Case File Index

Fairer than Mean Girls on X and TMZ.

The registry of every troll.fan dossier. Each file is sourced, both-sides, and scoped to the claim — the accusation and the defense at full strength, a verdict that judges the specific claim and never the person, and evidence you can check. Documented conduct only. The naturalist observes; he does not sentence.

The chips are posture, not a verdict. Documented a sourced, both-sides file — you decide; it is not a finding of guilt. Divisive a critique of specific claims, expressly not fraud. Cross-link the fuller treatment lives on evilrobots.lol / thefire.lol. Adjudicated outcomes (convictions, settlements, sanctions) are stated as such inside each file.

Security-industry figures — 31 files

Hackers, self-styled experts, and personalities whose public record the community documented. Verdicts are scoped to specific claims; several are handled with care as divisive-but-not-fraud.

Frank AbagnaleThe "Catch Me If You Can" legend against the prison records that overlap the years he claims to have been on the run.Documented Gregory D. Evans / LIGATT"World's No. 1 Hacker" branding, a wire-fraud guilty plea, and a book the analyses call heavily plagiarized.Documented Chris HadnagySocial-engineering figure; the DEF CON transparency-report ban and both sides of it.Documented Ankit FadiaThe teen "ethical hacker" brand; plagiarism findings and debunked hacks, against his own defense.Documented Carolyn Meinel / Happy HackerSeventeen claimed professional identities, disputed technical materials, and the 1999 FBI episode — stated as suspicion, never a charge.Documented John Vranesevich / AntiOnlineThe late-90s security-news impresario and the manufactured-news allegations documented against him.Documented Frank Jones / SpyKingCodex Data Systems and the DIRT surveillance tool; a federal guilty plea and debarment, from the primary docket.Documented Ian Murphy / Captain ZapThe early stolen-goods conviction, the reinvention as a consultant, and the persona vs. the record.Documented Christian Valor / se7enThe inflated statistic fed to the press, sourced to the Wired exposé that unwound it.Documented Laura CallahanThe DHS deputy CIO and the Hamilton University diploma-mill degrees; her own "I was scammed too" defense.Documented John Flowers / KozoruThe credential claims a Kansas City paper's registrar checks could not find.Documented Bill HancockThe purchased-degree findings, stated as documented allegation — nothing adjudicated.Documented Ali JahangiriThe questionable doctorate and the plagiarism analyses — percentages attributed to attrition, not asserted as fact.Documented Simon Smith / eVestigatorThe self-styled cyber-investigator, the disputed vulnerability findings, and his litigation against critics.Documented Steve Gibson / GRCA divisive expert, not a fraud: two specific technical predictions that lost, weighed against real products and a real following.Divisive Ira WinklerThe self-promotion critique — scoped to specific claims; the pen test he actually performed put back in the defense.Divisive Dan VertonThe cyber-war author and the credential critique — a criticism case, not a conviction.Divisive James Scott / ICITThe manufactured-authority case (think-tank "fellow" title) — press-documented, platform-enforced. Not Jason Scott the archivist.Divisive Marcus Hutchins / MalwareTechThe WannaCry hero who pleaded guilty to past malware and served time — a documented turnaround, not a fraud.Divisive Peiter Zatko / MudgeL0pht to the Twitter whistleblower disclosure — largely credible, weighed on the GPO-authenticated record.Divisive Kevin MitnickThe myth-construction and security-celebrity drama; the hacker-history lives on thefire, cross-linked.DivisiveCross-link Aaron BarrThe HBGary Federal "I deanonymized Anonymous" overreach and the weekend that followed. Not Barrett Brown.Cross-link Kim Dotcom / KimbleThe Kimble-era German fraud convictions (adjudicated) and the Megaupload indictment (charged, never tried).Documented Silk Road / Ross UlbrichtThe darknet market, the library-laptop bust, two life sentences, the federal agents who robbed the case — and the 2025 pardon. Charged with murder-for-hire, never tried.Divisive John McAfeeAntivirus founder to charged crypto promoter who died before resolution — the person, not the company; charged, not proven.Documented Michelle DelioTech journalist whose Wired/MIT-TR stories relied on sources editorial review couldn't verify.Documented Keith Alexander / IronNetEx-NSA director's cyber firm; SPAC hype to near-zero collapse. Verdict scoped — the shareholder suit settled with no admission.Divisive Joe SullivanEx-Uber CSO, convicted (2022, 9th Cir. affirmed) for covering up the 2016 breach — the hackers' payment routed through the bug-bounty program, hidden from the FTC.Documented Walter O'Brien / ScorpionClaimed an IQ of 197 and hacking feats the community couldn't verify; the CBS drama was built on the legend.Documented Joi ItoMIT Media Lab director who resigned in 2019 over concealed Epstein funding; DEF CON-banned in 2026.Documented Pablos HolmanInventor/futurist named in the 2026 DOJ Epstein files and DEF CON-banned — not charged with any crime; being named is not an accusation.Documented Vincenzo IozzoSecurity researcher DEF CON-banned in 2026 over an Epstein-file reference; not charged, denies wrongdoing, calls the ban "entirely performative."Documented Austen Allred / BloomTechLambda School's founder; CFPB + California orders over misrepresented income-share-agreement terms and placement rates.Documented DK Matai / mi2gThe early-2000s security firm famous for hyperbolic cyber-threat press releases and inflated damage stats. Reputational, never litigated.Documented

