Fine. It is unacceptable. But read the press release a second time and pay attention to the dates, because the dates are the actual story.

The company had been supplying Russian military end users since 2019. Not since the full-scale invasion. Since 2019, five years after Crimea, in the middle of a sanctions regime that every exporter of dual-use goods in this country was legally obliged to understand. When the EU tightened sanctions after February 2022, the company did not stop. It rerouted. The goods travelled through firms in Turkey, the UAE, Hong Kong, Belarus, Kyrgyzstan, South Korea, Poland and Lithuania. European manufacturers were shown forged end-user certificates promising the equipment would stay in third countries. The real customers, per the investigation, were companies attributable to Rostec, the conglomerate at the heart of the Russian defence industry.

The first search warrants came in August 2025. Four properties, searched simultaneously, roughly forty data storage devices seized. In mid-May of this year the managing director and co-owner, a 28-year-old Belarusian citizen, was arrested. He has been sitting in pre-trial detention since. Total deliveries: more than 3.3 million euros.

Count it out. Seven years of deliveries. Three of them under the hardest sanctions regime Europe has ever imposed. Then somebody knocked on the door.

The press release celebrates the ending. Nobody in it explains the beginning or the middle.

The pattern, again

If you have been reading this site for a while, you already know where this is going. I have spent the better part of a year writing about the same underlying condition from different angles. A capital full of accredited intelligence officers. An espionage law that until recently did not care unless Austria itself was the target. A counterintelligence apparatus that needed six and a half years to attribute a cyberattack on its own Foreign Ministry.

Sanctions evasion is the trade version of the same disease. Espionage needs residency and cover. Sanctions evasion needs a jurisdiction and clean paperwork. Austria offers both, and cheaply. A GmbH costs almost nothing to set up, the banking works, and the customs and licensing apparatus that is supposed to catch this was never built for adversarial trade, for counterparties who forge documents professionally and route consignments through five countries as a matter of routine.

To be fair, this is not an Austrian invention. The Kyiv Independent showed in June, with customs records, how EU-made machinery keeps reaching Russian missile plants through third-country intermediaries. C4ADS has mapped the broker geography in detail: China and Hong Kong, Turkey, the UAE. Moscow’s procurement people treat European export controls as a delay, not an obstacle.

But this case is ours, and it raises a question nobody at Monday’s announcement wanted to touch: how many companies like this are operating in Vienna right now, and who exactly is looking for them?

Note what solved this case

There is a second point, and it connects to something this site has covered at length this year.

Nobody read anyone’s Signal messages to crack this network. It was cracked with the oldest tools in the trade: corporate records, customs data, a paper trail, coordinated house searches, forty seized hard drives, and prosecutors willing to hold a suspect while the analysis ran. Financial and trade forensics. The boring end of intelligence work.

I find that worth saying out loud in the same year the DSN’s flagship legislative project, the surveillance of encrypted messengers, sits before the Constitutional Court, sold to the public as indispensable against exactly this category of threat. Terrorism, extremism, espionage. Here is arguably the most consequential hostile-state operation uncovered in Austria this year, one that fed the engines of Russian cruise missiles, and it was taken apart with powers the state has had for decades.

The lesson is not that new powers are never justified. The lesson is that the binding constraint in Austrian counterintelligence has rarely been legal authority. It has been attention, staffing, and the willingness to sit with boring documents for a very long time. No trojan fixes that.

Brussels has the tool and will not use it

One more layer. In June 2023 the EU’s 11th sanctions package created a mechanism to ban exports of sensitive goods to third countries that systematically re-export them to Russia. It took until the 20th package for Brussels to activate it, and when it finally did, it applied the ban to one product category and one country: CNC machine tools to Kyrgyzstan. By the Kyiv School of Economics’ numbers, Kyrgyzstan supplied about one percent of Russia’s battlefield goods. China and Hong Kong supplied the overwhelming majority.

Kyrgyzstan appears in the Vienna network’s country list. So do Hong Kong, Turkey and the UAE. None of those three face the mechanism, because they are trading partners with leverage, and Brussels knows it. Which means enforcement falls back on the member states, on national services finding the Vienna node of a network whose other nodes will simply reconstitute somewhere else next quarter.

What should be asked at trial

The proceedings are ongoing and the presumption of innocence applies to everyone involved. But the questions are already on the table, and they should be asked in court and in parliament.

Which European manufacturers shipped against those forged certificates, and what did their due diligence actually consist of? Criminal liability under EU law generally requires knowledge, but “we saw a stamp and stopped asking” is a compliance posture, not a defence of the system. When did Austrian authorities receive the first indication, from customs data, from a partner service, from anyone, and what happened to it between 2019 and August 2025? And is sanctions enforcement at the DSN a unit with a headcount, or a project with a press release?

The ministry says it will continue to act consistently against anyone supporting the Russian armaments apparatus. Good. The measure of that sentence will not be the next announcement. It will be how many years the next network gets to run before anyone notices.

A procurement notice on Austria’s public tender portal records the extension of a licence agreement between the Interior Ministry and the US vendor Penlink, worth roughly 1.85 million euros over two years. The package covers Penlink products including Webloc. Der Standard reported the deal first; netzpolitik.org followed with the ministry’s response, which was that no public information can be given about specific software solutions, and that anything the ministry uses, it uses within its legal powers.

The first half of that answer is a choice rather than a constraint. The second half cannot be verified, because the first half prevents anyone from checking it.

What makes this worth more than a paragraph of outrage is what Webloc actually is, and why the standard categories used in Austrian surveillance debate do not fit it.

What Webloc does

Webloc was built by the Israeli firm Cobwebs Technologies, acquired by Spire Capital in 2023 and merged into Penlink. It is sold as an add-on to Tangles, Cobwebs’ web and social media intelligence platform, and it is not a wiretap, not an interception system, and not spyware in the conventional sense. It never touches the target’s device.

Instead it ingests the exhaust of the mobile advertising industry. Every time a phone opens an app that shows ads, an auction runs in under a second and the user’s data is broadcast to a large number of bidding parties. Separately, tracking SDKs embedded in apps collect and sell data directly. Both streams carry a Mobile Advertising ID, a persistent identifier tied to a specific handset, alongside GPS coordinates, Wi-Fi access point names, IP address, device model, operating system, language, and in many cases the ad targeting segments used to classify the person behind the phone.

Citizen Lab’s April 2026 analysis, based on leaked contract documents from El Salvador, technical specifications from Vietnam, US Navy procurement records and Penlink material from 2025, describes a system with access to a continuously updated stream from up to 500 million devices worldwide, refreshed every four to twenty-four hours, with three years of history available for query.

The interface is what matters. An analyst can draw a polygon on a map and retrieve every device observed inside it during a time window. They can intersect two polygons to find devices present in both, which surfaces people who travelled between two places. They can set alerts for new devices entering a monitored area. They can run a heat map on a single identifier to infer home address and workplace, which the vendor documentation treats as the expected workflow rather than an edge case. One example screen in the leaked material tracks a person moving from Germany through Austria into Hungary. Another resolves a single device to a specific building, rendered in Street View.

Note what this means structurally. Even when the target is one person, the query runs against everyone. A geofence around an address returns the neighbours. A geofence around a mosque, a clinic, a union hall or a newsroom returns whoever was there. The distinction between targeted and mass surveillance, which does most of the load-bearing work in Austrian legal argument about the SNG and the Constitutional Court proceedings on messenger surveillance, does not survive contact with this architecture. The Vienna-based tracking researcher Wolfie Christl put it plainly: even used against individuals, the system collects and analyses data on millions of uninvolved people every day.

Two legal questions, neither answered

There are two separate lawfulness problems here and they are routinely collapsed into one.

