory stalls, and this particular action likely stalls with it. The management-side law firms watching the case are not predicting which way it goes, and several note the motion could dispose of the case outright (Jones Walker; Ogletree Deakins).

So: is it true the AI was harvesting data? Partly, and on Eightfold’s own admission it pulls third-party professional data and scores you 0 to 5. The covert version, scraping your social media and location to judge your personality, is a serious allegation that is plausible, partly corroborated by Eightfold’s own privacy notice, and not yet proven. A court has not decided who is right. It starts to on August 4.

Read more

A reasonable person hears “your phone’s ads are secretly a surveillance network” and reacts one of two ways. Either it sounds like paranoid tech mythology, the boogeyman under the bed, a thing that feels true but that nobody can actually point to. Or it sounds so obviously true that it becomes background noise, a thing everyone already “knows” and therefore nobody bothers to verify.

Both reactions skip the step that actually matters: counting.

So I counted. Over the last several days I built a structured database cataloging every company, every dated incident, every regulatory action, and every documented harm case I could find in published reporting on the ad tech surveillance pipeline, the system by which the advertising data your phone broadcasts every day gets resold into government and private intelligence products. Not vibes. Not a single viral thread. A database: 424 named entities, 354 sourced articles, 302 dated events, 146 monitorable news sources, and a glossary of 195 technical and legal concepts, cross-referenced against each other. This piece is the census report.

The short answer to “is it real”: yes, and it is bigger, older, and more legally protected than most people who have heard of it understand. The long answer is the rest of this article.

The Org Chart Nobody Draws

Break the 424 entities down by what they actually are, and the shape of the industry becomes visible in a way that individual news stories never quite convey:

• 106 data brokers: the aggregators and resellers who acquire raw location, device, and behavioral data and package it for sale: Gravy Analytics, X-Mode/Outlogic, Kochava, SafeGraph, Near Intelligence/Azira, Mobilewalla, Cuebiq, and a long tail of smaller wholesalers.

• 98 surveillance vendors: companies whose product is turning ad-derived data into a queryable tracking tool for government or private intelligence buyers. Babel Street (Locate X), Fog Data Science (Fog Reveal), Anomaly Six, PenLink/Cobwebs (Webloc), Venntel, ISA (Patternz), Rayzone Group, and dozens more.

• 83 adtech firms: the mainstream advertising exchanges and platforms whose ordinary operation generates the data supply: Google, Meta, Microsoft/Xandr, PubMatic, Magnite, OpenX, The Trade Desk, Criteo, LiveRamp.

• 42 researcher organizations: the academics, NGOs, and watchdogs (Citizen Lab, EFF, ICCL, Cracked Labs, AppCensus) who did the work of documenting all of the above.

• 40 government agencies: the buyers: ICE, CBP, the FBI, the IRS, DHS, the NSA, Special Operations Command, and their state and local equivalents.

• 37 regulators: the FTC, state attorneys general, the Irish DPC, the UK ICO, and peers, whose enforcement actions form most of the “what has actually been tried” record.

• 18 news outlets: the specific publications (404 Media, EFF Deeplinks, netzpolitik, The Markup) that have made this beat their own.

That is not a conspiracy theory’s shape. That is an industry’s shape. Nearly a hundred companies whose entire business model is repurposing advertising exhaust into tracking products is not a fringe phenomenon. It is a sector with an org chart, a supply chain, competitors, private equity owners, and government procurement contracts, exactly like any other sector, except this one’s product is a map of where you have been.

What Changed This Year: The Chatrie Ruling, and the Memo That Answered It

On June 29, 2026, the Supreme Court ruled 6-3 in the case of Okello Chatrie, a Virginia bank robbery suspect identified through a geofence warrant, that constitutional privacy protections extend to cellphone location history even when a person has voluntarily opted into a service like Google’s location history (Supreme Court of the United States, Chatrie v. United States, No. 25-112, slip opinion; SCOTUSblog, “Court rules that law enforcement’s use of ‘geofence warrant’ was a ‘search’”; The Hill, “Supreme Court sends geofence warrant case back to lower court”; Police1, AP, “Geofence warrants: SCOTUS rules constitutional privacy protections apply to cellphone location history”). Justice Elena Kagan, writing for the majority, held that people should not be treated as forfeiting privacy simply for “doing the ordinary things cellphone users do.” Justice Samuel Alito dissented, arguing Chatrie had no privacy expectation in data he voluntarily shared with Google. The Court did not decide whether this specific search violated the Fourth Amendment; it remanded the case for the lower courts to reconsider.

It is, on its face, a real win. It is also, on close reading, a ruling that touches only one of the two channels feeding the surveillance pipeline. Chatrie governs compelled process, a warrant served on a provider like Google. It says nothing about data a government agency or private intelligence firm simply buys on the open market from a broker who acquired it through an SDK or the real-time bidding auction. That is the loophole the rest of this article is about, and within two weeks of the ruling, I obtained direct evidence that the industry already knows it.

A source close to the ownership of a U.S. location-intelligence firm, a company that sells ad-derived geolocation intelligence to defense and intelligence customers and that I am not naming in order to protect the source, shared an internal memo the company sent to its government and enterprise customers immediately after the Chatrie decision. The memo is worth quoting because it is the clearest documented example I have found of a vendor explaining, in its own words, exactly why a Supreme Court privacy ruling does not apply to it:

“[The company] does not obtain its core intelligence data through compelled process from operating system providers, mobile carriers, internet service providers, or similar entities. [Its] platform relies on commercially available datasets, including user-consented SDK data, AdTech telemetry, Real-Time Bidding (RTB) signals, application-shared data, and verified third-party data sources.”

Read that sentence again. The company is not disputing that its data is functionally similar to what Chatrie now protects. It is asserting that the acquisition method is different, purchase instead of compulsion, and that the difference is the entire legal firewall. That single distinction, purchased versus compelled, is the hinge the whole industry pivots on, and the vendor just confirmed it in writing to its own customers rather than to a reporter.

The memo goes further, and this is the part that should worry anyone tracking where this industry is heading rather than where it has been. It acknowledges that “more states are passing or considering laws that limit the sale, transfer, or use of precise geolocation data,” citing Oregon’s roughly 1,750-foot precision threshold as an example of a jurisdiction where location data precise enough to identify a device within that radius may be restricted. Then it says this: “This is one reason some vendors are increasingly relying on RTB-heavy datasets as legal restrictions on more precise data become stricter.” In other words, as states start regulating the clean, precise location data (the kind SDKs collect directly), the industry’s own account of itself says vendors are shifting toward the messier, harder-to-regulate bidstream data instead. Regulating the good data pushes the market toward the bad data. The memo even concedes what the bad data actually looks like: RTB signals are “often no more reliable than ZIP-code level accuracy,” “plagued with fraudulent locations,” and the company claims to discard “80 percent or more” of what it receives as unusable. It should not be read as continuous real-time tracking, the memo says, correctly. What it should be read as is a permanent structural incentive, created by well-intentioned state privacy laws, to keep the noisiest and least accountable data channel in the pipeline the most commercially important one.

A note on the memo itself. It was provided to me directly by a source close to the company’s ownership. I know the source’s identity and how they came to have the document, and the quoted passages are reproduced as received and in context, altered only where marked in brackets to withhold the company’s name. I am not naming the company because doing so could help identify the source. The full memo remains in my possession. If the company disputes the authenticity of these excerpts or believes they misrepresent it, I will publish its response in full.

The Three-Layer Legal Bypass

The reason a memo like that can exist without anyone at the company blinking is that the entire industry sits inside a legal vacuum built from three separate, unrelated exemptions that happen to stack.

Layer one: the Fourth Amendment, avoided by purchase instead of compulsion. The third-party doctrine, from Smith v. Maryland (1979), holds that information voluntarily shared with a third party carries no reasonable expectation of privacy, so no warrant is needed to obtain it from that party. Carpenter v. United States (2018) carved out a narrow exception for historic cell-site records because that collection was pervasive and unavoidable for anyone who owned a phone. The government’s response to Carpenter, and now to Chatrie, has been consistent: stop compelling the data from carriers and providers, and buy the same data from brokers instead, where neither ruling applies. The 2023 declassified ODNI report on Commercially Available Information confirmed that this is not an accident of interpretation but a known, deliberate acquisition strategy across the intelligence community (ODNI, “Senior Advisory Group Panel on Commercially Available Information”; Lawfare, “ODNI Report Reveals ‘Significant’ Privacy Concerns for U.S. Citizens”).

Layer two: the Privacy Act of 1974, which only ever applied to the government’s own files. The Privacy Act binds federal agencies’ handling of records they maintain: collection limits, notice requirements, an individual’s right to inspect and correct. It has never regulated the commercial sector, data brokers, or advertising technology, and it does not stop an agency from purchasing on the open market a dataset it would be barred from building itself. When ICE buys a subscription to a location-intelligence product, ICE is not “collecting” in the sense the Act contemplates. ICE is procuring a software license. The statute simply does not reach the transaction, because the transaction was never imagined by the people who wrote a law in 1974 to govern government record-keeping, not the resale market for smartphone telemetry that would not exist for another three decades.

Layer three: international human rights law, ratified and then defanged. Article 17 of the International Covenant on Civil and Political Rights declares that “no one shall be subjected to arbitrary or unlawful interference with his privacy.” The United States ratified the ICCPR in 1992, but attached a formal declaration that its substantive articles, Article 17 included, are non-self-executing: they create no cause of action in any U.S. court. Congress never passed implementing legislation. The U.S. never joined the protocol that would let an individual bring a complaint, and it rejects the UN Human Rights Committee’s position that the treaty covers U.S. conduct beyond its borders. The right exists. It has existed, on paper, since 1992. It has never once stopped a single American data broker from selling a single location point. The only version of international privacy pressure that has ever actually cost the industry money is not human rights law at all, it is EU trade law: the Schrems rulings that repeatedly struck down U.S.-EU data transfer frameworks for failing to meet European standards, forcing the successive renegotiations from Safe Harbor to Privacy Shield to the current Data Privacy Framework. Economic leverage moved the industry. Rights language did not.

Stack the three layers and the picture is not a gap in the law. It is a vacuum engineered from the outside edges of three different legal regimes, none of which was designed with the others in mind, that happen to leave the exact same transaction, a private company selling your location history to a government agency, untouched by all three simultaneously.

The Receipts: When the Abstraction Becomes a Person

None of this stays abstract for long once you look at the incident record. A sample from the 302 dated events in the database:

In July 2021, a Catholic priest was identified and forced to resign after a Catholic newsletter purchased mobile advertising ID data tied to the Grindr app, correlated it against his home and work addresses, and de-anonymized him without a single hack, breach, or court order involved (The Pillar, “Pillar Investigates: USCCB gen sec Burrill resigns after sexual misconduct allegations”; Time, “A Catholic Priest’s Alleged Grindr Outing and Data Privacy”).

In 2019, a Motherboard reporter paid a bounty hunter $300 and had him locate a specific T-Mobile phone within minutes, no warrant, no subpoena, just a phone number and a payment, demonstrating that real-time carrier location data was for sale to essentially anyone willing to pay a middleman (Vice/Motherboard, “I Gave a Bounty Hunter $300. Then He Located Our Phone”).

In 2020, Motherboard revealed that the Muslim Pro prayer app’s embedded SDK was selling location data that flowed, through the broker chain, to U.S. military contractors, prompting Google to eventually remove the underlying broker, Predicio, from its platform (Vice/Motherboard, “How the U.S. Military Buys Location Data from Ordinary Apps”; Vice/Motherboard, “Muslim Pro Stops Sharing Location Data After Motherboard Investigation”).

In 2022, the defense contractor Anomaly Six gave a sales demonstration in which it showed prospective government clients that it could track the real-time movements of employees at Fort Meade and Langley, the physical homes of the NSA and CIA, using nothing but commercially purchased ad-tech location data (The Intercept, “American Phone-Tracking Firm Demo’d Surveillance Powers by Spying on CIA and NSA Employees”).

In 2023 and 2024, EPIC and Rolling Stone documented that the Veritas Society, an anti-abortion advocacy group, obtained data identifying visitors to more than 600 Planned Parenthood locations for targeted advertising, a revelation that surfaced through a Senator Wyden investigation (EPIC, “Data Broker Helped Anti-Abortion Group Target Planned Parenthood Visitors, Wyden Letter Reveals”; Rolling Stone, “600 Planned Parenthood Locations Tracked for Anti-Abortion Ads, Senator Reveals”).

In January 2025, Gravy Analytics, one of the largest location data brokers in the industry, was breached, and roughly 30 million location data points, tied to device identifiers for people who had visited medical clinics, military installations, and religious sites, were dumped publicly (TechCrunch, “A breach of Gravy Analytics’ huge trove of location data threatens the privacy of millions”; The Record, “Major location data broker reports hack to Norwegian authorities”). The breach happened weeks after the FTC had ordered the company to stop selling sensitive location data in the first place, illustrating a risk regulation alone cannot fix: even a banned dataset, once collected, remains a permanent, leakable liability.

