The FTC’s own example of what that buys you: a segment of “visitors to pregnancy centers.” Much of that location data came from ordinary phone apps, scooped up through the ad auctions that fire every time an app loads a banner.

That same pipeline from your phone, to an ad ID, to a broker, to a buyer; it sells to the government too. A federal agency that isn’t allowed to collect your location without a warrant can simply buy it from a broker who got it from your weather app. The EFF has tracked this exact data reaching Customs and Border Protection. In this transaction you are not the customer. You are the inventory.

So “privacy settings” turns out to be the wrong frame. This isn’t about hiding. It’s about cost. Every setting below makes you a little more expensive to surveil — and surveillance, like any other operation, runs on a budget. The goal isn’t to disappear. It’s to make yourself not worth the money.

Here are the five that matter on an iPhone.

The most powerful security setting is the power button

Before any of the toggles, the most important thing to understand about your iPhone is counterintuitive, and almost nobody is told it:

A phone that is turned off is dramatically harder to break into than a phone that is merely locked.

Here’s why. When your iPhone has been unlocked even once since it booted up, the keys that decrypt your data are sitting in its memory, ready to go.

Forensic tools, the ones police and border agents use, made by companies like Cellebrite, are far better at pulling data off a phone in that “already been unlocked” state.

But when a phone is powered all the way off and hasn’t been unlocked since, those keys don’t exist in memory yet. The data is a safe with the door welded shut. Leaked documents from the tool-makers themselves show that a powered-off, up-to-date iPhone is the case they struggle with most.

So the single most protective thing you can do, in any moment of real risk (a protest, a border crossing, a traffic stop) is hold the side button and a volume button until the slider appears, and power the phone all the way down. Not lock it. Off.

Everything else is settings. This is a habit. The habit matters more.

Do this now: turn on Advanced Data Protection

If you only change one setting today, change this one.

By default, a lot of what’s in your iCloud — your backups, your photos, your notes — is encrypted in a way where Apple holds a key. That’s convenient if you get locked out. It also means that if someone sends Apple a subpoena, Apple can hand over the contents. You’re trusting not just Apple, but everyone who can legally lean on Apple.

Advanced Data Protection changes that. Turn it on and those categories become end-to-end encrypted — meaning Apple itself can no longer read them. A legal demand to Apple comes back empty, because there’s nothing for Apple to hand over.

Settings → tap your name at the top → iCloud → Advanced Data Protection → turn it on.

It’ll ask you to set up a recovery key or recovery contact first. Do it, and write the recovery key down somewhere physical — because the flip side of “Apple can’t read your data” is “Apple can’t recover it for you either.” That’s the deal. It’s a good deal.

One disclaimer: this protection is strong, but it’s not untouchable by governments. In early 2025 the UK secretly ordered Apple to build a backdoor into it — and rather than comply, Apple simply switched the feature off for British users.

That should have been the end of it. It wasn’t. Under pressure from Washington the UK appeared to drop the demand that summer, then quietly reissued it aimed only at UK residents; a tribunal threw out Apple’s challenge, and as of mid-2026 the fight is still grinding through the courts — now, at least, partly in the open.

ADP is still switched off in Britain. The lesson isn’t “don’t use it.” It’s that even the best tool is a few political decisions away from changing.

The everyday baseline: four toggles for a normal Tuesday

If you’re not facing a specific threat, you’re facing the ambient one — the quiet, constant harvesting that feeds the broker economy. These four close the biggest leaks.

1. Tell apps not to track you.

Settings → Privacy & Security → Tracking → turn off “Allow Apps to Request to Track.”

This cuts the advertising identifier, the name tag every app could read to follow you across all the others. Turning it off is real and worth doing. It’s also not magic: companies fall back to other tricks.

But you’ve taken away the easy one.

2. Turn off Apple’s own ad tracking. Settings → Privacy & Security → Apple Advertising → turn off Personalized Ads.

Apple markets itself as the privacy company, and it’s better than most — but it still runs an ad business that profiles you inside the App Store and News. Off.

3. Lock down location. Settings → Privacy & Security → Location Services.

Go app by app: almost nothing needs “Always,” and most things don’t need “Precise.”

Then find System Services → Significant Locations and turn it off — that’s the quiet log of the places you go most.

4. Use a real passcode, and hide your notifications.

A six-digit PIN can be brute-forced by the same forensic tools mentioned above. A longer alphanumeric passphrase costs much more to crack with brute force.

Settings → Face ID & Passcode → Change Passcode → Passcode Options → Custom Alphanumeric Code.

And while you’re there, set lock-screen previews to “When Unlocked” so your messages don’t display to anyone holding your phone.

That’s the baseline. Fifteen minutes, and you’ve made yourself meaningfully more expensive than you were this morning.

If you’re higher-risk: organizers, immigrants, journalists

If you’re in a category where your phone could be searched or seized — at a protest, an arrest, an ICE encounter, a border crossing — the stakes change, and so does the playbook. A few additions, stated plainly, with no false comfort.

Disable Face ID before any risk moment.

Under current U.S. law, courts have more often allowed police to compel you to unlock a phone with your face or fingerprint than with a passcode you remember — the rough idea being that your face is a physical thing they can use, while the contents of your mind get more protection.

That law is genuinely unsettled and split across the country, so don’t treat it as a guarantee. But the practical move is clear: when seizure is possible, switch to passcode-only.

Squeeze the side button and a volume button until the power-off slider appears, then cancel — your next unlock will require the passcode, not your face. Or better yet turn it all the way off.

At the border, the law is weaker — and it depends on who you are.

U.S. citizens cannot be denied entry for refusing to unlock a device, though agents can seize it and hold you up.

Green-card holders are in a stronger position than visa-holders but face real pressure.

Visa-holders and visa-waiver travelers can be turned away for refusing. That asymmetry is the whole game: the same act of refusal carries wildly different costs depending on your status.

The practical guidance from the Electronic Frontier Foundation: carry as little as possible, ideally a clean travel device; keep sensitive material in encrypted cloud storage (behind Advanced Data Protection) rather than on the device; and power the phone all the way off before you reach the checkpoint.

Lockdown Mode, if you’re a target. If you have specific reason to think you’re being targeted by government-grade spyware — the Pegasus class of tool, which can infect a phone with no tap or click from you — Apple’s Lockdown Mode (Settings → Privacy & Security → Lockdown Mode) shrinks the attack surface these tools use. It’s been confirmed to block real attacks. It also breaks some everyday features, which is why it’s for people genuinely at risk, not everyone.

The honest bottom line

What actually moves the needle: Advanced Data Protection, a long passphrase, location minimization, and the habit of powering off. Those four are not theater.

What’s oversold: the tracking toggles help, but they don’t stop everything — companies have other ways to follow you, and Apple’s own collection isn’t fully switched off by its own switches. Flip them anyway; just don’t believe they make you invisible.

finally, for a person who might be searched, the physical state of the device protects you more reliably than the law does: especially if you’re not a citizen, because that’s exactly where the legal protections are thinnest.

Off beats locked.

A passphrase beats a face.

Carrying less beats carrying a fortress.

You don’t have to do all of this today. Do the power-off habit and Advanced Data Protection this afternoon. Come back for the rest.

This is part of a series on hardening the devices you actually carry. Next: Android. Companion tool — a free, no-account walk-through for getting your data off the brokers — lives at transparencycascade.org/protect. For the deepest reference, the Electronic Frontier Foundation’s Surveillance Self-Defense is the standard.

Remember Mobilewalla — the broker the FTC caught in 2024 holding 500 million people’s locations, drawn from the ad auctions inside ordinary phone apps?

On Android, there’s a single number sitting at the center of that whole machine, and you can delete it.

It’s called the advertising ID.

Think of it as a name tag your phone wears that every app can read. By itself, one app knowing you opened it isn’t much. But the ad ID is the same tag across every app, so the weather app, the game, and the flashlight can all report “this same person was here,” and a broker can stitch those reports into a single profile — where you live, where you sleep, who you’re near — and sell it.

To a marketer. To a stalker.

To a federal agency that isn’t allowed to collect it but is allowed to buy it.

So on Android, the highest-leverage privacy is pulling the name tag off.

This isn’t about disappearing — it’s about cost.

Every step below makes you more expensive to surveil, and surveillance runs on a budget.

Here are the settings that matter. Android’s menus move around between phone-makers and versions, so the paths below are the common ones — if yours is slightly different, search the Settings app for the bold word.

Do this now: delete your advertising ID

This is the one with the most leverage per second of effort.

Settings → Security & privacy → Privacy controls → Ads → Delete advertising ID. (That’s the Samsung/One UI path; on stock Android — Pixel and others — it’s Settings → Privacy → Ads. If your menus differ, search the Settings app for Delete advertising ID.)

On Android 12 and newer, this doesn’t just reset the tag to a new number — it removes it. Apps that ask for it get back a string of zeros. The durable thread that lets brokers follow you across every app, cut.

It’s not a force field. Companies have other ways to recognize you: your IP address, the specific fingerprint of your device, the account you’re logged into. But the ad ID is the easy one, the one the whole broker economy is built on by default.

Take it away and you’ve broken the cheapest link in the chain.

While you’re in your Google account, do the matching cleanup: go to myaccount.google.com/privacycheckup and turn off Web & App Activity, Location History, and Ad personalization, and set anything you keep to auto-delete after three months.

The one big idea: the most powerful security setting is the power button

A phone that is turned off is dramatically harder to break into than a phone that is merely locked.

When your phone has been unlocked even once since it booted, the keys that decrypt your data are sitting in memory, ready. The forensic tools police and border agents use — made by companies like Cellebrite — are far better at pulling data off a phone in that “already unlocked” state. Power the phone all the way off, and those keys aren’t in memory yet. The data is a safe with the door locked shut.

We know how well this works, because the tool-makers’ own capability documents were leaked. They showed Cellebrite could pull data from ordinary Android phones in most states — but a powered-off phone is the hardest case, and certain hardened phones, fully off, they simply listed as inaccessible.

This is a habit, and the habit matters more.

The everyday baseline: four moves for a normal Tuesday

1. Audit your app permissions. Settings → Security & privacy → Privacy controls → Permission manager.

Go through Location, Camera, Microphone, and the one people miss — Nearby devices. Set location to “Approximate” or “Only while using” wherever you can; a weather app does not need your exact GPS point or your location at 3 a.m. Leave “remove permissions if app unused” turned on, so the apps you forget about lose their access automatically.

2. Use Firefox with uBlock Origin. This is the one place your Android phone genuinely beats an iPhone.

Install Firefox, then add the uBlock Origin extension — it blocks ads and trackers at the network level, before they even load. (Chrome on Android allows no such extensions, and on iPhones Apple forbids this entirely.) Set DuckDuckGo as your search engine while you’re at it.

3. Use a real screen lock, and hide your notifications. Settings → Security & privacy → Device unlock → Screen lock.

A longer PIN or a passphrase, not a four-digit code. Then turn off lock-screen notification previews so your messages don’t display to anyone holding the phone.

4. Turn off Wi-Fi and Bluetooth scanning. Settings → Location → Location services → turn off Wi-Fi scanning and Bluetooth scanning.

This is the “improve location accuracy” feature, and what it actually does is let apps locate you by the Wi-Fi and Bluetooth signals around you even when your GPS is off. Few people need that; everyone has it on by default.

That’s the baseline. Twenty minutes, and you’ve gone from the easiest target in the room to one that costs real money to track.

If you’re higher-risk: organizers, immigrants, journalists

If your phone could be searched or seized — at a protest, an arrest, an ICE encounter, a border crossing — the stakes change. A few additions, stated plainly, with no false comfort.

Turn off fingerprint and face unlock before any risk moment. Under current U.S. law, courts have more often allowed police to compel you to unlock with your fingerprint or face than with a passcode you remember — your body is treated as a physical thing they can use, while the contents of your mind get more protection. That law is genuinely unsettled and split across the country, so don’t treat it as a guarantee. The practical move: when seizure is possible, restart the phone (after a reboot, most Androids require the PIN, not your fingerprint, on the first unlock) and rely on a memorized passcode.

Consider a hardened phone if this is your life, not just your worry. For people at serious, sustained risk — some journalists and organizers — there’s GrapheneOS, a stripped-down, de-Googled version of Android that runs only on Google’s Pixel phones. It adds real defenses: a “duress PIN” that wipes the phone if you’re forced to unlock it, hardware that refuses data connections over USB while locked (the exact thing forensic tools exploit), and the ability to deny any app internet access. In those leaked Cellebrite documents, fully-locked Pixels running GrapheneOS were the ones listed as inaccessible. It’s not for everyone — it can break apps, and it’s a commitment — but it’s the real thing.

At the border, the law is weaker — and it depends on who you are. This is the paragraph to read twice. U.S. citizens cannot be denied entry for refusing to unlock a device, though agents can seize it and hold you up. Green-card holders are stronger than visa-holders but face real pressure. Visa-holders and visa-waiver travelers can be turned away for refusing. The same act of refusal carries wildly different costs depending on your status. The practical guidance from the EFF: carry as little as possible, ideally a clean travel device; keep sensitive material in encrypted cloud storage, not on the phone; and power the device all the way off before you reach the checkpoint.

Turn off 2G. Settings → Network & internet → SIMs → disable 2G. Cell-site simulators — the fake cell towers police use to sweep up phones at protests, sometimes called Stingrays — generally work by forcing your phone down onto old, insecure 2G. Refusing 2G closes that door.

The bottom line

What actually moves the needle: deleting the ad ID and minimizing your Google account, a strong screen lock, and the habit of powering off. Those are not theater.

What’s oversold: the tracking toggles help, but they don’t make you invisible — your IP and device fingerprint still identify you, and Google’s location logging hides in more than one switch. Flip everything anyway; just don’t mistake it for a cloak.

And the one truth under all of it: for a person who might be searched, the physical state of the device protects you more reliably than the law does — especially if you’re not a citizen, because that’s exactly where the legal protections are thinnest. Off beats locked. A passphrase beats a fingerprint. Carrying less beats carrying a fortress.

You don’t have to do all of this today. Delete the ad ID and learn the power-off habit this afternoon. Come back for the rest.

This is part of a series on hardening the devices you actually carry. Next: your laptop. Companion tool — a free, no-account walk-through for getting your data off the brokers — lives at transparencycascade.org/protect. The deepest reference is the Electronic Frontier Foundation’s Surveillance Self-Defense.

The patent is US 12,236,780 B2, “Systems and Methods for Electronic Signature Tracking and Analysis.” It was granted on February 25, 2025, to Leonardo US Cyber and Security Solutions — the American arm of Leonardo, the Italian defense conglomerate. It is the second patent in a family behind a product called ELSAG SignalTrace. And the specification describes, in the company’s own filing, two striking capabilities.

The first: once the system has watched you a few times, it no longer needs the camera.

In the patent’s words, it “will be able to detect the likely presence of a vehicle and its associated license plate without visual information, e.g., without the use of a camera.” The license-plate reader is the training wheel. Once the model learns you, the reader can come off.

The second is the one that moves this out of surveillance and into something closer to prophecy. The system, the patent says, “allows an investigator to forecast the presence of a violation type, vehicle, or group of vehicles across time and location.”

Not where you were. Where you will be.

Nobody reported this patent. The story that ran last month — and it was a good one — was about the first patent, and the product it powers.

This is the part that came after.

The story so far

If the phrase “reads the devices in your pockets” doesn’t ring a bell, here is the reporting that should get you current, because other people did the hard first work.

In June, Joseph Cox at 404 Media obtained and published the product sheet for ELSAG SignalTrace and laid out what it is: a system that bolts onto the license-plate-reader cameras already blanketing American roads and, instead of just reading your plate, it reads the radio signals your devices are constantly broadcasting. Alisa Valdes-Rodriguez, at her investigative newsletter The Pugilist, carried it forward — the earlier patent, the marketing push, the fact that police in states like New Mexico can already buy Leonardo’s gear off existing contracts. And Proton — the encrypted-email company — pulled Leonardo’s own brochure and product page into the light.

Here is what that brochure says, in Leonardo’s own words. SignalTrace builds what it calls a “unique, trackable ‘electronic fingerprint’” from the devices you carry. Its list of “Tracked Device Types” is not vague. It names key cards. Wearables — “watches, fitness trackers.” Wireless headphones. Your car’s tire-pressure sensors and infotainment system. And, in a detail that reads like satire until you sit with it, your pet’s microchip.

The company is careful to say it captures “only publicly broadcast device frequency activity” and does not read the contents of your messages. That is true, and it is beside the point. It doesn’t need your messages. It needs the constellation. As the brochure puts it, the system “recognizes vehicles by electronic fingerprint — even without a visible or correct plate.” Change your plate, remove your plate: the watch on your wrist and the sensors in your tires still say it’s you.

That was the June story: the plate reader had learned to track the person instead of the car.

What the second patent adds

Which brings us back to the patent nobody covered.

The first patent — US 11,941,716 B2, granted in March 2024 — is about collecting. Gather the device signatures, correlate them with the plate, timestamp the location, build the fingerprint. It is a surveillance system, and a bad one, but it is a system for recording the past. It answers the question was this person here.

The 2025 patent adds one word to the title — Analysis — and with it, a different question. Not was this person here but where is this person going. The forecasting language is right there in the filing. So is the no-camera capability: the system, once trained, can flag your “likely presence” with no visual confirmation at all. Put the two together and you have a system that can predict where a named individual will be, and register that they were there, without a single camera in the frame.

That is not a plate reader anymore. That is a pre-crime engine, patented and on the shelf. A continuation application filed in January 2025 is still pending, so the family is still growing.

What is known and what is unknown

No police department is known to be running SignalTrace. Not one. Every reporter who has touched this story — 404 Media, Valdes-Rodriguez, Proton — went looking for a deploying agency and found none.

What exists is a patent, a product brochure, and a sales pitch. The correct sentence is built, patented, and being sold — not necessarily being used on you.

And it cannot reliably track your phone. Modern phones rotate their Bluetooth and Wi-Fi identifiers precisely to defeat this kind of tracking, and for an updated iPhone or Android, that mostly works.

The devices that give you away are the dumb ones: the tire-pressure sensor broadcasting a fixed ID, the RFID chip in your work badge, the pet microchip under your dog’s skin. Those don’t rotate. Those don’t hide.

Neither caveat is comforting.

The system doesn’t need to crack your phone.

It needs your car, and your headphones, and your keychain.

Follow it home

One more fact, because it changes the shape of the thing. The company that holds these patents is controlled by the Italian government, which owns the single largest stake in Leonardo and appoints most of its board. Leonardo already sells its plate readers directly to American law enforcement — to Immigration and Customs Enforcement and the Drug Enforcement Administration, on the public record. So the pipeline for the person-tracking upgrade is not hypothetical. The buyer relationship exists. The product is built.

The patent that turns it predictive was granted a year and a half ago.

That is the whole architecture of the thing, and it is why the pet microchip stays with me. You did not consent to be tracked by your dog. You did not do anything wrong. You just exist in a world that is quietly wiring itself so that existing is enough — so that the signals leaking off the ordinary objects around you can be gathered, fingerprinted, and, now, run forward in time to guess your next move.

The cameras were always the least of it. The cameras were just teaching the machine what you look like from the inside of your own pocket. The patent says it doesn’t need them anymore.

Patent:

https://patents.google.com/patent/US12236780B2

On February 9, 2024, Instagram and Threads quietly became different platforms. Mark Zuckerberg announced that political content from accounts you don’t already follow would no longer be recommended to you by default — no more surfacing in Explore, no more Reels suggestions, no more popping up in suggested accounts.

The announcement landed in a blog post and a round of press coverage. Then it faded.

That setting is still running.

It has been running for over two years.

If you joined Instagram after February 9, 2024, you have never seen a political post from an account you don’t follow surface in your discovery feeds.

You were not told. You were not given a choice. The choice was made for you, set to OFF, and the platform moved on.

The 2026 midterms are six months away.

What Was Actually Announced

Zuckerberg’s announcement used the phrase “won’t recommend.” The framing was deliberate. Meta said the platform would no longer proactively surface political content from accounts users don’t follow. Washington Post reported it as Meta stepping back; TechCrunch called it Instagram and Threads declining to “proactively” recommend political content; Variety ran the same language. The Instagram official blog post described the move as respecting user preferences.

“Won’t recommend” sounds like restraint. Like the platform stepping back, giving you space.

What it describes is a default-state change. Political content from accounts you don’t follow — the entire discovery layer through which new political voices reach new audiences — was switched to suppressed by default. Users who want to see that content must navigate to settings, find the toggle, and turn it on. No prompt appeared when the change happened. No in-app notification told existing users the settings had changed. New users who joined after February 9 inherited the suppressed default without being told it existed.

“Users can turn it on” is true. “Users were told it was turned off” is false.

The surfaces affected were exactly the ones that matter for political discovery: Explore, Reels recommendations, and suggested accounts. Content from accounts you already follow continues to appear in your feed. The suppression falls specifically on the discovery layer — the surfaces where political voices without large existing followings build reach, where grassroots organizations find new audiences, where candidates who aren’t already famous get found.

Political content didn’t disappear.

It became invisible in the spaces where new audiences form.

How the Toggle Suppresses

The February 9, 2024 announcement works through three components that, combined, work differently from ordinary content moderation.

First: binary opt-in, not opt-out. The default is not “reduced” political content. It is no recommended political content from non-followed accounts. The toggle is binary. A user who doesn’t know to look for it doesn’t get a softened experience — they get none of the discovery-layer political content that the platform would otherwise surface.

Second: no user notification. Existing users were not told. Meta published a corporate blog post. There is no record of Meta sending users an in-app prompt, an email, or a settings-screen disclosure explaining that their political content visibility had been reduced as of that date. For the hundreds of millions of users who don’t follow platform-policy news, the change happened and they never learned it had.

Third: continuous new-user inheritance. Every user who created an Instagram or Threads account after February 9, 2024 has never experienced the platform with the political discovery layer enabled. They have no pre-change baseline to compare against. To them, this is just how Instagram works.

The persistence dimension is the part that doesn’t make headlines. The setting has been running since February 2024.

A candidate running for Congress in a competitive district in 2026 whose campaign account was built for Instagram’s discovery features has been operating in a suppressed-reach environment since before the 2024 cycle, and will be in the same environment for the 2026 midterms.

When Political Content Became a Liability

Meta didn’t frame the change as a business decision. They framed it as a user-experience improvement, a response to feedback that political content was generating negative experiences. That framing isn’t false. Political content on social platforms does generate negative user experiences. That is partly why it is engaging. Engagement is what pays.

By early 2024, political content recommendation had become a liability for Meta’s business model. Congressional scrutiny over the 2020 election cycle and the January 6 period. Advertiser pressure. Regulatory exposure in the EU under the Digital Services Act. The engagement calculus had flipped — political content was generating regulatory attention and advertiser anxiety faster than it was generating revenue. When political content became a net negative for the business model, removing it from recommendation defaults was the choice that protected revenue.

This is not a claim about intent. It is a claim about function. The political de-recommendation was not a principled editorial intervention. It was what happens when political content becomes a liability rather than an asset and the business follows the money.