The first concerns the supply chain. Location data harvested from consumer apps under a consent banner about advertising, then sold onward through data brokers to a surveillance vendor, then sold to a state intelligence service, is being processed for a purpose no user ever agreed to. Christl’s position is that consent is effectively the only conceivable GDPR basis for such a transfer, and that no party in the chain holds valid consent for state surveillance. Germany’s consumer protection ministry took a comparable line in 2024, arguing that transferring personal data as a commodity in itself is incompatible with data protection law. The claim in Penlink’s older documentation that collection is GDPR compliant and consent-based rests on the same fiction the entire ad-tech sector rests on.

The second concerns the buyer. Even assuming the data existed lawfully, the Interior Ministry would need a domestic legal basis to acquire and query it. Purchasing commercially available data is a well-known route around the warrant requirement precisely because it does not look like a search. Nothing is intercepted, no device is compromised, no court is asked. In the United States, seventy-two members of Congress called in March 2026 for an investigation into warrantless location data purchases by ICE and other agencies, and an internal DHS review in 2023 already found that several DHS components had broken federal law through such purchases.

Austria has answered neither question. The ministry’s response to netzpolitik.org gestured at extremist and terrorist offences and indicated the Directorate for State Protection and Intelligence Service as the responsible body, which tells us the intended use case without telling us the authority for it.

The oversight gap is the actual scandal

The Austrian data protection authority told netzpolitik.org that it has no closer knowledge of the ministry’s planned use of the software and was not consulted. Under the GDPR, prior consultation with the supervisory authority is required where a data protection impact assessment identifies a high residual risk.

Work through the possibilities. Either the ministry conducted an impact assessment on a system that queries commercial location data covering hundreds of millions of people and concluded there was no high risk, or it did not conduct one. Both are difficult to defend. The regulator has kept the door open, noting it can examine compliance at any time through a complaint or an own-initiative review. It has not said it will.

Meanwhile the transparency record is instructive. Citizen Lab sent ninety-six freedom of information requests across fourteen European countries and six EU bodies. Austrian ministries, alongside Dutch and Romanian ones, declined to say whether they use Webloc. Europol confirmed holding relevant information and refused to release it. Not a single European agency confirmed use. Austria’s participation only became known because a procurement document sat in a public tender portal. Green MP Süleyman Zorba, who had previously been told that any disclosure would endanger national security, has made the obvious point that the deployment is now documented in public award records.

Austria is, on current evidence, the second confirmed ad-based surveillance customer in the EU after Hungary, where domestic intelligence has been using Webloc since at least 2022 and bought a fresh licence round in March 2026.

Mission creep is not hypothetical

The reassurance offered in these debates is always that the tool is reserved for terrorism, extremism and organised crime. There is now a documented answer to that.

Tucson police in Arizona acquired Tangles and Webloc for sex trafficking investigations, funded from a state border security programme. An internal report obtained by journalists describes the department using the system to investigate burglary, robbery and the theft of several thousand dollars of cigarettes, running advertising ID queries across crime scene areas to locate a suspect’s workplace, his former girlfriend and the apartment the identifiers kept returning to. The same system was used to monitor protests during campaign visits by presidential and vice-presidential candidates.

That is the empirical trajectory of a capability that is fast, cheap, warrantless and sitting on an analyst’s desk. Nothing about Austrian institutional culture makes it immune, and the current absence of any published control regime makes it less protected than the American departments where at least the procurement records are litigated.

The counterintelligence problem nobody is discussing

There is a dimension to this that civil liberties framing misses, and it should concern Austrian security professionals more than it currently does.

If the Interior Ministry can buy access to a stream covering hundreds of millions of devices, so can anyone else with a budget and a front company. The data does not become available only to lawful buyers. It is a commercial product moving through an opaque broker layer, and the same bidstream that produces Webloc produces competitor systems from other vendors, some of them in jurisdictions with no meaningful export control on this category.

Vienna hosts the IAEA, UNODC, the OSCE, OPEC and a large diplomatic corps. It is one of the densest concentrations of intelligence-relevant personnel in Europe. Every one of those people carries a phone running apps with embedded tracking SDKs. A geofence around the Vienna International Centre, a ministry, an embassy or a safe house is a commercially purchasable product. Pattern of life on a named official requires only linking one identifier, and advertising IDs are routinely matched to names, addresses and phone numbers by the same industry that insists they are anonymous. The US Federal Trade Commission has stated directly that these identifiers provide no anonymity in the marketplace.

A state that normalises the purchase of this data for its own investigations has a weaker position from which to argue that the market should not exist. That is a counterintelligence cost, not just a privacy cost, and it is being incurred without public debate.

What should happen next

Three things are reasonable to demand, and none of them require accepting or rejecting the underlying capability.

Publish the legal basis. Not the operational detail, not the target selection, just the statutory provision under which commercially sourced location data may be acquired and queried, and which oversight body approves individual queries.

Have the data protection authority open an own-initiative review. The question of whether the underlying processing is lawful is squarely within its mandate and does not depend on the ministry’s cooperation.

Treat ad-based tracking as a defensive problem. For anyone in Austria handling sensitive material, the mitigation is unglamorous and available today: reset advertising identifiers regularly or disable them entirely, deny location permission to any app that does not require it for its core function, and remove ad-supported apps from devices used for sensitive travel. This is not a substitute for regulation. It is what can be done while regulation does not exist.

Sources

• Wolfie Christl, Astrid Perry, Luis Fernando Garcia, Siena Anstis and Ron Deibert, “Uncovering Webloc: An Analysis of Penlink’s Ad-based Geolocation Surveillance Tech,” Citizen Lab Report No. 191, University of Toronto, 9 April 2026
• Sebastian Meineck, netzpolitik.org, 30 June 2026
• Der Standard, reporting on the Interior Ministry procurement record
• VSquare, Szabolcs Panyi, on Hungarian intelligence use of Webloc, April 2026
• Austrian federal procurement portal, tender award documentation

On 4 May, the Austrian Foreign Ministry confirmed an ORF report from the previous evening. Three Russian diplomats had been declared persona non grata over the antennas on the roof of the embassy on Reisnerstrasse in the 3rd district and on the Donaustadt compound described above. The installations, according to ORF’s sources, were used to intercept data transmitted by international organisations based in Vienna over satellite internet. The three have already left.

This is the largest single Russian expulsion in Austria’s post-2022 period and brings the cumulative total to 14 since the full-scale invasion. The 14 figure, set against the seven-thousand-or-so hostile officers operating in this city and the dozens of accredited Russian personnel still in Vienna, is small. The story matters less for the numerical impact than for what it signals about how the new coalition is actually treating the espionage portfolio.

Foreign Minister Beate Meinl-Reisinger framed it in unusually direct language for an Austrian foreign minister: “Espionage is a security problem for Austria. In this government, we have initiated a change of course and are taking consistent action against it.” Then, more pointedly: “It is unacceptable for diplomatic immunity to be used to conduct espionage.”

Both sentences should be read in the context of what the Austrian government did before reaching the expulsion decision.

The Russian ambassador was summoned to the Foreign Ministry in April. Vienna asked Moscow to waive the immunity of the three officers so that the prosecutor’s office could open a case. Russia refused, which is the answer everyone in the building expected. Once that refusal was on the record, the only remaining instrument was a PNG declaration. That sequence, asking for immunity to be lifted before going to expulsion, is itself meaningful. It tells you the Justice Ministry would have preferred to prosecute, not deport. That is the institutional logic of the §319a draft I wrote about last month coming into view. The government is signalling that it wants foreign espionage on Austrian soil treated as a criminal matter rather than a diplomatic one.

