# 2026-08-21 - Cyber Terrorism Is Terrorism **This Was Not a Hacked Gmail Account** ![[resources/images/cisa-mobile-guidance-highly-targeted-individuals-2024-12.png]] <iframe width="100%" height="20" scrolling="no" frameborder="no" allow="autoplay; encrypted-media" src="https://w.soundcloud.com/player/?url=https%3A//api.soundcloud.com/tracks/soundcloud%253Atracks%253A2385874800&color=%23ff5500&inverse=false&auto_play=false&show_user=true"></iframe><div style="font-size: 10px; color: #cccccc;line-break: anywhere;word-break: normal;overflow: hidden;white-space: nowrap;text-overflow: ellipsis; font-family: Interstate,Lucida Grande,Lucida Sans Unicode,Lucida Sans,Garuda,Verdana,Tahoma,sans-serif;font-weight: 100;"><a href="https://soundcloud.com/bryantmcgill" title="Bryant McGill" target="_blank" style="color: #cccccc; text-decoration: none;">Bryant McGill</a> · <a href="https://soundcloud.com/bryantmcgill/cyber-terrorism-is-terrorism" title="Cyber Terrorism Is Terrorism" target="_blank" style="color: #cccccc; text-decoration: none;">Cyber Terrorism Is Terrorism</a></div> A partial reconstruction of my handwritten notebooks documents some of the measures I took to study the attack surface, preserve evidence, and attempt recovery and remediation. Begin with [[wiki-cyber-attack/welcome|Welcome — Cyberattack Research and Reconstruction Archive]], which provides a structured route into the reconstructed notebooks and the systems, technologies, institutions, and concepts they contain. ##### This category of attack is treated by the United States government as a matter of **[[wiki/National Security|national security]]**, not consumer inconvenience. In March 2023 the [[wiki/White House|White House]] issued [[wiki/Executive Order 14093|Executive Order 14093]], prohibiting federal operational use of [[wiki/Commercial Spyware|commercial spyware]] that poses risks to national security. The order's stated rationale is worth reading slowly, because it is not written in the language of theft. It identifies the deployment of these tools against **activists, academics, journalists, dissidents, and political figures** for the **purpose of intimidating** them, curbing dissent and political opposition, and constraining freedom of expression, assembly, and association. The operative verb is **intimidate**. Not defraud. Not monetize. Intimidate. The accompanying White House fact sheet characterizes the spread of these capabilities as posing "distinct and growing [[wiki/Counterintelligence Risk|counterintelligence and security risks]]" to the United States, extending explicitly to the safety of government personnel and their families, and notes that the misuse of such tools has not been confined to authoritarian states—democratic governments have confronted the same revelations about actors operating inside their own systems. A year later the [[wiki/United States Department of the Treasury|Treasury Department]] sanctioned members of a commercial spyware consortium for developing and distributing technology used against Americans, a group the designation identified as including government officials, journalists, and policy experts. That is the machinery of [[wiki/Economic Statecraft|economic statecraft]]—the same instrument applied to arms proliferators and terror financiers—deployed on behalf of individual people who were surveilled. Then consider what the government instructs a targeted individual to actually do. In December 2024, following the compromise of American telecommunications infrastructure, [[wiki/Cybersecurity and Infrastructure Security Agency|CISA]] published [[wiki/Mobile Communications Best Practice Guidance|mobile guidance]] addressed to what it terms **[[wiki/Highly Targeted Individuals|highly targeted individuals]]**. Its central instruction reads: **"Highly targeted individuals should assume that all communications between mobile devices—including government and personal devices—and internet services are at risk of interception or manipulation."** That is the federal cybersecurity agency informing a human being that the correct epistemic posture toward his own telephone is **total suspicion**. That category applied to me through access. **Targeting is not assigned by rank. It is assigned by access.** At the relevant time I held a United Nations appointment as a Global Champion and a congressional recognition as an Ambassador of Goodwill, which meant credentialed presence inside secured corridors on occasions like Human Rights Day. My phone therefore carried direct routes to celebrities, elected officials, White House staff, NGO directors, policymakers, journalists, authors, and humanitarian leaders—not institutional switchboards but personal numbers, the kind that get answered. Read that inventory back against Executive Order 14093's own enumeration of who commercial spyware is deployed against: activists, academics, journalists, dissidents, political figures, and members of non-governmental organizations. **My contact list was not adjacent to the published victim taxonomy. It was a superset of it.** Separately, the publishing network I operated recorded more than fifty billion impressions and over a billion engagements across its documented reporting periods, grown without paid promotion—an unmediated distribution channel into an audience larger than most national broadcasters command. The target profile is direct: a credentialed individual with physical access to secured diplomatic environments, a personal contact graph that maps one-to-one onto the acknowledged target profile for commercial intrusion tools, and an owned distribution surface capable of reaching a meaningful fraction of the connected world without asking anyone's permission. Each characteristic independently attracts collection interest. Together they create a high-value target surface. This also reframes the address book. It was not merely something I lost. **It was among the most valuable objects I owned**, and not to me. And the [[wiki/Federal Bureau of Investigation|FBI]], which files this conduct under **[[wiki/Transnational Repression|transnational repression]]**, defines it as a foreign nation breaching borders "by physical or digital means" to silence, coerce, or threaten—placing hacking, stalking, assault, and abduction inside a single continuous category, because the Bureau understands them as varying implementations of one objective. The tactics it enumerates run from cyberhacking through stalking and attempted kidnapping to threats against a target's family and friends. Most importantly, the Bureau names the structural feature that makes this terrorism rather than crime: the injury does not terminate at the target. It states that even people who were never targeted are left afraid to express themselves, and that this produced silence is the actual objective of the campaign. Read that formulation against any standard definition of terrorism and the isomorphism is exact. **Violence is applied to a particular body in order to produce an effect in every body watching.