JAMES SCOTT (ICIT)▊
- ALIAS
- "James Scott" · reported full name James Scott Brown, per BuzzFeed News ATTRIBUTED
- OPERATION
- Cofounder, Institute for Critical Infrastructure Technology (ICIT) — billed as "America's Cybersecurity Think Tank" FACT
- HABITAT
- The Washington briefing circuit — an ICIT forum at a Ritz-Carlton drew participants from the Marine Corps, DHS, NASA, the NSA, the White House, and the FBI, per BuzzFeed ATTRIBUTED
- STATUS
- STEPPED AWAY — "voluntarily decided to step away from ICIT," in the institute's own words, May 2018 FACT
- DISPOSITION
- Twitter suspended ICIT's account, the executive director's, and Scott's own for violating policies on "fake accounts and related behavior," Feb 2019 FACT
You think an Air Gap is a defense? Sofacy, Stuxnet, Uroburos, AirHopper, BitWhisperer and ProjectSauron…enough said!
James Scott, from one of the 40-plus cyber-books he self-published as an ICIT “senior fellow” — authority by name-drop, the house style. In 2018 BuzzFeed News reported ICIT amplified Scott’s work through a network of at least 45 fake social-media accounts. His own quotes, collected.
The specimen, observed 2013–2018 in the grand ballrooms of the capital, distinguished by a call that returns its own echo: forty-five voices, one throat. Or so the ornithologists at BuzzFeed counted.
Approach this exhibit with the care it is owed. There is no conviction in this drawer, no indictment, no civil judgment — no court has ever weighed any of it. What the record holds instead is a single, unusually complete study of authority as a manufactured product: how it is assembled, how it is amplified, and how quickly the habitat empties when the amplifier is unplugged.
The specimen disputes the central charge and gave its account on the record. You will hear it in full. That is why the archive exists. Every event below carries its receipt. Both sides get the microphone.
the drama timeline
ACT I — THE CONSTRUCTION (2013–2018)
The display structure rises with remarkable speed: books, an institute, a title, a briefing circuit. Note what the structure is made of. The field will spend Act II doing exactly that.
-
2013
The expert appears
Scott begins self-publishing books on information security — the start, per BuzzFeed and attrition.org, of his documented record in the field. His prior ventures, per BuzzFeed, included Belvedere Global Strategies, Princeton Corporate Solutions, RenuEn, Zaga Studios, and SpitFire Alliance — the last offering "1,000 LinkedIn messages to targeted industry players." Asked about SpitFire, Scott told BuzzFeed: "I don't recall. I'm not sure what that is."
-
MID-2010s
"America's Cybersecurity Think Tank"
Scott cofounds ICIT with Parham Eftekhari — a 501(c)(3) nonprofit billing itself as "America's Cybersecurity Think Tank." Its briefings are real and well-attended: BuzzFeed describes an ICIT forum at a Ritz-Carlton with participants from the Marine Corps, DHS, NASA, the NSA, the White House, and the FBI. Sponsors, per BuzzFeed, could pay to have executives listed as ICIT "fellows."
Every display structure in this drawer has a name. This one names itself for the entire habitat. Ambition, in this species, is not a private trait.
-
TO 2018
The chorus sings
Around the institute and its cofounder, an audience assembles. Per BuzzFeed's later count: at least 45 Twitter accounts with stock-image profiles and bot-pattern behavior, plus fake YouTube accounts, amplifying ICIT content and Scott's books. The commentary runs warm: "James Scott is the most important figure in cyberwar thought leadership right now. I'm completely floored by how brilliant he is." And warmer: "This man is without a doubt the most dangerous man on the planet."
Nature offers few spectacles like a bird applauding its own song in forty-five voices. The field marvelled; then it counted.
ACT II — THE COUNT (MAY 2018)
A journalist notices one spammy reply, and pulls the thread. Ten days later the ballroom is measurably emptier.
-
MAY 15 2018
BuzzFeed publishes the investigation
Craig Silverman's investigation lands: the fake-account network, the credential history, the SEO press. Eleven of the accounts are suspended by Twitter during the reporting. ICIT's statement: its social accounts "are managed and maintained by its marketing and public affairs employees" and "are not bots." Scott's response: "We've been set up … and they're not Russian; we're not sure who they are" — and "I think it's some people on the alt-right that think they're helping us."
-
MAY 23 2018
Sponsors out; cofounder out
McAfee, Centrify, Anomali, and Parsons cut ties. ICIT announces Scott has "voluntarily decided to step away from ICIT" and says it will hire a law firm to conduct "a review of the claims in the article against" him. Cofounder Eftekhari says the fake accounts were "managed by outside overseas social media management contractors," and that he was never personally involved.
Observe the flock dynamics. The sponsors, who paid to be called fellows, do not wait for the law firm's review. Capital has faster reflexes than governance.