The technical layer matters, and I will be brief about it because there are people in this city who know more than I do about exactly what those antennas were doing. The basics are these. When an international organisation in Vienna sends and receives traffic over satellite, the uplink and downlink are not magic. They are radio waves with side lobes that bleed off the main beam, and they pass over rooftops in defined geometric patterns. Anyone with the right antenna at the right altitude in the right place can pick up that traffic. Decrypting it is harder, but the volume of communications moving through the IAEA, UNOV, the OSCE and the EU Agency for Fundamental Rights, accumulated over years, gives serious cryptanalytic teams plenty to work with. Embassy rooftops are uniquely valuable platforms for this work because of immunity. Nobody, including DSN, can come up and look at the equipment.

The Donaustadt compound is what makes this case sharper than the standard embassy SIGINT story. The site sits within walking distance of the UN City complex. The line of sight is, to put it generously, ideal. Anyone who has walked along Wagramer Strasse on a clear afternoon understands the geometry instinctively. The question that has been quietly asked in Vienna’s diplomatic circles for years is why nobody acted on this earlier.

Part of the answer is that DSN until recently was not in shape to act. Sylvia Mayer took over on 1 January as the first female director of the agency. The Russian ambassador was summoned in April. The expulsions were announced on 4 May. That is the operational rhythm of a service that has decided to spend its first major political capital on this file. Mayer herself was on the podium at the press conference. Asked why these installations were a particular threat, she limited herself to saying it had to do with their size and nature, and declined to comment on the timing. The decline to discuss the timing is the whole story. The timing is a political choice, not an intelligence one. The antennas have been there for years.

There are limits to what I will read into a single expulsion. Austria has now expelled 14 Russian diplomats in four years, which compared to other European countries is still on the low side. The bulk of accredited Russian personnel are still here, doing whatever they do, with the same immunities. The Donaustadt compound is still in operation. The antennas, as a class of equipment, are not going anywhere, and Russia will rotate in new staff under different cover within months. The structural facts of Vienna’s exposure have not changed.

What has changed, possibly, is the political ceiling on what can be done about that exposure. For most of the past decade, the standard official Austrian position was that Vienna’s hosting role required a particular kind of equidistance, and that expulsions complicated relationships with international organisations that depended on diplomatic stability. That position has been quietly retired by the current government. Meinl-Reisinger’s “change of course” line is not rhetorical. It maps onto a sequence of concrete decisions: the §319a draft, the summoning of the ambassador, the public request for immunity waiver, the public expulsion. These are not the actions of a government still committed to the bridge.

The next move belongs to Moscow. The Russian embassy called the expulsions “outrageous” and “politically motivated,” and warned of a “harsh” response, calling the bilateral relationship “at a historical low.” In recent pattern, “harsh response” usually means a reciprocal expulsion of Austrian diplomats, often more than the original number, and visa frictions for Austrian citizens. The relationship will degrade further. That is also part of the price of the course change, and the government appears to be prepared to pay it.

The piece I wrote last month argued that the §319a draft was real progress but that the Ott verdict would tell us more than the law itself. The expulsions on 4 May added a third data point to that picture. Taken with the verdict that landed on 20 May, the bill, the expulsions and the conviction are starting to look less like isolated events and more like a deliberate sequence. Vienna, for the first time in a long time, is acting like a country that takes its espionage problem seriously.

Whether that lasts beyond the next election cycle is a question I will not answer today. It depends on which parties are at the table after the next vote and what they decide to do with the institutional momentum the current government has built. The political risks are real. The operational improvements are also real. Both things can be true.

Criminal profiling has always rested on one core assumption: criminals are creatures of habit. They leave behavioral signatures. They escalate predictably. Their psychology leaks through their methods. For decades, this held up well enough. The FBI’s Behavioral Analysis Unit built an entire discipline around reading crime scenes like psychological fingerprints, classifying offenders as organized or disorganized, mapping modus operandi against personality types, and predicting the next move based on the last one.

Then AI entered the equation. Not as a tool for investigators, but as a tool for criminals. And it didn’t just make crime easier. It fundamentally altered who commits crime, how they behave while doing it, and what traces they leave behind. That shift is quietly dismantling the foundations of classical profiling.

The Old Rules

Traditional profiling works on a set of behavioral axioms. Behavior reflects personality. Crime scenes tell stories about the offender’s psychology. Signature behaviors, those acts unnecessary for completing the crime but driven by deep psychological needs, remain consistent across offenses. Modus operandi evolves as the offender learns, but the core emotional drivers stay stable.

These principles gave investigators a framework: analyze the scene, read the behavior, build a psychological sketch, narrow the suspect pool. It was never perfect. FBI internal data suggested profiling contributed to solving roughly 17% of cases where it was applied. Academic reviews have been even less generous. But as a supplementary tool alongside forensic evidence and traditional detective work, it had value.

The problem is that every one of these axioms assumes the offender is acting from their own psychology, with their own skills, under their own operational limitations. AI has removed those constraints.

The New Criminal Doesn’t Fit the Old Mold

Consider what AI has done to the barrier of entry for sophisticated crime. Voice cloning now requires 20 to 30 seconds of audio. Convincing deepfake video can be produced in under an hour using freely available tools. Dark LLMs and jailbreak-as-a-service platforms generate phishing campaigns, social engineering scripts, and even malware with minimal technical knowledge required from the operator.

This is the first major break from classical profiling logic. The old model assumed a correlation between crime sophistication and offender capability. An organized crime scene implied an intelligent, socially competent, methodical individual. A well-crafted social engineering attack suggested experience, psychological insight, and confidence. AI has severed that link entirely. A teenager with a laptop can now execute attacks that would have previously required a team of experienced operatives.

The Trend Micro research team documented this shift in their 2025 criminal AI report: the underground ecosystem has moved from experimentation to industrialization. Criminals no longer build their own tools. They rent them. The barrier has collapsed, the tooling has professionalized, and the attack surface has expanded across every domain. Telegram channels now recruit “AI video actors” and “deepfake presenters” as a service category.

What does this mean for profiling? It means the behavioral signature, the profiler’s primary analytical unit, is increasingly a product of the tool rather than the person behind it. When a deepfake CEO orders a wire transfer on a video call, the behavioral cues that investigators would normally analyze (speech patterns, confidence level, emotional state, decision-making style) belong to the AI model, not the attacker. The criminal becomes invisible behind the synthetic layer.

AI Doesn’t Just Enable Crime. It Redirects It.

Here is the less obvious but more consequential effect. AI isn’t simply making existing criminal patterns more efficient. It is creating entirely new behavioral categories that classical profiling has no framework to address.

Take synthetic identity fraud. Criminals now build complete fake identities using a mix of real and fabricated data, pass automated KYC checks with AI-generated documents, and operate accounts that leave behind a perfectly normal behavioral footprint. There is no psychological signature to read because the “person” never existed. The behavior was designed by algorithm to look average.

Or consider AI-powered behavioral mimicry. Trend Micro and Group-IB both documented cases where AI studied institutional behavior patterns (transaction timing, approval workflows, communication styles) and then replicated them precisely to avoid triggering fraud detection. The criminal isn’t acting like themselves anymore. They are acting like the system expects a legitimate user to act. This is the opposite of what profiling relies on: instead of behavior revealing identity, behavior is engineered to conceal it.

The 2025 AI Incident Database recorded 346 AI-related incidents in a single year. Of those, 179 involved deepfake impersonation. The targets ranged from CEOs to private individuals. In one case, a British widow lost half a million pounds in a romance scam powered by deepfake video of a celebrity. A Florida couple lost $45,000 to a fabricated Elon Musk giveaway. These are not sophisticated adversaries with complex psychological profiles. These are operators running playbooks, sometimes literally purchased as step-by-step tutorials from underground forums.

The Profiling Crisis

Classical profiling depends on three things that AI is systematically eroding:

Behavioral consistency. AI allows criminals to switch personas, communication styles, and operational methods between attacks with zero psychological cost. There is no escalation pattern to track because each attack can be calibrated independently by the tool.