The June 2024 “political filter bug” — in which Meta’s political content filter accidentally suppressed content outside the policy’s intended scope — makes the mechanism visible. The bug was not an editorial misjudgment. No human editor had made a call that was too broad. The algorithm was running the suppression, and when it continued filtering political content for users who had opted in to see it, Meta logged it as a bug and fixed it. The code was driving the result, not anyone’s judgment about a story. (Timing note: the bug surfaced just before the first 2024 presidential debate.)

The Asymmetry

The political content default change did not affect all political accounts equally.

A politician with two million followers who posts political content: her followers already see it. The recommendation suppression has limited marginal impact. When your audience is already there, you don’t need discovery.

A grassroots organization with twelve thousand followers that built half its audience through Explore and Reels recommendations: the suppression is material. The discovery layer was how they grew. It’s gone by default now, accessible only to users who know to find the toggle.

The mechanism lands hardest on political voices without large existing followings — smaller candidates, advocacy organizations, new political movements, independent journalists, organizers whose reach depended on the platform surfacing their content to people who weren’t already looking for them. The already-established faced less impact. The less-established faced more.

The default produces that gap whether or not anyone intended it.

Pope Leo XIV Names the Mechanism

On May 25, 2026, Pope Leo XIV published Magnifica Humanitas. The encyclical addresses technology, labor, human dignity, and the social consequences of algorithmic systems at length. (The RAMM covered the encyclical’s broader argument and its pairing with Arendt in The Encyclical & The Antichrist.) Paragraph 171 is the load-bearing passage for the Meta mechanism:

“A further risk, less visible but no less serious, is that of social control made possible by the massive collection of data and use of algorithmic systems. When every action—movements, purchases, relationships and preferences—leaves a trace, a new form of power emerges, namely the power to profile, predict and influence behavior, often without individuals being fully aware of it. If such kinds of data are used to make decisions affecting concrete opportunities — such as access to credit, employment or essential services — there is a risk of undermining freedom and discriminating against the most vulnerable. Furthermore, control is exercised not only through explicit prohibitions, but also through the architecture of visibility: what is amplified or rendered invisible, what is rewarded or penalized, ultimately shapes opinions and choices, fostering conformity and self-censorship.”

Magnifica Humanitas does not contain the words Meta, Facebook, Instagram, Threads, or Zuckerberg. Leo XIV deliberately names the mechanism without naming the platform. This is methodological precision, not evasion — a doctrinal document that names a current executive is tied to that executive’s news cycle and loses its authority when the executive changes. A document that names the mechanism survives every corporate realignment, every political cycle, every succession announcement.

Section 171 of the encyclical’s language maps to the Meta mechanism point by point:

“Less visible but no less serious” — the political-toggle generated a brief news cycle in February 2024 and then largely faded. The setting kept running. The silent toggle is less visible than the January 2025 fact-checking rollback, which was announced, controversial, and publicly debated. The silent default is the less-visible instance Leo is describing.

“Often without individuals being fully aware of it” — users are not aware the toggle exists. New users have never learned it was ever otherwise.

“Control is exercised not only through explicit prohibitions” – Meta banned nothing. No content was removed. No account was suspended.

“Through the architecture of visibility” – the recommendation infrastructure was changed. What discovery surfaces was restructured.

“What is amplified or rendered invisible” – political content from non-followed accounts was rendered non-recommended. Not invisible in absolute terms. Invisible in the discovery space where audiences form.

“Fostering conformity and self-censorship” – when political creators and campaigns learn that political content does not reach new audiences on Instagram by default, they adjust. They optimize toward content that performs better in the new environment. The architecture shapes behavior without requiring a prohibition.

Leo names the class. This piece names the instance. Together they are stronger than either alone.

What the Pelley Firing Has in Common With a Toggle

On June 3, 2026, Scott Pelley was fired from 60 Minutes. The Pelley firing operates at a different layer — editorial rather than algorithmic — and through a different mechanism: an anchor removed from a broadcast news program rather than a recommendation toggle set to OFF on a social platform.

Neither event involves an explicit prohibition. Meta did not ban political content. CBS News did not prohibit political journalism. In both cases, reach is reduced through mechanisms that don’t register as censorship in the conventional sense — no government action, no court order, no formal rule prohibiting content. One is a default-state change in an algorithm. The other is an editorial personnel decision. Both reduce the reach of a category of political speech without issuing a prohibition on it.

The distinction that matters: the Pelley firing is public. It generated press coverage, institutional commentary, discussion about editorial independence at CBS News. The Meta political-toggle is silent. It generated a news cycle in February 2024 and then continued running without further controversy while millions of new users joined and inherited the suppressed default without knowing.

Visible suppression generates accountability. Silent suppression compounds.

This is the property Leo XIV is naming in §171 — the risk that is “less visible but no less serious.” The visibility of the intervention determines whether it generates scrutiny. The Meta mechanism was designed, intentionally or not, to generate none.

The Calendar

The February 9, 2024 political-toggle has now been running for over two years. Here is what has not happened in that time:

Meta has not sent users a retroactive notification explaining that political content from non-followed accounts was suppressed in their discovery feeds since that date.

Meta has not published a transparency report showing the cumulative reach impact on political content — how many impressions were not delivered, to how many accounts, across what categories of political content.

Meta has not changed the toggle’s default from OFF to ON.

New users who join today still inherit the suppressed default without being told.

The 2024 presidential election cycle ran under this default. The 2026 midterms will run under it too. A competitive House race in which a challenger’s campaign depends on Instagram discovery to reach voters who aren’t already following them is running in an environment where that discovery is suppressed by default for every potential new follower who hasn’t found the settings toggle.

The mechanism is not time-limited. It was not a temporary election-safety measure. It is the default state of Meta’s recommendation infrastructure for political content, and it will be the default state when voters in November 2026 are making up their minds.

What This Is and Isn’t

This is not a claim that the political-content default suppression determined 2024 election outcomes. The mechanism is documented; the specific causal pathway from mechanism to electoral result is not.

This is not a claim that Meta designed the toggle to benefit one party over another. The mechanism that lands hardest on smaller political voices with fewer existing followers produces partisan asymmetries, but the mechanism’s logic is engagement-economics, not partisanship. The documented finding is what the mechanism does, not what was intended.

This is not a claim that silent defaults are inherently illegitimate. Platforms make default decisions constantly. This is a claim about a specific kind of silent default — one that restructures political-speech discovery without user notification, during an election cycle, with persistent effects on new-user cohorts who join without ever learning the configuration they’ve inherited.

The precise claim is the one that is hardest to refute and most important to name: Meta made a choice on behalf of its users about what political content they would encounter in discovery feeds, did not tell them, and has continued not telling the users who have joined since.

Leo XIV names what that is: control exercised through the architecture of visibility.

What Comes Next

The silent default is a documented mechanism with two years of operational history. What would accountability for it look like?

The Digital Services Act, which applies to Meta’s platforms in the European Union, requires risk assessment reports under Articles 34 and 35 for designated Very Large Online Platforms. Those reports are supposed to disclose systemic risks including to civic discourse and democratic processes. Whether the February 2024 political-toggle and its silent-default-without-notification mechanism appear in Meta’s DSA disclosures, and how they are characterized if they do, is a live regulatory and journalistic question.

In the United States, there is no equivalent disclosure regime. No platform is legally required to notify users when recommendation defaults change. No federal transparency requirement covers the cumulative reach impact of default-state changes on political content.

The 2026 midterms will be the second federal election cycle that runs under this default. The outcome of those elections will be shaped in part by which political voices reach new audiences through discovery feeds — and which don’t, because the platform that, as of 2025, serves three billion monthly users decided, in February 2024, that political content would be suppressed by default in the spaces where new audiences form.

Most users still don’t know.

The mechanism has a name now: the architecture of visibility. A pope named it in May 2026. The journalism is naming the instance. The reader gets to reckon with what that means between now and November.

Sources

Primary Timeline Events: - Meta silent-default political-content suppression (February 9, 2024) - Meta Fixes Bug in Political Content Filter (June 26, 2024) - 60 Minutes Phase 5: Pelley Fired; CBS Capture Complete (June 3, 2026)

Reporting: - Meta won’t recommend political posts on Instagram and Threads (Washington Post, February 10, 2024) - Instagram and Threads will no longer ‘proactively’ recommend political content (TechCrunch, February 9, 2024) - Meta’s Instagram, Threads Will Stop Recommending Political Content (Variety, February 9, 2024)

Primary Source — Doctrinal: - Pope Leo XIV. Magnifica Humanitas, §171. Holy See / vatican.va. May 25, 2026.

Cascade-Research Context: - Pattern — algorithmic suppression - Pattern — media capture

She had not threatened anyone. She had not done anything that morning except hand people ballots. The agents were there because of a sentence she had typed into a phone five months earlier.

She refused to sign. She did not delete the post. “For ICE to come to me over a social media post,” she told reporters afterward, “just feels very 1984 to me.”

Hold the scene in your head, because everything that follows is in it. On one side, a woman with an Instagram account. On the other, two armed agents of the federal government, a manila folder of her physical particulars, and a letter that names the prison. Three powers are in that room: the power of the badge, the power of the gun, and the power of the prison. That is not a balanced encounter.

What she actually posted

Back up to January. On the 7th, an ICE agent shot and killed Renée Nicole Good, 37, a poet and mother of three, in a residential Minneapolis street during Operation Metro Surge — the federal immigration-enforcement surge into Minneapolis that began that month. She was sitting in her Honda Pilot. Video showed her turning the wheel away from the agent in the seconds before he fired at least three times. Her last words, spoken calmly: “That’s fine, dude. I’m not mad at you.” (The RAMM covered the killing and its aftermath at length — the incident breakdown, and the pipeline that put that agent on that street.)

The next day the Minnesota Star Tribune identified the agent as Jonathan Ross. Gonyea shared that identification on Instagram and added one line: “I think today is a great day for Jonathan to be indicted.”

That is the entire predicate. Read it again. It cites a tier-one newspaper for the agent’s name. It calls for an indictment — a legal process, a grand jury, due process of law. It is the thing the Constitution was written to protect: a citizen petitioning, in public, for the government to hold one of its own to account.

Ross has not been charged. He has not been investigated. Within a day of the shooting the FBI revoked Minnesota’s state investigators’ access to the evidence and the state probe collapsed; six federal prosecutors later resigned rather than do what the Justice Department asked, which was to investigate Good’s widow instead of the man who killed her. Calling for Ross’s indictment was not a fringe demand. It was the demand a functioning justice system would have met on its own.

Five months later, that sentence was the reason two agents could assemble Gonyea’s home address and walk into her workplace.

The pretext database

Her Instagram was not evidence of a crime. It was a search term.

To see how a public post becomes a target, you have to look at the directive sitting underneath the whole apparatus. On September 25, 2025, the President signed National Security Presidential Memorandum 7, “Countering Domestic Terrorism and Organized Political Violence.” For the first time in American history, a federal directive names beliefs — not acts — as indicators of terrorism: anti-capitalism, anti-Christianity, “anti-Americanism,” “extremism on migration.” The Brennan Center found it “ungrounded in fact and law,” citing no statute and no constitutional provision. It does not mention the First Amendment at all.

On December 4, Attorney General Pam Bondi issued the memo that turned the directive into operations. It ordered the FBI to compile lists of targeted groups, to run a five-year retroactive review of its own files, to stand up a cash-reward system for citizen informants, and to instruct prosecutors to charge “the most serious, readily provable offenses” — conspiracy, RICO, material support for terrorism. The Joint Terrorism Task Forces were told to map “the full network of culpable actors.”

The directive defines the beliefs. The memo builds the machine that hunts for them. What it does not supply — what it cannot supply, because beliefs are not crimes — is evidence. So the apparatus needs something to search. It needs a place where a citizen’s opinions, movements, associations, and physical particulars already sit, indexed and retrievable.

That place is your digitized life. It is the same material a poll worker’s Instagram is made of. The post is not proof of a threat. It is the index entry that lets the machine find you and decide, after the fact, what to call you.

The notice accuses itself

Gonyea posted the notice she was handed, so we don’t have to rely on anyone’s paraphrase. It runs on ICE letterhead, headed in bold: YOU MAY BE IN VIOLATION OF FEDERAL LAW. It says the agency’s Office of Professional Responsibility “has identified an Instagram post handle, ‘TURNDAPAIGE OFFICIAL’” — her account, the one carrying the indictment post — “which it has reason to believe may constitute a violation of Title 18.” It requires that she “promptly remove and/or discontinue the aforementioned behavior.” And it adds, in the flat language of a form, that “receipt of this Notice will be taken into consideration, should you continue.”

Read that last line again. The notice does not allege a completed crime. It demands she take down constitutionally protected speech, and it warns that whatever she says next will be counted against her. That is not law enforcement. It is a record that her future speech is now on file — the pre-crime logic of NSPM-7, reduced to a single page with a signature line.

Then comes the part worth holding up to the light. The notice warns her against two federal crimes. One is threatening to assault, kidnap, or murder a federal official. The other — and here the document accuses itself — is the federal anti-doxxing law: knowingly making a person’s “restricted personal information” public in order to threaten or intimidate them. ICE served that warning on a woman by handing her a folder that held her name, her home address, her date of birth, her height, her weight, and the color of her eyes. The agents who came to accuse her of exposing someone’s private particulars arrived with a dossier of hers. They cited the law against doxxing while doing the doxxing.

And neither crime is hers. To threaten under the first statute, you have to make a threat; she asked for a grand jury. To violate the doxxing law, you have to publish someone else’s private information to facilitate violence; she shared a newspaper’s identification of a public official and called for him to be indicted. The Department of Homeland Security later told NPR that she had “committed a federal crime by publishing an ICE officer’s address online.” Her post contained no address. The accusation was not a description of what she did. It was a reason, assembled after the decision to come for her had already been made. The law cited does not fit — because the law cited was never really the charge. The charge was the opinion.

The loophole that makes the database theirs

Here is the part that should change how you think about the phone in your pocket.

On March 18, 2026, FBI Director Kash Patel testified under oath before the Senate Select Committee on Intelligence. Senator Ron Wyden asked him a direct question: “Can you commit to not buying Americans’ location data?”

Patel would not. “The FBI uses all tools, Senator,” he answered, “thank you for the question, to do our mission.” Pressed on the practice itself, he confirmed it: “We do purchase commercially available information that’s consistent with the Constitution and the laws under the Electronic Communications Privacy Act.”

Set that beside what the FBI told Congress three years earlier. In 2023, then-Director Christopher Wray testified that the Bureau had bought location data in the past but, “to my knowledge, we do not currently purchase commercial database information that includes location data derived from internet advertising.” Two directors, the same question, opposite answers. In 2023 the Bureau implied it had stopped. In 2026 its Director confirmed, on the record, that it buys.

The reason this is legal is a single gap in the law. In Carpenter v. United States (2018), the Supreme Court held that the government needs a warrant to compel long stretches of your location data from your phone carrier. But Carpenter says nothing about what the government may buy. So the agencies buy. Your location, your movements, the bed-down address where your phone sleeps every night — all of it is for sale on the open commercial market to anyone with a credit card, the federal government included. Wyden has a name for it: “an outrageous end-run around the Fourth Amendment.”

This is the same market that already produced one body. As the field guide laid out, the man who assassinated Minnesota House Speaker Melissa Hortman and her husband in their home had, in his car, a notebook listing eleven commercial people-search sites annotated by cost, and beside Hortman’s name, her home address. He bought the door. The brokers did not pull the trigger; they sold him the coordinates. The FBI shops in the same aisle, without a warrant. Gonyea’s dossier — the height, the weight, the address — is the retail version of the same product.

The asymmetry, and the word for it

The terror in this story is not the post. It is the badge.

A poll worker called, in public, for a legal process — and armed agents of the state arrived at her job with her physical description and the threat of prison. The threat is the point. The domestic-terrorism designation is not being used here to describe anyone’s conduct; it is being used as a weapon, and the weapon is the implied power to make a person disappear into the federal system for the crime of having an opinion. That is what terror, precisely, is: the use of force, or the threat of it, to coerce a population into silence. By that definition, the apparatus in this story has the word exactly backwards. It has named the dissenter the threat while functioning as the thing it claims to hunt.

The third power in the room — the power of the prison — is not theoretical.

The carceral proof arrived the same day Gonyea got her letter. On June 23, a federal judge in Texas sentenced the defendants from the July 4, 2025 protest at the Prairieland ICE detention center. Benjamin Song, the only one convicted of attempted murder, got 100 years. Maricela Rueda got 70. Five others — including a woman tied to an anarchist book club — got 50 years each. And Daniel Sanchez Estrada, who was not present at the protest, got 30 years for moving a box of antifascist zines after the fact: a conviction for concealing documents, not for terrorism, not for violence. These sentences are longer than any handed down to a January 6 defendant who stormed the Capitol. The antifa-terrorism framing that produced them was applied retroactively, after the protest, to upgrade ordinary charges. (As the investigative reporter Ken Klippenstein has argued of this apparatus, the logic is pre-crime — the government acting on what people might do, defined by what they believe. The indictments are public record; the pre-crime reading is his analysis, and a sound one.)

Thirty years for a box of zines is the answer to anyone who thinks the letter handed to Gonyea was an empty gesture. The designation is not a description. It is the threshold of a prison, and the state has shown exactly how far past that threshold it is willing to go.

The data-broker market that armed Gonyea’s dossier remains unregulated. No federal action against the brokers. The Fourth Amendment Is Not for Sale Act, which would require a warrant before agencies buy your data, passed the House in 2024 and died in the Senate; Wyden’s Government Surveillance Reform Act would do the same and is sitting, unmoved, in committee. The asymmetry is not an accident of enforcement. It runs in one direction because it was built to.

Back to the field guide, harder

The field guide told you to shrink your footprint — opt out of the brokers, switch your tools, make yourself expensive to surveil. Some readers took that as privacy hygiene, a tidy habit like flossing.

It is not hygiene. The footprint is the pretext database. The beliefs that count as a threat have already been written down, signed, and distributed across ten agencies. The market that sells your coordinates already operates without a warrant. The sentences that prove the threat is real have already been handed out, in years, to people who moved a box.

Gonyea did the one thing that still works: she refused. She did not sign, she did not delete, and she said the word 1984 out loud, on the record, so the rest of us could see the shape of the thing. The tools in the field guide buy you a little of the room she stood in. Use them — not because privacy is comfortable, but because, under a government that has made a public opinion into a search term, the footprint you leave is the file they open when they decide it is your turn.

Sources

• ICE OPR “Warning Notice” (full text): published by Gonyea on her GoFundMe and Instagram; reviewed by The RAMM. Substance corroborated by the Syracuse.com / NPR / Common Dreams reporting above; the §115(a)/§119 statutory citations appear in the document she published (the doxxing/threat substance is confirmed by reporting; outlets did not print the section numbers).

• Paigelynne Gonyea, Syracuse confrontation: “She posted about ICE. Five months later, DHS agents told her to take her post down” (NPR, June 26, 2026); “ICE agents confront New York poll worker during voting” (Democracy Docket); “‘Feels Very 1984’: ICE Agents Push Poll Worker to Delete Post” (Common Dreams) — letter wording, ICE OPR, Central Library, Instagram caption.

• Patel testimony, Wyden question, Wray 2023 reversal, Government Surveillance Reform Act: “FBI is buying location data to track US citizens” (TechCrunch, March 18, 2026); corroborated by Gizmodo and the Washington Times (March 19, 2026); see also NPR (March 25, 2026).

• Renée Good killing and the Jonathan Ross identification: ABC News and The Guardian (Jan. 9, 2026); NPR on the prosecutor resignations (Jan. 13, 2026); the Minnesota Star Tribune agent identification.

• Prairieland sentencing (corrected canonical figures): “Prairieland Texas ICE protest prison sentences” (The Intercept, June 23, 2026); “Alleged antifa members in Texas get maximum sentences” (Washington Post); Al Jazeera.

• NSPM-7 and the Bondi implementation memo: “Countering Domestic Terrorism and Organized Political Violence” (White House, Sept. 25, 2025); ACLU and the Brennan Center analyses; Democracy Now / Ken Klippenstein on the leaked memo (Dec. 8, 2025); Arnold & Porter, “DOJ Issues Sweeping New Domestic Terrorism Directive.”

• Carpenter v. United States, 585 U.S. 296 (2018); Fourth Amendment Is Not for Sale Act (H.R. 4639), Brennan Center, “Closing the Data Broker Loophole.”

• Companion piece: “Make Yourself Expensive: A Field Guide to Shrinking Your Data Footprint” (The RAMM, June 24, 2026).

Here’s the field guide.

I’d spent an hour, not long before, on the Culture, Faith, and Politics podcast with Pat Kahnke, talking about Peter Thiel, the Pope, and the surveillance economy the encyclical calls “data colonialism.” Near the end, Pat asked the question that always comes — the one that matters most: all right, so what can an ordinary person actually do? I promised I’d write it up. This is that piece. It’s also built to last: I’m keeping a permanent, updated version in the Resources section so it doesn’t rot the way a single post does, because the tools change and the advice has to keep up.

In the summer of 2025, a man assassinated the Speaker of the Minnesota House, Melissa Hortman, and her husband in their home. When investigators searched his vehicle, they found a notebook. In it was a list of eleven people-search and data-broker websites — Spokeo, TruePeopleSearch, Intelius among them — annotated with what each one cost and what information each one required. Beside that list was a roster of more than forty officials. Next to Hortman’s name was her home address.

The brokers did not pull the trigger. They sold the man the door.

This is the part of the surveillance story that usually gets left out, because it doesn’t fit on a screen. We talk about algorithms and feeds and AI as if the harm were abstract — a nudge here, a manipulated mood there. But the same infrastructure that decides which posts you see also assembles packages and sells the precise coordinates of your life to anyone with a credit card. Including the government. The data broker is the hinge between the abstract surveillance you feel and the physical harm you don’t see coming.

So when people ask me, after the reporting, what can I actually do? — this is the answer. Not “nothing, the system is too big.” And not “download these five apps and you’re safe,” which is a lie the privacy industry is happy to sell you. The answer is a strategy, and it starts with understanding what kind of business you’re up against.

Surveillance is a volume business

The companies doing this don’t make money off you specifically. They make money off everyone, at scale, cheaply. The whole apparatus runs on volume economics: collect everything, sell it in bulk, keep the marginal cost of each record near zero. That’s the weakness. You don’t have to make the surveillance machine blind. You just have to make it expensive.

Every record you remove raises their cost to supply you. Every percentage point of accuracy you degrade raises their cost to use you. Every assertion of refusal you put on the record raises their cost to ignore you. None of these, alone, frees you. Together, they’re a margin squeeze on a market that only works because the margins are thin.

That’s the context. Here’s the field guide — five moves, from what you can do this afternoon to what we have to build together.

Move 1: Remove your data

This is the highest-leverage thing an individual can do, because broker data is what feeds everything downstream — the government purchases, the targeting, the notebook in the killer’s car.