Hacker scene & crew drama — the scene eats its own

Forty years of the underground's own wars, busts, and betrayals — sourced to the mirrored zines and the court record. Start with Crew Rivalries, or read it as one arc on The Chronicle.

LOD vs MODThe "Great Hacker War" — banishment, a federal wiretap case, and the twist: the participants say the war was "a complete fabrication."Documented Lex Luthor / LOD founderFounded Legion of Doom in 1984 and edited its Technical Journals — the aristocracy of the BBS underground. Then he vanished; his legal identity was never publicly established. The other half of the LOD/MOD war.Documented Acid Phreak / Elias LadopoulosFounded and named MOD; when John Perry Barlow needled him in the 1990 Harper's forum, he pulled Barlow's credit report to make a point. The '92 federal case followed.Documented Corrupt / John LeeMOD's Brooklyn member and a lead character in "Masters of Deception"; the outer-borough, mixed-race crew the book framed against LOD. Indicted in 1992, pleaded, now a public speaker.Documented Scorpion / Paul StiraThe quiet MOD founder — raided in 1990, indicted in 1992, pleaded. The indictment's own analysis names him only twice, both on raid day. The one who stepped out of the light.Documented Outlaw / Julio FernandezThe MOD member who cooperated with the government — co-defendants went to prison, he did not. The snitch beat, attributed to the record. "We've just got to start hitting these sites left and right."Divisive The Antisecurity MovementADM → ~el8 / h0no / PHC "pr0jekt MAYHeM" → anti-sec → LulzSec. "Own the whitehats"; sellout = Fed enabler.Documented ADMThe elite tool crew at the root of the antisec ethos — ADM-w0rm (an early Linux worm), the DNS-spoofing kit, ADMsnmp. Release-quality attack tools and contempt for the industry that used them.Documented TESOThe Austrian exploit shop the industry feared — the 7350* series, the burneye protector, the format-string paper that shocked the field. Elite code, industry contempt, ADM's antisec sibling.Documented Goatse Securityweev + Spitler incremented a public AT&T URL to harvest 114,000 iPad-owner emails — the CFAA conviction the Third Circuit vacated. Is finding a flaw in a public URL a crime?Divisive Phineas FisherThe hacktivist who gutted the spyware vendors Gamma International and Hacking Team and published the receipts — "an anarchist revolutionary, not a vigilante." Never caught.Divisive The Disclosure WarsCiscogate, MBTA, Sklyarov: the recurring fight over whether corporate lawyers, not researchers, decide what a flaw may be spoken about.Documented GOBBLES SecurityThe anti-full-disclosure comedy act that trolled Bugtraq and ISS — own-words gold.Documented Phalcon/Skism vs NuKEThe virus-zine elitism war in 40Hex — the "everyone else is lame" purity panic, a decade before "script kiddie."Documented Phone Losers of AmericaThe prank-call crew you did not want to cross — pizza-bombing, fake classifieds, the works.Documented LulzSecThe 50-day 2011 spree "for the lulz," Operation AntiSec — brought down from the inside when its leader turned informant.Documented Operation Payback / the PayPal 14Anonymous's 2010 "Avenge Assange" DDoS on PayPal, Visa and Mastercard, the LOIC opt-in botnet, and the FBI crackdown that set up the LulzSec era.Documented Global Hell / gHDefaced whitehouse.gov and the U.S. Army in 1999 and got made into a federal example — "Global Hell is alive. Global Hell will not die." The dress rehearsal for the LulzSec crackdown.Documented Lizard SquadTook down PlayStation Network and Xbox Live on Christmas 2014 and grounded a plane with a bomb-threat tweet — "Because