Skill-behavior correlation. The assumption that crime complexity reflects offender sophistication is broken. AI democratizes capability. The profile of “who could do this” expands from a narrow suspect pool to essentially anyone with internet access and basic prompt engineering skills.

Psychological leakage. Crime scenes and communications used to leak the offender’s personality involuntarily. When AI generates the phishing email, conducts the video call, or crafts the social engineering script, the psychological content belongs to the model’s training data, not the operator’s mind.

This doesn’t mean profiling is dead. But it means the discipline needs to shift its unit of analysis. Instead of asking “what kind of person did this,” investigators increasingly need to ask “what kind of toolchain produced this behavior.” The profiling target is migrating from psychology to infrastructure.

Where Profiling Still Works, and Where It Can’t

Profiling retains value in crimes that remain fundamentally physical and personal: serial violent offenses, sexual crimes, stalking, arson. These still carry strong behavioral signatures because the offender’s psychological needs drive the act directly, not through a technological intermediary.

But for the fastest-growing categories of crime (fraud, identity theft, business email compromise, financial manipulation, extortion through synthetic media), classical profiling is increasingly irrelevant. The offender’s psychology matters less than their toolkit. Their behavioral patterns are shaped more by the AI model they are using than by their own personality.

The intelligence community and law enforcement agencies that recognize this shift will adapt. Those that keep trying to build psychological profiles of operators who are essentially invisible behind AI-generated behavior will waste time and resources chasing ghosts.

The profiler’s question used to be: Who is this person?

Now it needs to be: What system is this person hiding behind, and where does that system leak?

I’ve been covering cyber threats for years now, and I’ve sat through countless conference panels where retired generals talk about “the coming cyber war.” Always in the future tense. Always hypothetical. That era is over.

On February 28, the US and Israel hit Iran. But the shooting started in cyberspace. Hours before any jet crossed Iranian airspace, US Cyber Command had already gutted Tehran’s communications and sensor networks. General Dan Caine confirmed it publicly: space and cyber operations came first, leaving Iran unable to “see, coordinate, or respond effectively.” Think about what that means. By the time the bombs dropped, the Iranian military was already operating blind.

And it only got stranger from there.

Tehran’s traffic cameras killed the Supreme Leader

This is the part that reads like fiction but isn’t. Israeli intelligence had been inside Tehran’s traffic camera network for what appears to be months, possibly longer. Not just watching. Feeding the footage into a machine alongside CIA human intelligence, signals intercepts, satellite imagery, communications metadata. The Financial Times was first to report the scope of it. One Israeli source called the whole setup an AI-powered “target production machine.” You pour data in, you get a 14-digit grid coordinate out.

They built what they called a “life pattern” for Khamenei. His routes. His schedules. Which aides traveled with him. When his security detail was thinnest. The Jerusalem Post reported that Israeli analysts mapped these patterns over an extended period, cross-referencing traffic camera data with other intelligence streams.

Then the CIA confirmed Khamenei would attend a senior military meeting on the morning of the 28th. The entire operation timeline shifted around that single piece of intelligence. The result: Khamenei dead, along with the IRGC commander, the defense minister, the chief of staff, the head of the National Defense Council. More than a dozen top officials, gone before lunch.

I keep coming back to what RUSI wrote about this. They pointed out something that gets lost in the spectacle: cyber’s biggest contribution here wasn’t disruption. It was reconnaissance. Years of quiet network access, pre-positioned in Iranian infrastructure, activated at the decisive moment. That’s not a hack. That’s a long-term intelligence operation that happened to run through fiber optic cables instead of dead drops.

Israel doesn’t want to depend on Silicon Valley for its kill chain

Here’s something that should concern anyone in the AI policy space. Haaretz reporter Omer Benjakob told NPR that Israel is building its own military AI systems specifically because it can’t afford to rely on American commercial platforms. His quote was memorable: “One day someone will discover we also use Claude, and then there’ll be a protest in San Francisco, and then they’ll take Claude away from us.”

He said this on the record.

The Anthropic dispute with the Trump administration over military use of Claude is well documented at this point. But the strategic implications go deeper than one company’s ethical stance. If your precision targeting pipeline depends on a model whose provider can revoke access based on a policy change or public pressure campaign, you have a serious sovereignty problem. Israel clearly sees it that way. Others will too.

None of this means AI targeting is ready for primetime, though. The March 8 strike on the Shajareh Tayyebeh school in Minab killed 165 people. 110 of them were schoolgirls. The building used to be a military base. Whether AI targeting systems worked off stale data is still under investigation, but a UCL computer scientist put the core issue bluntly: “This stuff is only two or three years old.”

Speed and precision are not the same thing. This war is proving that every day.

60 hacktivist groups, one internet blackout, and a paradox

Iran’s internet dropped to somewhere between 1% and 4% connectivity on February 28. That’s barely functional. You’d think that would cripple the regime’s cyber response. And for the state-run APT groups operating inside Iran, it probably did, at least initially.

But that’s not how Iran’s cyber infrastructure actually works. Tehran has spent years building out proxy networks. Hacktivist groups, some loosely affiliated, some directly run by MOIS or the IRGC, operating from outside Iran’s borders. When the internet went dark domestically, these external nodes lit up.

Unit 42 counted around 60 groups active in the first week alone. Handala Hack, which has documented ties to the Ministry of Intelligence, ran wiper and exfiltration campaigns against Israeli defense targets. On March 12, they hit Stryker, one of the largest medical technology companies in the US. MuddyWater, an IRGC-linked group, turned out to have pre-planted backdoors in Israeli-adjacent defense and financial networks. They didn’t need to break in after the war started. They were already inside.

March 2 was when things escalated beyond the Middle East. Pro-Russian hacktivist group NoName057(16) formally joined the Iranian coalition. Since then, the combined front has been hitting targets in Cyprus, Romania, across the Gulf states. Government websites, airports, telecom providers. The Russia-Iran cyber axis is no longer theoretical. It’s operational.

Now, the OT and SCADA claims. Groups have been posting screenshots alleging access to Israeli water systems, Jordanian grain storage controls, various industrial systems. John Hultquist at Google Threat Intelligence has been saying for years that Iran exaggerates its cyber successes for psychological effect, and he’s right. A lot of these claims don’t hold up under scrutiny.

But I’d be careful about dismissing all of it. CyberAv3ngers compromised real US water systems in 2023 using nothing more sophisticated than default passwords on Unitronics PLCs. The capability is proven. What we don’t know is how much coordination these proxy groups can maintain while their state sponsors are dealing with an actual shooting war.

The information battlefield is now indistinguishable from the physical one

Before the first airstrike, Israel had already compromised BadeSaba, a popular Iranian prayer app with over five million users. They pushed messages to regime supporters urging military defection. They hijacked state news websites to publish anti-regime content. Later, they sent AI-equipped drone swarms over Tehran to hit Basij militia checkpoints.

Iran’s been playing the same game in reverse for years. Dozens of Israeli nationals recruited through Telegram, paid to commit low-level sabotage: starting fires, spraying antigovernment graffiti, sowing social discord. A Clemson University researcher called Israel’s approach “psychological operations integrated with military operations in one clean campaign with a single goal: toppling the Iranian regime.”

Both sides have turned every digital platform into a weapon. Messaging apps, news sites, social media, traffic infrastructure. There’s no longer a meaningful line between “cyber operation” and “influence operation.” It’s all one battlefield.

CISA is running on fumes at the worst possible time

I can’t write about this conflict’s cyber dimension without mentioning what’s happening at CISA. The agency has lost roughly a third of its staff. The temporary director got reassigned to another corner of DHS right as the war kicked off. FBI and NSA have put out joint warnings about Iranian targeting of US defense contractors and financial firms. Jamie Dimon at JPMorgan went on CNBC and said banks are bracing for a wave of cyber and terrorist attacks.