In April 2026, Citizen Lab published a full technical analysis of PenLink’s Webloc product, built on the July 2023 acquisition of the Israeli firm Cobwebs Technologies for roughly $200 million (the buyer of record was Spire Capital, the private equity firm that owns PenLink, which then merged Cobwebs in), showing a system covering roughly 500 million mobile devices globally, refreshed every four to twenty-four hours, with three years of historical depth, sold to ICE, the U.S. Navy’s Office of Naval Intelligence, the U.S. Army’s Space and Missile Defense Command, Hungarian domestic intelligence, and dozens of American municipal police departments (Citizen Lab, “Uncovering Webloc: An Analysis of Penlink’s Ad-based Geolocation Surveillance Tech”; 404 Media, “Inside ICE’s Tool to Monitor Phones in Entire Neighborhoods”; TechCrunch, “Penlink acquires Israeli web intelligence firm Cobwebs for $200M”).

And in May 2026, Haaretz and PPC Land reported that Israeli firms had built techniques to de-anonymize and track Starlink satellite internet users through the same ad-derived data channel, extending the pipeline’s reach to a connectivity technology many people specifically chose to route around traditional, trackable infrastructure (PPC Land, “Starlink users can be tracked and identified using ad data, Israeli firms show”; Cyprus Mail, “Cyprus-based company builds tech to reveal identities of Starlink users”).

These are not edge cases pulled to make a point. They are a representative sample from a dataset of 302 dated incidents involving priests, abortion clinic visitors, NSA and CIA employees, Muslim prayer app users, and satellite internet subscribers who thought they had opted out of exactly this. The bulk of the record runs from 2018 through 2026, but the earliest entry predates the smartphone entirely: in the summer of 1999, a stalker named Liam Youens bought Amy Boyer’s Social Security number and workplace address from the people-search broker Docusearch for a combined $154 (the SSN delivered August 2, the workplace address September 8), then on October 15, 1999 drove to that workplace and murdered her (EPIC, Remsburg v. Docusearch amicus brief; UPI, “Internet firm sued for girl’s murder”). The industry that sold the data that killed her was never meaningfully dismantled. It was scaled.

It Is Not Just an American Problem

The German investigative outlet netzpolitik.org, in a multi-year project called the Databroker Files, produced the most detailed non-U.S. documentation of this pipeline, showing that purchased bidstream and SDK data could be used to identify and track German soldiers, intelligence personnel, and EU officials, a national-security exposure created not by a hostile intelligence service but by the ordinary functioning of the advertising industry (netzpolitik.org, “Data Broker Files: How data brokers sell our location data and jeopardise national security”; netzpolitik.org, “Databroker Files: Targeting the EU”). A follow-up dataset identified roughly 40,000 apps feeding this specific tracking supply chain (netzpolitik.org, “Databroker Files: New data set reveals 40,000 apps behind location tracking”). Techdirt separately reported on a Lithuanian adtech firm and a Florida-based data broker found trafficking in sensitive U.S. military and intelligence worker location data specifically (Techdirt, “Lithuanian Adtech Firm And Florida Data Broker Trafficked In Sensitive U.S. Military And Intelligence Worker Location Data”).

Haaretz has separately reported extensively on the Israeli commercial intelligence ecosystem, ISA’s Patternz platform, Rayzone Group, and the “Insanet” ad-delivered spyware tool marketed as capable of infecting a target device via a single ad impression with no click required (Haaretz, “Revealed: Israeli Cyber Firms Have Developed an ‘Insane’ New Spyware Tool: No Defense Exists”). This is a global industry with a global supply chain, American demand, Israeli and European tooling, and app users on every continent unknowingly contributing the raw material.

The Money Behind the Monster

Follow the ownership and the picture sharpens further. PenLink’s $200 million acquisition of Cobwebs in 2023 was not a startup buying a startup, it was a U.S. law-enforcement-technology company consolidating an Israeli intelligence firm’s product directly into its own catalog for American police departments (Penlink press release, “Cobwebs Technologies Joins PenLink to Expand its Digital Investigative Platform”). Babel Street operates with private equity backing; Veritas Capital is the documented institutional sponsor, per public reporting, though some secondary claims about additional co-investors have not been independently corroborated and should be treated with appropriate caution. Near Intelligence, which had gone public via a SPAC merger and marketed itself as having the “world’s largest dataset of people and places,” collapsed into Chapter 11 bankruptcy in December 2023 after regulatory scrutiny, and its customer relationships and technology were absorbed by a successor entity, Azira (Business Wire, “Near Intelligence Files for Chapter 11 Protection and Enters into Agreement to Sell its Business”; Bloomberg, “Data Firm Near Intelligence Files for Bankruptcy Months After Going Public”). In August 2025, the Department of Justice’s Southern District of New York went further and criminally charged executives of data intelligence and mobile advertising companies in connection with the underlying conduct (U.S. Department of Justice, SDNY, “Executives Of Data Intelligence And Mobile Advertising Companies Charged”), the first indication that this specific corner of the industry’s collapse produced individual criminal exposure rather than just a bankruptcy filing and a rebrand.

That is a company failing and being reconstituted twice, once through bankruptcy and once through a felony indictment, while its underlying data relationships appear to survive each collapse under a new name. The product outlives the company. That pattern, more than any single vendor’s press release, is why cataloging entities rather than headlines is the only way to actually track this industry: the names change faster than the conduct does.

Why This Article Exists

The point of building the database wasn’t to produce one more “surveillance is bad” piece. Plenty of those exist, and most of them are correct but forgettable, because a single anecdote is easy to dismiss as exceptional. I wrote one of them myself: The Silent Enemy, the May essay this database grew out of, which traced the system’s shape in narrative form. This piece is the audit that essay demanded. What is much harder to dismiss is 424 named companies with competitors, 302 dated incidents with named victims and named agencies, and a Supreme Court ruling from two weeks before this article’s publication that a vendor’s own internal memo, obtained directly and quoted here for the first time, explicitly argues does not apply to it.

The boogeyman question has an answer. It is not a metaphor. It has a customer list, a revenue model, a legal strategy, and, as of this year, a Supreme Court ruling it is already writing internal memos about how to route around.

What a Normal Person Can Actually Do

Nothing on this list stops the pipeline. The pipeline is an industry, and industries get stopped by law or not at all. What these steps do is shrink your personal contribution to the data supply, which is worth doing anyway:

• Deny app tracking when asked, and kill the identifier. On iOS: Settings, Privacy & Security, Tracking, turn off “Allow Apps to Request to Track.” On Android: Settings, Privacy, Ads, delete your advertising ID. That identifier is the key the entire resale chain uses to link your records together.

• Audit which apps hold precise location. Weather, shopping, and free game apps with “always” location access are the classic SDK collection points in this article’s incident record. Downgrade to “while using” or “never,” and choose approximate over precise wherever the OS offers the option.

• Treat free ad-supported apps as what they are. Every ad impression is a bid request broadcasting your identifiers to hundreds of companies. A paid app, or the browser version of the same service, generally is not.

• If you live in California, use the DROP. The enforcement window opens August 1, 2026. One request directs every registered data broker in the state, plus their service providers and contractors, to delete your data unless a statutory exception applies (California Privacy Protection Agency).

• Expect to repeat all of this. The industry answered Apple’s tracking prompt with probabilistic fingerprinting, covered in the paid section below. Hygiene shrinks your surface. It does not create a right.

The paid section below goes further: the specific people who built this industry and where they came from, the technical mechanics of how a location point gets from your phone to a federal contractor’s dashboard, and the forward-looking signals worth watching over the rest of 2026, including the regulatory deadline that opens August 1.

Read more

The short version

The State of California operates a public ArcGIS server at https://services.gis.ca.gov/arcgis/rest/services. It runs ArcGIS Server version 10.71, a release that reached end of life and no longer receives security patches. That server hands out, to anyone on the internet with no login and no token, a folder literally named IntelligenceMilitary. Inside it is a single feature layer: Military Installations.

The exact endpoint anyone can open right now:

https://services.gis.ca.gov/arcgis/rest/services/IntelligenceMilitary/MilitaryInstallations/MapServer/0

That layer returns 148 polygons, each one a U.S. military installation in California, complete with the installation name, the operating service branch, and center coordinates. Beale Air Force Base. Travis Air Force Base. Sierra Army Depot. Mare Island Naval Complex. Mather. McClellan. San Francisco Naval Communications. The full set of 148.

I reported it to the state and to the relevant vulnerability disclosure program. The state never replied. Two separate triage processes closed it as “not applicable.” As of this writing the server is still up, still unpatched, and still serving the data.

What is actually exposed

The IntelligenceMilitary/MilitaryInstallations layer is a polygon feature service. Every feature carries a full attribute record. The fields include the installation name (instname, feat_name), the branch of service (service_d, values like USA, USAF, USN), a facility description (inst_desc, values like “Naval Installation”, “Military Airport”, “Army Installation”), and precise geographic coordinates (coord_x, coord_y).

A sample of what comes back with a single unauthenticated request:

• Sierra Army Depot (US Army)

• Beale Air Force Base (US Air Force)

• McClellan Air Force Base (US Air Force)

• Mather Air Force Base (US Air Force)

• Sacramento Army Depot (US Army)

• Travis Air Force Base (US Air Force)

• Mare Island Naval Complex (US Navy)

• San Francisco Naval Communications (US Navy)

That is 8 of 148. The layer returns the complete set, with full boundary geometry, in standard GeoJSON or Esri JSON.

“But base locations are public”

Yes, the fact that Beale Air Force Base exists and is near Marysville is not a secret. That is the wrong frame. The problem here is threefold, and none of the three is about whether a base can be found on a paper map.

First, this is precise boundary and perimeter geometry in a machine-readable format, aggregated into one clean file. There is a difference between “the public knows a base is over there” and “here is every installation in the state as GIS polygons you can load straight into a targeting or planning workflow in ten seconds.” Aggregation is the vulnerability. Convenience for an adversary is the harm.

Second, the layer does not sit alone. It sits on a server that also serves, unauthenticated, a large collection of other California infrastructure and hazard layers: fault lines, liquefaction zones, 100 and 200 and 500 year floodplains, fire responsibility areas, water district offices, public and private school locations, and political district boundaries. An analyst building a picture of the state can pull all of it from one host in one pass. Military installations plus floodplains plus fault zones plus school locations is not “public map data.” It is a pre assembled situational awareness package.

Third, and most important, the server is end of life. Version 10.71 is out of support. It receives no security updates. The exposure of the data is one problem. An unpatched, internet facing application server sitting in front of a state government network is a second, larger problem, and it is the kind of foothold that does not stay a map problem for long.

How it was found and verified

This was found during routine, non intrusive scanning of publicly reachable government GIS infrastructure. Verification was read only. The ArcGIS REST API exposes a service directory at a well known path. Requesting the directory in JSON returns the folder list. The IntelligenceMilitary folder returns its one service. The service metadata returns the layer, and a standard feature query returns the records.

No authentication was presented at any step because none was required. No data was altered. No write operations were attempted. The full evidence set, the raw REST directory pages, the per layer metadata, and the returned records, was captured and retained.

The disclosure timeline

• 2026-06-20 Finding documented, evidence captured, disclosure PDF prepared.

• 2026-06-23 Responsible disclosure emailed to the California State Threat Assessment channel (Cal CSIC, Cal OES), with CISA copied given the presence of federal military installation data on a state operated server. The email requested acknowledgement within 48 hours.

• 2026-06-23 The only response received was an automated intake reply from CISA directing submitters to their coordinated disclosure portal. No human from the state responded.

• 2026-07-03 The same finding, submitted through the California Department of Technology’s own vulnerability disclosure program, was triaged and marked “not applicable.” California’s own security program was told about California’s own exposed military installation data, and closed the report as not applicable.

• 2026-07-06 Re verified. The server still reports version 10.71. The IntelligenceMilitary/MilitaryInstallations layer is still served without authentication. Nothing has changed.

Why “not applicable” is the wrong answer

I want to be fair to triage teams. They see volume, and a lot of what crosses their desk is noise. ArcGIS servers are supposed to serve public map data, so an open service directory can look like working as intended.

It is not working as intended when the open service is a folder named IntelligenceMilitary containing 148 military installations, running on an unsupported server version, at a state government that did not choose to publish it that way and did not answer when told. “Public data on a public map server” is a reasonable default assumption. It stops being reasonable the moment you open the folder and read the name on it. And it is harder to defend when the program marking the report “not applicable” belongs to the same state that owns the exposed server. California’s own vulnerability disclosure program was in the best possible position to route this to the asset owner, and instead it closed the ticket.

The correct answer to a report like this is not to reward it. It is to route it to the asset owner and get the box either patched or pulled. A bounty is not the point. Remediation is the point.

A question for the people who keep saying “it is public anyway”

I want to put this directly to the culture that has grown up around open data, because that culture is the reflex being used to wave this away.

Every time one of these comes out, someone shrugs and says “so what.” So let me answer the “so what” plainly, because in this case the answer is not abstract and it is not small. So what? It is military bases. It is 148 United States military installations, Army, Navy, and Air Force, mapped out as neat polygons and handed to the entire internet with no login. That is the “so what.” If your reaction to an unpatched state server broadcasting the boundaries of every military installation in California is “so what,” then you are exactly the mindset this article is about.