we can." LulzSec for the gamer era, minus the cause.Documented Lapsus$The teen extortion crew that breached Nvidia, Samsung, Microsoft, Okta and Rockstar (the GTA VI leak) and bragged on Telegram. Low-tech, high-audacity, high chaos-for-clout.Documented The WikiLeaks Schism / OpenLeaksThe 2010 breakup: Assange's #2 Daniel Domscheit-Berg walked out, took the submission platform, said he destroyed ~3,500 unpublished leaks, wrote a tell-all, and launched a rival that flopped. The CCC expelled him.Documented w00w00The most influential crew you never heard of — alumni seeded Napster and WhatsApp and led security at half the industry.Documented Cult of the Dead CowFounded in a slaughterhouse; Back Orifice, hacktivism, and alumni from Mudge to a presidential candidate.Documented Chaos Computer ClubEurope's oldest hacker club (est. 1981). The BTX bank hack, the Hackerethik, Schäuble's published fingerprint, the state-trojan teardown — and it expelled the WikiLeaks defector.Documented GNAAThe mid-2000s shock-troll collective — the CNN and MacRumors hoaxes, the Sandy Loot Crew, and weev's home crew. A parody-corporate "association" named to be un-reportable.Divisive Encyclopedia DramaticaThe satirical wiki that documented (and weaponized) troll culture from 2004 — the lulz canon, the Oh Internet user revolt, and endless hosting and libel battles.Documented The L0phtThe Boston crew that told the Senate it could make the internet unusable in 30 minutes — then merged into @stake, the sellout the antisec bloc never forgave. L0phtCrack, Mudge, and the go-legit fault line.Documented Legions of the Underground / LoUDeclared "cyberwar" on Iraq and China in 1998 — and got publicly disavowed by the whole scene (cDc, CCC, 2600, Phrack, L0pht) in a joint statement. Crew overreach, met by the community.Documented Phiber Optik / Mark AbeneBlamed by the Secret Service for an AT&T crash it caused itself; the first hacker wiretap case; the "Robin Hood of cyberspace."Documented Erik Bloodaxe / Chris GoggansThe LOD "general" and Phrack editor who went legit — "no one wants to be a 40-year-old hacker living in fear of the Secret Service."Documented Kevin Poulsen / Dark DanteRigged a radio contest to win a Porsche, went fugitive, did the era's longest hacker sentence — then co-created SecureDrop.Documented Knight Lightning / Craig NeidorfProsecuted over a leaked E911 document valued at $79,449 — that BellSouth sold publicly for $13. The founding free-press case.Documented Operation Sundevil / the SJG raidThe 1990 Secret Service dragnet and the raid on a tabletop-game company over a cyberpunk sourcebook — the overreach that founded the EFF. "They have provided us with a devil."Documented The Mentor / Loyd BlankenshipWrote the Hacker Manifesto ("The Conscience of a Hacker") in Phrack — and the GURPS Cyberpunk book the Secret Service seized as "a manual for computer crime."Documented The RealmMelbourne's crew — Phoenix, Electron, Nom — busted in Operation Dabble, Australia's first big hacking case and the plot of Dreyfus & Assange's "Underground."Documented Cameron Smith / TDCThe lone Canadian who tried to revive the Legion of Doom and crown himself its leader — and got publicly demolished by the originals.Documented K2 / ADMmutateThe exploit-dev the antisec bloc branded the enemy; author of the first public polymorphic shellcode engine. The feud, both sides.Documented GweedsThe antisecurity essayist behind the "the security industry feeds the federal police state" thesis — aimed at @Stake/L0pht.Documented RSnake / Robert HansenCoined "clickjacking" and "Slowloris" and kept the XSS Cheat Sheet the whole