So at the exact moment when motivated, state-aligned Iranian cyber actors are looking for American targets, the primary agency that’s supposed to coordinate civilian cyber defense is hollowed out. That should worry people far more than it seems to.

European organizations need to pay attention

The NCSC in the UK puts Iran in the same threat tier as Russia and North Korea. That was true before February 28. It’s more true now, because the Russian hacktivist groups that joined the Iranian coalition have broadened the targeting aperture into Europe.

Organizations in Austria and the DACH region might feel geographically removed from this conflict. They’re not. If your supply chain touches Israeli technology, if your cloud provider hosts workloads for companies in targeted sectors, if you run Israeli-manufactured OT equipment, you’re in scope. CyberAv3ngers targeted Unitronics PLCs in 2023 specifically because they were Israeli-made. That logic doesn’t stop at borders.

Trellix published research showing that Iranian threat groups have expanded from targeting a handful of countries to more than twenty since the conflict started. Western Europe is on that list. The tactics are familiar: spear-phishing, unpatched edge devices, ransomware that looks criminal but serves state interests, data leaks timed for maximum embarrassment.

This doesn’t end when the bombing stops

Iranian APT groups like APT42, APT34 and MuddyWater have a well-documented habit of running campaigns for years after the initial trigger. The proxy networks are activated. Russia and Iran have found operational common ground in cyberspace. The infrastructure built for this conflict will be repurposed, not dismantled.

Two decades of defense policy debates about whether cyber is a “real” domain of warfare just got their answer. In this conflict, cyber was the opening move, the intelligence backbone, the targeting enabler, the psychological weapon, and the retaliatory instrument of choice for a regime that lost its conventional military options in a matter of hours.

We’re not waiting for the first cyber war anymore. We’re in it.

Having spent over a decade in intelligence and security operations, from securing diplomatic missions for the German Federal Foreign Office to advising law enforcement on digital threats, I have observed a consistent pattern. Organisations do not fail because they lack firewalls or antivirus software. They fail because they do not know what they are exposing to the internet in the first place.

The Problem No One Talks About

Every organisation has an attack surface. It includes every domain, subdomain, IP address, open port, exposed API, cloud instance, and forgotten staging server connected to the internet. For a company with even a modest digital footprint, this can amount to hundreds of potential entry points.

The challenge is visibility. Most SMEs have no systematic way to inventory their external-facing assets. A marketing team spins up a subdomain for a campaign and never takes it down. A developer leaves a test environment exposed with default credentials. An old mail server runs an unpatched version of Exchange. Each of these is an open door.

Large enterprises address this through dedicated security operations centres and expensive enterprise tools. But for a company with 50 or 100 employees, these solutions are neither accessible nor affordable. This gap between awareness and capability is where most breaches begin.

Attack Surface Management: From Military Doctrine to Cyber Defence

The concept of attack surface management (ASM) has its roots in military intelligence. Before any operation, you map the terrain. You identify vulnerabilities in your own position before the adversary does. The same principle applies to cybersecurity.

Modern ASM platforms automate the process of discovering, cataloguing, and continuously monitoring an organisation’s external-facing digital assets. They scan for exposed services, misconfigurations, known vulnerabilities, leaked credentials on the dark web, and other indicators of risk.

What makes ASM fundamentally different from traditional vulnerability scanning is scope and continuity. A vulnerability scan checks known assets at a point in time. ASM discovers unknown assets and monitors them continuously. It answers the question most security teams cannot: What do we not know about our own exposure?

The European Dimension

For European organisations, the stakes are compounded by regulation. The NIS2 Directive, which came into full effect across EU member states, imposes strict cybersecurity requirements on a far broader range of companies than its predecessor. Entities classified as “essential” or “important” must implement risk-based security measures, conduct regular assessments, and report incidents within tight timeframes.

GDPR adds another layer. A breach resulting from an unmonitored attack surface does not just cause operational damage. It triggers mandatory notification requirements and potential fines of up to 4% of global annual turnover.

Despite these pressures, most European SMEs still rely on periodic penetration tests, conducted once or twice a year, as their primary security assessment. In a threat landscape where new vulnerabilities are disclosed daily and attack infrastructure is automated, annual testing is the equivalent of checking your locks once a year in a neighbourhood where break-ins happen every week.

Continuous Monitoring as the New Baseline

The shift from periodic assessment to continuous monitoring is not optional. It is a necessity. Attackers use automated reconnaissance tools that scan the entire IPv4 address space in minutes. If an organisation exposes a vulnerable service, it can be discovered and exploited within hours, sometimes within minutes.

This is the operational reality that led me to develop SecurityScanner.ai, an attack surface management platform designed specifically for the European market. The platform provides continuous external monitoring, automated vulnerability detection, dark web credential monitoring, and AI-driven risk assessment. It is built from the ground up with GDPR-compliant infrastructure and priced for organisations that do not have six-figure security budgets.

The philosophy behind it is straightforward. Every organisation, regardless of size, deserves the same level of visibility into its attack surface that was previously only available to large enterprises and government agencies.

What a Proper ASM Workflow Looks Like

For organisations beginning to take attack surface management seriously, the process follows a clear logic.

Discovery is the first phase. You cannot protect what you do not know exists. This means automated enumeration of all domains, subdomains, IP ranges, cloud assets, and third-party services associated with your organisation. The results are often surprising. Most companies discover 30 to 40 percent more external assets than they were aware of.

Assessment follows discovery. Each discovered asset is evaluated for known vulnerabilities, misconfigurations, exposed sensitive data, outdated software, and weak encryption. This is where automated scanning intersects with threat intelligence, correlating discovered exposures against actively exploited vulnerabilities in the wild.

Monitoring makes the process continuous. New assets, new vulnerabilities, and new threats emerge constantly. A platform like SecurityScanner.ai runs these checks on an ongoing basis, alerting security teams to changes in their attack surface before adversaries can exploit them.

Dark web intelligence adds a critical layer that traditional scanning misses entirely. Stolen credentials, leaked databases, and mentions of your organisation on underground forums represent threats that exist outside your network perimeter but directly impact your security posture. Integrating dark web monitoring into the ASM workflow provides early warning of compromised accounts and data breaches.

The Intelligence Perspective

From an intelligence standpoint, attack surface management is fundamentally an exercise in counter-reconnaissance. You are attempting to see yourself the way an adversary sees you, and to close gaps before they are exploited.

This is not theoretical. In my advisory work with law enforcement and government institutions, I have seen repeatedly how even well-resourced organisations are compromised through forgotten assets. A subdomain pointing to a decommissioned server. An exposed admin panel with weak authentication. A cloud storage bucket with public read access. These are not sophisticated attacks. They are failures of visibility.

The lesson is clear. Cybersecurity is not primarily a technology problem. It is an intelligence problem. And like all intelligence problems, it begins with knowing your own terrain.

Conclusion

The European cybersecurity landscape is at an inflection point. Regulatory pressure is increasing. Attack automation is accelerating. And the gap between enterprise-grade security and SME capability remains dangerously wide.

Attack surface management is not a luxury. It is the foundation upon which all other security measures depend. Without continuous visibility into your external exposure, every other investment in cybersecurity is built on incomplete information.

For organisations ready to take this step, the tools now exist to make it practical and affordable. The question is no longer whether you can afford to implement continuous attack surface monitoring. It is whether you can afford not to.

Your WiFi router does more than connect you to the internet. The radio waves it sends are bouncing off everything in your room, including you. And those reflections contain a surprising amount of information.

This is called CSI sensing, and it is quietly becoming a big deal in security, smart homes, and healthcare.

What is CSI?

CSI stands for Channel State Information. When WiFi signals travel from your router to your phone, they dont go in a straight line. They bounce off walls, furniture, and people. This is called multipath propagation.