Stop and read the sentence out loud. “We are broadcasting the mapped boundaries of 148 United States military installations to the entire planet, with no login, on an unpatched server, and that is fine because it is open data.” Does that actually sound fine to you? Does it sound like a decision anyone made on purpose, weighed the tradeoffs on, and signed off on? Or does it sound like a default nobody ever stopped to question?

There is a difference between information that is public and information that should be assembled, packaged, and served to anyone on Earth in a format built for machines to consume. Transparency is a good and important thing. Open data on schools, districts, water offices, and hazard zones serves the public. But somewhere in the rush to make everything open, “the public has a right to know where the fire zones are” quietly turned into “here are our military installations as ready to use polygons, help yourself.” Those are not the same value. One is civic. The other is a gift to anyone who does not wish us well.

The question is not technical. It is cultural. Who decided that a folder named IntelligenceMilitary belongs on the open internet, and when did we all agree to stop asking? If the honest answer is that nobody decided, that it was just a default and an oversight dressed up after the fact as “open info,” then the honest response is to close it, not to defend it. “It is public anyway” is not a policy. It is what we say when we do not want to admit we were not paying attention.

“But I use ArcGIS to look up parcels”

A friend pushed back on me over exactly this. He looks up open parcels through ArcGIS all the time, he said, so what is the problem. It is a fair thing to ask, and the answer is the whole point.

I am not looking at open parcels. Nobody is objecting to a resident pulling up a lot line, a zoning layer, or a county boundary. That is the system working as designed, and it is good. Public parcel data is public on purpose. Somebody decided it, published it, and stands behind it.

That is not what this work is about. This work is about two things that are nothing like a parcel lookup. The first is unauthenticated write access to government ArcGIS databases, where a random person on the internet can not just read a layer but create, update, and delete records in it, with no login. That is not open data. That is an open door into the system of record. The second is sensitive data that was never meant to be laid out this way at all, aggregated and packaged and served to the whole world, of which a folder named IntelligenceMilitary holding 148 military installations is about as clear an example as exists.

Parcels are someone choosing to show you the property lines. This is a federal and state map server laying out military base installations, perfectly formatted, for anyone to take. And not just anyone. Bots. Automated scanners crawl this exact class of endpoint continuously, with no human in the loop, hoovering up whatever is reachable and never forgetting it once they have it. The parcel lookup is a person making a choice. This is a machine finding a door that was left open. Those are not the same thing, and pretending they are is how the door stays open.

What remediation looks like

The fixes are ordinary and well understood:

1. Take the end of life server off the public internet, or upgrade it. Version 10.71 should not be internet facing under any circumstances. This is the priority item regardless of the data.

2. Remove or restrict the IntelligenceMilitary service. If there is a legitimate need for this layer, put it behind authentication and serve it only to the parties that need it.

3. Review the rest of the exposed catalog. Decide deliberately, layer by layer, what should be public, and gate the rest.

4. Audit access logs on the military installations layer for prior unauthenticated pulls.

The point

I keep finding the same shape of problem. A government stands up a GIS server, forgets it, lets it age past end of life, and it quietly serves things nobody signed off on serving. When someone reports it in good faith, the report gets closed as noise because the reporting channels are tuned for bug bounties and not for “your unpatched server is handing out military installation boundaries to the entire internet.”

I tried to help. I did the work, I found it, I documented it, and I reported it quietly and in good faith to the people who own it and to the people paid to catch exactly this. Instead of a reply, or a fix, I was met with silence and a “not applicable.” So here it is.

I would rather not write these publicly. The quiet email is the right first move, and it should be enough. But the pattern is hard to ignore. The private reports get closed as noise, and the exposures stay open for weeks. The moment it becomes public, it gets fixed. If daylight is what finally moves a patch that should have shipped on day one, then daylight is what these will get, every time, until the quiet channel starts working.

Our adversaries would not hesitate to use an exposure like this against us. It costs them nothing and it is sitting in the open right now. God Bless.

The Vulnerability

The Town of Jupiter operates an ArcGIS-based geographic information system (GIS) for managing water, wastewater, energy, and public works infrastructure. Their REST API endpoints at https://maps.jupiter.fl.us/arcgis/rest/services were returning HTTP 200 responses to unauthenticated requests asking for Feature Server write access.

Specifically, the Lucity and EnerGov Feature Servers were accepting POST requests without token validation, allowing an unauthenticated attacker to:

• Modify water service layer data

• Update utility infrastructure records

• Alter public works asset information

• Corrupt critical GIS databases

This wasn’t a “read-only” exposure. This was write access to systems that directly manage water and utility services for the municipality.

What Could Have Happened

An attacker with access to these Feature Servers could have:

• Corrupted service layer data — Redraw utility lines, pipe routes, and infrastructure nodes in the GIS database, causing work crews to operate on false information

• Contaminated water treatment records — Modify treatment plant asset data, chlorination schedules, or pressure monitoring systems, potentially affecting public health

• Disabled critical alerts — Alter monitoring thresholds or sensor configurations in the GIS system that trigger operational alerts

• Disrupted emergency response — Modify asset locations so that emergency repair crews couldn’t locate broken water mains or gas lines during an outage

• Caused equipment damage — Trigger work orders on wrong infrastructure, causing crews to dig in the wrong locations and damage live utilities

• Sabotaged system reliability — Create a cascade of corrupted records that would require months of manual verification and repair

This wasn’t a data leak. This was the ability to write false information into systems that people depend on when their water doesn’t work. The damage would have been operational, public-facing, and difficult to detect until someone tried to use the system during an actual emergency.

The Discovery and Response

I identified the vulnerability on June 22, 2026, and contacted the Town of Jupiter directly. Initial emails to karl.c@jupiter.fl.us and tg@jupiter.fl.us bounced (invalid addresses), so I escalated to Florida CSOC (Cybersecurity Operations Center).

Florida CSOC (csoc@digital.fl.gov) acknowledged receipt on July 3, 2026, and immediately engaged the Town of Jupiter IT team. The Town’s IT leadership expressed gratitude and commitment to immediate remediation.

Verification and Remediation

On July 5, 2026, I re-verified the vulnerability status:

• Lucity Feature Server now requires authentication tokens (previously returned write access)

• EnerGov Feature Server now requires authentication tokens

• The Utilities folder no longer lists Feature Servers publicly

• Unauthenticated write exposure has been closed

The Town of Jupiter acted decisively and thoroughly. This is infrastructure security done right.

Impact and Lessons

Critical infrastructure GIS systems should never accept unauthenticated write requests. The fact that this was exposed for any period of time highlights the importance of:

1. Continuous API auditing — REST endpoints need regular authentication verification

2. State-level coordination — CSOC involvement ensured rapid escalation and accountability

3. Rapid response — When municipalities take critical infrastructure seriously, they fix it fast

The Town of Jupiter’s IT team did exactly what should happen in a responsible disclosure scenario. They fixed it. They fixed it completely. They fixed it fast.

~Ringmast4r strikes again.

El Descubrimiento del Código Fuente

En un repositorio Git expuesto en gitlab.mtt.gob.ve/cmorales/SIGESP-MPPT.git, accedido sobre HTTP plano sin autenticación, estaba el código fuente completo de Chamba Juvenil. 23.228 archivos. Stack de aplicación completo. Cada módulo documentado.

El sistema de rastreo de votos ocupaba una carpeta discreta con su propio controlador, modelo, capa de vista y frontend JavaScript. No era código legado. No estaba deprecado. Era un componente completamente mantenido y activamente usado del sistema de registro.

La Arquitectura del Módulo de Registro de Votos

Controlador: Registro_voto.php (430 líneas)

El controlador principal maneja la presentación de datos de votos:

POST /post_registro_votos

Este endpoint acepta:

• Nombre y cédula

• Asignación de estructura organizacional (códigos 2, 3, 17, 18, 19, 20)

• Estado, municipio, parroquia, centro de votación

• Respuesta de voto binaria (sí/no)

• Coordenadas de latitud y longitud

• Número telefónico

El controlador direcciona presentaciones a diferentes tablas de base de datos según el código de estructura:

if (structure_code in [gov_employee_codes]) {
  INSERT INTO tbl_servidores_publico
} elseif (structure_code in [organization_member_codes]) {
  INSERT INTO tbl_estructura_preorizado
} else {
  INSERT INTO tbl_registro_del_voto
}

La Función de Estadísticas

El método estadistica_votos() es donde sucede la manipulación:

$raw_count = count_all_votes();
$reported_count = $raw_count + 273 + 800;
return ["resultado" => $reported_count];

1.073 votos fantasma se añaden a cada reporte de estadísticas. Esto está hardcodeado. Esto es por diseño. El panel de reportes muestra números inflados de participación.

Esquema de Base de Datos

Tres tablas dedicadas para rastreo de votos:

tbl_registro_del_voto — Registros generales de votos de población

• id (clave principal)

• cedula (cédula de identidad nacional de ciudadano)

• nombre (nombre completo)

• telefono (teléfono)

• estado (código de estado)

• municipio (código de municipio)

• parroquia (código de parroquia)

• centro_votacion (ID del centro de votación)

• voto_si_no (binario: votó o no)

• latitud (latitud GPS)

• longitud (longitud GPS)

• estructura_asignacion (código organizacional)

• fecha_creacion (marca de tiempo)

tbl_servidores_publico — Rastreo de votos de empleados del gobierno (estructura idéntica)

tbl_estructura_preorizado — Rastreo de miembros de estructura de partido/organizacional (estructura idéntica)

Interfaz de Administración

El formulario de registro de votos existe en /admin/registro_voto.php. No está escondido. Tiene un mapa interactivo impulsado por Leaflet.js para captura de coordenadas GPS. Un administrador puede:

1. Buscar un ciudadano por nombre o cédula

2. Seleccionar su centro de votación de un dropdown

3. Hacer clic en un mapa para capturar coordenadas GPS

4. Marcar una casilla para “¿Votaron? Sí/No”

5. Presentar

Los datos se escriben directamente en la base de datos sin validación más allá de verificación de tipo básica.

El Despliegue de Tres Dominios

Dominio 1: Chamba Juvenil

registro.chambajuvenil.gob.ve — Sistema de aplicación de empleos de programas de empleo juvenil. 23.228 archivos en volcado .git. Módulo de rastreo de votos completamente funcional. Credenciales de base de datos expuestas en archivo .env.

Dominio 2: Juventud Socialista

registro.juventudsocialista.org.ve — Portal de organización de Juventud Socialista PSUV. Código idéntico. Estructura de base de datos idéntica. Formulario de rastreo de votos idéntico.

Dominio 3: Comunas Juveniles

comunajoven.com.ve — Portal de organización de gobernanza comunal. Misma infraestructura de rastreo de votos. Mismos formularios. Mismo API.

Los archivos de configuración de Git muestran los mismos scripts de despliegue usados en los tres dominios. El mismo desarrollador (Carlos Morales, cmorales@mtt.gob.ve) comprometió a repositorios alojando los tres.

La Conexión del API de Distribución de Gas

El endpoint GraphQL del API de Distribución de Gas del Estado Guárico expone introspección de esquema completa en:

api-distribucion-gas.guarico.gob.ve/graphql

El esquema incluye dos consultas críticas:

voterByCedulaRif(cedulaRif: String!): Voter
customerByCedulaRif(cedulaRif: String!): Customer

El objeto Voter retorna:

• cedulaRif (cédula de identidad nacional)

• firstName, lastName

• municipalityId, parishId

• createdAt (marca de tiempo de registro)

El objeto Customer retorna:

• cedulaRif (cédula de identidad nacional)

• gasSubsidyStatus

• paymentHistory

• distributionCenter

Mismo número de cédula. Una consulta retorna estado de votación. Una consulta retorna estado de subsidio. El API está diseñado arquitectónicamente para cruzar referencias.

Credenciales Expuestas y Configuración

Archivos .env

Chamba Juvenil almacenó credenciales de base de datos en archivos .env en texto plano:

DB_CONNECTION=pgsql
DB_HOST=localhost
DB_PORT=5432
DB_DATABASE=db_chamba_produccion
DB_USERNAME=postgres
DB_PASSWORD=OUUO5bHoG4Q255Js8gevu87fM/CoBf8JhAc/Wa6raI0=

Bases de datos secundarias documentadas:

db_pcj_2017_17052019

Configuración SFTP

Configuración SFTP de Visual Studio Code expuesta:

Server: 190.202.144.60
Port: 1022
Username: chamba
Password: 1s0p0rt3++
Remote Path: /var/www/html/registrochamba/chambajuvenilc/

Credenciales de acceso directo al servidor para el directorio de aplicación web de producción.

Tokens de Bot de Telegram

Dos tokens activos de bot de Telegram encontrados en código fuente:

Bot ID: 8534453577
Token: AAHrCe_QOQRLK_nToS0pb4f5Y4ba5zBSJBQ
Chat ID: 6021886971

Bot ID: 7265564977
Token: AAHJcYuxTQX7coz-qatLEd9j5Ai1RLDv_fY
Chat IDs: 830259515, 6021886971

Ambos hardcodeados en controladores PHP y JavaScript. Conectados al mismo grupo de chat. Usados para notificaciones del sistema.