** The bomb is not aimed at the person it kills; the person it kills is the medium through which the act addresses everyone else. That is precisely the structure the Bureau describes, and it is precisely what occurs when a person of any public consequence is dismantled in view of an audience: the demonstration is the product, and the target is the instrument. So the vocabulary exists. Counterintelligence risk. Repression. Intimidation. Sanctions. National security. That is how the government speaks about attacks on individuals when it speaks in its own voice, and that is the register in which any of this becomes intelligible. And when a person to whom it happened tries to speak, he is asked whether he tried a different password. The distance between those two vocabularies is the subject of everything that follows. --- The mistake begins with the word **hacking**. Most people hear it and reach for the nearest experience their lives have given them: somebody stole their credit-card number at a restaurant, their Facebook password was reset, their Gmail account behaved strangely, their bank froze a card and mailed another one. It is understandable that they do this. Human beings comprehend unfamiliar catastrophes by mapping them onto familiar ones. But the analogy collapses almost immediately. **A compromised Gmail account is an incident. A sustained attack across identity, finance, communications, devices, archives, business infrastructure, relationships, reputation, and the mechanisms by which a person proves who they are is an attack on continuity itself.** Imagine that instead of being an individual, you run a substantial regional company. You arrive Monday morning and discover that every computer in the building is gone. Not turned off. Gone. The servers are gone. The accounting system is gone. Payroll is inaccessible. The customer database is gone. The passwords do not work. The bank accounts are inaccessible. The phones cannot be trusted. The corporate email system has been penetrated. Your backups are compromised. Your historical records have disappeared. Contracts, photographs, correspondence, intellectual property, personnel records, tax documents, source code, research, passwords, authentication records, and decades of institutional memory have been scattered, deleted, corrupted, stolen, or rendered suspect. Now make it worse. The building is still standing, so everyone looking from the outside assumes the company still exists. That distinction matters enormously. A fire announces itself. A hurricane leaves wreckage. A bomb creates a crater. Cyber destruction can leave the victim sitting in an apparently normal room surrounded by apparently normal machines while **the operational reality underneath the visible world has been annihilated**. There may be no smoke, ambulance, police tape, or collapsed roof to provide observers with the visual grammar by which human beings recognize catastrophe. The devastation exists inside authentication systems, databases, social graphs, archives, administrative permissions, financial relationships, cryptographic credentials, search results, communications histories, and institutional dependencies. To someone who has never administered infrastructure, it can look absurdly intangible. To the person responsible for rebuilding it, it is civilization after the library burned. I had never lived merely as a consumer of a Gmail account. I had operated businesses, information systems, publishing systems, enormous personal and professional archives, websites, intellectual property, commercial relationships, communications networks, and decades of accumulated digital history. I had an [[wiki/Information Estate|information estate]] whose scale was closer to that of a small enterprise than an ordinary household. At one point the corpus represented **roughly one hundred million files accumulated across decades**. Those files were not simply photographs and documents. They were memory, provenance, evidence, correspondence, creative history, business history, technical history, relationships, authorship, research, accounting, identity, and the connective tissue required to reconstruct everything else. That is what people miss when they say, "So somebody hacked your Gmail?" Nobody hacked my Gmail. Gmail has nothing to do with any of this. It is not a smaller version of the story, it is not the entry point to the story, and it is not an ingredient in the story. It is simply the picture that appears in a mind that has never had occasion to hold anything larger. Say **[[wiki/Cyber Terrorism|cyber terrorism]]** and it arrives as *hacked*. Say **[[wiki/Identity Theft|identity theft]]** and it still arrives as *hacked*. And *hacked* renders, in almost everyone, as a login screen and a password reset, because a login screen and a password reset are the only specimens of the category their life has ever issued them. The word is doing what words do—retrieving the nearest available instance—and the nearest available instance is off by so many orders of magnitude that it functions as misinformation. What happened was something else entirely. Six years later, after an extraordinary amount of continuous reconstruction, my password manager presently contains **1,737 accounts and credentials, with 856 still carrying security warnings or compromise-related problems**. That number sounds dramatic until one understands that account remediation is among the most mechanical parts of the recovery. Passwords can sometimes be changed. Domains can sometimes be recovered. Machines can sometimes be replaced. Authentication can sometimes be rebuilt. The harder losses are the ones for which there is no reset link. There is no password reset for a dying parent's final communication. There is no backup restore for years lost with children. There is no two-factor authentication code that restores a reputation after millions of people have watched a public catastrophe unfold around it. There is no help-desk ticket that returns employees' livelihoods after a business can no longer support them. People had relocated to Austin for that work. They had leases, families, and futures organized around an assumption of institutional stability that I could no longer honor. Telling them was, on any ordinary scale of human difficulty, a devastating thing to do. On the scale I was actually operating within, it was among the smaller items on the list—and that ordering is itself the measurement. In any other life, uprooting the people who moved across the country to work for you would be the defining catastrophe of a career. Here it ranks below the items above it. There is no cloud restore that recreates the exact informational environment from which a life, company, community, and identity developed over decades. --- This is where the word **[[wiki/Terrorism|terror]]** becomes important—not theatrically, but mechanically. Terror is not merely damage. It is the manipulation of expectation. It is teaching someone that every ordinary object in the environment may contain an adversary. The phone becomes suspect. The laptop becomes suspect. The email becomes suspect. Authentication messages become suspect. Software updates become suspect. A strange battery drain becomes meaningful. A disconnected call becomes meaningful. A login alert becomes meaningful. A malfunctioning device becomes meaningful. A message that does not arrive becomes meaningful. Silence itself becomes information. That is psychologically different from fraud. Fraud wants the money. [[wiki/Surveillance|Surveillance]] wants the person. Extortion wants leverage over the person. [[wiki/Cyber Sabotage|Sabotage]] wants the person's systems to fail. Terror wants the person to understand that the boundary between private life and adversarial access may no longer be reliable. Extortion would have been wonderful by comparison, because then at least I would have known what they wanted. Extortion makes a demand. Terrorism just wants you to be