field cribbed from — then got waved away by a 2009 scene zine. The disclosure gadfly.Documented Thomas PtacekCo-founded Matasano — the software-security shop that audited everyone else's code and ran hiring CTFs — and became the disclosure evangelist the antisec bloc loved to hate.Documented Aleph One / Elias LevyAuthor of "Smashing the Stack for Fun and Profit" and longtime Bugtraq moderator — the disclosure gatekeeper the scene resented.Documented Solar Designer / Alexander PeslyakJohn the Ripper, Openwall, and the 1997 non-executable stack patch — a builder on the defense side of the disclosure wars.Documented Sabu / Hector MonsegurThe LulzSec leader who became an FBI informant and helped build cases against his own crew. The scene's cardinal sin, on the record.Documented Jeremy HammondThe AntiSec hacker behind the Stratfor breach, caught with the help of the informant Sabu, sentenced to 10 years.Documented The Morris Worm / Robert Tappan MorrisThe 1988 worm that crashed the early internet by accident — and became the first felony conviction under the CFAA.Documented Karl Koch / the KGB HackWest German hackers who sold US military access to the KGB — traced by "The Cuckoo's Egg." Koch was found burned to death in 1989.Documented The 414sMilwaukee teenagers who modemed into Los Alamos and a cancer center in 1983 — the Newsweek cover, the congressional hearing, and the moral panic that produced the CFAA. Ground zero for the crackdown era.Documented milw0rmTeenage crew that broke into India's BARC nuclear centre in 1998 to protest the bomb — "If a nuclear war does start, you will be the first to scream." (Not the later exploit-archive site of the same name.)Documented Grandmaster Ratte' / Kevin WheelercDc's founder and "Imperial Wizard," running the oldest group in hacking since a 1984 Texas slaughterhouse. Clean hands; the drama is the media doctrine itself.Documented Sir DysticWrote Back Orifice and dropped it at DEF CON 6 — cDc called it a security wake-up call, the AV industry called it a trojan. Both sides, on the record.Documented Oxblood RuffincDc's "foreign minister" and Hacktivismo founder who drew the line: hacktivism for human rights, but DDoS and defacement "off limits." The gatekeeping critique, attributed.Documented Deth Veggie / Luke BenfeycDc's "Minister of Propaganda" — the spokesman who made the group a press magnet. No rap sheet; the file is honest that the propaganda role is the story.Documented Beto O'Rourke / Psychedelic WarlordJoined cDc as an El Paso teenager, wrote t-files (including a murder-fantasy short story) — then ran for Senate, President, and Governor. Reuters revealed it; he confirmed it. The drama, not the politics.Documented Dan KaminskyThe researcher who saved DNS in 2008 — and got his private life dumped by ZF0 in 2009. "Walk onto a battlefield, you might get shot." Died 2021; cause stated as family-attributed.Documented Julien TinnesElite kernel/sandbox researcher named in the 2009 ZF0 owning alongside Mitnick and Kaminsky. The work is the story; the owning is one 2009 footnote, kept in proportion.Documented Adrian LamoThe "homeless hacker" who reported Chelsea Manning to the FBI — snitch to some, duty to strangers to him. He defended it on camera and never took it back.Divisive Topiary / Jake DavisThe voice of LulzSec — "the mouth of the Lulz Boat" — caught after Sabu flipped. "You cannot arrest an idea." Now a reformed public speaker.Documented tflow / Mustafa Al-BassamLulzSec's 16-year-old — convicted, then went legit harder than anyone: a UCL cryptography PhD, Chainspace (bought by Facebook), and the Celestia blockchain. The kid who outran