Clave Privada RSA

Una clave privada RSA PKCS#8 2048-bit completa almacenada en el repositorio. Esta clave puede descifrar tráfico, forjar certificados e impersonar servicios.

El Mapa de Infraestructura

De archivos de configuración de Git y archivos .env, la topología de red interna emerge:

Servidores de Base de Datos de Nómina (IPs internas):

• 172.31.8.44 — PostgreSQL principal (3 bases de datos: 2017, 2016, nómina de inducción)

• 172.31.8.93 — PostgreSQL de presupuesto/adquisiciones

Autenticación:

• 172.31.8.51 — Servidor LDAP (dc=mtt,dc=gob,dc=ve)

Servicios:

• proxy.mtt.gob.ve — Proxy de correo Zimbra

• gitlab.mtt.gob.ve — GitLab interno (donde se alojó el código)

• poi-r.vps.co.ve (puertos 3000/3001) — Servidor API para Ministerio de Agricultura Urbana

Este es un mapa parcial de la red interna del gobierno venezolano, extraído de un único repositorio Git expuesto.

La Evaluación de Calidad del Código

Inyección SQL: Universal

Cada interacción de base de datos usa concatenación de cadena directa:

$query = "SELECT * FROM tbl_registro_del_voto WHERE cedula = '" . $cedula . "'";
$result = $db->query($query);

La única protección es addslashes(), una función conocida por ser evitable desde mediados de los 2000s. Cada caja de búsqueda, cada filtro, cada campo de entrada en el sistema Chamba Juvenil es un punto potencial de inyección SQL.

Modo de Debug Habilitado en Producción

Cada archivo .env contiene:

APP_DEBUG=true

Esto significa que cualquier error muestra un rastreo de pila completo al navegador: rutas de archivo, llamadas de función, contenidos de variables, detalles de consultas de base de datos.

Credenciales Predeterminadas Nunca Cambiadas

Múltiples archivos .env exponen contraseñas que son predeterminados de framework, nunca modificados:

Raíz MySQL: password
Usuario Yii2: secret

Sin Endurecimiento de Servidor Web

Ni un único servidor gubernamental fue configurado para bloquear acceso a archivos sensibles. Ninguna regla .htaccess. Ninguna configuración nginx para negar .env, .git/config o docker-compose.yml.

Tres líneas de configuración de servidor web hubieran prevenido cada hallazgo en este reporte.

Cronología y Despliegue

Los metadatos de confirmación de Git muestran:

• Confirmación inicial: 2016

• Última actualización: 2019

• Desarrollador: Carlos Morales (cmorales@mtt.gob.ve)

• Organización: Ministerio de Transportes y Comunicaciones

• Repositorio: Alojado en GitLab interno en gitlab.mtt.gob.ve

El código fue mantenido en múltiples administraciones y ciclos electorales venezolanos. No fue abandonado. Fue operacional.

Patrón de Replicación

El código de rastreo de votos es idéntico en todos tres dominios:

• Mismo nombre de archivo de controlador y estructura

• Mismo esquema de tabla de base de datos

• Misma interfaz de formulario

• Mismos diseños de panel de administración

• Misma lógica de inflación de estadísticas

Esto no es desarrollo independiente. Esta es replicación deliberada de la misma infraestructura de vigilancia en múltiples sistemas gubernamentales.

Lo Que la Evidencia Muestra

Esto no es hipótesis. Esto no es inferencia. Esto es:

• Código fuente que puedes leer

• Esquemas de base de datos que puedes analizar

• Endpoints de API que puedes consultar

• Archivos de configuración que puedes descifrar

• Historial de Git que puedes examinar

• Direcciones de red que puedes mapear

El sistema de rastreo de votos existe. Fue construido. Fue desplegado. Fue conectado a sistemas de distribución de beneficios. Automáticamente inflaba estadísticas. Fue replicado en múltiples servicios gubernamentales.

La única pregunta que permanece sin respuesta es: ¿cuántos votos fueron influenciados por ciudadanos sabiendo que su comportamiento electoral estaba siendo rastreado y vinculado a su acceso a servicios gubernamentales?

Investigo y expongo la infraestructura de la tiranía. Cada artículo es otra pieza de evidencia que la gente que ama la libertad puede usar para entender, resistir y finalmente derrotar el control autoritario.

Investigación Crystal Vault — Parte X-B — 2026

Todos los datos obtenidos de archivos públicamente accesibles sin derivación de autenticación o compromiso del sistema. Código fuente, configuraciones de Git, esquemas de base de datos y respuestas de API documentadas tal como se descubrieron. Todas las URLs y credenciales verificadas para ser públicamente accesibles en el momento de la investigación.

El Propósito Real de Chamba Juvenil

Millones de jóvenes venezolanos hicieron lo que los gobiernos en todas partes dicen que hagan: solicitaron empleo. Entre 2017 y ahora, enviaron sus nombres, cédulas de identidad, números telefónicos, historiales educativos y cuentas de redes sociales a Chamba Juvenil, el programa nacional de empleos juveniles de Venezuela.

Se suponía que los ayudaría a encontrar trabajo. Capacitación de habilidades. Oportunidad económica.

Pero escondido en el código de ese sistema había algo más: un módulo completo de rastreo de votos que registraba si cada solicitante votó, capturaba su ubicación GPS cuando lo hizo, y almacenaba todo en una base de datos etiquetada como “ESTRUCTURA DE REGISTRO DEL VOTO”.

No fue un error. No fue negligencia. Fue infraestructura. Construida a propósito. Desplegada. Activa.

Cómo el Gobierno Convirtió Solicitudes de Empleo en Vigilancia Electoral

Esto es lo que pasó cuando solicitaste:

1. Completaste una solicitud de empleo en registro.chambajuvenil.gob.ve

2. Enviaste tu información personal: nombre, cédula, teléfono, educación, historial laboral

3. Detrás de escenas, el sistema te asignó un “código de estructura organizacional”

4. Empleados del gobierno podían luego iniciar sesión en un panel de administración y registrar si votaste

5. Tu estado de voto se almacenaba junto con tus coordenadas GPS, tu estado, tu municipio

6. Los datos se alimentaban a paneles de estadísticas que automáticamente inflaban los conteos de votos por más de 1.000 votos fantasma

Solicitaste un trabajo. El gobierno construyó una base de datos de votantes alrededor de ti.

Esto No Fue Un Programa

El código idéntico de rastreo de votos se ejecuta en tres dominios gubernamentales separados:

• Chamba Juvenil (empleos juveniles)

• Juventud Socialista (ala juvenil del PSUV)

• Comunas Juveniles (gobernanza comunal)

Tres sistemas diferentes. Misma infraestructura de vigilancia electoral. Misma estructura de base de datos. Mismos formularios. Mismo API.

Esto te dice algo crítico: no fue un error que sucedió una vez. Fue una opción deliberada de replicar la misma vigilancia en múltiples servicios gubernamentales.

Lo Vincularon a Tus Subsidios

Pero empeora.

El API de Distribución de Gas para el Estado Guárico, el sistema que decide quién recibe subsidios gubernamentales de gas, contiene una función dedicada de búsqueda de votantes. Puedes consultarlo por cédula nacional y obtener el estado de registro de votante de alguien.

Mismo número de cédula. Misma persona.

El gobierno ahora puede preguntar: “¿Quién recibe subsidios de gas?” y “¿Cómo votaron?” en el mismo sistema. La arquitectura está construida para cruzar referencias.

Este es el mecanismo de coerción. El acceso a la supervivencia, empleos, gas, vivienda, comida, se convierte en condicional al comportamiento político.

Lo Que Los Números Muestran

• 3 dominios gubernamentales ejecutando código idéntico de vigilancia electoral

• 23.228 archivos en el repositorio expuesto, incluyendo código fuente completo

• Coordenadas GPS registradas para cada voto

• 1.073 votos fantasma añadidos automáticamente a las estadísticas

• Cero controles de seguridad en el formulario de rastreo de votos

• HTTP plano para acceso de servidor, sin encriptación

El gobierno venezolano no solo vigiló la votación. La automatizó. La replicó. La integró con la distribución de beneficios.

Por Qué Importa Esto

En democracias, la votación se supone que es secreta. Emites tu voto. Nadie sabe cómo votaste. Ese es el punto completo, protección contra coerción.

Venezuela desmanteló esa protección por diseño. Un ciudadano no podía solicitar un trabajo gubernamental sin potencialmente tener su comportamiento electoral rastreado. No podía recibir raciones de gas sin que su estado de votante fuera consultable por el estado. No podía acceder a educación o subsidios de atención médica sin que la infraestructura de vigilancia supiera cómo votaron.

Este no es un estado de vigilancia que espía a disidentes. Este es un estado de vigilancia que condiciona el acceso a la supervivencia en la lealtad política.

El sistema Carnet de la Patria fue ampliamente documentado como una herramienta para esto. Lo que este código fuente revela es el mecanismo actual debajo. No alegaciones de políticos de oposición. No teorías. El código PHP actual. Las tablas de base de datos actuales. Los endpoints de API actuales.

Lo Dejaron Todo Atrás

Cuando los servidores que alojaban este código fueron expuestos, lo dejaron todo: el código fuente completo, las credenciales de base de datos, los archivos de configuración, el historial de Git mostrando quién lo construyó y cuándo.

El desarrollador fue nombrado. Las marcas de tiempo estaban ahí. La infraestructura fue mapeada.

No hubo intento de ocultarlo profesionalmente. Sin medidas de seguridad. Sin encriptación. Sin controles de acceso en el formulario de rastreo de votos. Solo un servidor web con archivos .env legibles para cualquiera con un navegador.

Esto sugiere una de dos cosas: O la infraestructura del gobierno venezolano es tan incompetente que expusieron su propio aparato de vigilancia por accidente. O no les importaba si era expuesto, porque el sistema ya había cumplido lo que se suponía que debería hacer.

La Verdad Simple

Solicitaste un trabajo. El gobierno construyó infraestructura para rastrear si votaste, dónde estabas cuando votaste, y vinculó esa información a tu acceso a servicios gubernamentales.

Esa infraestructura fue replicada en múltiples sistemas gubernamentales.

Eso es lo que el código muestra. Eso es lo que las bases de datos revelan. Eso es lo que los endpoints de API prueban.

Esto es lo que sucede cuando un gobierno trata a sus ciudadanos como amenazas a monitorear en lugar de personas a servir.

Investigo y expongo la infraestructura de la tiranía. Cada artículo es otra pieza de evidencia que la gente que ama la libertad puede usar para entender, resistir y finalmente derrotar el control autoritario.

Investigación Crystal Vault — Parte X-A — 2026

Todos los hallazgos se basan en archivos públicamente accesibles descubiertos sin derivación de autenticación o compromiso del sistema. Ninguna base de datos fue accedida. No se usaron exploits. El descubrimiento fue limitado a analizar lo que el gobierno venezolano dejó públicamente legible en internet.

The Source Code Discovery

On an exposed Git repository at gitlab.mtt.gob.ve/cmorales/SIGESP-MPPT.git, accessed over plain HTTP without authentication, was the complete Chamba Juvenil source code. 23,228 files. Complete application stack. Every module documented.

The vote tracking system occupied a discrete folder with its own controller, model, view layer, and JavaScript frontend. It was not legacy code. It was not deprecated. It was a fully maintained, actively used component of the registration system.

The Vote Registration Module Architecture

Controller: Registro_voto.php (430 lines)

The main controller handles vote data submission:

POST /post_registro_votos

This endpoint accepts:

• Name and cedula

• Organizational structure assignment (codes 2, 3, 17, 18, 19, 20)

• State, municipality, parish, voting center

• Binary vote response (yes/no)

• Latitude and longitude coordinates

• Phone number

The controller routes submissions to different database tables based on structure code:

if (structure_code in [gov_employee_codes]) {
  INSERT INTO tbl_servidores_publico
} elseif (structure_code in [organization_member_codes]) {
  INSERT INTO tbl_estructura_preorizado
} else {
  INSERT INTO tbl_registro_del_voto
}

The Statistics Function

The estadistica_votos() method is where the manipulation happens:

$raw_count = count_all_votes();
$reported_count = $raw_count + 273 + 800;
return ["resultado" => $reported_count];

1,073 phantom votes are added to every statistics report. This is hardcoded. This is by design. The reporting dashboard displays inflated participation numbers.

Database Schema

Three dedicated tables for vote tracking:

tbl_registro_del_voto — General population vote records

• id (primary key)

• cedula (citizen national ID)

• nombre (full name)

• telefono (phone)

• estado (state code)

• municipio (municipality code)

• parroquia (parish code)

• centro_votacion (voting center ID)

• voto_si_no (binary: voted or not)

• latitud (GPS latitude)

• longitud (GPS longitude)

• estructura_asignacion (organizational code)

• fecha_creacion (timestamp)

tbl_servidores_publico — Government employee vote tracking (identical structure)

tbl_estructura_preorizado — Party/organizational structure member tracking (identical structure)

Admin Interface

The voting registration form exists at /admin/registro_voto.php. It is not hidden. It has an interactive map powered by Leaflet.js for GPS coordinate capture. An admin can:

1. Search for a citizen by name or cedula

2. Select their voting center from a dropdown

3. Click on a map to capture GPS coordinates

4. Check a box for “Did they vote? Yes/No”

5. Submit

The data writes directly to the database with no validation beyond basic type checking.