terrified. And [[wiki/Cyber Extortion|extortion]], when it arrives, arrives with a specific grammar. It is not a transaction. It is a demonstration that the adversary has been in places you believed were yours, has assembled a portrait of your life out of material you never consented to surrender, and is now inviting you to negotiate with a version of yourself that they curated. The threat is not merely that something will be published. The threat is that **the adversary now holds [[wiki/Narrative Authority|narrative authority]] over your biography** and can release it in whatever configuration serves them, at whatever moment causes maximum structural damage. There is no reasonable posture available. Compliance concedes the principle. Refusal concedes the timeline. Either way you have been made a participant in your own dismantling. This is why I have sent people documentaries and reporting about systems such as **[[wiki/Pegasus Spyware|Pegasus]]**, and why I have pointed repeatedly to journalists, human-rights workers, political figures, dissidents, attorneys, executives, and other consequential individuals who have been targeted by sophisticated surveillance capabilities. Those cases provide the vocabulary for an entire universe of computer intrusion radically beyond the consumer imagination of a stolen password—an operational tier in which the target is not an account but a **human being's entire behavioral, relational, and informational surface**, and in which the objective is not acquisition but degradation. The timing made this even stranger. The period in which my own systems were collapsing coincided with an era in which governments, hospitals, school systems, corporations, infrastructure operators, technology companies, and public institutions were themselves being hit by extraordinary waves of intrusion, [[wiki/Ransomware|ransomware]], [[wiki/Supply Chain Compromise|supply-chain compromise]], data theft, and [[wiki/Advanced Persistent Threat|persistent adversarial operations]]. Every week seemed to bring another organization onto the news explaining that systems had been penetrated that everyone had previously assumed were secure. Federal agencies were disclosing breaches they could not fully characterize. Entire security departments staffed by professionals with enormous budgets, classified threat intelligence, incident-response retainers, and legal cover were fighting—and frequently losing—for control of their own networks. The scale was measurable. By September 30, 2023, the [[wiki/Identity Theft Resource Center|Identity Theft Resource Center]] had tracked **2,116 publicly reported data compromises in the United States affecting an estimated 233,935,731 victims**—roughly 234 million people. By year-end, the total had reached **3,205 compromises affecting an estimated 353,027,892 victims**. These were victim counts from reported compromises, not a count of uniquely compromised devices, and people affected more than once could appear more than once. Even with that limitation, the numbers describe a national environment saturated with breached identities, exposed records, compromised organizations, and successful cyberattacks. It is worth reconstructing that period concretely, because most people lived through it as ambient noise rather than as a sequence, and the sequence is the argument. In July 2020, attackers seized control of the Twitter accounts of a former president, a sitting presidential nominee, and several of the wealthiest people alive, and posted from them—an event that established, in a single afternoon, that the accounts of the most prominent individuals on earth could be taken by force. That autumn, a hospital network operating hundreds of American facilities was knocked into paper charting by ransomware, and school districts across the country cancelled instruction because their systems had been encrypted. In December 2020 the [[wiki/SolarWinds Compromise|SolarWinds compromise]] surfaced, in which a trusted software update had been weaponized to reach the Treasury, Commerce, State, Energy, and Homeland Security departments among roughly eighteen thousand downstream customers, and which the government later attributed to Russian foreign intelligence. Three months later, the Microsoft Exchange vulnerabilities attributed to Chinese state actors exposed tens of thousands of mail servers at once, prompting a second emergency directive in ninety days. Then it accelerated. In February 2021 an intruder manipulated the chemical dosing controls at a Florida water treatment facility. In May, a ransomware crew shut down the largest fuel pipeline on the East Coast and produced gasoline shortages across multiple states; that same month, Ireland's national health service was crippled, and weeks later one of the world's largest meat processors halted production. In July, the Kaseya supply-chain attack propagated ransomware through managed service providers into roughly fifteen hundred businesses in a single stroke. That same month, an international journalism consortium published the Pegasus Project, documenting a list of tens of thousands of phone numbers associated with potential targeting—heads of state, ministers, executives, human-rights defenders, attorneys, and journalists, including reporters whose colleagues had been murdered. By November the Commerce Department had placed the vendor on the Entity List. In December, the [[wiki/Log4j|Log4j vulnerability]] appeared in effectively every enterprise Java stack on the planet, and the head of CISA described it publicly as among the most serious she had encountered in her career. That is a compressed and radically incomplete list containing only incidents that made national news. Read it as a single paragraph rather than as headlines separated by weeks, and a different picture emerges: **this was not a series of unfortunate events but a sustained period in which the assumption of digital security failed simultaneously across government, medicine, education, energy, food, finance, and journalism.** Those were the conditions on the ground. My own catastrophe occurred inside that weather. By 2023, system penetration was not improbable; it was ambient. The difference is that the pipeline company had a crisis team, the hospital network had counsel and cyber insurance, and the federal departments had the [[wiki/National Security Agency|National Security Agency]]. And I was one person. That asymmetry remains one of the hardest parts to communicate. **Enterprise-scale problems do not magically become consumer-scale problems because the enterprise happens to belong to one human being.** An individual can possess decades of business infrastructure, intellectual property, servers, archives, accounts, websites, credentials, financial systems, correspondence, media, customer relationships, and institutional history. The adversary does not care whether the organizational boundary ends around a corporation or around a person. Complexity is complexity. [[wiki/Attack Surface|Attack surface]] is attack surface. Dependencies are dependencies. The difference is that the corporation has a security team, a general counsel, a cyber-insurance policy, a communications department, a board that understands the vocabulary, and a federal agency that will return its phone call. The individual has himself, at three in the morning, deciding whether the recovery email he is about to use is clean. If Nabisco lost its servers, accounting systems, historical archives, credentials, communications, employee access, customer records, intellectual property, banking relationships, and backups simultaneously, no serious observer would describe the event as "Nabisco got hacked." They would speak about **[[wiki/Operational Continuity|business continuity]], [[wiki/Incident Response|incident response]], [[wiki/Disaster Recovery|disaster recovery]], [[wiki/Digital Forensics|forensic reconstruction]], [[wiki/Operational Security|operational security]], financial exposure, identity infrastructure, supply-chain damage, legal liability, intelligence collection, extortion, and institutional survival**. A human being can suffer the same topology of destruction. The only thing that changes is that nobody convenes a war room. Nobody convenes anything. **There is no response mechanism.