Modern WiFi (802.11n and newer) divides its channel into many subcarriers. For each one, the system measures amplitude (signal strength) and phase (timing). This data is CSI.

Here is why this matters: when a person moves through a room, they disturb these signal paths. The human body contains a lot of water, which affects radio waves significantly. This disturbance shows up in CSI data as measurable changes.

So if you can read CSI data and analyze it properly, you can detect human presence and movement without any cameras or sensors on the person.

How it actually works

Think about throwing a stone in a pond. The ripples spread out and reflect off the edges. If someone walks through the water, the ripple pattern changes in a predictable way.

WiFi signals work similarly. There are regions between transmitter and receiver called Fresnel zones where signals interfere with each other. When you walk through these zones, you cause phase shifts that can be detected.

The processing pipeline looks like this:

First you collect raw CSI data from WiFi hardware. Then you clean it up, remove noise, fix phase errors. After that you extract features like variance, frequency components, correlation patterns. Finally you feed this into a classifier, could be SVM, could be a neural network like LSTM or CNN.

Recent papers from 2024 and 2025 report accuracy rates above 99% for activity recognition on standard datasets. Real world performance is lower, but still impressive.

What can you do with this?

Detecting people

The most basic application. Is someone in the room or not? This works even through walls, which is something cameras cannot do. You dont need line of sight.

Activity recognition

With good training data, you can distinguish walking from sitting from falling. This is useful for elderly care. If grandma falls and doesnt get up, the system can alert someone. No wearable device needed.

Vital signs

This one surprised me when I first learned about it. When you breathe, your chest moves a few millimeters. This tiny movement creates detectable changes in CSI. Researchers have demonstrated breathing rate detection and even heart rate estimation in controlled conditions.

Intrusion detection

This is where it gets interesting from a security perspective. Traditional motion sensors have problems. They have blind spots. They can be fooled if you move slowly enough. They need to be installed and maintained.

CSI based intrusion detection uses your existing WiFi infrastructure. It can detect slow, careful movement that would fool a PIR sensor. It works through walls. The intruder cannot see where the sensors are because there are no sensors, just your router.

Systems like Wi-Alarm have shown reliable detection of various intrusion patterns in research settings.

Counting people

You can estimate how many people are in a room. Useful for building management, energy savings, or compliance with occupancy limits.

How to Get Started – Technical Implementation

The cheapest way to experiment with CSI sensing is an ESP32 microcontroller. Espressif provides an official esp-csi toolkit on GitHub. You flash the firmware, connect the ESP32 to your WiFi network, and it starts outputting raw CSI data over serial. The data includes amplitude and phase for each subcarrier, typically 52 values per packet at 100-200 packets per second. From there you pipe it into Python for processing. Basic presence detection works by calculating variance across subcarriers. When someone moves, variance spikes. When the room is empty, it stays flat. You can get this working in an afternoon.

For better results you need better hardware. Raspberry Pi 4 with Nexmon firmware gives you access to CSI from the Broadcom WiFi chip. More subcarriers, cleaner phase data, higher sample rates. The setup is more involved, you need to patch the firmware and compile kernel modules, but there is good documentation. Intel 5300 NIC is the classic research platform with the most published code to reference, but requires an older laptop with mini PCIe slot. Once you have data flowing, the processing pipeline is standard: denoise with a low-pass filter or PCA, extract features like variance, entropy, dominant frequency from FFT, then train a classifier. Start with SVM for binary presence detection before moving to LSTM or CNN for activity recognition. Scikit-learn and PyTorch both work fine. The main challenge is not the code, it is collecting good training data for your specific environment.

Law enforcement and intelligence use

This is not just academic research. Government agencies are already using this technology operationally.

The US Department of Homeland Security has been developing through-wall sensing systems for years. Their latest project, DePLife (Detect Presence of Life), was developed with MIT Lincoln Lab. In 2024, six law enforcement agencies across California, Texas and South Carolina conducted field assessments of the technology. The system uses radar on WiFi frequencies to detect human presence through walls, showing results on a mobile app.

Israeli company Camero-Tech makes the Xaver series, which is already deployed by military and police units worldwide. Their XLR80 model can detect people through concrete walls from over 100 meters away. It shows real-time position, movement direction, and can even detect breathing of stationary targets.

MaXentric sells the Detex Pro to US law enforcement for around 6000 dollars. It is compact enough to lean against a wall and streams results to a smartphone. Police have used similar devices in hostage situations and warrant services.

The Range-R is another device in active use by US police departments. It can detect movement and breathing through standard building materials.

What makes WiFi CSI interesting is that you do not need specialized military hardware. The same physics works with commercial routers and cheap microcontrollers. The difference is range and reliability, but the basic capability is accessible to anyone.

The security angle

I work in cybersecurity, so I see two sides here.

On one hand, CSI sensing is a powerful tool. You can monitor spaces without visible cameras, which some people prefer for privacy. It works in darkness. It is hard to detect or jam. It uses infrastructure you already have.

On the other hand, the same capabilities create risks. If an attacker has access to your WiFi network, they could potentially monitor your activities. Research has shown CSI can be used to infer keystrokes, identify individuals by their gait, and build activity profiles.

This is not theoretical. The technology exists in commercial products and government hands. Whether it becomes a widespread threat depends on how aware people are and how we design systems going forward.

Getting started practically

If you want to experiment with this, you have options at different price points.

The cheapest is ESP32, around 5 euros. Espressif provides official CSI tools and it is relatively easy to get started. The data quality is moderate but enough for presence detection.

Raspberry Pi with Nexmon firmware is maybe 50 euros total. Better CSI quality, more flexibility, but requires more setup.

Intel 5300 NIC is the classic research platform. Good data quality, lots of existing code and papers to reference. You need a compatible laptop though.

For software, check out the ESP-CSI repository from Espressif, or the Linux CSI Tool for Intel hardware.

A good first project is simple presence detection. Binary classification, room empty versus occupied. Once that works, you can try activity classification or multi-room setups.

Limitations

I should be honest about the challenges.

Environment sensitivity is the big one. A model trained in your living room probably wont work in your office without retraining. Even moving furniture can break things. This is an active research area but not solved.

Hardware support varies. Not every WiFi chipset exposes CSI data. Consumer routers usually dont. You need specific hardware or firmware modifications.

Multi-person scenarios are hard. When two people are moving, separating their contributions to the signal is complicated.

Real-time processing needs decent hardware. If you want to run neural networks on CSI data continuously, you need computing power.

Where this is going

WiFi 7 is coming with wider channels, which means more subcarriers and finer resolution. Some enterprise vendors like Huawei already ship access points with built-in CSI sensing for smart building applications.

I expect we will see more commercial products in the next few years. The question is whether security and privacy considerations keep pace with the capabilities.

Final thoughts

The WiFi signals in your home carry more information than most people realize. This technology is real, it is improving, and it has both positive and concerning applications.

For security professionals, it is worth understanding. For everyone else, it is worth being aware that walls dont provide as much privacy as you might think.

We used to say that intelligence work was like looking for a needle in a haystack. It was difficult, sure, but at least we knew that if we found something sharp and metallic, it was probably the needle.

Those days are over.

Today, AI isn’t just hiding the needle; it’s dumping thousands of “fake needles” into the pile every second. They look real, they shine like metal, and they even feel sharp. But they are decoys. The modern analyst’s nightmare isn’t a lack of information it’s Information Overload on an industrial scale. We aren’t just looking for the truth anymore; we are trying to survive a flood of convincing lies.

The Weapon of Exhaustion

We often think of cyber warfare as hackers breaking down firewalls or stealing secrets. But the new threat is subtler and perhaps more dangerous. It’s what we call a “Bureaucratic DDoS.”