The Three-Domain Deployment

Domain 1: Chamba Juvenil

registro.chambajuvenil.gob.ve — Youth employment job application system. 23,228 files in .git dump. Vote tracking module fully functional. Database credentials exposed in .env file.

Domain 2: Juventud Socialista

registro.juventudsocialista.org.ve — PSUV Socialist Youth organization portal. Identical code. Identical database structure. Identical vote tracking form.

Domain 3: Comunas Juveniles

comunajoven.com.ve — Communal governance organization portal. Same vote tracking infrastructure. Same forms. Same API.

Git config files show the same deployment scripts used across all three domains. The same developer (Carlos Morales, cmorales@mtt.gob.ve) committed to repositories hosting all three.

The Gas Distribution API Connection

Guarico State’s Gas Distribution API exposes a GraphQL endpoint with full schema introspection at:

api-distribucion-gas.guarico.gob.ve/graphql

The schema includes two critical queries:

voterByCedulaRif(cedulaRif: String!): Voter
customerByCedulaRif(cedulaRif: String!): Customer

The Voter object returns:

• cedulaRif (national ID)

• firstName, lastName

• municipalityId, parishId

• createdAt (registration timestamp)

The Customer object returns:

• cedulaRif (national ID)

• gasSubsidyStatus

• paymentHistory

• distributionCenter

Same cedula number. One query returns voting status. One query returns subsidy status. The API is architecturally designed to cross-reference them.

Exposed Credentials and Configuration

.env Files

Chamba Juvenil stored database credentials in plaintext .env files:

DB_CONNECTION=pgsql
DB_HOST=localhost
DB_PORT=5432
DB_DATABASE=db_chamba_produccion
DB_USERNAME=postgres
DB_PASSWORD=OUUO5bHoG4Q255Js8gevu87fM/CoBf8JhAc/Wa6raI0=

Secondary databases documented:

db_pcj_2017_17052019

SFTP Configuration

Visual Studio Code SFTP config exposed:

Server: 190.202.144.60
Port: 1022
Username: chamba
Password: 1s0p0rt3++
Remote Path: /var/www/html/registrochamba/chambajuvenilc/

Direct server access credentials for the production web application directory.

Telegram Bot Tokens

Two active Telegram bot tokens found in source code:

Bot ID: 8534453577
Token: AAHrCe_QOQRLK_nToS0pb4f5Y4ba5zBSJBQ
Chat ID: 6021886971

Bot ID: 7265564977
Token: AAHJcYuxTQX7coz-qatLEd9j5Ai1RLDv_fY
Chat IDs: 830259515, 6021886971

Both hardcoded in PHP controllers and JavaScript. Connected to the same chat group. Used for system notifications.

RSA Private Key

A full PKCS#8 RSA 2048-bit private key stored in the repository. This key can decrypt traffic, forge certificates, and impersonate services.

The Infrastructure Map

From Git configs and .env files, the internal network topology emerges:

Payroll Database Servers (internal IPs):

• 172.31.8.44 — Primary PostgreSQL (3 databases: 2017, 2016, induction payroll)

• 172.31.8.93 — Budget/procurement PostgreSQL

Authentication:

• 172.31.8.51 — LDAP authentication server (dc=mtt,dc=gob,dc=ve)

Services:

• proxy.mtt.gob.ve — Zimbra email proxy

• gitlab.mtt.gob.ve — Internal GitLab (where code was hosted)

• poi-r.vps.co.ve (ports 3000/3001) — API server for Ministry of Urban Agriculture

This is a partial map of the Venezuelan government’s internal network, extracted from a single exposed Git repository.

The Code Quality Assessment

SQL Injection: Universal

Every database interaction uses direct string concatenation:

$query = "SELECT * FROM tbl_registro_del_voto WHERE cedula = '" . $cedula . "'";
$result = $db->query($query);

The only protection is addslashes(), a function known to be bypassable since the mid-2000s. Every search box, every filter, every input field in the Chamba Juvenil system is a potential SQL injection point.

Debug Mode Enabled in Production

Every .env file contains:

APP_DEBUG=true

This means any error displays a full stack trace to the browser: file paths, function calls, variable contents, database query details.

Default Credentials Never Changed

Multiple .env files expose passwords that are framework defaults, never modified:

MySQL root: password
Yii2 user: secret

No Web Server Hardening

Not a single government server was configured to block access to sensitive files. No .htaccess rules. No nginx configuration to deny .env, .git/config, or docker-compose.yml.

Three lines of web server configuration would have prevented every finding in this report.

Timeline and Deployment

Git commit metadata shows:

• Initial commit: 2016

• Last update: 2019

• Developer: Carlos Morales (cmorales@mtt.gob.ve)

• Organization: Ministry of Transportation and Communications

• Repository: Hosted on internal GitLab at gitlab.mtt.gob.ve

The code was maintained across multiple Venezuelan administrations and election cycles. It was not abandoned. It was operational.

Replication Pattern

The vote tracking code is identical across all three domains:

• Same controller file name and structure

• Same database table schema

• Same form interface

• Same admin panel layouts

• Same statistics inflation logic

This is not independent development. This is deliberate replication of the same surveillance infrastructure across multiple government systems.

What the Evidence Shows

This is not hypothesis. This is not inference. This is:

• Source code you can read

• Database schemas you can analyze

• API endpoints you can query

• Configuration files you can decrypt

• Git history you can examine

• Network addresses you can map

The vote tracking system exists. It was built. It was deployed. It was connected to benefit distribution systems. It automatically inflated statistics. It was replicated across multiple government services.

The only question that remains unanswered is: how many votes were influenced by citizens knowing their voting behavior was being tracked and linked to their access to government services?

I investigate and expose the infrastructure of tyranny. Every article is another piece of evidence that freedom-loving people can use to understand, resist, and ultimately defeat authoritarian control.

Crystal Vault Investigation — Part X-B — 2026

All data sourced from publicly accessible files without authentication bypass or system compromise. Source code, Git configurations, database schemas, and API responses documented as discovered. All URLs and credentials verified to be publicly accessible at time of investigation.

The Real Purpose of Chamba Juvenil

Millions of young Venezuelans did what governments everywhere tell people to do: they applied for work. Between 2017 and now, they submitted their names, national IDs, phone numbers, education histories, and social media accounts to Chamba Juvenil, Venezuela’s national youth employment program.

It was supposed to help them find jobs. Skills training. Economic opportunity.

But hidden in the code of that system was something else entirely: a complete vote-tracking module that recorded whether each applicant voted, captured their GPS location when they did, and stored everything in a database labeled “ESTRUCTURA DE REGISTRO DEL VOTO”—Structure of Vote Registration.

This wasn’t a glitch. It wasn’t oversight. It was infrastructure. Purpose-built. Deployed. Active.

How Government Turned Job Applications into Voter Surveillance

Here’s what happened when you applied:

1. You filled out a job application at registro.chambajuvenil.gob.ve

2. You submitted your personal data: name, cedula (national ID), phone, education, employment history

3. Behind the scenes, the system assigned you an “organizational structure code”

4. Government employees could then log in to an admin panel and record whether you voted

5. Your vote status was stored alongside your GPS coordinates, your state, your municipality

6. The data was fed into statistics dashboards that automatically inflated the vote counts by over 1,000 phantom votes

You applied for a job. The government built a voting database around you.

This Wasn’t One Program

The identical vote-tracking code runs on three separate government domains:

• Chamba Juvenil (youth jobs)

• Juventud Socialista (PSUV party youth wing)

• Comunas Juveniles (communal governance)

Three different systems. Same vote surveillance infrastructure. Same database structure. Same forms. Same API.

This tells you something critical: it wasn’t a mistake that happened once. It was a deliberate choice to replicate the same surveillance across multiple government services.

They Linked It to Your Subsidies

But it gets worse.

The Gas Distribution API for Guarico State—the system that decides who receives government gas subsidies—contains a dedicated voter lookup function. You can query it by national ID and get back someone’s voter registration status.

Same cedula number. Same person.

Government can now ask: “Who receives gas subsidies?” and “How did they vote?” in the same system. The architecture is built to cross-reference them.

This is the mechanism of coercion. Access to survival (jobs, gas, housing, food) becomes conditional on political behavior.

What the Numbers Show

• 3 government domains running identical vote surveillance code

• 23,228 files in the exposed repository, including complete source code

• GPS coordinates recorded for every vote

• 1,073 phantom votes added automatically to statistics

• Zero security checks on the vote tracking form

• Plain HTTP for server access (no encryption)

The Venezuelan government didn’t just surveil voting. It automated it. Replicated it. Integrated it with benefit distribution.

Why This Matters

In democracies, voting is supposed to be secret. You cast your vote. No one knows how you voted. That’s the entire point—protection from coercion.

Venezuela dismantled that protection by design. A citizen couldn’t apply for a government job without potentially having their voting behavior tracked. Couldn’t receive gas rations without their voter status being queryable by the state. Couldn’t access education or healthcare subsidies without the infrastructure of surveillance knowing how they voted.

This is not a surveillance state that spies on dissidents. This is a surveillance state that conditions access to survival on political loyalty.

The Carnet de la Patria system was widely documented as a tool for this. What this source code reveals is the actual mechanism underneath. Not allegations from opposition politicians. Not theories. The actual PHP code. The actual database tables. The actual API endpoints.

They Left It All Behind

When the servers that hosted this code were exposed, they left everything: the complete source code, the database credentials, the configuration files, the Git history showing who built it and when.

The developer was named. The timestamps were there. The infrastructure was mapped out.

There was no attempt to hide it professionally. No security measures. No encryption. No access controls on the vote tracking form. Just a web server with .env files readable to anyone with a browser.

This suggests one of two things: Either the Venezuelan government’s infrastructure is so incompetent that they exposed their own surveillance apparatus by accident. Or they didn’t care if it was exposed, because the system had already accomplished what it was meant to do.

The Simple Truth

You applied for a job. The government built infrastructure to track whether you voted, where you were when you voted, and linked that information to your access to government services.

That infrastructure was replicated across multiple government systems.

That’s what the code shows. That’s what the databases reveal. That’s what the API endpoints prove.

This is what happens when a government treats its citizens as threats to monitor rather than people to serve.

I investigate and expose the infrastructure of tyranny. Every article is another piece of evidence that freedom-loving people can use to understand, resist, and ultimately defeat authoritarian control.

All findings are based on publicly accessible files discovered without authentication bypass or system compromise. No databases were accessed. No exploits were used. Discovery was limited to analyzing what the Venezuelan government left publicly readable on the internet.

Today the country turns 250. A quarter of a millennium since a few men in Philadelphia signed their names to a document that could have gotten them hanged. Two and a half centuries of an experiment that, on paper, still shouldn’t work: a country held together not by blood or borders or a king, but by an idea.

I don’t think about the idea in the abstract. I think about it through the men in my family who were asked, again and again across all 250 of those years, to stand between this country and the people who wanted it dead.

Because my family didn’t wander into this story somewhere in the middle. We were there at the start of it.

Washington’s Guard

At the very beginning, when there was barely a country at all, just a ragged army and a single indispensable man holding it together, there was a Quirk standing at his side.

Captain Thomas Quirk served in General Washington’s personal bodyguard. Think about what that meant. The entire American experiment lived or died with one man; lose Washington, and the Revolution likely dies with him and there is no United States to celebrate 250 years later. The men trusted to keep him alive were handpicked, close, and expendable in his place. My blood was part of that wall.

This isn’t a story I go looking to inflate. It runs in the bloodline through the Society of the Cincinnati, the hereditary order founded in 1783 by the officers who actually won the Revolution, with Washington himself as its first President General, its membership passed down through the descendants of the men who were there. That is our line. Some of you will know exactly what that means.

So sit with it on a day like today. The country turns 250, and my family has been standing watch for every one of those years, from the man guarding Washington’s tent to the man watching the KGB two centuries later. I don’t think it’s chance that the Quirks were there to protect the father of the country, and have never once stopped serving her since.

The Quirks endure. That’s not a hope. It’s a record.

A Draft Notice

My great-grandfather, John Patrick Quirk I, didn’t volunteer. He was drafted into the First World War, pulled out of an ordinary life and shipped toward a war that the men fighting it barely understood. Trenches. Mud. Gas. A scale of mechanized killing the world had never seen.

He didn’t choose it. That’s the part I keep coming back to. The country called his number, and he went. No speeches, no parades in his own head, just a young man doing what was asked because that’s what the moment demanded. Whatever “America” meant in a philosophy seminar, to him it meant a notice, a train, and an ocean.

He came home. Most of the story I’ll never know. But the line continued because he made it back, and that’s the only reason I’m here to write any of this.

Monte Cassino

A generation later, his son, my grandfather, John Patrick Quirk II, got his own war.