** I went looking. There is nowhere to go. Consider what exists for every other category of catastrophe. A fire summons a fire department, an insurance adjuster, and a claim number attached to a payout schedule. A flood can trigger a federal disaster declaration, and with it grants, loans, temporary housing, and personnel who physically arrive. A violent crime produces a detective, an evidence technician, a case file, and a victim-services office with a statutory mandate. Every one of these is a **designated responder**: a named entity whose job is to come to where the damage is and begin repair. The entire architecture of modern civil life assumes that catastrophe is met by someone whose profession is meeting it. For an individual under sustained digital attack, that architecture simply does not exist. There is no repair crew. There is no adjuster. There is no fund. Nobody is dispatched, because there is no dispatcher and no unit to dispatch. What exists instead is an **intake form**. The FBI's [[wiki/Internet Crime Complaint Center|Internet Crime Complaint Center]] is the designated national reporting channel, and it is worth understanding precisely what it is designed to do, because the design is not concealed—the Bureau publishes it. IC3 aggregates related complaints in order to build referrals, which are then forwarded to local, state, federal, and international agencies for *potential* investigation. Its own site states plainly that because of the volume of complaints received each year, it cannot respond directly to every submission. And the volume is not marginal: across recent years the center has averaged more than two thousand complaints every single day, against annual reported losses in the billions. That is not a failure of will. It is arithmetic. **A referral pipeline is not a response capability**, and no honest reading of the published design suggests otherwise. The shortfall is also structural at the local level. A municipal police department is organized around jurisdiction, physical evidence, and local perpetrators. An intrusion routed through infrastructure in multiple countries, executed against cloud tenancies domiciled who-knows-where, using techniques that require forensic tooling and specialist analysts to even characterize, is outside the practical reach of nearly every local agency in the country because **the crime does not fit inside the container built to hold crimes**. There is no scene to secure. There is no perimeter. There is nothing to photograph. And then there is the timing, which converts an ordinary institutional gap into something closer to absurdity. During the exact window in which my systems were being taken apart, the federal government was managing intrusions into its own networks so severe that agencies were **formally ordered to disconnect and power down** affected infrastructure. ![[resources/images/cisa-emergenc-directive-2020-powerdown.png]] Sit with that image for a moment, because it is the correct frame for everything else in this essay. The United States federal government—with its classified collection, its appropriated budgets, its standing incident-response contracts, its cleared analysts, and its authority to compel—concluded that its best available option was to pull the plug on its own machines. Now consider the position of one person with none of that: no budget, no analysts, no threat intelligence, no contracts, no authority, no agency behind him, and nobody coming. If that apparatus was reduced to powering down, **imagine the degree of helplessness available to a single individual with no support whatsoever**. Whatever the reader is picturing is not severe enough. Departments with classified threat intelligence, dedicated incident-response contracts, and appropriated budgets were unable to establish what had been done to them or by whom. **The institutions one is supposed to report to were themselves the news story.** National-security equities and critical infrastructure receive the capacity. The individual receives a confirmation number. So the observation from earlier acquires a second and more literal meaning. It is not merely that the catastrophe has no visual grammar by which observers recognize it. It is that **the catastrophe has no institutional grammar either**—no adjuster, no declaration, no unit, no docket that leads anywhere. The practical consequence is operational: you are on your own, entirely, and the reconstruction is yours to perform alone against an adversary who may still be inside it. --- There is another difference people rarely understand: after an ordinary theft, the event ends. Someone steals the television; the television is gone. Insurance replaces it and the household reorganizes around the loss. A sophisticated digital intrusion can behave differently because **the attacker may remain inside the reconstruction process itself**. Every attempt to rebuild has to answer a recursive question: *Am I rebuilding from something trustworthy?* Is the backup clean? Is the recovery email clean? Is the device clean? Is the administrator account clean? Is the DNS clean? Is the cloud account clean? Is the phone number clean? Is the password manager clean? Is the person contacting support actually support? Which piece of the old infrastructure can safely become the foundation of the new one? That is an [[wiki/Epistemological Attack|epistemological attack]] as much as a technical one. **The victim loses not only data but confidence in the mechanisms used to determine what is true.** And the reconstruction is not attacked once. It is attacked as a practice. My address book—the contacts on the computer and the contacts on the phone—was deleted well over a hundred times. Not corrupted once and restored. Deleted, restored, deleted, restored, across years. My Dropbox was destroyed four separate times, in sequence, in concert with the local drives that were supposed to be the redundancy for it. Anyone who has ever designed a backup architecture will recognize immediately what that means: **the attack was not against the data but against the [[wiki/Recovery Topology|topology of recovery]]**, against the very idea that a second copy constitutes safety. Two things follow from that, and the second is the one nobody anticipates. The first is the destruction of the **[[wiki/Social Graph|social graph]]**, which is a category of loss almost no one thinks about until it is gone. An address book is not a convenience. It is the routing table for a human life—the accumulated ability to reach the exact person who can vouch for you, corroborate a date, remember a contract, confirm an identity, or simply answer when you call at the worst hour of the worst year. Erasing it does not merely inconvenience someone; it **severs the target from the population that could have helped him**, and it does so at precisely the moment when he most needs corroboration and least has the capacity to rebuild the index. Combine that with the suspicion described above—where the surviving contacts cannot be trusted to be who they appear to be—and the isolation is not merely achieved. It is achieved twice, by two independent mechanisms, one technical and one psychological, each reinforcing the other. The second is what repetition itself does to a person. A single catastrophic loss is an event; you grieve it and you rebuild. **A hundred iterations of the same loss is not an event but a curriculum.