Here’s the surprise, and it’s well-documented. In 2024, Consumer Reports (with the security firm Tall Poppy) ran a controlled study of paid data-removal services — the ones you’ve seen advertised on every podcast. Over four months, the paid services as a group removed only about 35% of participants’ personal records, and the report concluded plainly that doing it yourself is more effective than the services. Submitting opt-outs by hand removed 70%. Exactly one paid service kept pace — Optery, at 68%, basically tying the manual effort — with EasyOptOuts close behind around 65%. The rest trailed badly, the worst clearing single digits. The takeaway is sharper than “they’re all useless”: free DIY matches the single best paid service and beats all the others.

I’ll be direct, because it’s a useful correction: a few months ago I recommended one of these subscription services. The data says do it yourself, or if you want help, use Optery or EasyOptOuts — not the ones with the biggest ad budgets. The marketing spend and the removal rate are, if anything, inversely correlated.

What does it actually do? It removes you from the people-search sites that resell your address, relatives, and phone number. What does it not do? It doesn’t reach every broker, and the sites re-scrape and re-list you, so this is maintenance, not a one-time fix. Do it, then do it again in a few months.

The free tools that make this doable: - CORRECTION (June 25, 2026): I first recommended Permission Slip here as the free Consumer Reports app — and through early 2026 it was exactly that. But on May 28, 2026, Consumer Reports handed Permission Slip to DeleteMe, a paid removal service.

A free tier still exists, but the app now upsells “Permission Slip PLUS” and DeleteMe’s paid subscription, so decline the upsell. Better yet, skip it: the free by-hand route below does the same job for $0, and the study says doing it yourself beats the paid services anyway. The best free starting points are Yael Grauer’s “Big Ass Data Broker Opt-Out List” (the option Privacy Guides recommends first) and, if you live in California, the new state-run DROP tool — one deletion request every registered broker must honor.

For the technically comfortable, open-source projects exist that batch and automate removal requests across hundreds of brokers — search for a currently-maintained one (the Privacy Guides community is a reliable place to look) rather than trusting a name from a guide, since these tools change hands and quality varies. - The community-maintained “Big Ass Data Broker Opt-Out List” is the canonical DIY map — regular people keeping the instructions current as brokers change their forms.

The political point hiding in here: the nonprofit and open-source world already built the public-good version. The subscription services are selling you something that’s free and, on the evidence, worse.

Move 2: Shrink your footprint

These are the baseline switches everyone should make. I’m going to tell you what each one doesn’t do, because that’s exactly where the privacy industry lies to you.

Email — Proton over Gmail. Gmail’s business model is reading you; Proton’s isn’t, and your message contents are end-to-end encrypted. That’s a real upgrade. But — and the Freedom of the Press Foundation is blunt about this — Proton “is simply not made to protect your identity.” It operates under Swiss law and can be compelled to hand over the data it does hold: IP logs, payment info, your recovery email. It has done exactly that — including handing a “Stop Cop City” activist’s payment data to authorities, later shared with the FBI. Proton fixes the content and the business model. It does not make you anonymous. Anyone who needs anonymity should assume they’re identifiable on it.

Messaging — Signal. Lots of apps encrypt your messages now. The reason Signal is the standard isn’t just content — it’s metadata. Signal is built to collect and keep almost none of it. WhatsApp uses the same encryption but is owned by Meta and harvests the metadata around your messages. The content of what you said versus the record of who you talked to, when, and how often — that second thing is often the more revealing, and Signal is designed not to have it.

Browser — Firefox, hardened, for most people. It’s independent, built by a nonprofit, not Chromium-based, and has no crypto side-hustle. Turn on Enhanced Tracking Protection and you’re most of the way there. Brave blocks more aggressively out of the box and scores well on privacy tests — but be aware of its baggage: it was caught silently inserting its own affiliate codes into the crypto-exchange URLs users typed, it runs a cryptocurrency rewards scheme, and its leadership is its own conversation. For maximum anonymity, that’s Tor’s job, not a everyday browser’s.

Search — DuckDuckGo or Startpage over Google. Better, with an asterisk: DuckDuckGo was caught allowing some Microsoft trackers to run in its browser under a search-syndication deal, then changed it after the backlash. Better than Google. Not immaculate.

VPNs — mostly oversold. A VPN hides your browsing from your internet provider and encrypts your traffic in transit. That’s it. It does not make you anonymous, does not stop the tracking that doesn’t rely on your IP address, and does not protect you from malware or phishing. It just moves your trust from your ISP to the VPN company — which sees all your traffic and, per the EFF, often logs as much as the ISP did. Consumer Reports found 12 of 16 VPNs made misleading claims like “complete anonymity.” If you use one, the institutionally-vetted picks are Mullvad, IVPN, and Mozilla VPN. But don’t mistake a VPN for a force field.

Move 3: Build the capability — this is where it stops being about you!

Here’s the lever that the 70%-versus-35% finding actually points to. If doing it yourself works better than paying, then the thing standing between most people and real protection isn’t a product. It’s an hour of someone’s time and the knowledge of where to start.

That’s a solvable problem, and it’s a collective one. The opt-out treadmill is, in effect, a tax the broker market imposes on your attention — and the way you lower a tax for everyone is you teach people to do the thing, together.

This is the part of the work that happens in church basements and library meeting rooms and union halls — the physical, face-to-face resistance that the surveillance machine is worst at fighting. An algorithm can flood a forum with a thousand convincing posts. It cannot sit down next to your neighbor and walk her through a data-broker opt-out. We can.

You don’t have to invent this. The infrastructure exists: - The Electronic Frontier Foundation runs Surveillance Self-Defense and security-education trainings built exactly for at-risk communities — the model for a local data-detox clinic. - EFF’s annual “Opt-Out October” is a ready-made campaign you can localize.

Yael Grauer's "Big Ass Data Broker Opt-Out List" and EFF's Surveillance Self-Defense are your curriculum — free, current, and with no upsell you'd have to walk a neighbor past. The Catholic Worker movement didn’t write theology about hospitality and stop there; it ran houses. The move here is the same: don’t just protect yourself, host the room where ten of your neighbors protect themselves, and send each of them home able to teach ten more.

Move 4: Close the loophole

Everything so far is defense. But there’s a specific legal hole that makes the whole government-surveillance side of this possible, and it can be closed.

In 2018, the Supreme Court ruled in Carpenter v. United States that the government needs a warrant to obtain long stretches of your phone’s location data — even though a third party (your carrier) holds it. It was a genuine crack in the old rule that anything you hand a company loses its constitutional protection.

Here’s the hole: Carpenter limits what the government can compel. It says nothing clear about what the government can buy. So agencies just buy it. CBP purchased Americans’ domestic flight records — names, full itineraries, financial details — from a data broker owned by the major airlines, under a contract that barred the government from naming the source. ICE bought access to a Thomson Reuters database, CLEAR, holding more than 400 million names, addresses, and utility-service records — phone, water, electricity — so it could find people who avoid a driver’s license but still pay a utility bill. And in a separate seven-month stretch in 2021, ICE ran more than a million searches through LexisNexis’s commercial database. An ICE contracting document justified buying broker data specifically as a way around sanctuary-law limits. The data is laundered through a middleman, and the warrant requirement evaporates.

There is a model for closing this exactly — the Fourth Amendment Is Not For Sale Act, which would ban the government from buying the data it would otherwise need a warrant to get. The House passed it with a bipartisan majority, 219–199, in April 2024; the Senate never took it up, and when that Congress ended the bill died with it. As of this writing it hasn’t been reintroduced. That it cleared the House once, on a bipartisan vote, and then simply lapsed is the whole story in miniature: the fix is popular, written, and proven votable — and it’s sitting on the shelf for lack of pressure. The loophole is a choice, and choices can be pressured.

And there’s a move you can make right now that’s more than symbolic. Asserting your non-consent explicitly — telling platforms and data collectors, on the record, that you do not agree to this — is not a magic spell that creates a constitutional right. Don’t let anyone tell you it is. But it is a signal of refusal, and we have watched refusal signals become law. The “Global Privacy Control” — a simple browser setting that says “do not sell my data” — started as a voluntary, symbolic flag with no legal force. Then California made honoring it mandatory, and the state’s first major privacy enforcement action, a $1.2 million settlement with Sephora, was for ignoring those signals. Symbolic to enforceable, in a few years.

So when you assert non-consent, you’re doing three real things: building the record that your data was never given voluntarily (the soft spot in the law the brokers rely on), raising awareness, and adding to the pressure that shifts what courts are willing to treat as a “reasonable expectation of privacy.” That standard is not fixed. Carpenter moved it. You’re not claiming a right you don’t have. You’re doing the thing that creates it.

Move 5: Turn off the engine

The opt-out treadmill exists because there’s an industry whose entire product is the surveillance that generates the data. You can spend the rest of your life removing yourself from brokers who re-list you next quarter — or the law can ban the business model that makes the data in the first place.

That’s what surveillance-advertising legislation does. The Banning Surveillance Advertising Act, introduced in Congress by Representatives Anna Eshoo and Jan Schakowsky and Senator Cory Booker, would prohibit advertisers from targeting you using your personal data — explicitly including data bought from brokers — while still allowing ads based on what you’re actually reading. It attacks the supply at its source. (It has been introduced, not passed; it’s the model for the fix, not yet the fix.)

There’s a small, sharp irony worth holding onto here. One of that bill’s sponsors, Senator Booker, also turned up on the leaked guest list of Peter Thiel’s secretive “Dialog” society — the same recordless rooms where the people who build the surveillance apparatus meet the officials who are supposed to govern it. The fight over your data runs straight through the same few rooms. Which is exactly why the outside pressure matters.

What this adds up to

Start this afternoon: do an opt-out pass by hand with the Big Ass Data Broker Opt-Out List — the study says DIY beats the paid services — and switch your email and your default search. Tell yourself the truth about the limits — none of these tools is a force field, and anyone selling you one is selling you something.

Then go past yourself. Teach a room of neighbors to do what you just did. Learn the name of the bill that would close the loophole, and the name of the one that would turn off the engine, so that when the moment comes to push, you’re not starting from zero.

The two warehouses — the one that holds bodies and the one that holds attention — run on the same fuel: the cheap, frictionless, unconsented harvest of human life as data. The Pope named it colonialism in another form. The way you fight a colonial economy is not by perfecting your own hygiene. It’s by raising the cost of extraction until it isn’t worth it, and by demanding the law that makes it illegal.

Resistance to this is going to be physical and relational — face to face, in rooms, between people who can do for each other what no algorithm can do for anyone. The tools buy you a little room. Teaching multiplies it. And the politics, eventually, closes the door.

Make yourself expensive. Then go make the whole thing expensive, together.

Sources

Reporting & Studies: - Data Defense: Evaluating People-Search Site Removal Services (Consumer Reports, 2024) — the 35%-paid vs. 70%-DIY finding - Proton Mail Is Not for Anonymity (Freedom of the Press Foundation) - Brave Browser’s Affiliate Link Controversy (CoinDesk, 2020) - DuckDuckGo removes carve-out for Microsoft tracking scripts (TechCrunch, 2022) - VPNs: what Consumer Reports found (Consumer Reports) - Closing the Data Broker Loophole (Brennan Center for Justice) - FBI Director Patel confirms warrantless purchase of commercially-available data (NPR, March 2026) — the news peg - ICE Searched LexisNexis Database Over 1 Million Times in Just Seven Months (The Intercept) - ICE used a private utility database (CLEAR) covering 400M+ records (Washington Post / Georgetown) - House Passes Fourth Amendment Is Not For Sale Act (ACLU) - AG Bonta Announces Sephora Settlement (California DOJ) — Global Privacy Control enforcement - US Lawmakers Introduce Banning Surveillance Advertising Act (IAPP)

Tools & Guides: - EFF Surveillance Self-Defense — the canonical free guide - Permission Slip by Consumer Reports — free opt-out app - Big Ass Data Broker Opt-Out List — community DIY map

Related RAMM reporting: - The data-colonialism / two-warehouses series on detention, datacenters, and the surveillance-advertising economy

On the fifteenth of May, Pope Leo XIV signed an encyclical almost no one in American politics took seriously. Magnifica Humanitas — a long, dense document on artificial intelligence and human dignity — made a warning whose central claim was structural, not spiritual: a new power has grown up in the world that does not answer to any state. It is concentrated in a few hands and it runs on the harvesting of human data. In the encyclical’s own words, “the highest level is not the State, but rather major economic and technological actors that exercise de facto power over the conditions of everyday life.” Left unchecked, the Pope warned, the technology will “divide, exclude and generate new forms of injustice.” The commentary, where there was any, called it abstract. A spiritual leader gesturing at a technology he did not really understand.

Three weeks later, a Swiss hacktivist who goes by maia arson crimew found a directory of names sitting in the page source of a website that was supposed to be secret. The names were very good ones: the Treasury Secretary, the Director of National Intelligence, the four-star general who runs NATO’s forces in Europe, a sitting senator who oversees the Federal Trade Commission, the co-founder of Palantir. They belonged to Dialog, an invitation-only society Peter Thiel founded in 2006 and spent two decades refusing to discuss. The coverage fixed on the obvious things — the celebrity guest list, the off-the-record session titles (“Navigating WWIII,” “Build-a-Cult”), the detail that none of the 222 people registered with a government email address, which keeps the whole thing outside the reach of public-records law.

Set the two events next to each other and the second stops being a society-pages curiosity. The Pope described a structure: a private power, built on data, convening above the institutions meant to govern it. The leak is a photograph of that exact structure — the powerful few, hosting the officials who are supposed to oversee them, in a room with no minutes, by a tech financier’s invitation. Leo XIV named the thing. crimew, by accident, took its picture.

And here is what the picture shows, which is more than the commentary noticed. The leak, by itself, is not the scandal. If the meetings leave no record by design, the leaked membership does not give you the meetings; it gives you a list of names. The scandal is what those names already did for each other — out in the open, on the public record, in the months before anyone knew they shared a room. The leak is the key. The receipts were already public. You just needed to know which doors to try.

The room is the index, not the evidence

Here is the move I want to make carefully, because the easy version of this story is wrong.

The easy version says: these people met in secret, therefore they conspired. That is not a claim the documents support, and I am not going to make it. Nobody has the transcripts. The entire design of Dialog — personal email, off the record, no minutes — is built so that nobody ever will. If your story depends on what was said in that room, you do not have a story. You have a guest list and a suspicion.

So invert it. Treat the membership list not as evidence of anything, but as an index — a finding aid. It tells you which public actors to line up against each other. Then you go to the public record, the part that was documented — the Treasury decisions, the contract awards, the committee jurisdictions — and you read it with the index in hand.

What surfaces is not a single conspiracy. It is something more mundane and more damning: a set of ordinary, separately-reported transactions that nobody had connected, because nobody knew the parties were in the same network. Each one was covered for a day and forgotten. Lined up, they stop looking like coincidence and start looking like a pattern — the same network surfacing on both sides of one public decision after another.

Three of them are already fully on the record.

Ledger entry one: the Treasury rescue, and then the founder moved in

In October 2025, Treasury Secretary Scott Bessent approved a $20 billion rescue package for Argentina. Bessent is not a career diplomat who happened onto Argentine debt. He ran money for George Soros, then founded his own hedge fund, Key Square. Among the investors positioned to benefit was Robert Citrone — a former colleague of Bessent’s whose fund held Argentine debt, and who, Argentine press reported, called Bessent personally to ask for the rescue. Senator Elizabeth Warren wrote to the hedge-fund industry’s trade group asking, in effect, whether the people who stood to profit had helped write the check. Bessent denied that his finance colleagues had anything to do with it. The timing and the beneficiary list spoke for themselves. The package came with strings: the larger $40 billion version Trump floated was tied, explicitly, to Argentine President Javier Milei’s performance in his midterm elections.

That was October. Here is April.

In April 2026, Peter Thiel — the man who founded the society Bessent belongs to — relocated his family to Buenos Aires. He bought a $12 million mansion, enrolled his children in a local school, spent a week in private meetings with Milei’s government, and sat down with the president himself at the Casa Rosada. Milei called it “wonderful,” and said they had discussed how to make the austerity project “endure beyond his presidency.”

I want to be exact about what this is and is not. It is not proof that the bailout and the relocation were a single coordinated plan. There is no document that says so, and I am not claiming one. What is documented — fully, separately, by mainstream outlets at the time — is the shape: the same private network appears at both ends of the same foreign government within six months. One member’s department underwrites the regime with public money. The network’s founder then embeds with that regime personally, to help lock its program in place. You did not know those two men were in the same room until last Monday. Now you do, and the two stories you read months apart become one story.

Ledger entry two: the man who oversees the data cops, and the man who sells the data

Senator Ted Cruz is on the list. So is Auren Hoffman.

Cruz chairs the Senate Commerce, Science, and Transportation Committee. That committee has direct oversight of the Federal Trade Commission — the agency that holds whatever thin authority the United States has over commercial surveillance and the data-broker industry. It is not an abstract jurisdiction. In 2013, this same committee produced the landmark Senate staff report on data brokers, the one that first put the industry’s practices on the congressional record. The FTC’s 2022 move toward rules on “commercial surveillance” runs through the agency Cruz’s committee superintends. If anyone in government holds a lever over the business of buying and selling Americans’ movements and identities, it is the chair of that committee.

Auren Hoffman co-founded Dialog with Thiel. He also founded SafeGraph, a location-data broker, and LiveRamp — the identity-resolution spine of the modern advertising economy, now the corporate vessel of what was Acxiom, long described as the largest consumer-data broker in the world, holding billions of records and well over a thousand data points on the average American adult.

This is the concrete shape of the abstraction the Pope was warning about. When he wrote that “the highest level is not the State, but rather major economic and technological actors that exercise de facto power over the conditions of everyday life,” this is the kind of thing he meant: a man whose private company knows more about the average American than any government agency is permitted to, sitting in a recordless room with the senator who chairs its only oversight.

So in one off-the-record society you have the senator with jurisdiction over the data cops, and the man who runs one of the largest data-brokerage operations they would police. No document says Cruz ever acted on Hoffman’s behalf, and the recordless design guarantees none ever will. That is not the point. The regulator and the regulated belong to the same private club; it was hidden for twenty years; and we know it only because of a misconfigured web page. The conflict does not require a smoking gun to be a conflict. The structure is the story.

And this is the one place in the ledger where the abstraction has names on it, because the data-broker industry is the one whose harms are already in the case law and the morgue. The reason the FTC’s commercial-surveillance authority exists at all is that people have died at the end of a data-broker query. In 1999, a stalker named Liam Youens bought Amy Lynn Boyer’s date of birth, Social Security number, and workplace address from a broker called Docusearch for under two hundred dollars, drove to the workplace, and shot her dead; she was twenty. The New Hampshire Supreme Court ruled that a data broker owes a duty of care in handing a stranger another person’s life — the foundational precedent for the entire industry Auren Hoffman has helped build. It is not ancient history. In June 2025, a man assassinated Minnesota House Speaker Melissa Hortman and her husband and wounded State Senator John Hoffman and his wife Yvette; in his vehicle, investigators found a notebook listing eleven people-search and data-broker sites — Spokeo, Intelius, TruePeopleSearch among them — annotated with what each one cost and what each one required, beside a target list of more than forty officials with Hortman’s home address written next to her name. The brokers did not pull the trigger. They sold the man the door.

I am not drawing a line from any senator’s committee to a Speaker’s killing; there is no such line, and inventing one would be the same overreach I refused at the top of this piece. The point is narrower and harder to wave away. This is the documented character of the industry itself — lethal at the retail end, by the case law and the body count — and it is the industry one Dialog member runs and another is supposed to police, the two of them in a room with no minutes. You do not have to allege a deal to see the problem. An industry whose product has a morgue attached to it is being regulated by people who keep its chairman’s private company.

Ledger entry three: the contractor and the customer

Joe Lonsdale co-founded Palantir. He is on the list. So is Dan Driscoll, the Secretary of the Army.

Palantir is not a vendor with some government exposure. It is the data-fusion layer the federal government now runs on — the system through which agencies from ICE to the Pentagon stitch their separate databases into one queryable whole. The public contract ledger is its own indictment: a $30 million ICE “ImmigrationOS” deal in June 2025 that links tax, Social Security, passport, and license-plate data; a billion-dollar no-bid DHS purchase in early 2026; a $10 billion Army enterprise agreement; Project Maven; the VA; the USDA. These are not rumors. They are announced awards.

Lonsdale, who helped build the company that holds those contracts, sits in the same society as the Secretary of the Army, whose department signs them. Add the founder of the whole network, Thiel, whose Founders Fund seeded the surveillance-and-defense portfolio underneath all of it. The customer, the contractor, and the financier, in one room, with no minutes.

No contract was awarded in that room, as far as anyone can show — but the people on both sides of billions of dollars in federal procurement have been meeting privately for years, and arranged things so that no record of those meetings would ever exist. In normal government, that is what disclosure rules are for. Dialog is what disclosure rules look like when the people subject to them opt out together.

Why “no government email” is the whole thing

Come back to the detail everyone started with, because now it means more than it did on Monday.

None of them used a government address. That is not laziness or convenience. It is the mechanism. A public official’s job creates records — emails, calendars, correspondence — that the public can eventually demand to see. That is the deal: the power comes with a paper trail. What the personal-email registration does is sever the power from the trail. The meeting happens; the influence is exchanged; the relationships are maintained year over year — and none of it ever enters a system the law can reach.

This is not a cover-up in the usual sense. A cover-up suppresses a record that exists. This is the cleaner version: a record that is never created in the first place. There is nothing to withhold, nothing to redact, nothing to litigate for, because under the chosen channel there was never a document to request. It is the same logic by which agencies now buy location data from brokers to skip the warrant they would otherwise need, and by which an enforcement operation can finish its work before any court is permitted to rule on whether it was legal. The point, every time, is to keep the act on one side of a line the law sits on the other side of.

Dialog is that logic applied to the relationships themselves. Not “hide what we did.” Build the room so that what we did was never written down.

Hold the leak up against how power is supposed to run. Authority belongs as close as possible to the people it touches; the higher levels exist to serve the lower ones, not to rule them. Power flows up from the governed and answers back down to them. Leo XIV gave that principle its old name — subsidiarity — and warned, in the encyclical, that technology had turned it upside down. That is not a homily. It is an organizational chart. The room with no minutes is the chart inverted: the platform-builder at the top, and the Treasury and the spy services and the generals coming to him — by his invitation, on his terms, off the record. The publics those officials serve are not at the bottom of the chart. They are off it.

The people the machine catches leave no record either

You will have noticed that this whole story is missing something. It has Treasury Secretaries and senators and four-star generals and contract numbers in the billions. It does not have a single ordinary person it happened to. That absence is not an oversight. It is the same design, one layer down.