He fought at Monte Cassino, one of the ugliest, most grinding battles of the Second World War. Four months of it, early in 1944, in the mountains of Italy. A Benedictine abbey on a hilltop, German positions dug into the rock, a river valley below turned into a killing ground. The Allies threw assault after assault at that mountain and were thrown back, again and again, at a cost of tens of thousands of men. Soldiers from half the world bled on those slopes before the line finally broke.

My grandfather was wounded there.

I’ve tried to picture it, the cold, the artillery, the sheer stubborn horror of being told to take a mountain that would not be taken. He survived it. He carried whatever that did to a young man for the rest of his life, the way that generation did: quietly, mostly without saying much.

He came home too. And he never spoke of the war. Not to his family, not to anyone, not once. That’s why they are called the Silent Generation.

My Father

Then came my father, John Patrick Quirk III.

His war didn’t look like the two before it. There were no trenches, no mountain, no front line you could find on a map. He fought the KGB, a valiant patriot in the long, silent war of the Cold War, a spy standing against the Soviet machine that meant to bury everything this country stood for. The Iron Curtain was a battlefield too, and the men who fought on it did so in the dark, without parades, often without anyone ever knowing what they’d done or what it cost them.

Same bloodline, same choice, made again. My great-grandfather answered with a draft notice. My grandfather answered on the slopes of Cassino. My father answered in the shadows, against an enemy that wore no uniform and fought to win without a shot ever being fired. Three generations, three wars, three men who said yes when the country needed them.

My father is the reason it isn’t ancient history to me. The trenches and the mountain are photographs and secondhand memory, but him, I watched. I grew up inside the discipline and the vigilance of a man who had stared down the KGB, and I absorbed what he knew: that freedom has enemies who are patient, and that some of the most important battles for a country are the ones nobody sees.

What It Actually Means

Here’s what 250 years means to me, standing at the end of that line.

It doesn’t mean the country is perfect. My family didn’t fight for a perfect place, and no generation of them pretended it was one. The America of 1917 and the America of 1944 both had their sins in plain view. The point was never that the country had arrived. The point was that it was worth defending anyway, worth the mud and the gas and the mountain, because the alternative was worse, and because the idea underneath it was still, on balance, the best bet humanity had made about how to govern itself.

That’s the inheritance. Not a flag-waving certainty that we’re the greatest at everything. Something quieter and harder: a debt. Three men in my own bloodline, three men who carried the very same name, John Patrick Quirk, the First and the Second and the Third, were asked to give everything for a promise most of us now enjoy without a second thought. The promise that ordinary people get to run their own lives, choose their own leaders, and be more than subjects. The same name went to the trenches, up the mountain, and into the shadows against the KGB. One name, three wars, one country worth all of it.

They paid on that promise so I wouldn’t have to. And everything I absorbed from my father, what service means, what a country is worth, what it costs to keep it, is now mine to carry. The torch doesn’t stop at the last man who wore a uniform. It gets handed to whoever is willing to pick it up.

I intend to pick it up.

A New American Age

Here’s the harder truth, though. I’m not being handed the same country my grandfather bled for.

We are not the America of the 1940s and 1950s. That country, for all its flaws, knew what it believed. It had a shared spine of ethics, values, and culture that a man could point his life at. Much of that has been eroded, worn down a little at a time until you can see the country underneath straining to remember what held it together.

So the torch I’m carrying isn’t the same weight my fathers carried. Theirs was a rifle against a foreign enemy on a mountain or in a trench. Mine is something less visible and, in its own way, just as hard: to hold onto what we’re supposed to hold dear when so much of it is slipping. The enemy of a new American age isn’t always across an ocean. Sometimes it’s the quiet forgetting of who we said we’d be.

We are entering a new paradigm, and it will stand or fall on exactly this, on whether people like me are willing to guard the values, the ethics, the culture, the plain idea of freedom, with the same stubbornness my family guarded the ground at Cassino. Not with a rifle. With how I live, what I refuse to let go of, and what I pass down in turn.

The Light Outshines the Dark

I was raised on heroes. Real ones. The great Americans I was taught to admire and love, the soldiers, the founders, the builders, the ordinary people who did extraordinary things because they believed this country was worth it. That admiration wasn’t naive. It was the truth as my family lived it, generations deep.

So I’ll say plainly what’s become unfashionable to say. I know the modern degradation of this country. I’ve watched a whole industry of media, activists, and people who seem to genuinely hate America make a career of tearing it down, cataloguing only its sins, never its glories, treating contempt for the country as a mark of intelligence.

I disavow their opinions. Completely.

America is greater than the bad in it. It always has been. Yes, we have failures, real ones, ugly ones, and we should be honest about them. But a country is judged by its whole ledger, and ours is overwhelmingly one of liberty extended, tyranny fought, and lives made freer. The people sneering at that from the comfort and safety this country gave them have it exactly backwards.

The light outshines the dark. That isn’t a slogan to me. It’s the conclusion of a man who looked honestly at his own bloodline, a draft notice, a wound on an Italian mountain, a father who stood against the KGB, and understood that all of it was spent on something good. Something worth loving. Something still worth defending against everyone, foreign or domestic, who would rather see it fail.

Do Not Turn on Her

There’s a sickness loose in this country, and it isn’t the one you’d expect. People are ashamed to be American. Ashamed. And that shame has spread like a pandemic, a virus of the spirit, until whole swaths of the country flinch at their own flag.

I don’t believe that happened by accident. Shame at that scale is manufactured. You can make the argument, and I’ll make it, that this is a psy-op: a slow, patient information war waged by our adversaries and pumped through social media straight into the minds of our own people. You don’t have to invade a country you can convince to hate itself. The KGB my father fought understood that better than anyone, the cheapest way to defeat a nation is to get it to defeat itself, to rot its confidence from the inside until it no longer believes it deserves to stand. That war never ended. It just moved onto our phones.

And this is where my family’s history stops being a memory and becomes an instruction. We know what a wound is. My grandfather was wounded on a mountain in Italy and did not come home cursing the country that sent him, he came home and raised a son who served in his turn. So let me say it as plainly as I can:

America is wounded. Do not turn on her.

You do not abandon the wounded. You do not kick the country that gave you everything while she’s down on one knee. You carry her, the way my family has always carried her, until she’s back on her feet. That isn’t blind loyalty. It’s the only kind of loyalty that has ever meant anything: the kind that shows up when it’s hard.

The Blood I Carry

I’ll be honest here, because the rest of this isn’t worth writing if I’m not.

I am not where I want to be in life. I’ve fallen to the fate of circumstance, the way people do, the way the plans you make at twenty get rewritten by things you never chose. I won’t dress it up. There’s a distance between the life I imagined and the one I’m standing in, and I feel every inch of it.

But here is what I know, and it’s the whole reason this day means what it does to me: perseverance through hardship is part of our American blood. Endurance is the inheritance underneath all the others. The men whose name I carry didn’t prevail because the world was gentle with them. John Patrick Quirk I didn’t choose the draft. The Second didn’t choose that mountain, or the wound it gave him. The Third didn’t choose the shadow war he spent his life fighting. They endured what they were handed, and they kept moving.

And the war has found me in its own shape, the way it found each of them in theirs. My fathers all fought in wars. Mine is the cyberwar. The adversaries of the United States never went away; they moved onto the networks, and that is where I stand. The frontline of the cyberwar is my post, and I am at service to my country as I always have been. Whether openly, or in the shadows.

That’s the part of the legacy available to me right now, in this exact spot. A different battlefield, and a quieter, lonelier test underneath it: to keep going. To not set it down. To believe the low place I’m in is a chapter and not the whole book. The same stubbornness that held the line at Cassino is the stubbornness that gets a man up off the floor. It is the same blood.

This country was built by people who were not where they wanted to be, and refused to stay there. I come from them. I’m not done.

250

When I hear “250 years,” I don’t hear a distant number. I see Captain Thomas Quirk standing watch over Washington when the whole country was one bad night away from never existing. I hear John Patrick Quirk I’s train pulling out for France. I hear the guns at Cassino and my grandfather somewhere in them. I see my father in the dark, holding the line against the KGB. And then I feel the weight settle into my own hands.

The country is a relay, and my family has run its leg of it from the very first stride. Every generation gets handed something imperfect and bloodied and still, somehow, worth keeping, and is asked to carry it a little farther before passing it on. Thomas guarded the man who made it. The First carried it out of the trenches. The Second carried it off that mountain. The Third carried it through the shadow war.

Now it’s mine. I am Patrick Quirk, still a Patrick, still a Quirk, still the blood of the men who guarded Washington and bled at Cassino and stared down the Soviets. My war is the cyberwar, waged against the adversaries of this country on the newest front there is, and that is my post. I may not be where I wanted to be when the weight reached me. That doesn’t matter. You carry it from wherever you happen to be standing.

A new age, a new fight, to keep the torch lit when the wind is trying its hardest to put it out. To carry a wounded country instead of turning on her. To endure, because endurance is the oldest thing in our blood.

Two hundred and fifty years in, the least I can do is remember exactly what it weighed in their hands, and refuse to be the one who sets it down.

Happy birthday, America. From one of the men who still loves you, and always will.

The Quirks endure.

Patrick Quirk

How I Ended Up on a Scammer’s Leaderboard

June 30, 2026. Evening. My Discord account started DMing people unsolicited links to “duetux.com” with a promo code “CASH.” I didn’t send them. I wasn’t mass soliciting a crypto service. I didn’t have my password written on a sticky note.

Someone else was inside my account. I still don’t know exactly how.

It could have been malware. It could have been phishing. It could have been credential reuse from another breach. I don’t have forensic evidence of which vector worked. What I know for certain: My Discord token was compromised and immediately put to work spamming my contact list.

Most people would panic, reset passwords, enable 2FA, and move on. I did that. Then I started digging.

What I found was worse than a simple credential compromise. I’d been enrolled—without consent—in a sophisticated money laundering operation masquerading as an online casino. An operation that, based on the infrastructure I recovered, is defrauding roughly 10,000 people per month out of $2.5-5 million USD. Every single month.

And I wasn’t the only one compromised in this funnel.

This is their playbook.

The Scam in 60 Seconds

The Gambler Syndicate operates a decentralized cryptocurrency casino scam with a recruitment model that would make Amway jealous:

1. Your account gets compromised. Via malware, phishing, credential reuse, or social engineering—the vector changes, but the outcome is the same: They have your Discord token.

2. Your friends get contacted. Automated bots fire off DMs from your account with links to a fake casino.

3. They get hooked. The site shows a fabricated $3,450 bonus. To “unlock” it, they need to send a $100-500 “verification deposit” in crypto.

4. They lose everything. The account locks. The support chat ends. Their money is gone.

5. Someone got paid. The scammers who recruited victims get 50-70% commission. There are 100-500 of these recruiters worldwide, coordinating through Telegram.

The kicker: The organizers don’t even have to do the recruiting themselves. They’ve automated the entire funnel. Someone else does the dirty work, takes the commission, and the syndicate keeps everything else.

It’s organized crime with an affiliate program.

How Big Is This Actually?

The hard numbers from their own infrastructure:

• 1,200+ active domains (sister sites to duetux.com, coordinating casino traffic)

• 10,000 estimated monthly victims (conservative estimate based on visible infrastructure)

• $500-750 average loss per victim (ranging from $100 for the skeptics to $4,410 for the persistent)

• $2.5-5 million USD monthly revenue (minimum-to-maximum estimate)

• $30-60 million annually

For context: This is the financial footprint of a mid-sized tech startup. Except instead of building software, they’re stealing Discord accounts and ruining people financially.

The operation is run from Eastern Europe (Russian-language documentation), coordinated through Telegram, and laundered primarily through Bybit exchange and a Georgia-based VASP called Sher888. Cloudflare DDoS protection keeps the sites online. Privacy-protected domain registration keeps the operators hidden.

The Recruitment Machine

Here’s what separates the Gambler Syndicate from other scams: They’ve industrialized victim recruitment.

Step 1: Become an Operator
Message a Telegram bot called @gambler_panel_bot. You get credentials to an admin panel called gambler-partners.is. No interview. No vetting. Just automated registration.

Step 2: Get Your API Keys
Log in. Generate an API token. Request your VPN IP be whitelisted to their backend. They literally hand you the keys.

Step 3: Download the Tools
Visit the @gambler_tech channel. Download source code for:

• A Discord token stealer (malware)

• An automated DM spam bot

• A WebSocket client library for real-time coordination

Step 4: Deploy and Monitor
Distribute the malware however you want (game mod sites, fake extension repos, Reddit links). When victims fall into the funnel, their deposits trigger real-time WebSocket notifications. You see it live. Your dashboard updates. Your commission accrues.

Step 5: Get Paid
50-70% of every victim’s deposit hits your account. Minimum guarantee of 50% even if something goes wrong. Monthly settlement via bank wire through Sher888.

A mid-tier operator (50 victims/month at $500 average) is making $12,500-17,500 monthly. Top operators are pushing $100,000+. This is better than legitimate cybersecurity work, which is probably why they’re getting hundreds of sign-ups.

The Victim Funnel (From Their Wiki)

The operatives documented their victim psychology in excruciating detail. They know exactly why people fall for this.

Stage 1: Contact
“You have $3,450 waiting. Claim it here:” The link comes from someone in your contact list, so you trust it.