the rap sheet.Documented TeaMp0isoN / TriCkThe crew that called "Lulzsec ARE Script Kiddies," leaked a Blair address book, and whose founder Junaid Hussain left to run ISIS's cyber wing — killed in a 2015 drone strike.Documented Mitnick vs ShimomuraThe Christmas 1994 IP-spoof into a top researcher's home machine — who then teamed with a Times reporter to run the intruder down, wrote the book, and sold the movie. The manhunt, and the fight over who exaggerated what.Documented vDOSThe biggest attack-for-hire booter on the planet — 150,000+ attacks, $618k booked — run by two Israeli teenagers, until it got hacked and Krebs put their names to it. The DDoS-for-hire era, exposed.Documented Paras Jha / MiraiThe Rutgers student who named a botnet after an anime, pointed it at Minecraft rivals, and accidentally built the record IoT flood that knocked out Krebs and then half the internet's DNS. The Mirai co-author who pleaded guilty.Documented Mir Islam / Josh the GodThe UGNazi teenager who doxed the First Lady and the FBI director on exposed.su, then swatted at least nineteen people — including the reporter covering him. The celebrity-dox-and-swat spree that defined the era.Divisive Fly / Sergei VovnenkoThe fraud-forum admin who crowdfunded a plot to mail heroin to Brian Krebs and have police called on him — then, after prison, apologized. The reporter-revenge caper, both the plot and the mea culpa.Documented L0DE Radio HourThe live call-in shock-broadcast out of the IRC underground that outlasted the platforms it started on — trolling with a signal instead of a text trail. The zine scene's loudest, longest-running act.Documented BriansClubThe stolen-card megastore that used Brian Krebs's own name and face as its logo — then got hacked itself, its 26M-card database dumped to Krebs, who killed the cards. "No. I'm the real Brian Krebs here." The troll, trolled.Documented Rescator / Mikhail ShefelThe name inside the Target-breach malware and the carder who sold 40M stolen cards — chased by Krebs for a decade, finally unmasked, and then he sat down for an interview and pitched Krebs a business deal.Documented HieuPC / Hieu Minh NgoRan one of the internet's biggest identity-data shops — "more harm to more Americans than any other convicted cybercriminal" — got lured to Guam in a sting, did seven years, and came out a whitehat. "What I was doing was just evil."Documented John Bernard / John Clifton DaviesA UK con man who fled a 12-year fraud sentence, played a fake Swiss billionaire investor, and fleeced startups out of ~$30M via "due-diligence fees" paid to a vetting firm he secretly owned. Then reinvented himself again.Divisive Punchmade Dev / Devon TurnerThe rapper who wore a working diamond card-skimmer as jewelry, dropped tracks like "Wire Fraud Tutorial," opened a card shop under his own brand — then sued his bank for freezing the money. Uncharged, still posting.Divisive Graham Ivan Clark / "Kirk"The 17-year-old who seized the Twitter accounts of Obama, Musk and Biden in July 2020 to run a Bitcoin scam from inside the company's own tools. Owned the blue-check heavens for an afternoon; pled as a youthful offender.Documented Joel OrtizA college valedictorian who became the first person convicted of SIM-swapping — stole $5M+ in crypto, flexed on OGusers, and reportedly held the "0" Twitter handle. The origin story of the SIM-swap kids.Documented The Manipulaters / Saim RazaA Pakistani phishing crew Krebs unmasked for a decade thanks to their own catastrophic opsec — who kept emailing him to beg for takedowns. "Why you destroy our lifes? We never harm anyone." Raided in 2025.Documented