Consider the third ledger entry — the contractor and the customer — at the end where it actually lands. Palantir’s tools and the data-broker feeds that supply them exist to do one thing: find people. The mechanism is not in dispute and not secret. ICE pays LexisNexis roughly $22 million for Accurint, a database of 270 million people assembled from more than 10,000 sources; it pays Thomson Reuters a comparable sum for CLEAR; it pays Palantir $29.9 million for a targeting system called ELITE that, agents testified under oath last December, produces a dossier on a person — photo, address, an “Address Confidence Score” from 0 to 100 — and tells officers where to go. In one seven-month stretch ICE ran more than 1.2 million searches against one of these databases. In December 2025 it handed thirteen private skip-tracing firms up to $1.2 billion to locate people, as many as 50,000 cases a month, instructed to use “all technology available.”

So I went looking for the person. The named human being ICE bought its way to — the face to put on the receipt. After an exhaustive search of the public record, the honest finding is that I could not produce one. Not because it has not happened — it has happened, by the documented arithmetic, more than a million times — but because the purchase is laundered upstream of the arrest. When a broker sells your location to the government, you are never told. No warrant is served. No source is disclosed. You learn you were findable only when the unmarked car is already at the curb, and even then the paperwork records a street encounter, not a transaction. The same design that keeps the men in Thiel’s society off the public-records grid keeps the broker’s customer off your arrest record.

I will not invent a victim to make this land. That would be its own small dishonesty — and the dishonesty would be on the side of the people who built the machine. The harder, truer thing: the victim is real and the harm is mass — 32 people died in ICE custody in 2025, the most in two decades — but the specific person the data-purchase delivered is, by construction, anonymous. Not unrecorded by accident. Unrecorded by design. The machine is built so that no one can name them.

That anonymity is not a gap in the story. It is the story. The room with no minutes builds the system with no source that produces the arrest with no warrant. Three layers, one principle: keep the act on one side of a line the law sits on the other side of. The powerful version of that principle protects a Treasury Secretary’s dinner conversation. The ordinary version disappears a construction worker on his way home, and leaves no one to subpoena.

This is the end the Pope could see from the beginning. When Leo XIV warned that the technology would “divide, exclude and generate new forms of injustice,” he was not describing a hypothetical. The data-fusion stack does precisely that — it divides the findable from the safe, excludes the targeted from any process that could contest the targeting, and generates an injustice with no document attached to it. The encyclical reads, in this light, less like a homily than like a description of the contract ledger.

Look once more at who the leak places in that room — not as a celebrity list, but as layers. Laid out that way, the roster is a cross-section of one machine. There is the layer that harvests the raw material: the former chief executive of Google; Elon Musk, who owns a social platform and an AI company built on its feed; a director of Musk’s brain-interface venture. There is the layer that fuses the harvest into a dossier — Palantir, by its co-founder and its chief executive both. There is the capital that funds the stack — the venture firm Andreessen Horowitz, KKR’s Henry Kravis, the Treasury men. And there is the layer that buys the result and points it at people: the Secretary of the Army, the Director of National Intelligence, the ranking member of the House Intelligence Committee, and General Alexus Grynkewich, who now commands all NATO forces in Europe — and who, the leak shows, has been attending these gatherings since 2021, four years before he held the post. The relationship predates the office. Harvest. Fusion. Capital. Customer. Every link in the chain, in one room, with no minutes.

Be precise about the roster, because precision is the whole discipline here. The full 222 names were never published; reporters assembled a partial list from a leaked directory and a registration sheet. So this is not the claim that every tech power is on it — Meta, Amazon, Apple, today’s Google are not among the reported names, and may simply not have surfaced. The claim is narrower and harder to dislodge: the names that did surface already fill every layer, end to end. Even the two leading AI labs are reportedly there — OpenAI by two of its people, Anthropic by one — though those come from secondary reporting, not the primary leak, and in public the labs are at each other’s throats, funding rival war-chests aimed at the same lawmakers. Which is the point. You do not need a cartel. You need only a room — recordless, invitation-only, owned by the financier whose fund sits under the whole industry — that even sworn competitors, and the officials who regulate and buy from them, all find it worth their while to enter.

The leak did not breach that design. The meetings are still dark; we will never have the transcripts. What the leak handed us was the index — which public acts to read together. And read together, they are enough. The Treasury rescue and the Buenos Aires mansion. The data regulator and the data broker. The contractor and the customer. And at the far end of that last one, the people the machine is built to find and the law is built not to see.

We have seen this room before. Last September, at the Commonwealth Club in San Francisco — invitation only, press barred, microphones not supposed to be on — Thiel gave a four-part lecture series naming the Antichrist of the twenty-first century as the Luddite: the climate activist, the AI-safety researcher, anyone who would slow the machine. I wrote about those tapes when they escaped, in The Antichrist as Luddite. What carries over is not the theology. It is the architecture. Those lectures had to happen in a recordless room for the same reason Dialog does: the argument cannot survive being said in public. And in them Thiel named the obstacle — “the woke American pope,” the moral authority whose teaching, left standing, would give resistance somewhere to stand. Magnifica Humanitas is that pope answering.

So the two leaks are one operation from two angles. One caught the doctrine in the recordless room — the gospel that has to stay coded because the real one won’t bear it. The other caught the network — the officials and operators who run the machine that doctrine blesses. Same inversion both times: a thing that sells itself as freedom and works as capture, and calls the man warning about it the enemy.

The Pope said a new power had grown that exceeds the state and answers to no one. People called it abstract. Then a misconfigured web page produced its roster: the officials who run the state, gathered by the man who built the power, in a room with no minutes. The structure had a name in the encyclical. Now it has a guest list. The receipts were always public. We were just never supposed to know whose they were — or that the people on both sides of them had been keeping each other’s company all along.

Sources & Notes

The Dialog leak. WIRED, “Leak Exposes Members of Peter Thiel’s Secretive Dialog Society,” June 16, 2026 (the primary report; the directory was found in the site’s HTML source by the hacktivist maia arson crimew — her chosen name, styled in lowercase). The 222-name figure is the registration list for Dialog’s August 2026 Dublin retreat; the “no government email” detail is WIRED’s. Tier-1.

The encyclical. Pope Leo XIV, Magnifica Humanitas (May 15, 2026), vatican.va. Quoted lines are verbatim from the text: §71 (“the highest level is not the State, but rather major economic and technological actors that exercise de facto power over the conditions of everyday life”) and §9 (“can also divide, exclude and generate new forms of injustice”). §178 names “data colonialism… colonial in another form.”

Ledger one (Argentina). $20B Argentina rescue and the $40B figure tied to Milei’s midterms: Washington Post, Oct 26, 2025. Sen. Warren’s letter to the Managed Funds Association: Bloomberg, Oct 9, 2025. Robert Citrone’s reported call to Bessent: Buenos Aires Times. Thiel’s Buenos Aires relocation and Casa Rosada meeting (April 23, 2026): New York Times; Washington Times.

Ledger two (data brokers). The 2013 Senate Commerce Committee staff report, “A Review of the Data Broker Industry”. Amy Lynn Boyer / Docusearch: Remsburg v. Docusearch, 149 N.H. 148 (2003); EPIC case archive. The Hortman assassination notebook (11 data-broker sites; 45+ official target list): The Record / Recorded Future News and Star Tribune, June 2025.

Ledger three & the data machine. ICE data-broker/targeting contracts — LexisNexis Accurint (~$22.1M), Thomson Reuters CLEAR (~$22.8M), Palantir ELITE ($29.9M): LawNext and In These Times, April 2026; ELITE use confirmed under oath in M-J-M-A v. Wamsley, D. Or., 2025. ImmigrationOS ($30M, April 2025). 32 ICE custody deaths in 2025 (most in two decades): NPR, Oct 23, 2025. The wrongful-facial-recognition precedent (Robert Williams): ACLU, Williams v. City of Detroit.

The doctrine. The Commonwealth Club “Antichrist” lectures and the recordless-room method: The Antichrist as Luddite (The RAMM, May 28, 2026).

A note on method. This piece treats the leaked membership as an index to already-public acts, not as evidence of anything decided in the room. No claim here asserts coordination, agreement, or a deal among the named individuals; the meetings are off the record by design and no transcripts exist. Where a person’s confidence on the roster is below tier-1 (the AI-lab attendees), that is stated in the text.

Two percentage points. The kind of change that gets disclosed to a reporter and absorbed into a single afternoon’s news cycle. No press conference. No rule. Just a target adjusted, confirmed by a U.S. Citizenship and Immigration Services (USCIS) spokesman to the Washington Times in May.

Here is what that number means when you do the arithmetic. There are roughly 200 million registered voters in the United States. A 3 percent error rate, applied across that population, is not an abstraction. It is approximately six million people. And under a rule the Postal Service proposed on May 29, the people that database cannot cleanly confirm as citizens are the people who will not receive a mail ballot this November — with no warning, no notice, and no way to fix it inside the window that matters.

The most alarming part is not the 3 percent. It is what happens to the people inside it. When states have actually run their voters against SAVE and then checked the results by hand, most of the voters the database flagged as potential noncitizens turned out to be eligible American citizens — in the most rigorously documented cases, between 64 and 87 percent; in the full range of documented cases, as low as 14 percent in a single county, as high as 87 percent statewide. Not noncitizens correctly caught. Citizens wrongly accused.

This is the story of how a rounding error becomes disenfranchisement — and how the architecture was built so that no court will look at it until after the ballots aren’t mailed.

What SAVE is, and what it was never built to do

SAVE stands for Systematic Alien Verification for Entitlements. The name tells you what it was for: verifying immigration status so that government agencies could decide who qualifies for benefits like Medicaid, SNAP, and a driver’s license. It was built to answer one question — is this person a noncitizen who is nevertheless lawfully present? — for people who had already raised their hands and applied for something.

It was not built to verify U.S. citizenship. That is a structurally different question, and the difference is the entire problem.

SAVE contains Department of Homeland Security (DHS) immigration records — green cards, visa filings, A-numbers — plus Social Security citizenship and work-authorization data, and, since a 2025 overhaul, motor vehicle records. What it does not contain is a complete, current census of American citizens. It has no comprehensive record of citizens born in the United States. It has stale, incomplete records on the people most likely to be queried and flagged: naturalized citizens, who appear in the system because they were once noncitizens, and whose files may never have been updated to reflect that they took the oath.

A naturalized citizen is, by definition, a person SAVE once knew as a noncitizen. When you run the entire voter file against a database like that and ask it to certify citizenship, the false positives are not bugs. They are the predictable output of asking a benefits-eligibility tool to do citizenship verification it was never designed to perform. You cannot patch this with better data hygiene. The category mismatch is baked into what SAVE is.

In April 2025, DHS, USCIS, and the Department of Government Efficiency (DOGE) announced a “comprehensive overhaul” of SAVE to enable exactly this — mass voter verification. The overhaul added motor-vehicle data and expanded the system’s query volume from a few hundred thousand benefit checks a year to tens of millions of voter-registration checks. This is the move worth naming clearly. It was not a scale expansion of an existing function. It was a category expansion: the infrastructure of immigration enforcement, repurposed as the infrastructure of voter verification. The database name didn’t change. The population it can harm did.

The arithmetic, laid out so you can check it

Let me make the math transparent, because the math is the argument. Every figure here traces to a documented source, and I want you to be able to use these numbers yourself — including in a comment to the Postal Service, which I will get to.

Start with two different error rates, because conflating them is how this story gets reported badly.

Rate one is the inconclusive rate — the share of voter queries for which SAVE simply cannot return a definitive answer. The most precise figure available comes from the Bipartisan Policy Center, which in August 2025 analyzed SAVE’s performance on actual voter-verification queries and found a 3.12 percent inconclusive-response rate. the Bipartisan Policy Center (BPC) itself noted that “while 3 percent might seem small, it represents potentially millions of voters whom election offices would need to contact or investigate.”

That 3.12 percent maps almost exactly onto DHS’s own downgraded 97 percent accuracy target. The two figures are not the same measurement — an inconclusive result (SAVE declines to answer) is conceptually distinct from an error (SAVE returns a wrong answer) — but they converge on the same population: voters the system cannot cleanly confirm. That convergence is what matters operationally, because the gate keys on inconclusive results, not on formal errors.

Now apply it. Using ~200 million registered voters as a conservative midpoint between the Census Bureau’s survey figure (~174 million) and the Election Assistance Commission’s administrative figure (~211 million):

200,000,000 × 0.0312 = 6,240,000 inconclusive results

At the administration’s stated 97 percent target, the figure is 6 million. At the 98 percent accuracy DHS acknowledged it actually achieved in 2025, it is 4 million. So the honest range for voters SAVE cannot cleanly confirm is four to six million.

That is rate one. By itself it would be a manageable administrative headache — a lot of cases needing a second look.

Rate two is the false-positive rate — of the voters who do get flagged, how many are actually eligible citizens. This is the number that turns an administrative headache into disenfranchisement, and it is documented not in projection but in the field, in states that already ran this experiment:

• Iowa: The Secretary of State flagged 2,176 potential noncitizens through SAVE. After investigation, the confirmed count dropped to 277. That is an 87 percent false-positive rate — 1,899 eligible citizens wrongly flagged.

• Alabama: Secretary of State Wes Allen moved to purge 3,251 registered voters identified through SAVE, 84 days before the 2024 election. A federal judge blocked it; the court record showed roughly 2,074 of the flagged voters — 64 percent — were confirmed eligible citizens.

• St. Louis County, Missouri: Of 691 flagged voters, 81 percent of the original data was wrong once passports were checked, leaving 133 genuine noncitizen registrants out of the original 691.

• Boone County, Missouri: Of 74 flagged voters, more than half were citizens. One flagged voter’s registration paperwork bore the initials of the very staff member who had helped them register — at their own naturalization ceremony.

• Denton County, Texas: 84 flagged; at least 12 immediately proved citizenship — a documented floor of 14 percent, which the county official acknowledged was “probably higher.”

So: between 14 percent (the lowest documented floor) and 87 percent (Iowa) of flagged voters are eligible citizens, with most documented cases clustering between 60 and 87 percent.

Multiply the two rates. A note on the method: the inconclusive rate (3.12%) comes from BPC’s national analysis of SAVE voter-verification queries; the false-positive rates come from state-level samples of voters who appeared on flagged lists. These are different sampling frames, so the multiplication is an order-of-magnitude estimate, not a precise count — but that is exactly why the floor matters. Take the four-to-six million flagged and apply even a conservative midpoint false-positive rate of 60 percent:

4,000,000 × 0.60 = 2,400,000 (low estimate) 6,000,000 × 0.65 = 3,900,000 (central estimate)

The central estimate is between three and four million eligible American citizens flagged as potential noncitizens. The high end, using the documented 87 percent rate, reaches above five million. And the absolute floor — using only Denton County’s 14 percent, the lowest false-positive rate anyone has recorded — is still 560,000 citizens.

The floor is more than half a million wrongly flagged voters. The central estimate is in the millions. There is no version of this arithmetic that produces a small number.

A note on what the record does not contain, because the absences are load-bearing too. There is no DHS Inspector General audit of SAVE’s accuracy for voter verification. There is no Government Accountability Office (GAO) audit of SAVE since 2017 — and the 2017 report (GAO-17-204) covered benefit eligibility, not citizenship checks on the voter file. The full USCIS submission to Congress with the 98 percent actual-accuracy figure has not been publicly released; it currently exists in the public record only as relayed by the Washington Times. No federal watchdog has independently audited the accuracy of the tool now being pointed at the electorate. We are running it live.

The one-way gate

For most of SAVE’s history, a false positive was survivable, because the system that used it included a way to argue back. If a benefits agency flagged you, you got a notice. You could produce your naturalization certificate or your passport. The agency was required to complete additional verification before issuing a final denial. The design assumed error and built in a correction step.

Under the Postal Service’s proposed rule — Federal Register Docket 2026-10968, published May 29 to implement Executive Order 14399 — that correction step does not exist inside the window that decides whether you vote. Here is the operational sequence:

1. DHS runs the voter files against SAVE and builds State Citizenship Lists of confirmed citizens.

2. Voters with inconclusive SAVE results are not included on those lists.

3. States transmit their mail-ballot lists, derived from the federal lists, to USPS at least 30 days before ballots are mailed.

4. USPS mails ballots only to voters on the list.

5. USPS has expressly stated it “would not verify whether individuals should or should not be included” — because, in its framing, the verification already happened upstream. The Postal Service is the delivery point, not the review point.

Step two is the gate. A voter with an inconclusive SAVE result is not on the list. They receive no notification that they are not on the list. There is no mechanism at the postal tier to challenge it. And the timeline gives them no room to discover the problem and fix it: most states begin mailing ballots about 60 days before Election Day — early September — and the list is locked 30 days before that.

The voter does not know in advance that no ballot is coming. By the time they realize a ballot never arrived, the window has closed. A ballot not mailed is a vote not cast, and there is no downstream correction inside the mail-ballot process.

The proposed rule also requires a unique barcode on each ballot envelope, tied to the federal list entry, enabling per-ballot tracking. That detail matters for one reason: it tells you the non-delivery is not an accident the system is straining to prevent. The infrastructure to confirm that the right people are being excluded is being built into the envelope. The gate is engineered, not improvised.

This is the difference between the old SAVE and the new one. Under benefits, a false positive cost you a delayed Medicaid approval and a phone call. Under Docket 2026-10968, a false positive costs you your vote, silently, with no one obligated to tell you it happened.

Why no court will stop it in time

You might assume that a mechanism capable of failing to mail ballots to millions of citizens would be the kind of thing a federal court would examine before it goes live. It will not — and the reason is a quiet masterpiece of timing.

On May 28, 2026, U.S. District Judge Carl J. Nichols (D.D.C., a Trump appointee) denied a motion for preliminary injunction in DSCC v. Trump, the consolidated challenge to EO 14399 brought by the Democratic Senatorial Campaign Committee alongside the NAACP, the League of United Latin American Citizens (LULAC), Common Cause, Black Voters Matter, and the Lawyers’ Committee for Civil Rights Under Law. He did not rule on whether the executive branch can set the rules for federal elections — a question Article I of the Constitution assigns to state legislatures and Congress. He ruled on ripeness — the legal doctrine that a court will not decide a challenge until the harm is concrete rather than anticipated.

His logic: no final rule existed yet, so no concrete harm had crystallized. He wrote that “the Postal Service may ultimately issue a final rule that directly affects Plaintiffs,” and that the plaintiffs “may renew their motions if and when those future actions occur.” Until then, he found the challenge “largely speculative” (docket 1:26-cv-01114, Mem. Op., May 28, 2026). Reasonable enough, in the abstract. The harm hadn’t happened yet.

The day after Nichols ruled — May 29 — the Postal Service published its proposed rule. The procedural obstacle was cleared on a Wednesday; the executive branch walked through the opening on a Thursday. The sequencing is documented, in the public record, one day apart.

Now follow the calendar forward, because the calendar is the weapon:

• Comment period closes: July 2, 2026.

• Final rule expected: ~July 29, 2026 (the EO’s 120-day mandate from its March 31 signing).

• States begin mailing ballots: early September 2026.

• Window between final rule and ballot transmission: roughly 30 days.

A party seeking to stop the final rule would have to file, brief, argue, and win — all within about 30 days of the rule’s publication, before ballots go out — while the government argues, again, that the harm is still speculative until ballots are actually refused. The same ripeness logic that foreclosed relief in May will be raised again in August. And if a court holds that it needs evidence of actually-refused ballots before it will find a cognizable injury, then by the time the evidence exists, the ballots have already not been mailed. The harm and the proof of harm arrive at the same moment, which is the moment it is too late.

This is the trap, and it is elegant. The ripeness doctrine is being applied correctly at every step. There is no rogue judge, no defied order, no obvious villainy in the opinion. The architecture simply sequences the harm to land after the final rule and before litigation can reach the merits. Every move is formally compliant with administrative law. That is not a softening of the problem. That is the problem. The timing is the weapon: by the time a court is allowed to rule on whether this is legal, the ballots have already not been mailed. The damage is finished before the law is allowed to look at it.

Who built it, and who can’t be found

There is a named conductor, and there is a void above him, and both are part of the finding.

The named official is Postmaster General David Steiner, who signed the proposed rule. According to Democracy Docket’s reporting, Steiner had “met with other senior Trump administration and DOJ officials to discuss ways to implement the order” before the rulemaking. That is not inferred coordination — it is a disclosed inter-agency steering process. The one-day gap between the Nichols ruling and the USPS notice is not a coincidence; it is what coordination looks like from the outside.

Above Steiner, the only other verifiably named coordinator is Commerce Secretary Howard Lutnick. EO 14399’s text directs DHS and USPS to “coordinate with the Secretary of Commerce in effectuating all relevant aspects” of the order — an instruction with no obvious statutory basis, since Commerce has no authority over either the Postal Service or elections. Senate Democrats flagged the anomaly in a June 1, 2026 letter and characterized “nonpublic reports that you and your office had a key role in drafting” the order. I want to be precise about what that is: a congressional characterization of a nonpublic claim, not independent confirmation that Lutnick drafted the EO. It is attributed here as exactly that and no more.

Above Lutnick, the record goes dark — and the darkness is itself the finding. The usual architects of this kind of policy — Stephen Miller, Russell Vought, James Sherk, the longtime voter-fraud advocates Hans von Spakovsky and Cleta Mitchell — are not documented in any primary or independent source as architects of EO 14399. The mechanisms in the order map onto von Spakovsky’s and the Heritage Foundation’s published advocacy with real precision: SAVE-based voter verification, federal-database matching, mail-ballot restrictions. DHS did brief Mitchell’s Election Integrity Network on SAVE implementation under a predecessor order in June 2025. The information flowing out of the administration to the advocacy network is documented. The flow back — the drafting credit — is not.

This is the deniable-proxy pattern, and it is worth understanding as a category. Procurement capture leaves a paper trail: ethics filings, SEC disclosures, contracting databases. Executive-order capture leaves almost none. The mechanisms are public; the attribution chain above the named implementing officials runs through deliberative-process privilege and channels designed to leave no record. The policy is fully documentable. The architects above the postmaster general are not. That asymmetry is not a gap in my reporting. It is the structural signature of how this kind of power now operates.

What this is, in one sentence

A regulatory mechanism produces an at-scale operational effect — millions of citizens unable to vote by mail — inside a judicial-review window that has been foreclosed by the correct application of ripeness doctrine. Every step is legal. The engineering is in the sequence.

SAVE was built for benefits. It was overhauled in 2025 to check tens of millions of voters against a database that cannot reliably tell a naturalized citizen from a noncitizen. Its accuracy target was lowered, quietly, to 97 percent. At the scale of the electorate, that produces millions of inconclusive flags, most of which fall on eligible citizens. Those citizens drop off the list that decides who gets a mail ballot. They are not told. And the one court that could have looked at the merits declined, on the ground that the harm had not happened yet — the day before the machine that produces the harm was switched on.

What you can do, before July 2

This is where the timing cuts both ways. The same narrow window that forecloses litigation is also, right now, open for something else: the public record.

The Postal Service’s proposed rule is in a public comment period that closes July 2, 2026. Anyone can submit a comment on Docket 2026-10968 through the Federal Register at federalregister.gov/documents/2026/06/02/2026-10968/ballot-mail-for-federal-elections. Click “Submit a Formal Comment” on that page; no account is required. You can also mail written comments to: USPS Headquarters Library, 475 L’Enfant Plaza SW, 11th Floor North, Washington, DC 20260. Comments become part of the official rulemaking record. They are what a future court reviews when it asks whether the agency considered the foreseeable consequences of its rule. An agency that finalizes a rule over a record full of documented, specific, sourced objections is in a materially weaker position than one that finalizes over silence.