** It teaches, with the patience and consistency of any effective training regime, that reconstruction is futile—that effort does not produce durable results, that nothing you build stays built, that the relationship between labor and outcome has been severed. Behavioral science has a precise term for the state produced by [[wiki/Learned Helplessness|inescapable, non-contingent adversity]]. **Iterated destruction is not inefficiency on the attacker's part. It is the method.** One deletion takes your data. A hundred deletions take your belief that action matters, which is a far more valuable asset and considerably harder to restore. And that same corrosion does not stay inside the machines. It propagates outward into the social field, and this is the part almost nobody anticipates, including the person it happens to. When you are successful, you appear to be surrounded. There are collaborators, associates, admirers, partners, employees, correspondents, and a large ambient population of people who seem to constitute a community. What is actually happening is that **success functions as a coordination signal**, and a great deal of what looks like relationship is really proximity to trajectory. When the trajectory inverts, the population thins with a speed that is genuinely difficult to describe to anyone who has not watched it, and you learn in the crudest available manner which attachments were to you and which were to the resources moving through you. Few people ever have occasion to run that experiment. But then the second mechanism arrives, and it is far worse, because it is not sociological. It is tactical. When you are under sustained attack, and the attack propagates through communications channels, devices, accounts, and the people connected to you, **you can no longer distinguish between a friend, a compromised friend, an impersonated friend, and an approach**. A message arrives that sounds slightly wrong. A person you have known for years asks a question that lands strangely. Someone offers help at a moment so precisely calibrated that the timing itself becomes evidence. You have no forensic capacity to resolve any of it, and every resolution you attempt requires trusting some channel that you have already learned cannot be trusted. Suspicion metastasizes because **it is the only rational epistemic posture available inside an adversarial environment that has already demonstrated it can imitate the people you love**. The only functional coping mechanism, in the short term, is to raise a firewall against everyone. And that firewall works. That is the terrible part. It genuinely reduces attack surface. It genuinely limits exposure. And it simultaneously severs you from the exact resource that human beings require in order to survive catastrophe, which is other human beings. **The defensive measure and the injury are the same act.** You amputate the community in order to protect what remains, and the thing you were protecting begins to die of the amputation. Isolation from community in the middle of an ongoing attack changes the disaster itself. Every disaster protocol humans have ever devised—every one, across every culture—assumes a surrounding social body: neighbors who dig, relatives who house you, congregations that feed you, colleagues who cover for you, friends who sit with you. Cyber terrorism is nearly unique among catastrophes in that **it degrades the [[wiki/Social Immune System|social immune system]] as a direct operational effect**, not as a side consequence. It isolates the target and then attacks the isolated target, and the isolation is not a byproduct of the attack. It is one of its deliverables. --- Which brings me to the question that no insurer, no court, no actuary, and no well-meaning acquaintance has ever been able to answer, and which I have stopped expecting anyone to answer: **what is the line item?** Every compensatory system humanity has built requires a denominator. Name the loss, price the loss, restore the loss. That machinery works for a stolen vehicle and disintegrates entirely at this scale, because the destruction propagates through domains that have no unit of account. What is the repair cost when the person you built a life with begins drinking under the weight of a catastrophe neither of you can stop, and the drinking becomes its own weather system, and the household reorganizes itself around instability that arrived from outside and then took up residence inside? Sustained terror does things to people. It does them to the target and it does them to everyone standing near the target, and the people standing nearest absorb a version of the attack that nobody ever counts, because **the secondary casualties of an attack on a person are the people who love that person**. But the consequences are not mitigated by understanding their cause. The marriage still ends. The children still watch it end. What is the line item for children who will not speak to you? Not gone—which is the specific cruelty of it. Reachable in principle. Unreachable in fact. Every single day. For years. There is no restitution schedule for that. There is no filing. There is no policy rider. There is nothing on any form anywhere in the developed world that captures the difference between a father who lost his children and a father whose children are alive and well and located and simply will not answer. What is the line item for a **credit score of 500 sustained across six years**? People treat credit as an inconvenience, a number affecting interest rates. It is not that. It is an **[[wiki/Administrative Caste Assignment|administrative caste assignment]]**. It governs where you may live, what you may rent, what employment you may obtain, what insurance you may purchase, what vehicle you may operate, and whether any institution will permit you to sign anything at all. A destroyed credit profile does not reduce your purchasing power; it demotes you to a **legal category of person** whose participation in ordinary economic life requires permission that is systematically withheld. And the entire mechanism is retrospective and automatic: it does not know why the number moved, cannot be told, and would not care. What is the line item for a year without a working computer, when every machine you touch is bricked on power-up, and you are a technologist? A year without a phone, when your professional existence and your public voice are both constituted through networked communication? People hear that and register inconvenience. It is not inconvenience. It is **occupational decapitation**. It is the surgeon's hands, the pianist's hands, the singer's larynx. My instruments and my archive and my income and my audience and my identity were all the same object, and that object was removed for a year while the world kept