Stage 2: Hook
The casino interface is professional. The bonus is real (on screen). The only thing preventing withdrawal is a “verification deposit.” This is the magic moment—they’ve already convinced the victim they’re wealthy. Now it’s just about proving it.

Stage 3: Investment
$100 to start. Doesn’t clear. “$500 for priority processing.” Still stuck. “$2,000 to unlock premium withdrawal.” By now, the victim has already lost the psychological game. They’re chasing the $3,450 illusion instead of accepting the loss.

Stage 4: Exit
Account locked. Support chat disconnected. Victim realizes they’ve been robbed.

The documentation actually calls this “victim loss-chasing mechanics”—as if it’s a feature, not a crime. They’re engineering the psychological traps that make victims dig deeper instead of walking away.

The Technical Architecture

For those who care about the engineering:

Infrastructure:

• Hosting: Cloudflare CDN (free tier DDoS protection)

• Domains: Registered through PublicDomainRegistry under pseudonym “Thiago Powell”

• API Backend: REST + WebSocket (real-time event streaming)

• Language: Appears to be Node.js/Next.js (based on domain configuration)

Cryptocurrency Flow:

1. Victims send deposits to: TE51Enb6DZWuDQ8EF4imJT1R (Tron USDT wallet)

2. Funds consolidate (~200 victims at a time)

3. Routed to Bybit exchange (95% of proceeds)

4. Converted to fiat

5. Moved to Sher888 VASP (Georgia) for final settlement

6. Bank wire to operator accounts

They support 17 blockchain networks: Bitcoin, Ethereum, XRP, Solana, TON, Tron, Binance Chain, Litecoin, USDT, USDC, Monero, and others. This means victims can scam-pay from whatever chain they hold. Maximum optionality for maximum victim targeting.

Command & Control:
Real-time WebSocket endpoint broadcasts when deposits arrive. Operators watch live:

newDeposit: victim sent $500
newDrain: $500 moved to exchange
newMessage: operator-to-victim comms relay

It’s a leaderboard. Gamification. They’re literally competing on Slack-style dashboards to see who can defraud the most people fastest.

Why You Should Care

You’re in their targeting cone if:

• You use Discord (account compromise via any vector: malware, phishing, credential reuse)

• You download games or mods from untrusted sources (potential malware distribution)

• You reuse passwords across multiple sites (exposed credentials get weaponized)

• You hold cryptocurrency (payment method)

• You’ve ever fallen for a “too good to be true” financial offer (victim profile)

The psychological trap is real. Their own documentation shows they understand human cognitive bias better than most UX designers. The $3,450 bonus doesn’t exist, but your brain doesn’t care. Your brain sees: You’re wealthy. You just need to “unlock” it. Every dollar you send is an investment, not a loss. The sunk cost fallacy does the rest.

If this happened to you, you’re not stupid. You got targeted by a professionally engineered exploitation vector with a $30-60M budget. That’s not a scam. That’s a financial weapon.

What Happened After I Reported This

The infrastructure is still active. On July 1, 2026, duetux.com is still online. The wiki is still public. The Telegram bots are still registering new affiliates. Cloudflare is still protecting their backend. The payment processing is still flowing.

I’ve filed reports with:

• FBI IC3 (Internet Crime Complaint Center)

• Tether Abuse Team (cryptocurrency transaction tracking)

• CISA (Cybersecurity & Infrastructure Security Agency)

• Interpol (international law enforcement coordination)

The usual suspects. They have evidence. They have blockchain trails. They have bank records from Sher888.

What they don’t have yet is the political will to coordinate an international takedown of a syndicate operating out of a jurisdiction (Eastern Europe) where cybercrime has become economically indistinguishable from state-sponsored activity.

How to Protect Yourself

For Discord Users:

• Enable 2FA on your Discord account (SMS or authenticator app)—this blocks account takeovers even if your password is compromised

• Don’t reuse passwords across sites (if your password leaked from LinkedIn or another breach, it’ll be tried against Discord)

• Don’t download “game installers” from random Reddit threads

• Don’t click “install this mod” links from unknown sources

• Don’t trust DMs with investment opportunities, even from friends—their account is probably compromised

• If your account starts DMing people unsolicited, you’ve been compromised—reset your password immediately and check your login history for unfamiliar IPs/sessions

• Check your authorized apps: Discord Settings → Authorized Apps → Review and revoke anything you don’t recognize

• Check if your email recovery settings have been changed (your email might have a forwarding rule set by the attacker)

For Cryptocurrency Holders:

• Assume every “investment opportunity” DMed to you from a friend is a scam (because their account is compromised)

• Never send a “verification deposit” to prove wealth

• The fact that you see money in an account doesn’t mean you can withdraw it

• If withdrawal is blocked, it’s not an investment. It’s a scam.

• Watch for deepfake videos of celebrities endorsing casinos—they’re fabricated

For Parents:

• Know what your kids are downloading

• Game installers from obscure websites are trojan vectors

• Discord tokens are accounts. Stolen accounts are used to scam strangers

• Teach them: If it promises money with no effort, it’s designed to steal from them (or from their friends’ parents)

What’s Happening Now

Law enforcement agencies move slow. The Gambler Syndicate moves fast. By the time any coordinated takedown happens, they’ll have already shifted infrastructure, rotated wallets, and fired up sister operations under different names.

This is their third or fourth major operation. They’ve done MrBeast casino variants. They’ve done Andrew Tate pump-and-dumps. They’ve done AI deepfake testimonials. Each time they’ve gotten more sophisticated. Each time the funnel has gotten tighter.

The competence threshold for organized cybercrime has gotten so low—and the profitability so high—that there’s essentially no reason for criminal enterprises to stop. The punishment risk is minimal. The reward is $2.5-5 million monthly.

That math doesn’t change unless we change the response.

The Bigger Picture

This isn’t a story about one scam. This is a story about what happens when:

• Platforms don’t require authentication for malware distribution (anyone can create game installer repos)

• Payment infrastructure doesn’t verify users (Bybit lets you move millions through automated accounts)

• Offshore jurisdictions don’t cooperate with law enforcement (Seychelles registrants have zero accountability)

• Cryptocurrency is frictionless (17 chains, instant settlement, no reversals)

• Affiliate recruitment is automated (Telegram bots with zero gatekeeping)

You end up with a $30-60M annual crime operation running on an ad-hoc infrastructure that’s part malware, part casino, part money laundering pipeline, and part psychological exploitation.

This will keep happening. It will keep scaling. It will keep targeting people who—like my contacts—suddenly got a message from “me” that looked legitimate enough to click.

What I Did Next

I’m publishing this because silence is complicity. The victims in the Gambler funnel need to know:

1. This is organized. It’s not a one-off scam. Hundreds of people coordinated this across multiple countries.

2. This is targeted. They had your account credentials. This wasn’t random spam. This was a direct compromise with a specific vector.

3. This is profitable. It only stops when it becomes unprofitable. Law enforcement is slow. Individual defensive measures matter more.

I’ve documented everything. I’m making it public. I’m providing law enforcement with the playbook.

What you do with this information is up to you.

If you got DMed a casino link from a friend recently—especially if you don’t remember your friend sending it—reset their password immediately and check their login history. If you received such a link yourself, don’t click it. Their account is compromised via one of several vectors: malware, phishing, credential reuse from another breach, or social engineering. The specific vector doesn’t matter as much as the response: isolate, reset, verify. You’re not the target. Your contact list is.

If you’re running a Discord server, warn your members. If you’re a security researcher, here are the infrastructure details you need to build detection. If you’re in law enforcement, I have more specifics than I can publish publicly.

This is what organized cryptocurrency crime looks like in 2026.

Data sources: Operational documentation from wiki.gambler-partners.is, blockchain analysis of primary collector wallet (TE51Enb6DZWuDQ8EF4imJT1R), API endpoint enumeration, Telegram threat actor profiles, Whois records, SSL certificate analysis, WebSocket event tracking, and direct victim communications.

Confidence level: HIGH (based on captured operational documentation and real-time infrastructure observation)

GAMBLER SYNDICATE — OPERATIONAL INTELLIGENCE REPORT

Classification: HIGH-PRIORITY THREAT / ORGANIZED CYBERCRIME
Report Date: 2026-06-30 @ 23:55 UTC
Incident Trigger: Discord account compromise at 6:16 PM UTC
Investigation Status: COMPLETE

1. ORGANIZATIONAL STRUCTURE

Command Hierarchy

GAMBLER SYNDICATE (Unknown CEO/Founder)
    │
    ├─ @gamblerworkmain / @gamblerwork (PRIMARY OPERATIONAL ADMIN)
    │   ├─ Day-to-day operations
    │   ├─ IP whitelist approvals
    │   ├─ Operator recruitment & vetting
    │   └─ Financial distribution (50-70% operator commission)
    │
    ├─ @lord_gambler / @lord_gamb (TECH ADMIN / ENGINEERING LEAD)
    │   ├─ Infrastructure maintenance
    │   ├─ API & WebSocket development
    │   ├─ Bot source code management
    │   ├─ Database administration
    │   └─ Payment flow integration (17-chain crypto support)
    │
    ├─ @gambler_panel_bot (AUTOMATED REGISTRATION BOT)
    │   ├─ New operator account creation
    │   ├─ Automated login/password generation
    │   ├─ API token provisioning
    │   └─ Panel access onboarding
    │
    ├─ @gambler_info (PUBLIC INFORMATION CHANNEL)
    │   ├─ Documentation publishing
    │   ├─ Policy announcements
    │   └─ Public-facing communications
    │
    └─ @gambler_tech (BOT SOURCE CODE REPOSITORY)
        ├─ Discord token stealer malware
        ├─ DM spam bot code
        ├─ WebSocket client library
        └─ Social media automation tools

Operator Network

• Estimated active operators: 100-500

• Recruitment method: Telegram @gambler_panel_bot + incentive structure

• Commission structure: 50-70% of verified victim deposits

• Insurance/Hedge guarantee: 50% payout floor on successful conversions

• Real-time incentive tracking: WebSocket event notifications (newDeposit, newDrain)

2. INFRASTRUCTURE ASSETS

Primary Domains

DomainPurposeStatusTech StackRegistrarduetux.comPublic-facing casino (victim recruitment)ACTIVENext.js + TurbopackPDR (PublicDomainRegistry)gambler-partners.isOperator/affiliate management panelACTIVEREST API + WebSocket + WikiUnknown (likely same)gambler-panel.comLegacy backend infrastructureDEADSocket.io (deprecated)Unknown

Hosting Infrastructure

CDN/Protection Layer:

• Cloudflare (AS13335)

• Free tier DNS + DDoS protection

• IPs: 104.21.96.120, 172.67.180.13 (IPv4)

• IPv6: 2606:4700:30336815:6078, 2606:4700:3030ac43:b40d

SSL Certificates:

• Issuer: Cloudflare TLS + Google Trust Services

• Issue date: 2026-06-30 (same day as domain registration)

• Validity: 90 days (Sept 28, 2026)

• Dual issuance indicates automated Cloudflare provisioning

API Endpoints & Protocols

REST API (gambler-partners.is):

Base URL: https://gambler-partners.is/api/
Authentication: Bearer token (obtained via @gambler_panel_bot)
Rate limiting: Unknown (IP whitelist required)
Endpoints: [Full list requires active access]

WebSocket Command & Control (LIVE):

Endpoint: wss://gambler-partners.is/api/ws
Authentication: ?token=Worker_{token}&connectionType=bot
Real-time events:
  - newDeposit (victim funding detected)
  - newDrain (victim account drained)
  - newMessage (operator-to-victim communication)
Purpose: Live deposit tracking + operator gamification

Telegram Bot API:

• @gambler_panel_bot (account creation)

• @gamblerworkmain (approvals & escalations)

• @lord_gamb (technical support)

Documentation Infrastructure

Operational Wiki:

• URL:

https://wiki.gambler-partners.is/

• Sitemap: https://wiki.gambler-partners.is/sitemap.md

• LLMs dump: https://wiki.gambler-partners.is/llms-full.txt

• Format: Markdown (50+ pages of operational procedures)

• Language: Russian (Cyrillic documentation)

• Access: Public (no authentication required)

Wiki Categories:

• Core panel operations

• Domain setup & management

• Promo code generation

• Telegram bot deployment

• Social media operation manuals (Instagram, TikTok, YouTube Shorts, Meta Threads)

• VPN/OPSEC configuration

• Victim psychology & conversion optimization

• Account compromise techniques

• Payment integration procedures

3. OPERATIONAL PROCEDURES

Victim Recruitment Pipeline

Primary Channels:

1. Discord (ACTIVE) — Account compromise → DM spam

2. Telegram — Direct bot invitations + affiliate link sharing

3. Instagram — Fake celebrity/influencer casino pages

4. TikTok — Video-based funnel with deepfake testimonials

5. YouTube Shorts — Automated spam video campaigns

6. Meta Threads — Large-scale comment/reply spam (”millions” targeted)

Victim Funnel (Scam Mechanics)

Step 1: CONTACT
├─ Victim receives DM from "trusted contact" (compromised account)
└─ Link: duetux.com with promo code CASH

Step 2: REGISTRATION
├─ User creates account at duetux.com
└─ Fabricated $3,450 bonus balance appears instantly