The arithmetic in this piece is built to be used. The 3.12 percent inconclusive rate is the Bipartisan Policy Center’s, published. The false-positive range — from a documented floor of 14 percent in a single Texas county to 87 percent statewide in Iowa, with most documented cases clustering between 64 and 87 percent — is on record in Iowa, Alabama, Missouri, and Texas, in court filings and county data. The one-way structure of the gate — no notice, no challenge, no correction inside the mailing window — is in the text of the rule itself.

After July 2, this becomes history. Before July 2, it is a warning that can still be entered into evidence.

Three to four million eligible American citizens. A database that was never built to find them. A rule that turns its errors into silence. And a courthouse door that opens only after the ballots have already failed to arrive.

The comment period closes July 2. The ballots start mailing in September. The window between them is the whole story.

Update — June 24, 2026: a court reached the merits

On June 22, 2026, a federal court did the thing this piece argued the ripeness doctrine had foreclosed: it ruled on the SAVE database itself, on the merits, and found it unlawful. U.S. District Judge Sparkle L. Sooknanan (D.D.C.) granted summary judgment to the League of Women Voters and a coalition represented by Citizens for Responsibility and Ethics in Washington (CREW), the Fair Elections Center, and Democracy Forward, and ordered DHS to set aside and vacate the 2025 SAVE modifications — the integration of Social Security citizenship data, the partial-Social-Security-number searches, and the bulk access that let state and local election officials run voters against the system. The court found those changes violated the Social Security Act‘s disclosure prohibition, the Privacy Act of 1974, and the Administrative Procedure Act. “All in all,” Sooknanan wrote, “the federal government has knowingly trampled on the privacy rights of Americans in a manner that threatens the sacred right to vote.”

This matters, and I want to be exact about how — because the win is real and the trap is still set, and those are two different tracks.

What the ruling reaches: the use of the modified SAVE database to purge voters from registration rolls. That is the application this piece’s arithmetic was about — the 97 percent target, the false-positive flood, the database that cannot reliably tell a naturalized citizen from a noncitizen. A court has now looked at the merits of that machine and vacated it. The accuracy and Privacy Act concerns laid out above are not speculative anymore; they are findings.

What the ruling does not reach: the mail-ballot mechanism — EO 14399’s USPS rule, the July 2 comment window, the ripeness sequence described in “Why no court will stop it in time.” The League of Women Voters case is a separate track from the DSCC v. Trump mail-ballot challenge Judge Nichols declined to hear on ripeness grounds. Democracy Docket’s own report draws the line: this ruling is “distinct from mail-ballot or USPS-related actions.” So the timing trap at the center of this piece is intact. The comment period still closes July 2. The final USPS rule is still expected in late July. The 30-day window before ballots mail is still the whole story.

And two cautions on the win itself: the administration can appeal to the D.C. Circuit, and as of this writing the order’s stay status — whether the vacatur takes effect immediately or is paused pending appeal — has not been specified. A merits ruling is not a final word; it is the start of the next phase.

The cleaner way to hold both facts at once: the purge use of SAVE has been ruled unlawful and vacated, on the merits, by a court willing to reach them. The mail-ballot use routes around courts by design, and that design has not yet been tested on the merits — and can only be tested inside the same narrow window this piece has been warning about. One door has been shut. The one this piece is about is still the trap.

The comment period still closes July 2.

Sources

Primary timeline events (Capture Cascade): - Judge Carl Nichols declines to block EO 14399 mail-ballot provisions (May 28, 2026) - USPS issues proposed rule, Docket 2026-10968, implementing EO 14399 (May 29, 2026)

Government and primary documents: - U.S. Postal Service, Proposed Rule, Federal Register Docket 2026-10968 (published June 2, 2026) — comment period closes July 2, 2026 — federalregister.gov - Executive Order 14399, “Ensuring Citizenship Verification and Integrity in Federal Elections” (signed March 31, 2026) — Federal Register - GAO-17-204, “Immigration Status Verification for Benefits: Actions Needed to Improve Effectiveness and Oversight” (2017) — gao.gov - U.S. Census Bureau, Voting and Registration in the Election of November 2024 (CPS) — ~174M registered — census.gov - U.S. Election Assistance Commission, 2024 EAVS Report — ~211M active registered

Policy research: - Bipartisan Policy Center, “What Adding Motor Vehicle Data to USCIS’s SAVE System Means for Election Administration” (August 2025) — 3.12% inconclusive rate; Iowa case — bipartisanpolicy.org - Protect Democracy, “The SAVE Tool Explained” — Alabama 3,251 flagged / 2,074 eligible — protectdemocracy.org - Brennan Center for Justice, “Homeland Security’s ‘SAVE’ Program Exacerbates Risks to Voters” — brennancenter.org

Reporting: - Homeland Security lowers the accuracy rate for database used to spot voter fraud (Washington Times, May 15, 2026) — USCIS spokesman Zach Kahler; 97% target; 98% actual 2025 - SAVE tool keeps mistakenly flagging voters as noncitizens (Texas Tribune, Feb 13, 2026) — Denton County - “The Broken Database That Could Upend the 2026 Election” (Popular Information) — St. Louis County, MO - “Not Ready for Prime Time” (Techdirt / Alaska Beacon, Feb 26, 2026) — Boone County, MO - Federal judge blocks Alabama voter purge program (NBC News, Oct 2024) — Alabama - Postal Service moving forward with Trump’s attack on mail voting (Democracy Docket, May 29, 2026) — Steiner coordination; SAVE reliance - Federal judge refuses to block Trump order on mail ballots — for now (Votebeat, May 28, 2026) — Nichols ruling

Related RAMM coverage: - Trump’s Campaign to Decide Who Counts? (The RAMM, April 3, 2026) — the SAVE+USPS mail-ballot architecture and the birthright-citizenship layer of the same electorate-control system - Every Database Is an Immigration Database Now (The RAMM, April 1, 2026) — the pattern of which SAVE’s repurposing is the continuation - The Lutnick System (The RAMM, April 10, 2026) — Commerce Secretary Lutnick’s conflict architecture and the anomaly of Commerce’s coordination role in EO 14399

Commerce Secretary Howard Lutnick had signed an export-control order designating both AI models as barred from foreign-national access. Under the Export Administration Regulations, letting a foreign national use a controlled product counts as a “deemed export,” the same legal category as shipping it abroad. Anthropic cannot tell, in real time, which of its users are foreign nationals and which are US citizens. So the only way to comply was to shut the models off for everyone. A federal letter went out at 5:21 p.m.; a worldwide product went dark the same night.

If this looks like a sudden escalation, it isn’t. It is the second use of a lever I wrote about in February — and the first time the lever’s real purpose became impossible to misread.

What February was

Back in February, the Pentagon designated Anthropic a “supply chain risk” — a label normally reserved for companies like Huawei and ZTE, firms treated as hostile to national security. The trigger was not a technical failure or a security breach. It was defiance: Anthropic had refused a Pentagon demand to remove safety guardrails from its models. Hours after the blacklist, the government used Claude inside the Maven Smart System to help identify targets in the Iran strikes — and signed OpenAI to a deal nearly identical to the one Anthropic had just been punished for hesitating over. I laid out the sequence in “The Pentagon Banned Claude as a National Security Threat. Then It Used Claude to Bomb Iran.”

The safety objection was never the point. The punishment was for saying no in public.

The same month produced the other half of the mechanism. The Defense Production Act — a 1950 statute written to make factories build tanks and ships in wartime — was turned inside out. I called that piece “The Hammer and the Guardrail”: the power to compel production had become the power to compel recklessness.

In February, all of this read like a fight about one company’s safety politics. You could squint and call it a contract dispute with an unusually stubborn vendor.

June removed the squint.

What June confirmed

The Friday order rests on the same foundation as February — designate, assert a threat, enforce — but the trigger this time complicates the picture before it confirms it.

The government’s action followed a private warning. According to the Wall Street Journal, confirmed by The Information and Reuters, Amazon CEO Andy Jassy told Treasury Secretary Scott Bessent and other officials that Amazon’s own security researchers had found Fable 5 could be prompted — by feeding it a codebase and asking it to hunt for flaws — into producing information useful for cyberattacks. Within a day, the White House convened, had researchers test the claim, and Lutnick’s letter went out.

Amazon is not a rival. It is Anthropic’s largest investor, hosts Anthropic’s infrastructure, and is owed a $100 billion cloud commitment. The company that bankrolls Anthropic is the company that told the government Anthropic’s flagship was dangerous — and the government reached for an export-control off-switch inside twenty-four hours. Amazon also sells a competing model line, Nova.

What’s being kept secret is narrower than it first looked, and the narrowing matters. The mechanism of the jailbreak has been reported — the codebase trick, the vulnerability-hunting. What remains classified is the government’s formal assessment and the letter itself.

So the order doesn’t rest on evidence no one can see; it rests on a demonstrated weakness anyone can describe, wrapped in a determination no one can examine. Anthropic’s answer was that the weakness isn’t its own: rival models, GPT-5.5 among them, surface the same behavior without any bypass at all, and within a day developers had restored Fable 5’s behavior on another model using leaked system prompts and roughly one line of code. If the containment came undone that fast, the containment was never the point.

Hold the structure up to February’s and the family resemblance survives the new facts. A bare national-security assertion. A formal finding the public never sees. And underneath it, a government that — per the Journal — had “long felt that Anthropic couldn’t be trusted to manage the security risks its new model presented,” that tried to stop Fable 5 from shipping at all and failed, and that issued its order three days after the launch it couldn’t prevent. The guardrail-removal demand in February and the suspension in June are two uses of one tool: a national-security designation, aimed at the firm that has fallen out of favor, with the proof held back. What changed in June is that the tip came from inside the cap table.

The part worth keeping you up at night

Wendy, who writes at wendy664.substack.com, put the through-line plainly: the precedent isn’t really about AI. The claim that pulled Fable and Mythos offline could pull any platform offline — a social network, a search engine, a news app. The mechanism doesn’t care what it’s aimed at.

That’s the part the record now confirms, even as it complicates the rest of her read. The trigger wasn’t a faceless rival; it was Anthropic’s own investor — and the precedent is worse for it. An off-switch a competitor can throw is dangerous. An off-switch your own largest investor can throw is a different category of exposure, and it is available against any company whose backers have a phone number at Treasury.

Two worlds, one diagnosis

What makes Friday hard to wave off is that two people who share almost no priors read it the same way. Wendy comes at it from the accountability side. Nate B. Jones comes at it from the builder’s — he writes for the people who use these tools, and posted his analysis, “The End of Unrestricted AI: Why Claude Fable 5 Was Just Forced Offline”, filmed urgently from a plane by a man who likes the product and expects it back soon.

Jones doesn’t dismiss the safety worry; he grants that a jailbreak against one frontier model is plausibly directionally right as evidence about the whole class. That concession makes his bottom line land harder. He reads the foreign-national “deemed export” language as a shutdown button in export-control wrapping, and then, having granted the concern, refuses the process: “That’s not safety governance. That’s simply the exercise of discretionary power.”

What Jones wants instead is a transparent statutory path, a clear technical standard, and a way for the company to answer the evidence — because otherwise, he warns, any frontier model can be frozen “on the basis of a claim the public cannot see, from a process no one can audit.”

His demand next to Wendy’s warning is the same sentence said twice: neither rests the case on the model being unsafe, both argue the process is the danger, both name the same fix. And they are not only agreeing about AI. Each has seen this lever aimed somewhere else first.

This is not, finally, an AI story. It is one move, and the move has grammar — five parts that repeat, agency to agency, whatever the subject. Once you can read the grammar you can recognize the next instance on sight, in a room you’ve never looked at, before the cover story arrives. It runs like this: the power is designated by discretion, so no statute fences it. A wrong is asserted that no one outside the room can see. The wrong is enforced selectively, against some and not others. The punishment is delivered through the process itself — the investigation, the indictment, the credential pulled, the switch thrown — so the harm lands whether or not anything is ever proven. And under every pretext, the real offense is defiance. Discretionary designation, unseeable predicate, selective enforcement, punishment-as-process, defiance as the true offense. That is the shape, and I’ve traced it across domains.

Watch it hold across four rooms that share nothing else. When the false-statements case against James Comey fell apart, the Justice Department re-indicted him in April 2026 over a year-old deleted Instagram photo of seashells spelling out 86/47— the defendant was fixed; the charge was swapped. Bill Pulte’s FHFA aimed identical mortgage-fraud referrals at Lisa Cook, Letitia James, Adam Schiff, and Eric Swalwell — all Democrats Trump had publicly threatened with retribution before each referral — after Fannie Mae’s own fraud staff doubted the evidence; a Senate letter naming all four called them “political enemies of President Donald Trump,” and James’s court filing, brought by Abbe Lowell, argued Pulte had turned the agency into a “political weapon” aimed at “Trump’s enemies,” while the Government Accounting Office, the GAO, reviews Pulte’s referrals and Cook’s firing sits before the Supreme Court in Trump v. Cook, argued January 21, 2026. A federal judge, Paul Friedman, found the Pentagon’s press policy built to weed out “disfavored journalists” and keep the ones “on board and willing to serve.” And the White House stood up a Media Bias Portal at whitehouse.gov/mediabias — with a tip line at whitehouse.gov/biastips soliciting public reports against named journalists — anchored by an “Offender Hall of Shame” and a leaderboard the site itself calls a “race to the bottom,” with the coverage tagged “lie” and “left-wing lunacy.” Prosecution, finance, press credential, a denunciation portal — one grammar, four dialects.

Fable isn’t the worst of these. It’s the clearest. Every other case leaves you arguing about the conduct: maybe Comey did lie, maybe the mortgages were irregular, maybe the reporters really were a problem. Fable is the one instance with a control condition. OpenAI was rewarded on the exact terms that condemned Anthropic — the same Pentagon, the same guardrail question, the same week — with everything else held constant. That isolates the two steps that matter: the enforcement was selective, and the offense was defiance. The informant was the only variable. The target was the constant. The OpenAI contrast is what proves the target was chosen, not the conduct.

So the close holds, just wider. A national-security assertion, backed by a classified finding and a tip from whatever quarter supplies one, can take a major platform off the internet overnight: and the machinery that does it has an off-switch that keeps getting thrown at the people who criticize the people holding it. The one demand that would make any of this legitimate — transparency, a process you can audit, evidence a company can answer — is the exact thing a discretionary off-switch is built to avoid. The off-switch was always the point. It just took until June for two people from opposite worlds to look at it and say, in one voice, that the only answer is to make it something the public can see.

Sources: primary reporting is the Wall Street Journal (Jassy–Bessent contact; that Bessent “long felt Anthropic couldn’t be trusted”), with Axios reconstructing the Thursday-night sequence and the failed attempt to block Fable 5’s release and the 90-minute takedown window, and The Information and Reuters corroborating. Confirming secondary coverage includes NBC News, Quartz, Benzinga, and The Next Web. Named-person anchors in the close are wire-sourced: Comey re-indictment (NBC News, Apr 28 2026); Pulte/Cook referrals (Senate Banking GAO-referral letter Nov 17 2025 naming all four; CNN Business GAO probe Dec 4 2025; CNBC Trump v. Cook Jan 21 2026 argument). GAO clause carries the CNN Business inline link.

The precise coding language is “Full and Open After Exclusion of Sources” with exactly one offer received; the methodology section explains what it means.

Ninety-one percent concentration in a billion-dollar sample sounds like a monopoly.

What it actually is: an audit. An audit of a procurement architecture built by Congress, operated by successive administrations, and navigated with precision by a class of VC-backed defense startups. The 91 percent is not fraud. It is not rogue contracting. It is not a violation of any federal statute. It is a documented output of two legal pathways operating in structural tandem — and a window into why a competition audit of the defense-AI vertical produces a number that strange.

This piece explains the architecture. A fortcomming companion piece, Two Doors, Same Room, will examine the enterprise-vehicle and capture-via-protest mechanisms — the Anduril $31B indefinite-delivery/indefinite-quantity (IDIQ) ceiling, the Palantir $10B Army enterprise license agreement (ELA), the Palantir Defense Intelligence Agency (DIA) MARS protest — that operate alongside and on top of what you’re about to read. Those are different statutory mechanisms, different evidence, and a different structural finding. Start with either one. The architecture is the story.

Reading the Procurement Database

The federal government’s official record of its own purchases is called FPDS-NG — the Federal Procurement Data System, Next Generation. The public-facing version lives at USAspending.gov. Every contract award and contract vehicle above the micro-purchase threshold is supposed to be in there, coded across dozens of fields: what was bought, by which agency, from which vendor, for how much, and — critically — how it was competed.

That last part is what the audit focused on. Specifically: a three-field combination that serves as a fingerprint.

Field one: extent_competed. This tells you the competition category for the award. The value “Full and Open After Exclusion of Sources” is FPDS’s technical translation of one specific situation: the contracting officer applied the categorical preference for competitive procurement, then invoked a statutory exception that permitted excluding all other sources. It looks like competition at the top level; one step deeper, it is not.

Field two: number_of_offers_received. When this field reads 1, no competing bid was received — or sought.

Field three: any small-business set-aside designation. This is the final marker. When you have exclusion-of-sources coding plus one offer received plus a small-business set-aside, you are looking at the signature of a very specific statutory authority: a Small Business Innovation Research (SBIR) Phase III sole-source award under 15 U.S.C. §638(r)(4) — the SBIR program’s Phase III provision. And once you know that, you know something important about how the defense-AI vertical is built.

What the SBIR Phase III Authority Actually Does

The SBIR program operates in phases. Phase I is a small feasibility award — typically $50,000 to $300,000 — made to a startup while it is genuinely small. Phase II is a prototype development contract, typically $750,000 to $2 million. Both phases require the firm to qualify as a small business under the relevant size standard (generally under 500 employees for the applicable industry classification — the NAICS, or North American Industry Classification System, codes the government uses to define each sector’s size cutoff).

Phase III is where things get architecturally interesting.

Under 15 U.S.C. §638(r)(4), any federal agency can award a Phase III contract — a full production-scale procurement — to a firm that completed Phase I or Phase II SBIR work, without competition. The statutory language covers not just the original technology and agency, but explicitly: “a different application of the technology, including a different program or agency.” A small startup that wins a Phase I Air Force SBIR award for an AI sensor-fusion platform has just banked a predicate — a prior award that serves as the qualifying basis for later sole-source contracts — and that credential follows it indefinitely, at any agency, for any sufficiently related application.

No size requalification is required at Phase III. The small-business eligibility check happens at Phase I/II entry. Once the predicate is banked, the sole-source eligibility persists regardless of what the firm does next — how large it grows, how much VC money it raises, what its valuation reaches. The Phase III sole-source authority is a one-time eligibility gate, not an ongoing constraint.

What the contracting officer must produce is a J&A — Justification and Approval — asserting that the work “derives from” the prior SBIR funding. That derivation claim is the procedural gate; whether it functions as substantive review or administrative formality is not visible in public procurement data. The federal regulatory implementation sits at FAR 6.302-5 — a provision of the Federal Acquisition Regulation, the government-wide rulebook for buying things — with a counterpart at DFARS 206.302-5, the Defense Department’s supplement to those rules, that specifically authorizes SBIR Phase III sole-source awards across all DoD components. The J&A documents for the three anchor contracts identified in this audit are not posted in the public FPDS record. They are, as the research pack documents, a FOIA target.

Throughout this piece, “the fingerprint” refers to that one specific combination of three database fields — exclusion-of-sources coding, one offer received, and a small-business set-aside — appearing together on a single award. That trio is what this mechanism leaves behind in the database: the three-field signature of a contract that was never put to competition, because statute says it does not have to be. Wherever the audit finds all three on one record, it has found an SBIR Phase III sole-source award.

The Audit Findings: Pathway 1

Across 1,005 award and indefinite delivery vehicle records examined from eight defense-AI firms, the audit found 56 records carrying the three-field fingerprint, totaling $1,008.4 million in obligations. Here is the breakdown of the firms operating inside this architecture:

Anduril Industries: 40 records, $913.6 million. The anchor is contract vehicle 70B02C20D00000019 — the Customs and Border Protection (CBP) Autonomous Surveillance Towers indefinite-delivery/indefinite-quantity (IDIQ) vehicle. The $913.6 million figure represents total obligations across all 40 SBIR-fingerprinted Anduril records in the audit scope; the CBP vehicle alone carried approximately $862.1 million in task-order obligations between 2020 and 2026 across 23 child task orders (the individual orders placed under the umbrella vehicle), with the parent vehicle carrying a $2 billion ceiling. The parent vehicle carries the SBIR Phase III designation: one offer received, Small Business Set-Aside Total. The underlying SBIR predicates were Air Force and AFWERX — the Air Force’s innovation-procurement arm — Phase I and II awards on AI autonomy and sensor-fusion platforms. The Phase III application — autonomous surveillance towers at the southern border, awarded through the Department of Homeland Security rather than the Air Force — qualifies under §638(r)(4)(B)’s cross-agency, different-application provision. By the time the CBP task orders were flowing, Anduril’s valuation had crossed $14 billion.

Shield AI: 6 records, $19.1 million. The canonical instance is Navy IDV N6833524G0022, literally titled “SBIR PHASE III BOA” — basic ordering agreement — in the federal record. The SBIR Phase III designation is not inferred from field combinations here; it is written into the contract title. Shield AI was valued at approximately $12.7 billion at the time of its most recent documented awards.

Vannevar Labs: 4 records, $14.0 million. Vannevar Labs is a defense-software startup that builds AI tools for intelligence analysis and electronic warfare — sifting foreign-language signals, open-source data, and sensor feeds for military and intelligence users. The anchor is FA860425CB008, an AFWERX STRATFI-Velocity award — a mechanism the Air Force built specifically to convert Phase II prototypes into Phase III production awards via SBIR sole-source authority. STRATFI (Strategic Funding Increase) is the formal pipeline for exactly this conversion. The Vannevar SBIR.gov portfolio documents Phase I and Phase II Air Force and AFWERX predicates supporting the sole-source eligibility.

Palantir Technologies (transitional case): 5 records, $60.9 million, coded “No Set-Aside Used.” Palantir uses the exclusion-of-sources coding via non-SBIR statutory authority — the firm outgrew small-business eligibility years ago and cannot bank SBIR predicates. The coding recurs; the SBIR predicate does not. Palantir’s procurement architecture layers enterprise vehicles and OTA awards on top of this, a three-layer structure covered in the companion piece.

SpaceX: 258 FPDS records, zero exclusion-of-sources. SpaceX’s launch contracts are genuinely competed firm-fixed-price awards. The audit method produces no false positives on SpaceX; the three-field fingerprint does not appear. This is the negative-case anchor: competed procurement leaves a different signature.