Conference bans & misconduct — the scene polices its own

The other side of DEF CON growing up: the transparency-report bans and the misconduct reckoning that hit the scene's own celebrities in 2016–2017. Allegations are stated as allegations and attributed; denials and the absence of any criminal charge are kept beside them; nobody here is called guilty of anything a court has not found. See the parent DEF CON file.

Jacob AppelbaumThe Tor developer and Snowden-era privacy face who resigned in 2016 amid sexual-misconduct allegations he flatly denies as "entirely false." Banned by DEF CON and Noisebridge; charged with no crime.Disputed John Draper / Cap'n CrunchThe phreaking legend behind the 2600 Hz whistle trick — later the subject of 2017 BuzzFeed-reported misconduct allegations and a DEF CON ban. Never criminally charged in that matter.Disputed Morgan Marquis-BoireThe Citizen Lab researcher who exposed government spyware — then, per The Verge's 2017 reporting, faced multiple assault allegations. Cut by Citizen Lab, EFF, and First Look; DEF CON banned.Reported Eric MichaudBanned by DEF CON in its own words for "enabling" Marquis-Boire — a characterization that is DEF CON's, citing the Washington Post, not adjudicated and not ours. Charged with nothing.Disputed Tom AlexandrovichThe Israeli cyber-official arrested in a 2025 Las Vegas child-sex sting during Black Hat/DEF CON week. His attorney says he is "presumed innocent" and will "vigorously defend" — a charge, not a conviction.Charged

Censorship & revolving door — character under pressure

Not the machine — the people. The mechanism of the censorship-industrial complex is analyzed on evilrobots.lol; these files are the drama supplement: how each figure behaved when the pressure hit — who kept their composure, who melted down, who threatened critics, who owned it. In our failures is where we show our true grace. Documented conduct, both sides, scoped to the claim; several subjects were themselves harassment targets and are handled without pile-on.

Chris KrebsDefended the 2020 election as "the most secure," was fired by tweet and publicly threatened, then sued for defamation — conduct under pressure. (Not Brian Krebs of KrebsOnSecurity.)Documented The Disinformation Governance BoardDHS's disinfo board that lasted three weeks. Handled straight — the institutional failure, not the person (Jankowicz was a harassment target; nothing drawn from it).Documented Hamilton 68The "Russian bot dashboard" the Twitter Files showed was mostly flagging real Americans — even Twitter's own T&S chief called the methodology shoddy.Documented Renée DiRestaStanford Internet Observatory research lead. The apparatus — SIO, EIP, the flagging mechanism — is analyzed and scored on evilrobots.lol; that is where this file lives.evilrobots → Alex StamosSIO director, ex-Facebook CSO, Krebs Stamos Group. Capture-mechanism profile on evilrobots.lol.evilrobots →

The organizations (GEC, EIP, the funding pipeline) and the apparatus operators (DiResta, Stamos) are capture-mechanism — analyzed and scored on evilrobots.lol, cross-linked above, not re-litigated here. Harassment targets who behaved straight under pressure (Yoel Roth, Kate Starbird) are covered plainly on evilrobots' record and are deliberately not given a mock file here.

Organizations — 10 files

Company and institution dossiers. The record is the entity's claims and conduct; principals are named but distinguished from the org.

Crown SterlingCryptography claims rejected by named experts and the Black Hat 2019 sponsorship debacle — expert opinion attributed, company distinguished from its CEO.Documented DEF CONThe $30 cash-at-the-door hacker party that became a ~$580 institution with a code of conduct and a ban list. Capture or growing up? The price chart is its own.Divisive AxactThe world's largest diploma-mill operation (NYT, 2015) — hundreds of fake university sites; founder convicted. Diploma-mill label attributed to the NYT.Documented X TwitterThe hacker-drama rap sheet — Hacker Croll (2009) and the FTC leash, the @N handle extortion, the CEO’s own SIM-swap, the 2020 Bitcoin God-mode hack, and Mudge’s cleanup-turned-whistleblow. Same human hole, reopened for a decade.Documented Tea AppThe women’s-safety app that required a driver’s license to keep you safe, then left ~72,000 of those IDs in a passwordless bucket 4chan found first.Documented Linux FoundationThe nonprofit named after Torvalds’ kernel booked $220.7M in 2024, pays seven-figure exec comp, and lists Linux fifth — straight off its own IRS 990.Divisive Python Software FoundationApproved for a $1.5M NSF security grant, the PSF walked away rather than attest it runs no DEI programs. The board voted unanimously; both sides argued.Divisive Internet Archive vs UniversalThe world’s library, sued from two sides — it lost book-scanning as fair use at the Second Circuit, then settled the labels’ $600M+ Great 78 suit.Documented 4chan vs UK OfcomThe UK fined 4chan £520,000 for skipping age checks. Its US lawyer replied with a giant AI hamster and a First Amendment countersuit. Nobody has paid.Divisive Microsoft Worker ProtestsEmployees organizing as “No Azure for Apartheid” disrupted events and occupied president Brad Smith’s office over Azure’s Israel-military contracts. Arrests and firings followed.Documented