Step 3: PSYCHOLOGICAL HOOK
├─ False withdrawal success UI shown
├─ "Verification deposit" demanded ($100-500 minimum)
└─ Victim believes they need to "unlock" their bonus

Step 4: PAYMENT
├─ Victim transfers crypto to wallet (17 supported chains)
├─ Primary collector: TE51Enb6DZWuDQ8EF4imJT1R (Tron USDT)
└─ WebSocket event fires: newDeposit (operator notified in real-time)

Step 5: THEFT
├─ Funds consolidated
├─ Account locked
├─ Support chat ends (operator disconnects)
└─ WebSocket event fires: newDrain

Step 6: VICTIM LOSS
├─ Total per-victim loss: $100-4,410 USD
├─ Monthly victims: ~10,000 (estimated)
└─ Monthly revenue: $2-5M USD (estimated)

Operator Workflow

Step 1: REGISTRATION
├─ Message @gambler_panel_bot
└─ Receive: username/password for gambler-partners.is panel

Step 2: AUTHENTICATION
├─ Log into panel
├─ Navigate to Settings → API
└─ Copy API token (authentication key for all API calls)

Step 3: IP WHITELIST
├─ Request IP whitelist via @gamblerworkmain or @lord_gamb
└─ Provide: Operator's VPN IP address (mandatory per wiki)

Step 4: BOT DOWNLOAD
├─ Visit @gambler_tech channel
├─ Download Discord token stealer source code
├─ Download automated DM spam bot
└─ Download WebSocket client library

Step 5: CAMPAIGN DEPLOYMENT
├─ Execute token stealer (distribute via game installers/extensions)
├─ Monitor WebSocket for newDeposit events
├─ Harvest target contacts' Discord tokens
└─ Launch automated DM campaigns to victim contact lists

Step 6: REAL-TIME MONITORING
├─ Connect to WebSocket: wss://gambler-partners.is/api/ws?token=Worker_{token}
├─ Listen for events: newDeposit (victim funded), newDrain (funds moved)
├─ Gamification: Leaderboard of top operators by deposit volume
└─ Commission tracked in real-time dashboard

Step 7: PAYOUT
├─ 50-70% of verified victim deposits credited to operator account
├─ Insurance guarantee: 50% minimum payout (hedge against fraud)
└─ Monthly settlement via VASP (Sher888, Georgia-based)

Money-Laundering Flow

Victim Deposit (duetux.com, 17-chain crypto)
    ↓
Primary Collector Wallet (TE51Enb6DZWuDQ8EF4imJT1R - Tron USDT)
    ↓
Consolidation Phase (~200+ victims aggregated)
    ↓
Relay/Mixer Wallets (multi-hop through privacy coins if used)
    ↓
Bybit Exchange Deposit (95% of proceeds routed here)
    ↓
Sher888 VASP (Georgia-based, final cash-out point)
    ↓
Bank wire / ACH to operator personal accounts
    ↓
Operator commission payout (50-70% of deposit)

Money Movement Timeline:

• Deposits: Immediate consolidation (minutes)

• Relay: Variable (hours to days depending on circuit load)

• Exchange deposit: Within 24 hours

• VASP settlement: 1-7 business days

• Operator payout: Monthly settlement cycle

4. TECHNICAL CAPABILITIES

Discord Token Stealer Malware

Name: “Projekt Passion” (game installer trojan variant)
Distribution: Game modding sites, browser extension repos
Payload:

1. Hook Discord.exe process
2. Extract session token from AppData/Local/Discord/Local Storage/
3. Exfiltrate to Telegram bot backend
4. Return control to legitimate application (fileless persistence)

Execution: User downloads game installer → runs .exe → token stolen silently

DM Spam Bot

Capability: Automated message distribution
Target: All contacts in victim’s Discord friend list
Payload: Link to duetux.com + promo code CASH
Timing: Deployed within minutes of token theft
Volume: 1,000+ DMs per compromised account

WebSocket Real-Time Tracking

Purpose: Live operator gamification + event notification
Events Tracked:

• newDeposit — Victim sent crypto to collector wallet

• newDrain — Funds consolidated and moved to next stage

• newMessage — Operator-to-victim communication relay

Operational Significance:

• Operators see deposits in real-time (incentivizes continued recruitment)

• Leaderboard competition drives operator volume

• Event timestamps enable pattern analysis (victim behavior prediction)

API Capabilities (Inferred)

Authentication:

POST /api/auth/login
POST /api/auth/register
GET /api/auth/token

Operator Management:

GET /api/operators/profile
GET /api/operators/dashboard
GET /api/operators/statistics
POST /api/operators/whitelist/request

Campaign Management:

GET /api/campaigns/active
POST /api/campaigns/create
GET /api/campaigns/{id}/performance

Wallet Management:

GET /api/wallets/collector
GET /api/wallets/{id}/balance
POST /api/wallets/transfer

Victim Tracking:

GET /api/victims/deposits
GET /api/victims/conversions
GET /api/victims/engagement

Social Media Automation

Instagram Automation:

• Fake celebrity casino page creation

• Automated follower acquisition

• Hashtag targeting to gambling audiences

• DM bot for link distribution

TikTok Automation:

• Video repurposing (testimonial clips + casino gameplay)

• Automated posting to high-engagement accounts

• Deepfake testimony integration (AI-generated victim “success stories”)

• Comment spam with link injection

YouTube Shorts Automation:

• Bot-generated short videos (5-15 seconds)

• Automated upload scheduling

• Algorithmic gaming for “Trending” placement

• Link-in-bio injection

Meta Threads Automation:

• Bulk account creation

• Automated posting across multiple accounts

• Comment/reply spam at scale (”millions” documented in wiki)

• Cross-platform link aggregation

5. FINANCIAL SCOPE

Revenue Estimation

Monthly Victim Count: ~10,000 (conservative estimate based on 1,200 active domains)

Victim Loss Distribution:

• Low-value victims: $100-500 (40% of victims)

• Mid-value victims: $500-2,000 (45% of victims)

• High-value victims: $2,000-4,410 (15% of victims)

• Average per-victim loss: ~$500-750 USD

Monthly Revenue Calculation:

10,000 victims × $500 avg = $5,000,000 USD/month
(Conservative: 10,000 × $250 = $2,500,000 minimum)
Range: $2.5M - $5M USD monthly
Annual estimate: $30-60M USD

Operator Commission Structure

Commission Model:

• Base rate: 50-70% of verified victim deposits

• Insurance guarantee: 50% minimum payout (hedge against fraud claims)

• Performance bonus: Undocumented (likely based on volume/conversion rate)

• Monthly settlement: Via Sher888 VASP

Operator Economics:

• Tier 1 operator (10 victims/month @ $500 avg): $2,500-3,500 monthly

• Tier 2 operator (50 victims/month): $12,500-17,500 monthly

• Tier 3 operator (200 victims/month): $50,000-70,000 monthly

• Top operators: Potentially $100,000+ monthly (depending on cohort size)

Infrastructure Costs

Estimated monthly operational expenses:

• Domain registrations (1,200+ domains @ $0.50-2 avg): ~$1,000

• Cloudflare CDN/DDoS protection: ~$200-500

• VPS/hosting (redundant servers): ~$2,000-5,000

• Telegram bot infrastructure: Negligible

• Cryptocurrency transaction fees (17-chain support): ~$5,000-10,000

• Operator payout processing (Sher888 VASP): ~5-10% fee on settlement

Net monthly profit: ~$2.2M - $4.7M USD (after expenses & operator commission)

6. THREAT ACTOR PROFILE

Geographic Attribution

Likely Origin: Eastern Europe or Southeast Asia

Evidence:

• Russian-language operational documentation (Cyrillic wiki)

• Telegram infrastructure preference (Eastern European adoption pattern)

• Seychelles jurisdiction (offshore crypto haven — common for Russian operators)

• 24/7 operational tempo suggests Eastern European timezone

Suspect countries (ranked by probability):

1. Russia / Former Soviet republics (Cyrillic documentation)

2. Ukraine (cybercriminal hub infrastructure)

3. Romania / Eastern Europe (Seychelles jurisdiction preference)

4. Southeast Asia (secondarily, due to crypto expertise)

Operational Sophistication

High-confidence indicators:

• Multi-domain infrastructure (1,200+ coordinated sites)

• Automated token stealer malware development

• Real-time WebSocket C&C (not script-kiddie level)

• Psychological profiling (victim loss-chasing mechanics documented)

• International VASP integration (money laundering sophistication)

• Multi-chain cryptocurrency support (technical expertise)

• Automated social media deployment (botnet-level ops)

Assessment: Professional organized crime syndicate, not casual fraudsters

Previous Activity

• MrBeast casino variant (Q1-Q2 2026) — Similar scam targeting influencer audiences

• Andrew Tate variant — Fake celebrity endorsement pump-and-dump

• AI deepfake video production — Sophisticated victim testimonial fabrication

• Discord token stealer campaigns (June 2026) — Mass account compromise operations

Operational Security Posture

Strengths:

• Privacy-protected domain registration (Thiago Powell identity likely pseudonym)

• Seychelles jurisdiction (poor law enforcement cooperation)

• Telegram C&C (decentralized, no single point of failure)

• Cloudflare DDoS protection (prevents simple takedowns)

• VPN requirement for operators (prevents IP-based attribution)

• Multi-crypto support (prevents single-chain analysis)

Weaknesses:

• Public wiki exposes internal procedures

• API endpoints likely vulnerable to enumeration

• Operator recruitment creates informant vector

• VASP (Sher888) creates accountability point

• Real-time WebSocket events create forensic fingerprints

• Victims file complaints (enables law enforcement coordination)

Threat Classification

MITRE ATT&CK Mapping:

• Tactic: Resource Development (infrastructure setup)

• Technique: Acquire Infrastructure - Domains

• Tactic: Initial Access (Discord account compromise)

• Technique: Phishing - Spearphishing Link

• Tactic: Execution (malware deployment)

• Technique: User Execution - Malware

• Tactic: Defense Evasion (Cloudflare obfuscation)

• Technique: Proxy - Multi-tier proxy

RACI Assignment:

• Responsible: Unknown syndicate operators (Eastern European-based)

• Accountable: @gamblerwork, @lord_gambler (primary admins)

• Consulted: Sher888 VASP, PublicDomainRegistry, Cloudflare

• Informed: 10,000+ monthly victims

COMPLETE ASSET INVENTORY

Domains

• duetux.com (primary casino, active)

• gambler-partners.is (operator panel, active)

• gambler-panel.com (legacy, dead)

• ~1,197 sister domains (estimated, not individually mapped)

IP Addresses

• 104.21.96.120 (Cloudflare CDN)

• 172.67.180.13 (Cloudflare CDN)

• 2606:4700:3033::6815:6078 (IPv6 CDN)

• 2606:4700:3030::ac43:b40d (IPv6 CDN)

Cryptocurrency Wallets

• Primary collector: TE51Enb6DZWuDQ8EF4imJT1R (Tron USDT TRC20)

• 17-chain support: BTC, ETH, XRP, SOL, TON, TRX, BNB, LTC, USDT, USDC, Monero, others

Telegram Accounts

• @gamblerwork (primary admin)

• @gamblerworkmain (operational control)

• @lord_gambler (tech admin)

• @lord_gamb (tech admin variant)

• @gambler_panel_bot (registration bot)

• @gambler_info (info channel)

• @gambler_tech (bot source repo)

Infrastructure Services

• Registrar: PublicDomainRegistry (PDR)

• CDN/DDoS: Cloudflare (AS13335)

• VASP: Sher888 (Georgia-based, final settlement)

• Exchange: Bybit (95% of proceeds)

• DNS: Cloudflare nameservers

SUMMARY

The Gambler syndicate is a highly organized international cryptocurrency scam operation with:

• 100-500 active operators across multiple jurisdictions

• 1,200+ coordinated domains targeting crypto/gambling audiences

• $2-5M USD monthly revenue (estimated)

• 10,000+ monthly victims (estimated)

• Sophisticated technical infrastructure (token stealer malware, WebSocket C&C, multi-chain crypto)

• Professional operational security (offshore jurisdiction, Telegram C&C, VPN requirement)

• Psychological exploitation (victim loss-chasing mechanics, deepfake testimonials)

Estimated timeline to detection: Already active (June 2026 deployment observed)
Estimated profitability window: 6-18 months before law enforcement takedown
Recommended action: FBI/CISA coordination with Interpol (Eastern European law enforcement)

EVIDENCE SOURCES

1. Wiki sitemap: https://wiki.gambler-partners.is/sitemap.md

2. LLMs dump: https://wiki.gambler-partners.is/llms-full.txt

3. Domain Whois: PublicDomainRegistry (Thiago Powell, Seychelles)

4. WebSocket endpoint: wss://gambler-partners.is/api/ws

5. Tron wallet: TE51Enb6DZWuDQ8EF4imJT1R (blockchain explorer)

6. Telegram admins: @gamblerwork, @lord_gambler (direct observation)

7. Operational flow: Panel registration → API token → IP whitelist → bot deployment

8. Victim communications: Discord scam DMs, casino interface screenshots