Anduril’s $913.6 million out of the $1,008.4 million SBIR-fingerprinted total is the 91 percent — that is, Anduril holds 91 percent of all SBIR-Phase-III-fingerprinted defense-AI obligations in the audit sample. The number is large because one contract vehicle is large: the CBP Autonomous Surveillance Towers (AST) indefinite-delivery vehicle, with its 23 task orders, is the dominant mass.

The 91% is dominated by one contract — but the architecture it documents is shared. Remove that one vehicle and the 91 percent number changes, but the structural finding does not: the SBIR Phase III three-field fingerprint is shared infrastructure across the early-scaling defense-AI startup cohort, not an Anduril idiosyncrasy. Shield AI, Vannevar Labs, and Palantir all carry the same FPDS signature; Anduril’s scale is exceptional, the mechanism is not.

The Audit Findings: Pathway 2, and What FPDS Cannot See

Here is the structural finding that matters more than the 91 percent.

The firms that did not show up in the SBIR Phase III fingerprint audit — OpenAI, Scale AI, Saronic Technologies — are not absent from defense-AI procurement. They are absent from FPDS-visible defense-AI procurement — that is, the slice of federal buying that shows up in the Federal Procurement Data System at all. The mechanism they use is Other Transaction Authority (OTA), authorized under 10 U.S.C. §4022.

OTAs are procurement vehicles that are explicitly and deliberately outside the Federal Acquisition Regulation. They are not “contracts” as the Competition in Contracting Act defines that term. They are not subject to the competition requirements of FAR Part 6 (the section of the Federal Acquisition Regulation that mandates full and open competition). They are not subject, in most circumstances, to the bid-protest jurisdiction of the Government Accountability Office (GAO) — the congressional watchdog that hears challenges to how contracts were awarded. And critically: they are not coded in FPDS by extent-competed or number-of-offers-received. Those fields are designed for FAR-governed contracts. OTAs are categorically excluded from that framework.

The documented OTA awards for the firms in the audit scope:

OpenAI: zero FPDS contract records. $200 million CDAO OTA announced June 16, 2025 (CNBC). CDAO — the Chief Digital and Artificial Intelligence Office — is the DoD’s enterprise-AI procurement vehicle. Based on the audit record and the reported named awards, OpenAI’s documented federal defense engagement is OTA-mediated. None of it feeds the system the FPDS audit reads. (For the politics of these AI-to-DoD contract relationships — including the selective enforcement dynamics between OpenAI and Anthropic — see The Pentagon Banned Claude as a National Security Threat. Then It Used Claude to Bomb Iran.)

Scale AI: residual $700,000 in FPDS from a 2021 Phase I SBIR award — one small predicate, never converted to Phase III production. The firm’s actual defense engagement spans two OTA vehicles: a prime prototype contract from the Defense Innovation Unit (DIU) for Thunderforge, the DoD’s flagship AI-for-military-planning program (March 2025, contract value not publicly disclosed), and a separate CDAO Production OTA with a $500 million ceiling (originally $100 million when awarded September 2025, expanded to $500 million in May 2026). Additionally, the Army Contracting Command awarded Scale AI a $99 million R&D contract in August 2025 for data operations and AI model development. The reason Scale AI routes through OTA rather than SBIR: post-Meta investment, Scale AI is approximately 49 percent Meta-owned at a $29 billion valuation. It is not a small business. It cannot bank new SBIR Phase I/II predicates. The OTA rail is its only available non-competitive pathway.

Saronic Technologies: $500 in FPDS — a micro-contract. The substantive engagement is a $392 million Navy OTA for the Corsair Autonomous Surface Vessel, reported by DefenseScoop in August 2025 and routed through Navy OTA infrastructure rather than FPDS competition coding.

The named OTA awards — OpenAI $200 million, Scale AI $500 million CDAO ceiling plus $99 million Army R&D, Saronic $392 million, plus approximately $200 million for Anthropic under the July 14, 2025 CDAO four-vendor prototype OTA (the same vehicle that awarded $200 million each to OpenAI, Google, and xAI) — total more than $1.4 billion in non-competitive procurement that a FPDS-based competition audit cannot reach.

A methodological note on precision: those OTA figures are per-award named-press disclosures, not a consolidated audit. The $913.6 million Anduril figure is FPDS-sourced and verifiable field by field. The OTA figures are from CNBC, DefenseScoop, and DoD press releases — reliable for individual awards, but not summed from a unified dataset. The aggregate non-competitive volume across the defense-AI vertical is bounded below by approximately $2.4 billion in FPDS-visible plus named-OTA figures; the actual total requires a consolidated OTA audit that has not been conducted.

The Dual-Pathway Architecture: The Finding That Outlasts the Number

The 91 percent figure is the headline. The structural finding underneath it is more durable.

The defense-AI vertical does not have one non-competitive procurement pathway. It has two, operating simultaneously, with architectural complementarity: each pathway covers the procedural friction the other encounters.

Pathway 1 is SBIR Phase III: 15 U.S.C. §638(r)(4), FAR 6.302-5, DFARS 206.302-5. Available to firms that banked Phase I and II predicates while small. Produces FPDS-visible awards coded “After Exclusion of Sources.” Requires a J&A asserting derivation from prior SBIR work. Operates inside the FPDS system.

Pathway 2 is OTA non-competitive consortia: 10 U.S.C. §4022, administered through a set of Defense Department “innovation” buying organizations and the industry consortia they run — CDAO (the Chief Digital and Artificial Intelligence Office), the Defense Innovation Unit (DIU), AFWERX (Air Force), SOFWERX (Special Operations), and the consortium managers Tradewinds, NSTXL, and SOSSEC that assemble pre-vetted vendor pools an agency can award to without open competition. Available to firms regardless of size, so long as they can qualify for a consortium or reach a direct OTA award. Produces awards that do not carry FPDS extent-competed coding. Does not require a FAR-governed J&A (though OTA agreements often carry internal approval documentation that is functionally analogous). Operates outside the FPDS system.

Both pathways are statutorily authorized. Both have been in the federal procurement toolkit for years. What is documented here is their systemic vertical-level dual-deployment: the same vendor class operates both pathways simultaneously, with the pathway selection conditioned not on the nature of the work but on the firm’s scaling trajectory at the moment of federal-defense entry.

Firms that banked SBIR predicates while small — Anduril (founded 2017), Shield AI (founded 2015), Vannevar Labs — ride Pathway 1 for applications where the “derives from” assertion holds. Firms that arrived at scale without banking SBIR predicates — OpenAI, Scale AI post-Meta investment, Saronic — ride Pathway 2 because Pathway 1 is not available to them. Anduril is the paradigm case of dual-pathway operation: SBIR Phase III covers the CBP autonomous-surveillance-towers production line; OTA covers the Replicator initiative — the Pentagon’s program to field thousands of low-cost autonomous drones at speed — and newer DoD applications where, for a firm now valued well past $14 billion, the connection to the original SBIR predicates becomes more attenuated — a documented pattern in how SBIR Phase III scope limits apply as firms scale beyond their founding-stage eligibility window.

The pathway-selection is not a vendor-by-vendor preference. It is a function of scaling trajectory at the moment of federal-defense entry. The architecture is the through-line; the pathway taken is determined by when a firm arrived and whether it was small enough, at the right moment, to bank a predicate.

Why This Architecture Is Structurally Novel

Before the current defense-AI era, the dominant procurement-capture pattern was the Beltway-bandit revolving-door model: a traditional defense contractor maintained personal-relationship networks with program offices, and won sole-source contracts one J&A at a time. The accountability scrutiny point was the individual J&A: GAO bid protests reviewed J&A adequacy; IG investigations reviewed specific sole-source abuses; congressional oversight focused on particular procurement scandals.

The dual-pathway architecture operates one layer above the J&A.

The statutory pathways — SBIR Phase III and OTA — pre-authorize non-competitive procurement in categories defined by statute, not by individual contracting-officer judgment. A firm inside Pathway 1 does not need a fresh judgment call on competitive adequacy for each award; it needs only a procedural J&A asserting derivation from prior SBIR work, which the statutory scheme treats as an administrative threshold rather than a competitive review — and which, in practice, the documented record shows these awards passing readily. A firm inside Pathway 2 does not need a J&A at all.

The result is a vendor class that is non-competitively procured by statutory design, not by a sequence of individual judgment calls that could be reviewed and overturned one at a time. GAO bid-protest authority polices individual contract awards; SBA polices individual SBIR program integrity; DoD IG polices individual OTA-consortium decisions; Congress oversees 15 U.S.C. §638 and 10 U.S.C. §4022 separately, in different authorizing committees. No single oversight body reviews the dual-pathway vertical-deployment pattern end-to-end as a unified fact.

This is the structural accountability gap. The 91 percent concentration is the residue of Pathway 1 — the portion FPDS can see. The larger and faster-growing portion of the vertical is on Pathway 2, where the audit instrument does not reach. The audit does not reveal that a competition occurred and was lost. It reveals that a competition was structurally foreclosed before it could happen.

The Policy Acceleration: Why the Gap Is Growing

The dual-pathway architecture is an existing structure. What has changed recently is the demand side.

Executive Order 14265, signed April 9, 2025, institutionalized OTA preference at the DoD-wide policy level, explicitly directing acquisition components toward other-transaction vehicles for defense-AI procurement. Secretary Hegseth’s Warfighting Acquisition System memo pushed the same direction administratively. EO 14271 reinforced the commercial-item preference framework that the companion piece covers in detail.

The executive policy preference for OTA means that Pathway 2 is now policy-preferred as well as statutorily authorized. The demand-side of the procurement architecture has been aligned with the supply-side pathways the vendor class already inhabits.

The FPDS audit is a snapshot of the architecture’s documented output before the full effect of those 2025 policy changes has worked through the system. The $1,008.4 million Pathway 1 figure largely reflects awards obligated between 2020 and 2026; the Pathway 2 OTA figures include 2025-announced awards still early in their execution periods. If the executive-policy preference for OTA accelerates Pathway 2 adoption across the vertical, a 2028 audit of the same eight firms may show a dramatically different FPDS picture — not because competition increased, but because more of the vertical moved to the rail FPDS cannot see.

The structural accountability gap is not going to appear in FPDS. The 91 percent figure is the visible residue of Pathway 1. The faster-growing segment is on Pathway 2. The audit instrument that produced the 91 percent figure is the wrong instrument for the problem we now have.

What Responsible Oversight Would Look Like

The FPDS audit documented here is, in the language of the field, a partial audit of Pathway 1 only.

A comprehensive competition audit of the defense-AI vertical would require:

For Pathway 1: FOIA requests for the J&A documents on the Anduril CBP IDIQ (70B02C20D00000019), the Shield AI Navy BOA (N6833524G0022), and the Vannevar Labs STRATFI award (FA860425CB008) — to establish whether the “derives from” determination was substantively reviewed or applied as a procedural formality. Task-order-level offers-received data pulled directly from the FPDS-NG atom feed — the government’s raw machine-readable procurement export — because the USAspending.gov copy of that data carries unreliable values for some task-order-level fields. Cross-reference of SBIR.gov Phase I and II predicate contracts against Phase III production awards to map the derivation chain agency-by-agency.

For Pathway 2: OTA roster pulls from CDAO, DIU, Tradewinds, NSTXL, and SOSSEC covering the firms in scope. Per-consortium documentation of the consortium-establishment competitive steps, to assess whether the consortium structure was genuinely competitive at the establishment stage or whether the consortium-establishment step was de facto predetermined. Consolidated dollar-amount aggregation across the full OTA universe, which currently exists only in fragmentary form via press releases and DoD announcements.

For the vertical as a whole: A framework that can assess the cumulative non-competitive position of the defense-AI vendor class across both pathways simultaneously. GAO has the authority to conduct procurement audits. A GAO request specifically directed to examine the dual-pathway architecture — SBIR Phase III plus OTA, across the defense-AI vertical, as a unified fact — would be the appropriate oversight instrument. That audit has not been requested. Whether it is requested is a congressional decision.

What the May 26 FPDS audit established is the predicate: 91 percent concentration in the visible part of a procurement universe whose larger and faster-growing segment is structurally invisible to the instrument being used. That is enough to justify asking for an instrument capable of seeing the whole picture.

The architecture built two pathways. The audit measured one of them. The other is behind FPDS.

Sources

Primary Procurement Data (FPDS-NG / USAspending.gov): - Anduril IDIQ 70B02C20D00000019 — After Exclusion of Sources, 1 offer, Small Business Set-Aside Total (USAspending.gov, accessed 2026-05-26) - Shield AI N6833524G0022 — IDV titled “SBIR PHASE III BOA” (USAspending.gov, accessed 2026-05-26) - USAspending.gov API award-detail endpoint (FPDS-NG mirror) — extent_competed / number_of_offers_received / type_set_aside fields

Statutory Sources: - 15 U.S.C. §638(r)(4) — SBIR Phase III sole-source authority - 10 U.S.C. §4022 — Other Transaction Authority - FAR 6.302-5 / DFARS 206.302-5 — SBIR Phase III competition exception

Reporting: - OpenAI wins $200 million U.S. defense contract (CNBC, June 16, 2025) - Navy moves to buy autonomous maritime drones from Saronic via $392M OTA (DefenseScoop, August 22, 2025) - Anthropic awarded $200M DOD agreement for AI capabilities (Anthropic, July 14, 2025) — prototype OTA, CDAO - Anthropic, Google and xAI win $200M each from Pentagon AI chief for ‘agentic AI’ (Breaking Defense, July 14, 2025) — confirms four-vendor, $200M each, CDAO vehicle - Pentagon awards mega contracts to Musk-owned company, other firms for new ‘frontier AI’ projects (DefenseScoop, July 14, 2025) - DIU’s Thunderforge Project to Integrate Commercial AI-Powered Decision-Making (DIU, March 5, 2025) — Scale AI prime prototype OTA, DIU contracting authority - Scale AI Expands Pentagon AI Partnership to $500 Million (Scale AI, May 2026) — CDAO Production OTA, $500M ceiling; originally $100M when awarded September 2025 - Scale AI Secures $99M Army Contract for R&D Services (GovConWire, August 2025) — Army Contracting Command, competed FAR contract

Policy Documents: - Executive Order 14265 — Modernizing Defense Acquisitions and Spurring Innovation in the Defense Industrial Base (April 9, 2025)

Research Infrastructure: - FPDS Audit Timeline Event — 2026-05-26 — Capture Cascade timeline; 1,005 records; $1,008.4M; 91% Anduril - Defense-AI Dual-Pathway Procurement Architecture — Capture Cascade theme index

Companion Piece: - Two Doors, Same Room: The 2026 Procurement Architecture — enterprise vehicles and capture-via-protest (FASA commercial-item preference, EO 14265/14271, Palantir DIA MARS protest); same vendor class, different statutory mechanisms. Published at The RAMM.

Related RAMM Coverage: - The Pentagon Banned Claude as a National Security Threat. Then It Used Claude to Bomb Iran. — selective enforcement dynamics between OpenAI and Anthropic in DoD contracting; context for the CDAO OTA awards documented here. - The Hammer and the Guardrail — how the Pentagon weaponized the Defense Production Act to force Anthropic to remove AI safety guardrails; backstory to the same DoD AI contracting relationships.

This is not a story about a smoking gun. It is a story about two documents that do not match, and about the administrative process that made them different without Congress knowing.

The Man and the Job

Michael Obadal spent 27 years as an Army colonel before joining Anduril Industries as a Senior Director. His background — decades in military acquisition and operations — made him the kind of hire that defense companies make when they want to build relationships with the government they are trying to sell to. Trump nominated him to be Under Secretary of the Army in March 2025. The Senate confirmed him on September 18, 2025, by a vote of 51 to 47.

The Under Secretary of the Army is one of the most consequential procurement officials in the federal government. The office oversees Army acquisition and technology programs, including decisions about which defense contractors win the contracts that drive American military modernization. When the Army wants to buy autonomous systems, AI battlefield software, or drone-killing counter-air platforms, the Under Secretary’s office is in the chain.

Anduril Industries builds all of those things. In the nearly six months between Obadal’s September confirmation and the March 2026 contract award, the Army was negotiating and finalizing an Indefinite Delivery, Indefinite Quantity contract with his former employer — the largest Army AI contract in history.

The recusal question was not theoretical.

Two Documents, One Recusal

Here is what Obadal said at his Senate Armed Services Committee confirmation hearing on May 8, 2025, as reported by Breaking Defense:

“I am recused, writ large, from anything having to do personally and substantially with my former employer.”

Here is what his signed ethics agreement actually says. This is the verbatim text of Section 2 of the Amended Ethics Agreement, signed by Obadal on August 15, 2025, and transmitted to the U.S. Office of Government Ethics by the Department of Defense on August 18, 2025:

“Pursuant to the impartiality regulation at 5 C.F.R. § 2635.503, for a period of two years after my resignation, I will not participate personally and substantially in any particular matter involving specific parties in which I know Anduril Industries or is a party or represents a party, unless I first receive a written waiver, pursuant to 5 C.F.R. § 2635.503(c).”

The difference is not a matter of legal hair-splitting. Under federal ethics regulations, “particular matter involving specific parties” is a term of art with a defined scope. It means specific decisions — specific named contracts, specific named companies — not the broader program-level architecture decisions in which a former employer has only a generalized interest. The regulation that uses this term (5 C.F.R. § 2635.503) explicitly excludes broader policy matters, rulemakings, and program-level decisions from its coverage.

In plain English: “anything having to do with my former employer” covers Anduril’s interests broadly. “Any particular matter involving specific parties” covers only specific named-Anduril decisions. Those are not the same commitment.

There are two other gaps in the document record that compound the mismatch.

The first is time. Obadal’s testimony described the recusal without a sunset date — consistent with a permanent or indefinite commitment. The document he signed commits him for exactly two years after his resignation, expiring on approximately September 22, 2027. Senator Elizabeth Warren’s May 7, 2025 letter to Obadal explicitly demanded a four-year recusal. The document delivers half.

The second is the override mechanism. The recusal in the ethics agreement is not absolute. It can be suspended whenever Obadal “first receives a written waiver, pursuant to 5 C.F.R. § 2635.503(c).” The waiver is issued by the Designated Agency Ethics Official in the Department of Defense Office of the General Counsel — the same office that processed the ethics agreement in the first place. A written-waiver carveout converts the recusal from a wall into a door that ethics officials can open.

How It Got That Way

The mismatch between testimony and document traces to an administrative process that happened between Obadal’s nomination in March 2025 and his confirmation in September 2025 — without public disclosure.

When Obadal signed his original ethics agreement on April 11, 2025, he committed to a different and broader standard. The original agreement, included in the amended document’s enclosures, covered him under 18 U.S.C. § 208 — the criminal conflicts-of-interest statute — because he represented that he held vested Anduril restricted stock units. The § 208 commitment was indefinite: it applied for as long as Obadal held financial interests in the company. It also covered any matter with “a direct and predictable effect on the financial interests of Anduril Industries” — a broader standard than the named-contract-specific test in the later version.

Between April and August, the document changed.

Obadal’s August 15, 2025 letter to the DoD ethics official explained the reason: he had not actually held vested restricted stock units as of the original signing date, only unvested RSUs. Because unvested RSUs would be forfeited upon confirmation — and because he held no other Anduril equity — the financial-interest basis for the § 208 commitment evaporated. The original ethics agreement’s premise was wrong.

So the commitment was narrowed to match the corrected facts: from the indefinite, broader § 208 financial-interest bar to the two-year, named-party-specific § 2635.503 impartiality commitment.

That substitution was processed administratively, through a letter from Obadal to DoD’s ethics official and transmitted to the Office of Government Ethics (OGE) by Danica S. Irvine, Alternate Designated Agency Ethics Official, DoD OGC. The whole process was complete on August 18, 2025 — four weeks before the Armed Services Committee voted to confirm Obadal. There is no public record that the committee was informed that the recusal commitment had been substantively narrowed between the original nomination and the confirmation vote.

This note is about the structural gap in the process, not a claim that any rule was broken. The OGE administrative-amendment process permits amendments when underlying facts change. The Senate could have requested the updated Ethics Agreement (EA) before voting. The piece’s structural claim is narrower: Senators who voted on whether Obadal’s recusal was adequate did so without being publicly informed that the recusal had been narrowed since his nomination.

The $20 Billion Question

In March 2026, the Army awarded Anduril Industries a contract with a ceiling of $20 billion.

Contract PIID W9128Z-26-D-A001, awarded March 13, 2026, is an Indefinite Delivery, Indefinite Quantity (IDIQ) vehicle — meaning the ceiling represents the total authorized spending authority over the contract’s life, not a single payment. The contracting officers of record are Kristin Height and Robin Delossantos at the Army Contracting Command at Aberdeen Proving Ground. The contract is for Army enterprise-wide AI, autonomous systems, and command-and-control platforms. The first task order, issued later in 2026, was worth $87 million and covers counter-drone command-and-control.

Under a plain reading of the § 2635.503 language, the $20B IDIQ — in which Anduril is the named contract awardee — would appear to be “a particular matter involving specific parties.” Under that reading, the commitment in the EA would prohibit Obadal from personally and substantially participating in the award unless a written waiver was issued first. Whether the IDIQ in fact falls within that statutory scope is the kind of determination a DoD ethics official would make — but the plain text of the regulation and the contract point in the same direction.

No written waiver has been disclosed. The Certification of Ethics Agreement Compliance — a document Obadal was required to submit to OGE within 90 days of his September 22, 2025 confirmation, meaning by approximately December 22, 2025 — has not been located in OGE’s public PAS Index as of the date of this publication.

One possibility is that both documents exist but have not been made public or have not yet been indexed in a way our search reached. Another is that they do not exist. Either outcome is significant: the first invites the documents’ disclosure; the second raises questions about whether the ethics compliance regime is functioning.

The Pattern

This is the second time RAMM has documented this specific mechanism.

In February, we covered Tom Homan’s appointment as Border Czar and the ethics architecture that accompanied his team. David Venturella, a former senior vice president for Client Relations at GEO Group — the private prison company that holds billions of dollars in ICE detention contracts — returned to DHS as a senior adviser in February 2025. He received an ethics waiver that allowed him to participate in GEO-related detention matters, converting what would have been a statutory post-employment restriction into an administratively-granted permission.

The structural logic is the same in both cases. A categorical legal bar — the kind of bar designed to prevent officials from serving the interests of their former employers — gets converted into a narrower administrative commitment. The commitment comes with a written-waiver mechanism, which means that a government ethics official can lift the restriction. Within the rules of the system as designed, the restriction is no longer a wall. It is a door.

In the Homan-Venturella case, the statutory pathway was 18 U.S.C. § 207 — the post-employment restriction statute — lifted by formal waiver after appointment. In the Obadal case, the statutory pathway was 18 U.S.C. § 208 — the financial-interest-based conflict statute — narrowed at the pre-confirmation stage by amendment to a weaker regulatory standard. The mechanisms differ; the outcome is the same: the categorical bar becomes administratively tractable within the appointee’s expected tenure, with a written-waiver override built in.

The difference with Obadal is the gap between what the document says and what was said under oath to describe it.