Think of it as a weapon of exhaustion. Adversaries are using generative AI to create a “Cognitive Flood” millions of synthetic reports, deepfake videos, and bot managed panic. The goal isn’t to destroy our data; it’s to force us to waste our limited resources verifying it. It’s a “deceleration weapon” designed to clog the gears of intelligence agencies with perfectly formatted junk.

Chasing Ghosts in the Gray Zone

This isn’t just a digital problem; it has physical consequences. We are seeing the rise of “Physical DDoS” attacks.

Imagine a crisis scenario: An AI bot farm floods emergency channels with reports of a massive fire or an armed conflict in a specific neighborhood. The reports look genuine. Photos generated by AI start circulating. Police and first responders rush to the scene, sirens wailing. But when they arrive, the streets are empty.

While our security forces are busy chasing these digital ghosts, the real threat actors are operating unchecked elsewhere. This is the Gray Zone where digital deception translates into real world blindness.

The Cost of Verification

In this noise, the “Weak Signals” the subtle, quiet indicators of a real terrorist plot or a foreign intelligence operations are completely drowned out.

There is a concept called “Open Source Intoxication.” It means we are getting drunk on bad data. Every hour an analyst spends analyzing a high quality deepfake is an hour stolen from investigating a real threat. The “Verification Tax” we are paying is becoming too high to sustain.

Fighting Fire with Fire

So, how do we fix this? We have to admit that the human eye is no longer enough. We can’t “eyeball” our way out of this.

We need a “Zero Trust” approach to open source data. Unless a piece of information from the web (OSINT) can be cross referenced with human assets (HUMINT) or technical signals, it should be treated as noise.

More importantly, we need to adopt an “AI vs. AI” doctrine. If the attack comes at machine speed, the defense cannot move at human speed. We need our own algorithms to filter the noise, spot the synthetic patterns, and clear the haystack, so human analysts can get back to doing what they do best: finding the real needle.

The Greatest Danger is Hacked Perceptions

For years, I have monitored cyber threats for governments and international institutions. From securing diplomatic missions across 12 countries for the German Federal Foreign Office (Auswärtiges Amt) to tracking the digital footprints of terror financing for the Ministry of Interior in Türkiye, I have always encountered the same reality: The greatest danger I witnessed was not hacked devices, leaked databases, or cracked passwords. The greatest danger was hacked perceptions.

Today, when we say “Cyber Security,” we still picture hooded hackers and scrolling green code. But as a cyber intelligence professional who has operated in the field, I can tell you this: To collapse a state or an institution, you no longer need to attack their servers. You only need to target their reputation and the trust that holds their society together. From border security to election manipulation, I have operated wherever data is weaponized. And with this experience, I can tell you: Digital Disinformation is the nuclear weapon of the 21st century.

We Are in an Invisible War

Understanding Digital Disinformation

Wars used to be fought along physical borders. Now, they are fought on the screen of your smartphone, inside that “innocent” tweet you read with your morning coffee. I have personally analyzed how bot networks are coordinated during election periods, how terror organizations manipulate algorithms to spread propaganda, and how “Deepfake” content is designed to disrupt financial markets.

1. Who Pushes the Button? (The Geopolitics of Likes)

The biggest misconception is that disinformation is chaotic. It is not. It is a calculated investment with a specific ROI (Return on Investment). The “button” is almost always pushed by states and state-sponsored groups. But the motivation isn’t just to cause trouble; it is strictly transactional. In my experience, I have seen that foreign powers invest heavily in influencing elections based on their future interests.

The Actors and Ethical Complexity :

Two or three major companies, primarily based in Israel and India, operate at the center of this industry, focusing on election interference and disinformation prevention. I can attest that the products performing the best in this field are often of Israeli origin. Importantly, the necessity of producing counter-information to prevent disinformation inherently gives these software capabilities the potential for intentional or unintentional disinformation. This demonstrates the complex dual-use ethical framework of the industry.

2. The Death of the “Egg Account” (The Incubation Era)

If you are still trying to spot a bot by looking at its creation date or lack of a profile picture, you are fighting a modern war with a stone axe. Those days are over. Today, millions of accounts are created daily across the globe, but they don’t tweet immediately. They are put into “Incubation”. These sleeper accounts are kept dormant for months or years. When the time comes, they are sold to the highest bidder. Because they have a history, they bypass traditional security filters. The only reliable detection method left is analyzing the Synthetic Text Ratio. We are no longer looking for a “fake photo”; we are looking for the linguistic fingerprint of an LLM (Large Language Model) in their posts.

Field Evidence: Instant Data Correlation:

To quantify the access speed of these tools, we conducted a test: We created a new social media account using a freshly acquired, unlisted phone number (a ‘zero’ line from the state) and defined political views/interests. We searched this number in an undisclosed disinformation tool on the same day. The result was instantaneous: the tool successfully returned the profile. This demonstrates an incredible data ingestion speed, suggesting zero-latency correlation or direct data access, proving that high-value information is immediately accessible.

Operational Depth: Data Enrichment and Sociological Targeting :

Open-market social media analysis tools are useless in elections for this reason. Effective disinformation requires data enrichment. These software capabilities must be fed by external data sources, such as previously compromised Turkish Republic personal information databases. By adding layers like the user’s phone number, address, age, and gender, highly potent disinformation applications can be created. This process allows for the acquisition of the target audience’s sociological profile; for example, if the area of residence is economically depressed, disinformation focused on financial matters is the most effective tactic.

3. The Timeline of a Lie: Simultaneous Saturation

How does a lie wash over a nation in minutes? The process I have observed in the field is a masterclass in coordination. It is not a ripple; it is a tsunami. The attack happens simultaneously across three layers:

• The Swarm: Thousands of small, incubated accounts initiate the spark.
• The Merchants: “Blue Check” verified accounts, which have been bought and repurposed, validate the lie to trick the algorithms.
• The Amplifiers: If necessary, mainstream media channels are engaged through paid advertisements or compromised journalists.

The key here is location diversity. The attack is launched from different geographical locations at the exact same second to trick the platform’s “organic trend” algorithms.

The Mechanism of Validation :

• Seeding: The lie is planted in “news sites” that appear reliable but are actually front operations.
• The Echo Chamber: Bot networks and “useful idiots” (an intelligence term for those who unwittingly spread propaganda) are activated.
• Legitimation: The topic becomes a Trend Topic (TT), and mainstream media validates the lie with headlines like “Claims circulating on social media…”

4. The Future: We Need “Police AI”

The sheer volume of AI-generated disinformation has surpassed human capacity to moderate. We cannot fight machines with humans anymore. The future of digital security relies on “Police AIs.” We need advanced AI systems designed solely to audit the outputs of other LLMs. These systems must verify information with 100% accuracy against trusted data ledgers.

Establishing AI Provenance :

Given the proliferation of AI models in the market, it is paramount to establish the origin of any AI-generated content (text, image, etc.). For this to be operational, every AI model must be mandated to possess a unique, invisible metadata ‘fingerprint’ or identifier. While some large AI providers are already implementing such systems, all new AI models entering the public market must be obligated to report this unique identifier to public institutions and regulatory bodies. This standardization is necessary to ensure analysis and attribution can be performed swiftly and accurately by intelligence organizations.

In 2025 and beyond, the only thing that can stop a rogue AI manipulating a population is a stronger, ethically coded AI policing the digital borders.

INTELLIGENCE REPORT

TECHNICAL ANATOMY OF MODERN DISINFORMATION

Infrastructure, Data Enrichment, and Attribution Protocols (2025)

Classification: PUBLIC (Redacted for General Release) Author: Ozan Akyol | Digital Intelligence Sector: Cyber Warfare & Strategic Intelligence Date: November 2025

EXECUTIVE SUMMARY

Unlike traditional cyberattacks that prioritize stealth and anonymity, modern disinformation operations prioritize “Localization” and “Persistence.” This report outlines the technical architecture of state-sponsored and private-sector influence campaigns observed in the field.