-
MAY 25 2018
The specimen gives its account
Engadget's Violet Blue publishes "The bogus expert and social media chicanery of DC's top cyber think tank," reporting among other things Scott's use of the insult "mind midget" across sock-puppet accounts. Asked for comment, Scott replies on the record: "ICIT had outsourced its social media management to overseas contractors. I've apologized and regret not managing them more vigilantly at the time. I voluntarily resigned my duties at ICIT so that ICIT was not impacted." He adds that his ICIT books were given away free "so that 'cost' never stopped people from accessing the data," and that he never charged for public speaking or public-sector advisory.
ACT III — THE SUSPENSION, AND THE INSTITUTE AFTER (2019– )
The platform delivers its own verdict, nine months late and unappealable. The display structure, interestingly, survives its architect.
-
FEB 2019
Twitter suspends the institute — and the man
Twitter suspends three accounts: ICIT's main account, executive director Eftekhari's, and Scott's own — for violations "regarding fake accounts and related behavior, such as spamming or attempting to manipulate conversations on the platform," per Twitter as reported by BuzzFeed. Eftekhari: "There is no 'fake account' activity of any kind that the institute is actively engaging in." Scott does not respond to requests for comment.
-
EPILOGUE
The institute survives; the cofounder does not appear in it
ICIT operates today as a 501(c)(3) critical-infrastructure think tank, with fellows, co-chairs, and impact programs. Its website does not mention James Scott. The attrition.org watch-list file remains open. The archive keeps the tape running.
The rarest ending in this drawer: the nest outlives the bird, and the nest's own records do not recall a bird.
both sides, on the record
BuzzFeed's finding (theirs, not ours): at least 45 fake Twitter accounts plus fake YouTube accounts amplified ICIT content and Scott's books; his security credentials consist of self-published books begun in 2013; his prior ventures sold social-media engagement; flattering SEO articles about him were manufactured [1].
The platform's action: Twitter suspended 11 network accounts during the reporting, then in February 2019 suspended ICIT's main account, its executive director's, and Scott's own, citing fake-account and manipulation policies [1] [3].
The market's action: McAfee, Centrify, Anomali, and Parsons cut ties within days; the institute announced its cofounder's departure and a law-firm review of the claims against him [2].
Scott denies running the fake accounts. His account, on the record to Engadget: ICIT "had outsourced its social media management to overseas contractors"; he apologized, regretted "not managing them more vigilantly," and "voluntarily resigned" so the institute would not be impacted [4]. To BuzzFeed he went further: "We've been set up" [1].
The output is real. The books exist; per his statement, ICIT gave them away free, and he never charged for public speaking or public-sector advisory [4]. The institute is a genuine 501(c)(3), its briefings genuinely drew federal participants, and it operates to this day [1] [6].
Scope of the record: no crime was ever alleged, no charge filed, no court or regulator has adjudicated anything on this page. Who operated the accounts was never formally established; the findings are a news organization's investigation and a platform's terms-of-service enforcement, and the institute's own law-firm review published no public findings.
YOU DECIDE
Scoped to the claims, never the man. The claim under examination is narrow: that the authority of "America's Cybersecurity Think Tank" and its resident expert was partly a manufactured product — a bot chorus, a thin résumé, self-arranged press. That claim belongs to BuzzFeed, Engadget, and attrition.org, and the platform's suspensions and the sponsors' exits point the same way. The counter-claim — outsourced contractors, a set-up, a voluntary resignation — is Scott's, on the record, and no tribunal has ever ruled between them.
Weigh the costly signals: four sponsors paid the cost of leaving in a week; the institute kept the mission and dropped the cofounder; and the man who wrote books on information warfare says the information war was waged against him.
The archive does not judge. The archive merely keeps the tape running.
evidence locker
PRESS INVESTIGATION — THE PRIMARY RECORD HERE IS REPORTING, NOT A COURT
WATCHDOG & BACKSTORY
ICIT — icitech.org SELF-PUBLISHED — the institute today: operating, 501(c)(3), and silent on its cofounder.
icitech.org
THE DISCOURSE — LIVE SEARCH ONLY; THE PRINCIPALS' ACCOUNTS WERE SUSPENDED
The standard. Everything above is sourced to named press reporting, the platform's own enforcement actions as reported, the institute's own statements, the watchdog archive, and the subject's on-the-record responses. Facts are stated as facts; findings are stated as findings and wear their finder — "bogus expert" belongs to Engadget, "little evidence" to attrition.org, not to us. No crime is alleged anywhere on this page and none was ever charged; nothing here was adjudicated, and the page says so. The defense is presented at full strength, in the subject's own words. No motive is asserted, no private character diagnosed. The burden of proof is on us, not the subject. If it couldn't survive a defamation challenge, it wouldn't be on this page.