What We Don’t Know

There is a dispositive question this piece cannot answer.

Whether Obadal participated personally and substantially in the decision to award the $20 billion IDIQ to Anduril, and whether any written waiver was issued to authorize that participation, is not established by the documents in the public record. It is what the FOIA process exists to resolve. RAMM has filed or will file Freedom of Information Act requests with the U.S. Office of Government Ethics and the Army Office of the General Counsel seeking the Certification of Ethics Agreement Compliance, any written waivers issued under § 2635.503(c) related to Anduril matters, and any recusal-scope determinations issued for the Under Secretary’s office in connection with the IDIQ award decision.

What the existing public record does establish is this: in April 2026, Obadal gave public statements to Breaking Defense characterizing the Army’s enterprise-licensing-agreement program — the program architecture of which the Anduril IDIQ is the first major vehicle — as a program-wide initiative he was publicly associated with. He did not identify himself as recused from it in those statements.

The question of whether that program-level decision falls inside or outside the “particular matter involving specific parties” scope of his ethics agreement is the question his ethics agreement creates but leaves unanswered. The testimony language — “writ large, from anything having to do personally and substantially with my former employer” — would cover it. The document language may not.

The Document Is on the Internet

The ethics agreement that governs Michael Obadal’s conduct as Under Secretary of the Army is publicly posted on the U.S. Office of Government Ethics website. It has been there since August 2025. It is not classified, not FOIA-dependent, not contested.

The document he signed is narrower than the recusal he described under oath. That narrowing happened through an administrative process that the senators who confirmed him had no public notice of. A $20 billion contract went to his former employer nearly six months into his tenure. No waiver has been disclosed.

The answers to what happened between that document and that contract may eventually come through FOIA responses or congressional inquiry. But the document the government has already made public is enough to ask the question.

Sources

Primary Documents

• Michael Obadal Ethics Agreement (AMENDED) — OGE PAS Index, signed August 15, 2025; DoD transmittal August 18, 2025. Full text on file.

• Senator Warren letter to Obadal on ethics commitments — May 7, 2025.

• 5 C.F.R. § 2635.503 — Extraordinary payments from former employer; impartiality recusal regulation

• 18 U.S.C. § 208 — Acts affecting a personal financial interest; criminal conflicts-of-interest statute

• Contract W9128Z-26-D-A001 — Army IDIQ to Anduril Industries, $20B ceiling, awarded March 13, 2026. ACC Aberdeen Proving Ground. Contracting officers: Kristin Height, Robin Delossantos. Federal record: https://www.usaspending.gov/award/CONT_AWD_W9128Z26DA001_2100_-NONE-_-NONE-/

Confirmation Testimony

• Breaking Defense, May 8, 2025 — Senate Armed Services Committee confirmation hearing; testimony quote: “I am recused, writ large, from anything having to do personally and substantially with my former employer.” (https://breakingdefense.com/2025/05/army-undersecretary-nominee-faces-questions-about-financial-ties-to-anduril/)

Context and Coverage

• Breaking Defense, April 2026 — Obadal public statements on Army enterprise-licensing program.

• Tom Homan: The Commander — RAMM, February 2, 2026. Background on the Homan-Venturella ethics-waiver pattern.

Visa filed a comment. JPMorgan filed a comment. Coinbase filed a comment. The four largest U.S. bank trade associations filed a joint letter. Boutique fintechs filed. A regional Texas bank that runs a Mexico-border corridor filed. Public-interest groups filed in opposition. Roughly forty-seven organizations weighed in on the OCC rule alone; the FinCEN docket had logged sixteen comments by early June.

One name is missing. World Liberty Financial — the stablecoin company majority-owned by the Trump family, issuer of the fourth-largest stablecoin in the world, and the active applicant for a federal bank charter from the very agency writing one of these rules — has not, as of June 5, submitted a comment to either docket. Not to the rule that defines its compliance floor. Not to the rule that defines the charter it is right now seeking. That absence is documented. What it means is the question this piece is about — and the honest answer is that there are two readings, both of which I’m going to keep in front of you the whole way through, because collapsing them into one is exactly the kind of overreach this story doesn’t need.

What’s being claimed, and what isn’t

Let me be precise before I’m interesting, because absence is a treacherous thing to build an argument on.

What I can document: World Liberty Financial, its charter-applicant entity WLTC Holdings, its USD1 token, the Trump-family holding entity DT Marks DEFI, and the named principals around it — Eric Trump, Donald Trump Jr., Zach Witkoff, Steve Witkoff, and crypto czar David Sacks — do not appear as commenters in either the FinCEN/OFAC docket or the OCC’s GENIUS Act docket. That finding rests on enumerated comment counts, named-commenter lists, and web-wide searches of WLF’s own press output, which through early June mentions its OCC charter pushes but says nothing about a FinCEN filing.

What I cannot document: why the absence exists. I have two explanations. Neither is confirmed. Neither is dismissed. I’m going to hold both.

And one boundary that matters more than it looks: “absent from the comment docket” is not the same statement as “absent from the rulemaking.” A public comment letter is one channel of engagement, the visible one. An empty comment field proves absence from that channel. It does not, by itself, prove absence from the process. Keep that distinction; the whole analysis turns on it.

One caveat in the interest of not overstating my own certainty. I read the live Regulations.gov comment list for the FinCEN docket directly: as of June 5 it held sixteen public submissions, and I checked the submitter on every one. No filing from World Liberty Financial, from WLFI, from any Witkoff entity, or from USD1’s issuer. (There is a comment filed under the surname “Sun” — a two-paragraph, technology-neutral endorsement of stablecoin innovation, submitted with no organizational affiliation. It is not Justin Sun and not a Tron, HTX, or USD1 entity; it is an individual who happens to share a common surname.) The comment period does not close until June 9. WLF could still file before then. If it does, that is itself the story, and a different one. As of this writing, it hasn’t.

The two dockets

Docket one — FinCEN/OFAC, FINCEN-2026-0100. Published in the Federal Register on April 10, 2026, the proposed rule sets anti-money-laundering and sanctions-compliance program requirements for permitted payment stablecoin issuers. The comment period runs April 10 through June 9. As of June 5 it held sixteen public submissions. The named industry filers: the American Bankers Association, Bank Policy Institute, Consumer Bankers Association, and Independent Community Bankers of America, jointly, on April 22; plus Coinbax, Tokenization Systems, Validation Cloud, ARC Regulatory, ARGA Atlas, CLNM Capital, International Bancshares Corporation, and a handful of individuals. WLF: not present.

Docket two — the OCC’s GENIUS Act rule. Published February 25, 2026, comment period closed May 1. Roughly forty-seven organizations filed — Visa, JPMorgan, Coinbase, the big bank coalition, plus critical comments from Better Markets, Brookings, the Duke financial-regulation blog, and Americans for Financial Reform. WLF: not present.

That second absence is the louder one, because the OCC rule is the directly consequential one for WLF. WLTC Holdings filed its national trust bank charter application on January 6, 2026. Throughout the entire comment window for the OCC’s stablecoin framework, WLF was a pending applicant for a charter under that exact framework. It would, if approved, be among the first entities to operate inside the rule. An applicant has every conventional reason to comment on the regime it is asking to be admitted to. It didn’t.

And the comparison is the point. This is not absence from some obscure procedural notice. These are the two primary implementing rules for the statute that governs USD1’s legal existence. Every commercially significant peer in the industry showed up to shape them — the biggest banks, the biggest crypto operators, the public-interest challengers, the law firms coordinating client positions. The single most exposed entity in the room said nothing on the record.

The architecture that makes the silence legible

A missing comment letter is, on its own, a shrug. What turns this one into a signal worth examining is the structure it sits inside — and that structure is documented, not inferred.

Between late 2024 and mid-2026, the administration and a small set of partners assembled what amounts to a closed regulatory loop, in which the entity being regulated is owned by the family of the people doing the regulating. It has five joints, and each is on the record.

One: the product at scale. USD1, controlled through the Trump-family entity DT Marks DEFI, had crossed roughly $4.6 billion in circulating supply by April 2026, with reports placing it above $5 billion by mid-year. Trump-affiliated wallets hold billions of governance tokens; a reported three-quarters of token-sale revenue has flowed to Trump-family entities. The single largest stablecoin-settled transaction in crypto history — a $2 billion investment routed through USD1 in the MGX-Binance deal — was announced onstage in Dubai by Eric Trump and Zach Witkoff.

Two: the statute. Congress passed the GENIUS Act on July 18, 2025, the first federal stablecoin law. After it, every legal route to issuing a U.S. stablecoin runs through Treasury — an OCC federal charter, a new federal payment-stablecoin issuer pathway, or a state regime that Treasury Secretary Scott Bessent personally certifies as comparable. Before the law, USD1 had no clean federal legitimacy. After it, that legitimacy is granted by the department whose Secretary serves at the pleasure of the President whose family owns the product.

Three: the rule rewritten inside the application window. The OCC published its proposed revision to the chartering rule, 12 CFR 5.20, five days after WLTC filed its application. The final version published March 2 — fifty-four days after the application — and took effect April 1, with thirty-five days still left in WLTC’s review window. Two public-interest groups had lodged a textual challenge to whether a trust charter of WLTC’s kind was even authorized; the OCC’s rewrite went directly to the legal surface that challenge depended on.

Four: the applicant walking the path. WLTC filed January 6. Comptroller Jonathan Gould, a Trump appointee, twice declined Senator Elizabeth Warren’s demands to pause the review. By May 21, Zach Witkoff was telling reporters WLF was in the “final stages” of conditional approval. As of early June, the OCC’s licensing tracker still listed the application as pending.

Five: the framework written by the same office. The bureau drafting the stablecoin rulebook is the bureau granting the charter, appointed by the President whose family owns the applicant. And the applicant is absent from the comment docket of the rulebook that will govern it — a fact the next section reads two ways.

Researchers tracking this pattern have a name for it: not ordinary regulatory capture, where an industry lobbies to soften a rule, but something one rung further in — a collapse of the boundary between regulator and regulated at the level of identity. The statute’s beneficiaries, the rule’s drafters, the charter’s grantor, and the regulated entity’s owners converge on the same small set of people. No single watchdog sees the whole sequence: ethics offices police individual disclosures, the OCC reviews individual applications, Congress oversees individual statutes, the foreign-investment review body looks at individual deals. The pattern lives in the seams between those reviews.

That is the room the missing comment letter sits in. This documented loop is the shared context both readings below depend on — under one reading it makes the comment channel useless to the incumbent; under the other it explains why other channels suffice instead. The silence isn’t a random gap in the public record. It’s a silence this piece has to read two ways, and the next section holds both.

Two readings, both kept

Here is where discipline has to do the work. The absence is a fact. The meaning of the absence is a reading. There are two, they point in different directions, and I am not going to tell you which is true, because I can’t, and because the honest finding is the absence itself.

Reading one: confidence in the outcome

Under this reading, WLF didn’t comment because it had nothing to gain by commenting — the rule was already shaped to fit the way it already operates.

Consider the details. The FinCEN rule sets its suspicious-activity reporting threshold at $5,000, the bank standard, rather than the $2,000 money-services-business standard. An operator moving institutional-scale volume — a $2 billion settlement, multibillion-dollar reserves — clears that bar without changing a thing. The reserve-backing requirements are satisfied by the BlackRock-managed Treasuries and BitGo custody WLF already uses. The freeze-and-block technical requirements are the kind a trust-chartered entity would build anyway. On this reading, the rule asks WLF for nothing it doesn’t already have.

So why file? A comment letter would add nothing to a winning position — and it would create a public record that opponents (the public-interest groups, state attorneys general, future plaintiffs challenging any OCC approval) could later mine for admissions about how WLF actually operates. A confident actor stays off the docket.

The sharper version of this reading is uncomfortable: if the rule was pre-fitted to the incumbent before the comment period even opened, then the comment period was, in effect, theater — not because anyone rigged the live comment-response cycle, but because the design was settled upstream. That is the capture pattern operating not in the lobbying, but in the architecture itself.

Reading two: engagement through other doors

Under this reading, WLF did engage the rulemaking — just not where the public can see it.

The channels that wouldn’t show up in a comment count are real and ordinary: private meetings between a company’s counsel and agency staff during a comment window; informal Treasury-to-OCC coordination through the offices of Secretary Bessent, the Treasury financial-intelligence under secretary, or Comptroller Gould; White House coordination through crypto czar David Sacks that leaves no formal docket footprint. None of these is exotic. All of them are invisible to a comment enumeration.

There is some on-the-record texture here, though I want to be careful with it. Gould’s OCC was demonstrably engaged at a senior level on the charter — twice refusing Warren’s halt demands, declining in Senate testimony to confirm certain ownership-disclosure details. That a high-level track existed on the charter side is consistent with a high-level track on the rulemaking side through the same channels. It does not establish one. I’m noting a possibility, not asserting a meeting that I cannot show you happened.

The structural upshot of reading two is different from reading one but not contradictory: WLF’s interests are represented, but the representation never touches the transparency apparatus that’s supposed to capture it. And I’ll flag the obvious gap — I could not directly inspect the docket’s ex parte communications log; absence of a documented off-record contact is not proof there wasn’t one.

Why I’m keeping both

I’m not choosing. Reading one would have me treat pre-arranged confidence as proven; it isn’t. Reading two would have me treat back-channel engagement as confirmed; it isn’t. Both stay live.

And notice what they share. Under reading one, the architecture makes the comment channel useless to the incumbent. Under reading two, the architecture supplies other channels the incumbent uses instead. Either way, the standard transparency mechanism — the public comment record — fails to capture the most exposed actor’s engagement with the rule that governs it. The absence is documented. What it signals is a reading, not a proof. The two readings are the candidate explanations, and the work of distinguishing them is investigative work not yet done.

What participation looked like

The two dockets drew roughly forty-seven organizations on the OCC rule and sixteen on FinCEN’s — every major bank, the largest crypto operators, the civil-society challengers, and boutique fintechs. USD1 is the fourth-largest stablecoin on earth and settled the largest stablecoin-denominated transaction in the history of the asset class. Its issuer is the one that said nothing.

A congressional concern on the record, not a finding

There is a congressional anchor for unease about this arrangement. On February 13, 2026, Senators Elizabeth Warren and Andy Kim wrote to Treasury Secretary Bessent raising concerns about the WLF/OCC setup, including whether the foreign-investment review body had examined a reported $500 million stake — a 49% interest, according to reporting by the Wall Street Journal and Reuters — taken in WLF by an Abu Dhabi-linked investment entity (Aryam Investment 1) tied to the Tahnoon bin Zayed orbit. The letter stated that CFIUS appeared to have been unaware the UAE-backed investment had even occurred.

I’m preserving the Warren/Kim letter for exactly what it is: a documented, formal concern raised by members of the Senate minority — not as a proven allegation, and not as this piece’s finding. The separate observation that no public record shows a foreign-investment review of that stake is a documented absence of documentation, not evidence that the deal evaded review. The letter gives the concern a place in the congressional record. It does not establish the underlying claim, and I’m not adopting it as if it did.

The relevance to the comment-docket story is narrow and specific: because that ownership question was unresolved in the public regulatory record during the comment window, a commenter could have raised it in the AML/sanctions docket as a live compliance concern. WLF didn’t. Whether that silence means the question is considered closed (reading one) or is being handled out of public view (reading two) is, again, open.

How you’d actually tell the two readings apart

The two readings aren’t permanently undecidable. They’re distinguishable, in principle, by records that exist somewhere — primarily through Freedom of Information Act requests to Treasury and the OCC. I’ll be candid that these are slow (a year to two years is normal for complex requests), often heavily redacted, and frequently incomplete. But they are the right next step, and they sort cleanly: if reading one is right, they come back empty of WLF; if reading two is right, they come back with the channel.

Four targets are worth filing. First, the ex parte communications log for the OCC’s stablecoin rulemaking across its comment window — any contact from WLF, its entities, its counsel, or from the White House crypto czar’s office, or from Treasury directed at OCC rulemaking staff. Second, the inter-bureau meeting calendars among Treasury, its financial-intelligence office, and the OCC over the same window. Third, the appointment calendar of the OCC’s chief counsel, who arrived from the law firm Skadden Arps and for whom no public recusal record on the WLTC matter appears — a verified absence of a recusal record, which is a documentation gap, not an accusation. A February 2026 Senate Banking Committee letter separately documented that the same chief counsel had submitted the Erebor Bank crypto-charter application as a Skadden partner shortly before joining OCC — a second instance of pre-OCC crypto-charter proximity with no public recusal record, extending the documentation gap beyond WLTC alone. Fourth, whether any WLF-affiliated entity registered on Regulations.gov at all, which would narrow how much of reading two could even be true.

Empty returns point toward reading one. Channel records point toward reading two. Until then, neither inference is established.

The tollbooth that didn’t testify

It’s worth naming what this is about at the level above the docket mechanics, and someone already has, precisely. Joyce Strong, writing at joycemstrong.substack.com, framed it in May as a story about seigniorage — the old sovereign profit of creating money. Her piece “Trump Wants to Own Money” argues that a privately issued, government-blessed dollar token captures the economic equivalent of that sovereign privilege: the reserve yield, the transaction fees, the float, the network lock-in. She calls WLF a “tollbooth at the future of money.” (Strong works the monetary-policy lane; I’m working the regulatory-record lane — different doors into the same building, and worth reading alongside this.)

That vocabulary sharpens the finding more than my own does. Every entity that will pay the toll showed up to argue over how the toll gets set. The entity positioned to operate the tollbooth did not file a word.

I want to end where the discipline requires me to. The absence is the finding. Its meaning is a reading I am declining to settle. Two explanations sit on the table with equal weight — confidence in a pre-arranged outcome, or engagement through channels the public can’t see — and both are consistent with the same documented structure: a regulatory loop in which the regulated entity is owned by the family of the regulator. What the absence does not support is the lazy inference that WLF is disengaged. It is, on every available indication, deeply engaged. It is simply not engaged here, in the one place the engagement would be visible to the rest of us.

The docket closes June 9. After that the record is fixed, and the question of what WLF chose to put into it — and what it chose to leave out — stops being a moving target and becomes a permanent fact about how this rule was made.

Sources

The dockets and the rule: - Regulations.gov docket FINCEN-2026-0100, Permitted Payment Stablecoin Issuer AML/CFT and Sanctions Compliance Program Requirements — https://www.regulations.gov/docket/FINCEN-2026-0100 - Federal Register, FR Doc 2026-06963, 91 Fed. Reg. 18,582 (April 10, 2026) — https://www.federalregister.gov/documents/2026/04/10/2026-06963/permitted-payment-stablecoin-issuer-anti-money-launderingcountering-the-financing-of-terrorism - U.S. Treasury press release SB0435, “Treasury Proposes Rule to Implement the GENIUS Act Requirements to Counter Illicit Finance” — https://home.treasury.gov/news/press-releases/sb0435 - Bank Policy Institute, “Banks Submit Recommendations on Treasury’s Implementation of the GENIUS Act” (joint ABA/BPI/CBA/ICBA comment, April 22, 2026) — https://bpi.com/banks-submit-recommendations-on-treasurys-implementation-of-the-genius-act/

OCC rule, charter, and the loop: - OCC GENIUS Act stablecoin NPRM (Bulletin 2026-3, published Feb. 25, 2026; comment period closed May 1, 2026); ~47 organizational comments per CryptoTimes 10-month GENIUS Act rulemaking review (May 18, 2026) - OCC 12 CFR 5.20 chartering-rule revision (NPRM filed days after the Jan. 6, 2026 WLTC application; final rule March 2, 2026; effective April 1, 2026) - WLTC Holdings national trust bank charter application (filed Jan. 6, 2026); OCC Digital Assets Licensing Applications tracker (status: pending, June 2026) - Comptroller Jonathan Gould Senate Banking Committee testimony (Feb. 26, 2026); twice-declined Warren halt demands

Ownership, transactions, and the congressional record: - Wall Street Journal reporting on Trump-family beneficial ownership of World Liberty Financial / USD1 and the Aryam/Tahnoon-linked stake - MGX-Binance $2 billion USD1-settled investment (announced at Token2049 Dubai by Eric Trump and Zach Witkoff) - Senators Elizabeth Warren and Andy Kim letter to Treasury Secretary Scott Bessent (February 13, 2026), raising CFIUS-review concerns about the UAE-backed investment in WLF and stating CFIUS appeared unaware the investment had occurred - Zach Witkoff “final stages of conditional approval” remarks (May 21, 2026)

Peer coverage / cross-citation: - Joyce Strong, “Trump Wants to Own Money,” joycemstrong.substack.com (May 16, 2026) — seigniorage framing; cited as independent corroboration of the WLF-as-monetary-tollbooth structural finding

Research context: - Capture Cascade research on World Liberty Financial, OCC chartering, and GENIUS Act rulemaking (2024–2026) - Capture Cascade administrative-engineering-of-accountability-evasion documentation (2026) - Capture Cascade docket-monitoring notes: June 2 and June 5, 2026

Methodology note: The FinCEN comment counts and named-commenter list above reflect a direct read of the live Regulations.gov comment list for docket FINCEN-2026-0100 as of June 5, 2026 — sixteen public submissions, every submitter checked. WLF’s absence is verified as of that read. The docket does not close until June 9; a late filing before then would change the story, and the piece is framed accordingly.

Six months later, Aronowitz was confirmed as Assistant Secretary of Labor for the Employee Benefits Security Administration — EBSA — the agency that enforces the fiduciary law his former company insured against. He forfeited $18.8 million in cash to take the seat.

Three months after that, his office proposed a rule.

The comment period on that rule closes June 1st.

The Walk-Away: What $18.8 Million Tells You

Federal financial disclosures are usually read as asset inventories — who owns what stock, what they’re divesting on the way in the door. The standard story is “Cabinet officer divests holdings worth $X.” The divestiture is the cure, and the headline follows the cure.

Aronowitz’s disclosure tells a different story, because the most significant number on it is a payment he didn’t receive.

When Aronowitz resigned from Encore Fiduciary on May 2, 2025, to accept his EBSA nomination, he was entitled to an earnout payment — his share (~44%) of the $42.7 million aggregate earnout from the 2022 sale of Euclid Fiduciary to Specialty Program Group. The payment was scheduled for approximately June 1, 2025. His OGE-278 filing states the outcome plainly: “I will forfeit my interest in that earnout when I resign from the company on May 2.”

Approximately $18.8 million. Gone.

The legal framework for ethics in government treats this as tidy. He can’t divest something he doesn’t own; he forfeited it voluntarily. The conflict is cured.

But there’s a different way to read that number: as a floor estimate of what the EBSA seat was worth to him, his network, or his cause.

Rational people do not walk away from $18.8 million in liquid cash for a Senate-confirmed regulator job that pays a government salary. They do it because the seat represents access to something more valuable — the ability to write the rules that govern the industry they came from.

Aronowitz had spent his entire career inside that industry. His $642,000 annual salary from Encore is the compensation-history number that can’t be divested. You can’t un-receive fourteen years of paychecks from an ERISA fiduciary-liability underwriter. You can recuse yourself from specific matters involving your former employer — but you can’t recuse yourself from your own professional formation, your own theory of how the law should work, your own opinion about whether ERISA litigation is a scam.