1. INFRASTRUCTURE & NETWORK ARCHITECTURE

The primary objective of the network layer is not to hide the traffic, but to make it appear indistinguishable from organic local activity.

• 4G/5G SIM Farms (The Localization Layer): Botnets no longer rely solely on datacenter IPs, which are easily flagged. Instead, operators utilize industrial-scale 4G/5G SIM Farms.
  • Operational Logic: The goal is to ensure traffic originates from a legitimate mobile carrier (e.g., a specific cell tower in Berlin or Istanbul). This bypasses “Datacenter IP” filters and mimics genuine user behavior.
• Weaponized IoT Devices: Compromised IoT devices (smart cameras, home routers) are utilized to achieve “Geo-Distribution.” By routing traffic through residential devices, the operation signals to platform algorithms that a topic is being discussed organically across the entire country, rather than a single server farm.
• Bulletproof Hosting Strategy: For the “Seeding” phase (hosting fake news sites), operators prefer Bulletproof Hosting providers located in jurisdictions with high resistance to international takedown requests, specifically USA, China, and Myanmar. The priority here is physical control and resilience against legal intervention.

2. C2 ARCHITECTURE & SOFTWARE STACK

The Command and Control (C2) infrastructure is designed for Portability and Speed, not aesthetics.

• Tech Stack: 80% of observed operations utilize a Python-based architecture. Django is the standard for User Interface (UI) development.
  • Why Python? It allows for rapid prototyping (Hot-fixes), extensive library support for data manipulation, and easy Dockerization. If a server is burned, the entire C2 infrastructure can be migrated to a new jurisdiction in minutes.
• Minimalist Design: These tools do not have polished UIs. They feature raw dashboards focused on inputting targets and monitoring volume/sentiment.

3. DATA ENRICHMENT & TARGETING (The Kill Chain)

The most lethal aspect of modern disinformation is the fusion of social media data with leaked state databases.

• Database Management: Operators use SQL-based structures (PostgreSQL/MySQL) to handle massive datasets. Python libraries (Pandas/SQLAlchemy) are employed to ingest “Dump Data” (leaked ID numbers, addresses, GSM numbers) and convert them into operational targeting lists.
• The Confidence Algorithm: Systems use a “Confidence Score” to match a social media profile with a real-world identity:
  • Match (Name + Surname + Phone): 70% Confidence
  • Match (Name + Surname + Phone + Address): 90% Confidence
  • Tactical Application: This score dictates the attack vector. High-confidence targets in economically depressed areas are targeted with financial disinformation; others may be targeted with political or social polarization content.

4. DETECTION & FORENSICS

Identifying these networks requires moving beyond simple content analysis to behavioral and visual forensics.

• Temporal Analysis: We analyze the timestamps of activity.
  • Indicator: Does the account tweet every day at exactly 13:30? Is there a human-like randomization (jitter) in the intervals, or is it perfectly linear?
• Visual Forensics (GAN Detection): Profile pictures are scanned for artifacts typical of ThisPersonDoesNotExist (GAN-generated) faces, such as asymmetric pupils, background distortion, or ear irregularities.
• Network Visualization (Maltego): While public institutions often use proprietary reporting tools, Maltego remains the industry standard for deep analysis. It is used to map the relationship clusters—visualizing who follows whom, who retweets whom, and funding sources.

Figure 1.1: Visualization of a coordinated botnet cluster targeting specific keywords. Node relationships indicate simultaneous Retweet/Quote actions, revealing the inorganic structure of the network. (Generated via Maltego).

5. ATTRIBUTION (Following the Trail)

In the cyber domain, IP addresses can lie, but money cannot.

• “Follow The Money”: Disinformation is expensive. It requires servers, thousands of SIM cards, software development, and ads.
• Attribution Methodology: Technical artifacts (e.g., comments in Russian/Chinese code) are often False Flags left intentionally to mislead. The most reliable attribution method is Cui Bono (Who Benefits?). Following the financial trail of server payments and spend similar to terror financing investigations often leads to the true perpetrator.

End of Report Access restricted to Operational and Strategic tier members.

Milipol Paris 2025 presented a markedly different atmosphere compared to previous years. The exhibition area was significantly smaller, and the overall pace of the event reflected this downsizing. Walking through the halls at a steady speed, it became clear that the entire fair could be completed in roughly 2.5 to 3 hours, leaving many visitors with the impression that this year’s edition offered considerably less material, fewer innovations, and a more muted energy.

A Noticeable Downsizing: Compact Layout, Limited Movement

The most immediate observation was the reduced physical scale of the event. Booths were positioned more closely than in past years, and the density of exhibitors despite the large names felt objectively lower. This compressed setup resulted in a faster circulation flow, but it also contributed to a sense that Milipol 2025 lacked the depth, diversity, and exploratory appeal that previously defined the fair.

Country-Based Clustering: An Arrangement That Created Distance Instead of Engagement

One of the structural choices that shaped the atmosphere this year was the decision to cluster companies strictly by country. While the intention was likely to create national showcases, in practice it led to a somewhat fragmented and less inviting environment. Instead of fostering cross-sectional interaction among companies, the country pavilions unintentionally created psychological boundaries between groups.

Many exhibitors noted that this arrangement gave the fair a rigid, compartmentalized feel reducing spontaneous engagement and limiting the natural flow of visitors across sectors.

A Clear Sign of Cost-Cutting: The Decline of Traditional Giveaways

In earlier years, Milipol was known for its abundance of branded military caps, tactical accessories, patches, and various promotional items. This year, however, the overwhelming majority of booths offered nothing beyond a simple pen.
This shift is not trivial; it reflects a broader trend across the industry:

• Firms are reducing marketing expenditures,
• Trade show ROI is being questioned more openly,
• Promotional spending is no longer seen as essential for visibility.

The minimalistic approach to giveaways mirrors the general tone of the event: lean budgets, cautious strategies, and a wait-and-see posture across the sector.

Innovation Gap: Few (If Any) New Products on Display

Perhaps the most striking aspect of Milipol 2025 was the absence of genuine novelty. Across both hardware and software domains, companies showcased products that were largely familiar iterations or re-presentations of existing solutions rather than newly launched concepts.

Notably:

• No groundbreaking surveillance systems,
• No next-generation counter-drone innovations,
• No major OSINT/SOCINT software advancements,
• No significant new tactical hardware platforms.

The fair felt more like a continuation of previous editions rather than a forward-looking showcase. Many exhibitors appeared to be present only to “maintain visibility,” not to demonstrate new technology.

Conversation with Exhibitors: “We’re Here Out of Obligation, Not Expectation”

During discussions with three to four companies, a recurring theme emerged: minimal expectations.
Multiple representatives openly admitted:

• “We’re not expecting much from this year’s Milipol.”
• “We came out of obligation rather than opportunity.”
• “Budgets are tight; this is more about presence than results.”

This sentiment was surprisingly consistent and highlights an important shift in the security and defence exhibition ecosystem. The industry appears to be navigating a transitional phase marked by budget constraints, uncertain market directions, and a reduction in high-impact product launches.

Overall Impression: A Transitional Year for the Security Industry

Milipol Paris 2025 can best be described as a quiet, transitional year. While the fair still gathered key players from across the defence, intelligence, and security sectors, the overall energy was restrained. With smaller booths, limited product innovation, cost-cutting signals, and lower expectations among exhibitors, the event reflected broader conditions in the European security landscape marked by strategic caution and reduced investment appetite.

Whether this signals a temporary slowdown or a longer-term recalibration remains to be seen. What is certain, however, is that Milipol Paris 2025 provided a clear snapshot of an industry taking measured steps rather than bold leaps.