moving, and attention infrastructure punishes absence with a totality that no other market does. Nobody wonders where you went. The feed closes over the space where you were, instantly and without residue. And there is a class of asset here that has no replacement cost because it has no replacement mechanism. A website of mine that was taken down carried roughly **ten thousand pages of content developed across ten years**. The pages themselves are the smallest part of that loss and the only part anyone thinks about. What actually disappeared was a decade of accrued **authority**—the citations, the inbound links, the index position, the search ranking, the compounding trust that a domain earns from the rest of the web slowly and can never purchase, accelerate, or petition for. You cannot rebuild that with money, effort, or talent, because the input it consumes is not any of those. It consumes **time in continuous good standing**, and continuous good standing is exactly the commodity that was destroyed. Rewriting ten thousand pages would take another decade; it would not restore the position, because the position was never a function of the pages. It was a function of ten years of uninterrupted presence, and the interruption is now a permanent feature of the record. Sit with the scale of that interruption, because it is the detail that makes the rest of this legible. **I did not have a working website for three years.** Not a degraded website. Not a slow one. None. A person whose entire professional existence was publication, whose readership was measured against the largest properties on the internet, was simply absent from the web for three consecutive years—and what finally went up, in 2023, was a **Blogger**. A free hosted blog on somebody else's platform. The decision was correct and I would make it again. When you cannot trust your own stack, cannot trust your own credentials, cannot trust your own devices, and do not possess the resources to defend a perimeter, **the rational move is to stop maintaining a perimeter and take shelter inside someone else's**. You give up sovereignty in exchange for a security budget you could never fund yourself. That is [[wiki/Threat Modeling|threat modeling]], and it is the same calculation that drives sovereign nations into alliances. The sequence contains the whole event in miniature: a man who operated an enterprise-scale publishing infrastructure across a decade goes dark for three years and reappears on a free blog. Everything that made the first condition possible had to be destroyed for the second condition to become the only available option. There is a reason 2023 is the year anything went up at all. Across March and April of that year, the intrusions stopped. Not tapered into ambiguity, not reduced to a manageable background rate—stopped, over a period of weeks, and did not resume. The address book stopped emptying itself. Machines powered on and stayed on and did what they were built to do. Ordinary function returned, which after that long registers not as relief but as disorientation, because normal behavior had itself become anomalous. The cessation is the single most analytically loaded detail in this account. It identifies no actor. It does identify **what kind of thing this was**. Opportunistic crime does not conclude; it exhausts. A financially motivated intruder leaves when the extractable value is gone, and he leaves at the moment the last account is drained, not on a schedule. Independent criminals operating against the same target do not coordinate a simultaneous withdrawal. What ends cleanly, across a defined window, after years of sustained pressure, and without the target having done anything to cause it, is not a crime wave burning itself out. **It is a campaign concluding.** Campaigns have beginnings and ends because campaigns have direction. And note what did not happen in those weeks. There was no event whatsoever on my side of the ledger—nothing I did, nothing anyone did for me. Something changed somewhere. The pressure was there and then it was not, and the first I knew of any decision was its absence. That is the final and most complete demonstration of the asymmetry this essay has been describing: it began without my knowledge, continued without my consent, and ended without my participation. I was never a party to any of it. I was the terrain it was conducted on. But the cessation of an attack is not the cessation of its effects, and this is where the analogy to ordinary crime fails most completely. When a burglary ends, the harm ends with it and only the replacement remains. When this ended, the credit score was still five hundred and stayed there for years. The estrangements did not reverse. The dead did not return, nor did the will, nor did the goodbye. Eight hundred and fifty-six credentials still carry compromise flags today. **The operation stopped in 2023 and the damage did not, because the damage was never the operation—it was the product.** And then—because material stability is downstream of economic stability, which was downstream of everything already described—the physical world goes as well. Housing. Possessions. The inheritance. The keepsakes. **The journals I had kept since childhood**, decades of handwritten interiority, the only primary source that ever existed for my own early life, unrecoverable in a way no drive is unrecoverable, because there was exactly one copy and it was made of paper. The family photographs. The objects that carry provenance for a human being—the things that testify, in a way testimony cannot, that a particular childhood happened to a particular person. Notice the symmetry, because it is the whole point. The ordinary analogy for total material loss is a house fire, and the ordinary analogy for total informational loss is a catastrophic drive failure, and **each of those is survivable largely because the other estate remains intact**. The family that loses the house still has the cloud. The man who loses the drive still has the shoebox in the closet at his mother's house. Both estates were destroyed here, and the second was destroyed *by* the first: the digital attack produced the financial collapse, the financial collapse produced the material dispersal, and the material dispersal consumed the physical redundancy that would otherwise have been the backup for everything the machines had taken. There is no accounting instrument that reconciles that. There never has been. The absence of the instrument is itself evidence of how far outside the recognized taxonomy of harm this sits. --- One event makes the word *terrorism* non-negotiable for me. My mother and I had a long and difficult history. There was harm in my childhood, and there were years of adult work between us afterward—slow, imperfect, mutual work—directed at one specific outcome. I wanted her to be able to die at peace. That was the entire project. Not resolution for me. Peace for her. Whatever had happened, I did not want the last chapter of her life to be governed by it, and by the end we had gotten much closer to that than either of us had any right to expect. When she was dying, she wrote to tell me she had approximately thirty days left. Those messages were deleted before I saw them. She died believing that I had abandoned her on her deathbed. The day before she died, on morphine, she rewrote the will—the only will that had existed my entire life, the one whose location she had recited to me in nearly every conversation we ever had, as if the recitation itself were a form of continuity between us. Motive is a question for people who were not there. It changes nothing about what the act was or what the act did. **Deleting a dying woman's final messages to her son does not acquire money, does not exfiltrate intellectual property, does not gain persistence on a network, and does not create a monetizable asset.