Investigations — on evilrobots.lol

The apparatus investigations — the EU DSA trusted-flagger regime and the disinformation funding pipeline (NSF, State, NED — money in, money out, and where the ratings landed) — are capture-mechanism, not industry drama. They are built and scored on evilrobots.lol: the Capture Leaderboard and the Revolving Door tracker. troll.fan keeps the drama receipts; the mechanism lives there.

Vendors — 15 files

Security vendors and their documented failures — breaches, outages, and the IPO-era stories. (Surveillance-vendor apparatus analysis lives on evilrobots.lol; these carry the industry-drama layer.)

CrowdStrikeThe July 2024 global outage — a kernel-level agent that bricked ~8.5M machines from one content file; the RCA, the apology to Congress, and the Delta suit.Documented LastPassThe 2022 cascading breach — ~30M vaults out via a keylogger on an engineer's home Plex server; the $150M crypto heist the feds later traced to it.Documented OktaThe identity vendor breached by proxy (Lapsus$/Sitel) and again via a personal Google account — both times, customers found it first.Documented DarktraceThe AI-washing case study — Autonomy pedigree, Goldman walked from the IPO, a short-seller report… and the audit that cleared it. Disputed, never proven.Documented MandiantAPT1 as the most lucrative press release in the industry — accurate intelligence, premiered like a blockbuster, $1B acquisition in 11 months. The mockery is the rollout, not the report.Documented SolarWindsThe 2020 Sunburst supply-chain compromise — a nation-state backdoor shipped through Orion updates to ~18,000 customers. The SEC sued the CISO over the disclosures, then saw the case dismissed with prejudice in 2025.Documented RSA SecurityThe $10M question — an anonymously-sourced Reuters report that RSA took NSA money to default a backdoored algorithm (Dual_EC_DRBG). RSA "categorically denies" it. Never proven.Divisive KasperskyThe world-class AV lab the U.S. banned on a risk determination — no public proof of a backdoor, a Commerce ban either way. Geopolitics, not adjudication.Divisive NortonThe antivirus that shipped a crypto-miner (Norton Crypto) and took a 15% cut — straight from its own terms of service. The internet reacted; Norton merged it away.Documented EquifaxThe unpatched Apache Struts flaw that spilled 147 million Americans' records — six weeks of silence, two insiders convicted of trading the secret, a ~$575M settlement.Documented YahooBreached every account it ever made — all 3 billion — hid a separate 500M breach from investors for two years, and drew the SEC's first-ever breach-disclosure fine.Documented LifeLockThe CEO printed his real Social Security number on billboards to prove identity theft was solved. It was stolen thirteen times. The FTC billed $112M across two settlements.Documented KaseyaREvil rode its VSA remote-management software through the MSP supply chain into up to 1,500 businesses over the July 4th 2021 weekend — victim of the crime, warned first per ex-employees.Documented VoatzThe blockchain voting app that ran real U.S. elections, had a prober reported to the FBI, was gutted by MIT and its own audit — then asked the Supreme Court to keep uninvited research a crime.Documented FortinetThe firewall vendor whose edge boxes kept becoming the door — an undocumented shared-password SSH login, a VPN that leaked plaintext credentials, ~87,000 devices dumped, nation-state advisories.Documented

Surveillance & spyware — 4 files

Companies whose product is watching — spyware, facial recognition, cloud cameras, phone extraction. The apparatus analysis lives on evilrobots.lol; these carry the drama and the receipts. Nothing here is a fraud finding; adjudicated outcomes are labeled inside each file.