** It has no acquisitive function whatsoever. Its only possible yield is the destruction of a specific human being's capacity to bear his own life. It is not theft. It targets the one thing in a person that cannot be reconstructed from backups—the reconciliation between a parent and a child at the exact hour when reconciliation is still possible and never will be again. That is the operational signature of terrorism. Not the acquisition of value, but **the production of suffering as the objective itself**. Terrorism does not bomb a market because it wants the market. It bombs the market because it wants everyone who ever walks through a market again to feel what they now feel. The cyber equivalent does not delete the messages because it wants the messages. It deletes them so that every future moment of grief, every anniversary, every memory of that woman, is permanently routed through an injury that can never be repaired, corrected, explained, or apologized for—because the person to whom the apology is owed is dead, and she died holding the wrong story. They do these things to break you. That is what the technique is for. That is why it is terrorism. --- And then comes the strangest injury of all: trying to explain it. People understandably compress the story until it fits inside something they already know. "My credit card got stolen once." "Somebody hacked my Facebook." "I had to reset my Gmail." They are not necessarily being cruel. They are searching their own experience for an analogy and discovering that their experience contains nothing of the necessary scale. Worse, the absence of visible injury denies the survivor the social category of survivor. **There is no hospital bed. There is no full body cast. There is no visual evidence that anything happened at all**, and human beings extend the status of victim almost entirely on the basis of legible physical damage. A man who walks away from a bombing without a scratch is still understood to have survived a bombing. A man whose entire informational existence was systematically dismantled over years is asked whether he tried a different password. So perhaps the clearest explanation is this. Imagine losing your wallet. Then imagine losing the bank. Then the filing cabinet. Then the office. Then the warehouse. Then the library. Then the photographs. Then the correspondence. Then the keys. Then every copy of the keys. Then the records proving which keys were yours. Then the people you employed. Then your ability to contact the people who knew you before it happened. Then your ability to prove to strangers that the person standing in front of them is the same person described by the records that disappeared. And if that ladder still has not communicated anything, then run the **simulation** in full, because every partial version of it is survivable and the whole point is that the composite is not. Burn your house down. All of it. Not a room. The structure, the contents, the garage, the boxes in the attic, the photographs, the journals you kept as a child, the letters, the objects your grandmother left you, the things you would have handed to your own children. Total. Now, on the same day, dismantle your entire digital existence—every account, every archive, every credential, every backup, every device, every proof that any of it was ever yours—so that the redundancy which would ordinarily have made the fire survivable does not exist. Now, on the same day, remove your income, your profession, your instruments, your public voice, and your credit, and hold them removed for years, so that no reconstruction is possible from any direction. Now, on the same day, put your mother, your children, and the person you love most on the same aircraft, and crash it. The plane makes **the shape of the subtraction** perceptible. It conveys simultaneity, which is the entire mechanism—any one of those losses is a thing human beings are built to survive, and survival is always accomplished by leaning on the others. The plane removes the leaning. And the difference between the metaphor and my actual circumstance runs in the wrong direction, because the people on my plane are alive: reachable in principle, unreachable in fact, permanently, with the further refinement that one of them died holding a false account of who I was. Now add the last condition, the one that has no analogue in any natural disaster: while you are standing in the ashes, you cannot determine who did it, you cannot determine whether it is finished, and you cannot determine which of the people offering to help you is part of it. So you wall them all off, and you finish the destruction yourself, with your own hands, correctly, because it is the only defensible thing to do. What remains, at the end of that, is a pedestrian with bad credit. And now do all of it during lockdown. Millions of people have told us honestly that the isolation of that period was among the hardest things they have endured, and they were enduring it with their photographs intact, their families reachable, their accounts working, their money where they left it, and nothing whatsoever pursuing them. That was the *baseline* difficulty—the version with no catastrophe in it. Now run the reconstruction on top of it, under conditions where the offices are closed, the branches are shut, the courts are dark, nobody will meet you in a room, and every remaining channel through which a life can be repaired has been routed into the exact medium that has been compromised. There was no walking into a bank with documents. There was no sitting across a desk from anyone. The only available instrument for rebuilding was the instrument that had been turned against me. And the isolation I described earlier—the firewall raised against everyone because nobody could be verified—drew no attention at all, because the entire world was doing the same thing for unrelated reasons. My condition was perfectly camouflaged by the general condition. Nobody noticed a man who had stopped answering, because nobody was answering. **That is a different category of experience.** --- Six years later I am still rebuilding. I am rebuilding accounts, archives, systems, chronology, provenance, technical history, professional history, relationships, intellectual property, photographs, writings, infrastructure, and the documentary continuity of a human life. Some of it is returning. Some of it will never return. And the strangest thing about the entire process may be that the visible reconstruction—the websites, books, accounts, files, credentials—is still easier than reconstructing the invisible thing that such an attack damages: the assumption that tomorrow will be connected to yesterday in approximately the way one expects. Most people have never had to think about that assumption because their lives have never forced them to. They wake up and yesterday is still there. Their photographs are still there. Their contacts are still there. Their bank recognizes them. Their children can reach them. Their mother can leave a message. Their business records exist. Their passwords work. Their history remains attached to their name. Their friends know where to find them. Their documents establish continuity between the person they were and the person they are. That continuity feels natural only because it has never disappeared. **Cyber terrorism, at its most devastating, is not the theft of information. It is the [[wiki/Weaponization of Discontinuity|weaponization of discontinuity]].** Once that distinction is understood, "somebody hacked your Gmail" no longer sounds like an explanation. It sounds like describing a city after an earthquake by saying that one of the lightbulbs broke. --- I wrote the following on June 15, 2022, reflecting on the loss that occurred on Christmas Day, 2020, while I was still in the middle of the larger ordeal. It contains no computers, no accounts, no credentials, and no vocabulary from any of the preceding pages, which is the reason I am placing it here rather than paraphrasing what it does. The register is **total subtraction**—not the loss of particular things but the loss of the categories that particular things belong to, including the instruments by which loss itself would ordinarily be assessed. And the last thing taken is the language. That is the whole argument of this essay arriving in poetic form four years before I could state it analytically: what an attack of this kind removes, finally, is not the possessions or the records or the people, but **the words that would have made any of it sayable**—including the one word owed to a dying woman who never received it. ![[resources/images/untitled-2022-06-15.png]] [[journal/2022-06-15 - Untitled|Untitled]] — written June 15, 2022; reflecting on December 25, 2020 > Someone took all the stars out of the sky > They took the moon and all its light > They took the good things; the bad things too > Then from the well; the last water they drew > > They took the color from all the flowers > We loved to look at for hours and hours > They took all the ART from every wall > They took both places—to stand or fall > > They took things we never knew existed > They took what was straight and bent and twisted > They took the small things, and the large things too > They took all the lies; but also, the truths… > > They took our good deeds and our sins > And all the hiding places deep within > They took our steady loving stare > And left our full hands empty and bare > > They took every simple thing we treasure > And they took the rulers by which to measure, > such loss… > > They took the smiles from a million faces > And put a question in all the sacred places… > There is nothing left, neither low nor high > They even took the proper words to say, “goodbye.” --- ## Related Work Readers who want the institutional and doctrinal map of what was actually happening in that period—rather than one person's account of standing inside it—should read [[articles/Cognitive-Cyber Warfare Measures and Countermeasures|Cognitive-Cyber Warfare: Measures and Countermeasures]]. That analysis traces the migration of conflict from the machine layer to the mind, and it supplies the historical lineage that makes this essay's experience legible as something other than misfortune. In particular it examines **[[wiki/Zersetzung|Zersetzung]]**, the East German doctrine whose name translates as *decomposition*, whose method was not to arrest a target but to make his life harder to understand than to survive—intimate profiling, professional disruption, relationship fracture, deliberate attribution fog, and above all **[[wiki/Concealed Causation|concealed causation]]**, the engineered condition of an unraveling life with no identifiable hand behind it. That is the topology. It has been rebuilt on every substrate since, and what once required a building full of informants can now be approximated from data. --- ## References - [Executive Order 14093, Prohibition on Use by the United States Government of Commercial Spyware That Poses Risks to National Security](https://www.federalregister.gov/documents/2023/03/30/2023-06730/prohibition-on-use-by-the-united-states-government-of-commercial-spyware-that-poses-risks-to) (Federal Register, March 30, 2023) - [FACT SHEET: President Biden Signs Executive Order to Prohibit U.S. Government Use of Commercial Spyware that Poses Risks to National Security](https://bidenwhitehouse.archives.gov/briefing-room/statements-releases/2023/03/27/fact-sheet-president-biden-signs-executive-order-to-prohibit-u-s-government-use-of-commercial-spyware-that-poses-risks-to-national-security) (The White House, March 27, 2023) - [Treasury Sanctions Members of the Intellexa Commercial Spyware Consortium](https://home.treasury.gov/news/press-releases/jy2155) (U.S. Department of the Treasury, March 5, 2024) - [Mobile Communications Best Practice Guidance](https://www.cisa.gov/sites/default/files/2024-12/guidance-mobile-communications-best-practices.pdf) ([[wiki/Cybersecurity and Infrastructure Security Agency|Cybersecurity and Infrastructure Security Agency]], December 18, 2024). The image reproduced below is an excerpt from this guidance. - [CISA Releases Best Practice Guidance for Mobile Communications](https://www.cisa.gov/news-events/alerts/2024/12/18/cisa-releases-best-practice-guidance-mobile-communications) (CISA, December 18, 2024) - [Internet Crime Complaint Center (IC3)](https://www.ic3.gov/) (Federal Bureau of Investigation) - [2020 Internet Crime Report](https://www.ic3.gov/AnnualReport/Reports/2020_IC3Report.pdf) (FBI Internet Crime Complaint Center) - [Q3 2023 Data Breach Analysis](https://www.idtheftcenter.org/wp-content/uploads/2023/10/20231011_Q3-2023-Data-Breach-Analysis.pdf) (Identity Theft Resource Center, October 2023) - [2023 Annual Data Breach Report](https://www.idtheftcenter.org/wp-content/uploads/2024/01/ITRC_2023-Annual-Data-Breach-Report.pdf) (Identity Theft Resource Center, January 2024) - [ED 21-01: Mitigate SolarWinds Orion Code Compromise](https://www.cisa.gov/emergency-directive-21-01) (Cybersecurity and Infrastructure Security Agency, December 13, 2020) - [Alert AA20-352A: Advanced Persistent Threat Compromise of Government Agencies, Critical Infrastructure, and Private Sector Organizations](https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-352a) (CISA, December 17, 2020) - [Transnational Repression](https://www.fbi.gov/investigate/counterintelligence/transnational-repression) (Federal Bureau of Investigation) - [FBI Philadelphia Brings Awareness to Transnational Repression](https://www.fbi.gov/contact-us/field-offices/philadelphia/news/fbi-philadelphia-brings-awareness-to-transnational-repression) (Federal Bureau of Investigation, March 26, 2025) - [FBI Dallas Brings Awareness to Transnational Repression, Urges Public to Report Incidents to Law Enforcement](https://www.fbi.gov/contact-us/field-offices/dallas/news/fbi-dallas-brings-awareness-to-transnational-repression-urges-public-to-report-incidents-to-law-enforcement) (Federal Bureau of Investigation, April 13, 2026) - [Proliferation of Foreign Commercial Spyware Drives Increasing Counterintelligence Risk](https://archive.dni.gov/files/CTIIC/documents/products/Proliferation_of_Foreign_Commercial_Spyware_Drives_Increasing_Counterintelligence_Risk.pdf) ([[wiki/Cyber Threat Intelligence Integration Center|Cyber Threat Intelligence Integration Center]], [[wiki/Office of the Director of National Intelligence|ODNI]]) - ["Transnational Repression" and U.S. Policy: In Brief](https://www.congress.gov/crs-product/R49036) ([[wiki/Congressional Research Service|Congressional Research Service]])