NSO GroupPegasus — the zero-click spyware sold to governments, the "50,000 numbers" list, FORCEDENTRY, and the WhatsApp verdict that ended in a permanent injunction. NSO's answer: "Enough is enough."Documented CellebriteThe phone-cracking box law enforcement loves — until Signal's Moxie bought one, popped it, and posted the exploit. Nothing adjudicated; everything demonstrated.Documented Clearview AIScraped 70B+ faces off the open internet for a police search engine — European regulators fined it repeatedly; it is still contesting. Privacy law vs. a working product.Documented VerkadaThe cloud-camera startup whose 150,000 feeds — Tesla, hospitals, jails, a school — fell to a Super Admin password sitting on the open internet. An FTC consent order followed.Documented

Compliance & certification — 11 files

The compliance-industrial complex — the standards bodies, certifiers, and insurers that sell assurance. Critiques of the model, both sides at full strength; no fraud asserted where none is adjudicated.

PCI Security Standards CouncilThe standard every breached company was "compliant" with — Verizon's own report found zero breached firms fully compliant at breach time. Security theater, or a floor? Both sides.Divisive Heartland Payment SystemsThe 2008 mega-breach — ~100M cards via SQL injection, disclosed on Inauguration Day, certified PCI-compliant the whole time. Albert Gonzalez got 20 years.Documented TrustwaveThe QSA that certified Heartland and (allegedly) scanned Target — sued twice for blessing the compromised, both suits dropped before the merits. Never adjudicated.Divisive OWASP FoundationThe nonprofit behind the Top 10 — and the 2023 open letter alleging it sits on a multimillion-dollar reserve while flagship projects see thousands. The board says the math is wrong.Divisive EC-CouncilThe CEH certification mill — documented courseware plagiarism over years, propped up by a DoD mandate. Its own defense: blame the contractors and the tools.Documented Cyber InsuranceThe industry that pays the ransoms that fund the next ransom — and denies a meaningful share of claims. The NotPetya "act of war" fights went to court; Merck largely won.Divisive ISC2The CISSP body a federal mandate (DoD 8570) made mandatory — then practitioners called the requirement "a warning flag." A million free certs, a legacy-member fee hike, and a CEO gone without explanation.Divisive ISACAThe 50-year, 185,000-member governance body behind CISA/CISM/COBIT. No fraud, no scandal — just the unproven gap between "compliant" and "secure," and an unhappy renewal desk. The mildest file here.Divisive InfoSec InstituteThe training firm documented by Attrition.org for plagiarizing independent researchers — then selling the courses to the NSA, GCHQ, and the military per its own client list. Blamed a contractor.Documented ICSA LabsOne of the oldest security-product certifiers — a vendor-pays model where the firms it graded paid it, helped write the criteria, and got 2–4 weeks to fix failures. Closed 2022. No fraud, just the incentives.Divisive Hakin9 MagazineThe hacking magazine documented for XSS on its own login page, unpaid authors, and mass "Spam Kings" solicitations — findings attributed to Attrition.org and Robin Wood, with the 2013 reform kept at full strength.Documented

AI safety theater — 4 files

The AI-ethics and safety teams built for credibility, then cut when they frictioned with revenue. The "theater" read is ours — analytic, not a claim of wrongdoing by anyone named; each company's rationale for the reorg is carried at full strength.

Google — Ethical AITimnit Gebru's "stochastic parrots" exit — fired or resigned, still disputed — and Margaret Mitchell's firing weeks later. The ethics team that frictioned with the research it reviewed.Divisive Microsoft — Ethics & SocietyThe team cut to zero in March 2023, mid-$10B-OpenAI push. Microsoft says responsible-AI work simply moved to the Office of Responsible AI.Divisive Meta — Responsible AIThe Responsible AI team broken up in Nov 2023, its people scattered into generative-AI product. Meta calls that "integrating." The Information called it a shell.Divisive OpenAI — SuperalignmentThe team promised 20% of compute to align superintelligence — dissolved in May 2024 when both leads quit. Jan Leike: "safety has taken a backseat to shiny products."Divisive

→ the full sourced research files · troll.fan · Spiritual successor to attrition.org/errata/charlatan