Encore Fiduciary’s Theory of the Case

Encore Fiduciary — previously Euclid Fiduciary, rebranded after Specialty Program Group’s acquisition — is in the business of pricing ERISA fiduciary-breach risk. (SPG is a subsidiary of Hub International, one of the largest insurance distribution companies in North America, owned principally by Hellman & Friedman.) Its core product: insurance that pays out when an employer loses an ERISA class action or settles one under litigation pressure.

The economics of that business are straightforward. Fewer meritorious claims, fewer payouts. Favorable pleading standards — those that let defendants knock out cases at the motion-to-dismiss stage, before discovery — reduce both frequency and severity of claims. A regulatory environment that raises the bar for plaintiffs is the most profitable possible state for a fiduciary-liability underwriter.

Encore has said so in court.

On January 15, 2025, Encore filed an amicus brief in Cunningham v. Cornell University (No. 23-1007), a case before the Supreme Court on ERISA pleading standards. The press release headline: “End ERISA Litigation Abuse By Requiring Federal Courts to Weed Out Meritless Cases Based on False and Misleading Evidence.”

Aronowitz, then still president of Encore, filed that brief in his corporate capacity. His public statement: “The claims in the Cunningham case are part of a pattern of turning voluntary employee plans into unfair liability traps. Our goal was to document the ERISA litigation abuse for the Supreme Court, and to advocate for fair fiduciary pleading standards that protect fiduciaries who diligently follow best practices.”

That is Encore’s theory of the case: litigation is abusive, fiduciaries who follow process deserve deference, courts should filter more aggressively.

He filed that brief in January. He forfeited the $18.8 million in May. He was confirmed to run EBSA in September.

The Side-by-Side

In March 2026, EBSA released the proposed rule: Fiduciary Duties in Selecting Designated Investment Alternatives — the “Investment Selection Rule.” Aronowitz personally framed and defended the rule at industry conferences across the spring: National Association of Plan Advisors NAPA’s (National Association of Plan Advisors) 401(k) Summit in Tampa (April 19–21), the Plan Sponsor Council of America, ASPPA (American Society of Pension Professionals & Actuaries).

His framing at NAPA on March 30, 2026: “ERISA is a law of process.” Fiduciaries who follow process are “entitled to deference by courts if their discretionary decisions are challenged.” The rule “gives plan fiduciaries discretion and flexibility in choosing plan investments.”

Compare that to Encore’s January 2025 amicus position: fiduciaries who “diligently follow best practices” deserve “fair fiduciary pleading standards.” Courts should “weed out meritless cases” against fiduciaries who followed process.

The structure is identical. Process compliance as a substantive shield. Judicial deference to documented process. The plaintiffs’ bar as the problem, not the fiduciary.

The Investment Selection Rule operationalizes that theory in federal regulation. Six factors — performance, fees, liquidity, valuation, benchmarking, complexity — that fiduciaries must “objectively, thoroughly, and analytically” consider. Twenty safe-harbor examples. And the rule’s explicit asset-neutrality, in Aronowitz’s framing at NAPA: “responsible fiduciaries decide what investments go into a retirement plan, not plaintiff lawyers or regulators.”

That line is verbatim Aronowitz at NAPA on March 30, 2026. It is also the animating argument of Encore’s amicus brief.

“Process, Discretion, Deference”

At NAPA in April, Aronowitz wasn’t just defending a rule. He was prosecuting an argument he’s been making for years.

“Hundreds of excessive fee and performance malpractice cases have been filed against American plan fiduciaries in the last 15 years by an enterprising and ever-growing ERISA plaintiffs bar.”

“The private retirement system has been swamped with lawsuits challenging fee and investment decisions, with over half of jumbo plans sued in the last 10 years — litigation that has almost exclusively benefited plaintiff lawyers who have secured well over $500 million in fees in these cases whereas most plan participants take home only a token $25 to $100. This is a scam.”

“Litigation risk — not investment quality — is the main barrier preventing private-sector workers from accessing certain asset classes.”

These are not the words of a neutral regulator describing a technical rulemaking. They are the words of an insurance executive describing the regulatory state his industry has long sought — and is now obtaining.

The trade press has covered the rule. NAPA-Net and PlanSponsor have both run stories on Aronowitz’s public defense of the Investment Selection Rule, characterizing his framing as “process-neutral” and noting that industry groups have responded favorably. What the trade press hasn’t done is the side-by-side: Encore’s amicus position from January 2025, next to the rule text from March 2026.

That comparison is this story.

What the Comment Period Closing Means

The Investment Selection Rule’s comment period closes June 1, 2026.

Comments are public. The named-commenter record will be available after the comment period closes. One question the comment record will answer is whether Encore Fiduciary, Specialty Program Group, or Hub International submits a comment endorsing the rule their former president proposed.

If they do, that is the circularity finding made explicit.

If they don’t, the circularity was already accomplished before the comment period opened: the rule reproduces the position they paid Aronowitz to advocate, in the industry venues, in the Supreme Court amicus briefs, for fourteen years. They don’t need to comment. The rule is already their comment.

For readers who want their voices in the record: the rule is Fiduciary Duties in Selecting Designated Investment Alternatives, DOL/EBSA. The docket is public. Consumer-side organizations — the AFL-CIO, Better Markets, the Pension Rights Center — are likely filing comments. Comments from workers and beneficiaries are accepted alongside industry submissions.

The Compensation-History Frame

This piece is one in a series tracking a pattern across the Trump administration’s implementation of the One Big Beautiful Budget Act and its regulatory corollaries: appointees whose pre-government compensation history is concentrated in the industries they now regulate, and whose early-tenure rulemaking is consistent with those industries’ stated positions.

The Aronowitz case is the sharpest single-subject specimen in that set — not because of the $18.8 million forfeiture, though that is striking, but because the rule-mirrors-amicus observation is mechanically verifiable. You don’t need to infer intent or reconstruct private conversations. You need a Federal Register notice and a Supreme Court amicus brief, both public documents.

The Ethics in Government Act framework offers two cures for financial conflicts: divestiture of assets and recusal from specific matters. Divestiture addresses what you own. Recusal addresses individual transactions. Neither addresses regulatory orientation — the professional theory of how the law should work that a fourteen-year career inside an industry instills, and that a single rulemaking can codify in federal regulation.

That is not an argument that Aronowitz did anything illegal. He was Senate-confirmed, 51-47, on a party-line vote, after a public hearing. The rule is going through notice-and-comment. The legal framework permits this.

The story is structural: when a regulator’s first major rulemaking reproduces his former employer’s litigation position argument by argument, the political economy of who got selected for the seat becomes the analytical question. Not “is this corruption.” This is how the system selects who gets to write the rules.

Sources

Tier 1 — Primary documents

• ProPublica, Trump Team Financial Disclosures, Daniel Aronowitz entry: https://projects.propublica.org/trump-team-financial-disclosures/appointees/aronowitz-daniel/

• Encore Fiduciary amicus brief press release, Cunningham v. Cornell University (No. 23-1007, January 15, 2025): https://www.prnewswire.com/news-releases/encore-fiduciary-in-amicus-brief-to-supreme-court-end-erisa-litigation-abuse-by-requiring-federal-courts-to-weed-out-meritless-cases-based-on-false-and-misleading-evidence-302351225.html

• DOL/EBSA, Fiduciary Duties in Selecting Designated Investment Alternatives, 91 Fed. Reg. 16088 (March 31, 2026): https://www.federalregister.gov/documents/2026/03/31/2026-06178/fiduciary-duties-in-selecting-designated-investment-alternatives

Tier 2 — Trade press

• NAPA-Net, “EBSA’s Aronowitz Outlines Fiduciary Framework for Investment Selection Rule” (March 30, 2026): https://www.napa-net.org/news/2026/3/ebsas-aronowitz-outlines-fiduciary-framework-for-investment-selection-rule/

• 401(k) Specialist, “Aronowitz Makes Case Against Frivolous ERISA Lawsuits at NAPA” (April 19, 2026): https://401kspecialistmag.com/aronowitz-makes-case-against-frivolous-erisa-lawsuits-at-napa/

• PSCA, Aronowitz confirmation: https://www.psca.org/news/psca-news/2025/9/aronowitz-confirmed-to-lead-ebsa/

• Holland & Knight, “A New Chapter at EBSA”: https://www.hklaw.com/en/insights/publications/2025/09/a-new-chapter-at-ebsa-dan-aronowitz-cleared-by-senate

Cross-reference — This piece is the first published RAMM entry in the compensation-history-as-diagnostic-layer series. Companion specimens: Kenneth Kies (Treasury/tax), Martin Makary (FDA), Abraham Sutton (CMMI), Howard Lutnick (Commerce). Architectural pattern piece forthcoming.

By Mark Ramm | The RAMM | May 29, 2026

The Choreography Is the Argument

On May 15, 2026, Pope Leo XIV signed his first encyclical. The document is dated, in the formal Vatican register, “Given in Rome, at Saint Peter’s, on 15 May, in the year 2026, the second of my Pontificate. LEO PP. XIV.” Forty-two thousand words across 245 numbered sections. Title: Magnifica Humanitas — “On Safeguarding the Human Person in the Time of Artificial Intelligence.” The title derives from the Magnificat: the encyclical’s “magnificent” is humanity-as-image-of-God, and the document closes on the same hymn’s reversal.

He signed it quietly. There was no press conference, no synchronized briefing, no Vatican Press Office curtain-raiser. The signing happened. The text did not.

Ten days later, on May 25, 2026, the encyclical was released to the world at the Vatican Synod Hall. At the Pope’s side, in the foreground of the photographs and at the microphones during the joint presentation, stood a thirty-three-year-old Canadian with no obvious place at a papal occasion: Chris Olah, co-founder of Anthropic and the leader of the company’s interpretability research (the technical discipline of trying to see, mechanically, what is actually happening inside a large language model). The National Catholic Reporter called the pairing “an unlikely duo.” The Washington Post led its coverage with a headline that, read carefully, is the structural fact of the week: “Anthropic aligns with Vatican over White House“.

Olah’s quoted line from the joint presentation: “We need moral voices that the incentives cannot bend.”

Twelve hours before that headline, The RAMM published “The Antichrist as Luddite” — Episode 1 of the Four-Layer Architecture series. It walked through a leaked recording of a private lecture in which Peter Thiel articulated, on tape, a christology that explicitly named two adversaries as the Antichrist he wanted the political and religious world to delay: AI-safety researchers, and “the popes who teach AI ethics.” Thiel’s framework worked by inversion. The figure conventionally identified as the katechon — the restrainer in 2 Thessalonians — was, on his account, the precise figure to be eliminated. The “Luddite” he attacked was the one urging restraint.

The juxtaposition is hard to read as an accident. One of the two named adversaries had just convened the other at the Vatican. The AI-safety research lead stood beside the Pope. The Pope released, jointly, a 42,000-word encyclical naming the regime that Thiel’s framework defends. The choreography is the argument.

This piece walks through what Leo actually wrote — section by section, in his words — and shows that the document is the structural diagnosis of the regime i have spent months documenting. Encyclicals are, by genre, forbidden from naming living political adversaries; they name structural sin.

What Encyclicals Are For (and What They Cannot Do)

A point of form, because it is load-bearing.

An encyclical is the highest register of papal teaching short of an ex cathedra dogmatic definition. It is a public letter, formally addressed to all the bishops and, since the twentieth century, to all people of good will. By convention (at least a century old, traceable in continuous practice from Leo XIII’s Rerum Novarum (1891) through Francis’s Laudato Si’ (2015) and Fratelli Tutti (2020)), an encyclical does not name living political adversaries. It does not name presidents, vice presidents, billionaires, parties. It names structural sin.

The convention operates in both directions simultaneously: it permits the Vatican to say things that would be diplomatically impossible if said as personal accusations, and it permits the targeted party to claim, with technical accuracy, “the encyclical didn’t name me.” The reasons are partly diplomatic (the Vatican maintains concordats), partly pastoral (the addressee is the universal Church, not one electorate), and partly theological (sin is a structure of disordered relations, not a biography).

The result is that any attentive reading of an encyclical has to do its own naming work. Leo wrote a 42,000-word diagnosis of the contemporary technological-political regime. He named the structures: private transnational platforms exceeding governmental capacity, the inversion of subsidiarity, the architecture of visibility, data colonialism, the slide toward “might makes right.” He did not name Peter Thiel, Larry Ellison, Sam Altman, J.D. Vance, the FedRAMP procurement architecture, the Cantor Fitzgerald disclosures, Anduril’s Lattice contract, ImmigrationOS, or NSPM-7. He cannot, by the genre.

The regime-level diagnosis is on the record. The political name for what was diagnosed — that is the unsayable thing. The encyclical’s form is itself part of the argument: a critique this thorough, this authoritative, this irrevocable, with no actor named in the indictment, demands that someone else complete the sentence.

§5 — Private Transnational Power “Surpassing” Governments

The text opens its structural argument early. Section 5, in full magisterial register, begins by acknowledging the conventional account (”In the past, it was largely up to the State to guide and direct innovation”) and then reverses it:

“Today, however, the main drivers of development are private, often transnational, parties that are endowed with resources and the capacity to intervene that surpass those of many Governments. Technological power thus takes on an unprecedented, predominantly ‘private’ aspect, which makes it even more challenging to discern, govern and direct such power toward the common good.”

He footnotes Francis’s Laudato Si’ on those who have acquired “an impressive dominance over the whole of humanity.” He pairs the observation with a regulatory call: “It is necessary to establish adequate regulatory tools capable of upholding justice and curbing the distorting effects of technological power.”

The text repays close reading. The Pope is not offering a moral exhortation to corporate good citizenship. He is making a political-theological claim about sovereignty: that the actors who shape the conditions of human life have shifted from the State to “private, often transnational” entities, that this shift is systemic rather than incidental, and that the conventional theological vocabulary for the State’s role (guidance, direction, the common good) now applies to a different set of actors who do not, by their corporate form, owe accountability to the populations they govern.

The verb is surpass. Not “complement,” not “supplement,” not “operate alongside.” Surpass. The platforms exceed the sovereign. This is a doctrinal concession that the foundational category of post-Westphalian political theology — the State as the bearer of public authority over the common good — has been factually displaced by entities the Church’s prior vocabulary did not have categories for.

This single section is also the verbatim inverse of the pillar Vice President J.D. Vance took to the Paris AI Action Summit on February 11, 2025: paraphrased from the White House transcript, I’m not here this morning to talk about AI safety — I’m here to talk about AI opportunity; excessive regulation could kill a transformative industry (presidency.ucsb.edu). Leo’s §5 reply, fifteen months later: regulation is the duty, not the threat.

The encyclical postdates Paris by 463 days. It names no Vice President. It does not need to.

§71 — Subsidiarity Inverted: The Platforms as “The Highest Level”

Subsidiarity is the organizing concept of modern Catholic Social Teaching. Coined formally in Pius XI’s Quadragesimo Anno (1931), it holds that decisions should be made at the lowest competent level: the family before the parish, the parish before the municipality, the municipality before the State, the State before the supranational body. The doctrine exists as a Catholic answer to two twentieth-century temptations simultaneously: collectivist totalitarianism on one side, atomized libertarianism on the other.

Leo’s §71 names a third temptation the doctrine never contemplated, because the situation did not exist when the doctrine was written.

“The principle of subsidiarity applies especially in the context of the digital revolution. Here, the highest level is not the State, but rather major economic and technological actors that exercise de facto power over the conditions of everyday life. This level, which monopolizes expertise, data and decision-making authority, involves companies and platforms that define conditions for access, rules of visibility, forms of interaction, and even economic opportunities. The principle of subsidiarity requires that such processes not be imposed from above in an opaque and unilateral manner, but instead be directed toward the common good with transparency, accountability and meaningful forms of participation (including independent checks, transparency regarding algorithms, equitable access to data and avenues for recourse).“

Three load-bearing observations.

First, “the highest level is not the State.” Subsidiarity in its classical form ranks the State as the upper bound. Leo declares the State displaced from the top. The doctrine still holds, but the top is now occupied by “major economic and technological actors.” The Church has, in one paragraph, conceded the operative fact of the present order and re-articulated its own foundational social doctrine around it.

Second, the verbs: monopolizes, defines, imposes, opaque, unilateral. This is not a description of a market. This is a description of a sovereign, one whose sovereignty is exercised through the architecture of access, visibility, interaction, and “even economic opportunities.” Leo is naming the platforms as the operative state for daily life.

Third, the closing parenthetical: transparency regarding algorithms, equitable access to data, avenues for recourse, independent checks. Read this paragraph as a Privacy-Act-amendment draft, because it functions as one. It is a four-point statutory checklist. It tracks, almost line-for-line, the agenda that the AI-safety wing of the technical community has been articulating for a decade and that has been, in the same decade, defunded, deregulated, or rhetorically attacked as Luddite by the actors Episode 1 of this series put on the record.

When Anthropic’s Chris Olah stood at the Vatican Synod Hall on May 25 and said there need to be people “outside those incentives… willing to say hard things,” and that decisions about AI “should not be left to people in the industry,” he was endorsing §71 in his own words.

§109 and §110 — The License to Name; The Call to “Disarm”

§109 is the section where the encyclical performs its most distinctive theological move: it licenses the work of naming as an act of social-doctrinal obedience.

“The principles of Social Doctrine offer a framework for understanding this new reality. In a world where data, computational resources and regulatory influence remain in the hands of a few, to speak of the common good means exposing this new form of epistemic, economic and political asymmetry and naming the new monopolies of AI. To speak of the universal destination of goods means finding ways of ensuring universal access to both technologies and the education needed to use them. To speak of subsidiarity calls for protecting the ability of communities to make choices and corrections, rather than confining their role to mere oversight after the standards have been set elsewhere. To speak of solidarity obliges us to recognize the hidden, often exploited workers, who sustain algorithmic systems. To speak of justice requires questioning the global distribution of power that decides who in fact can train these models and who is merely subjected to them.”

The clause is “naming the new monopolies of AI.” Leo does not name them by company. The genre forbids it. What he does — and the move is theologically substantive — is to define the work of naming as the obligation of social-doctrinal practice. To speak of the common good means exposing the asymmetry and naming the monopolies. Not evaluating. Not balancing. Naming. The verb is imperative.

In the immediately following section, §110, Leo introduces what may become the single most-quoted phrase from the encyclical:

“Finally, I would like to employ the expression ‘to disarm,’ which is close to my heart. Disarming AI means freeing it from the mentality of ‘armed’ competition, which today is not limited simply to the military context, but is also an economic and cognitive phenomenon. This entails a race for ever more powerful algorithms and larger datasets, driven by the desire to secure geopolitical or commercial dominance. To disarm means discrediting the assumption that technical power automatically confers the right to govern. To disarm does not mean rejecting technology, but preventing it from dominating humanity...”

Three vocabulary choices repay attention.

“Armed competition.” Leo is using the rhetoric of arms control on a technology that the geopolitical establishment treats as a neutral economic input. He is locating AI in the same moral universe as the nuclear arms race and the chemical-weapons regime — categories the Church developed an entire post-1945 doctrinal apparatus around. This is a category transposition. AI, on his framing, is an armed phenomenon by structure, not just by application.

“Economic and cognitive phenomenon.” Not just one or the other. The encyclical insists on the simultaneity. The arms race is economic (capital deployment, market dominance, geopolitical leverage); it is also cognitive — operating on attention, perception, the formation of belief, the conditions of public judgment. This is the doctrinal bridge to §134 (Arendt on epistemic preconditions) and §171 (the architecture of visibility). The Pope is treating the cognitive layer as a theater of armament.

“Discrediting the assumption that technical power automatically confers the right to govern.” Place this beside Larry Ellison’s quoted 2024 line that “citizens will be on their best behavior” once total surveillance is implemented. Place it beside Thiel’s lecture-room declaration that AI-safety advocates are the Antichrist’s restrainer to be eliminated, and beside the entire Silicon Valley register that maps technical capability onto political legitimacy as if the mapping were natural. Leo is performing a papal discrediting of that mapping. Technical capacity does not confer authority. The encyclical names the assumption and rejects it as an assumption.

§134 — Arendt at Magisterial Citation

§134 is the section that anchors a lineage The RAMM has been tracing for a year, and routes it through magisterial citation.

“Indifference to the truth leads, slowly but surely, to a descent into totalitarianism. As the philosopher Hannah Arendt wrote, the ideal subjects of such regimes are not so much those who are ideologically convinced, but rather ‘people for whom the distinction between fact and fiction (i.e., the reality of experience) and the distinction between true and false (i.e., the standards of thought) no longer exist.’“

The Arendt citation is from The Origins of Totalitarianism (1951), Part 3, the section on the ideal totalitarian subject. The conventional reading — Arendt herself encouraged it — is that the precondition of totalitarianism is not propagandized conviction but epistemic collapse: the loss of the public capacity to distinguish what is real from what is constructed.

The structural-AI implication is direct: algorithmic feeds calibrated to engagement maximize the very epistemic conditions Arendt named as totalitarianism’s prerequisite. This is the operational claim of the field that runs from Philip Agre’s 1994 surveillance-as-capture essay through the present generation of attention-economy literature — and Leo’s magisterial citation at footnote [143] gives it an anchor that secular technologist readings of Arendt have been unable to supply against an opposition that controls the platforms.

The architecture of visibility (which §171 will name in another five sections) is the operational form of the epistemic collapse Arendt warned about. Leo is connecting Arendt’s 1951 warning to the technical layer that, in 2026, is the substrate of public discourse. The connection is now magisterially anchored.

§§170–171 — The Digital Attention Economy and the Architecture of Visibility

§170 is the setup. It names, by phrase, the “digital attention economy” as a moral category, naming the platforms whose business models “thrive on human weakness” and asserting that “those who design or finance such systems bear a moral responsibility that cannot be ignored.” The phrase “those who design or finance such systems” is doctrinal language for the entire venture-capital and platform-engineering complex. Without naming a person, the Pope has located moral responsibility at the funding and design layers — exactly where the lecture in Episode 1 of this series defended the unrestricted right to operate.

§171 is the section that may end up being the document’s most quoted by social-systems researchers, because it names the operative mechanism in vocabulary the field has been searching for.

“A further risk, less visible but no less serious, is that of social control made possible by the massive collection of data and use of algorithmic systems. When every action — movements, purchases, relationships and preferences — leaves a trace, a new form of power emerges, namely the power to profile, predict and influence behavior, often without individuals being fully aware of it. If such kinds of data are used to make decisions affecting concrete opportunities — such as access to credit, employment or essential services — there is a risk of undermining freedom and discriminating against the most vulnerable. Furthermore, control is exercised not only through explicit prohibitions, but also through the architecture of visibility: what is amplified or rendered invisible, what is rewarded or penalized, ultimately shapes opinions and choices, fostering conformity and self-censorship.”

“The architecture of visibility.” This is the doctrinal coinage of the document. Catholic Social Teaching has, until this section, lacked a phrase for the operative mechanism that platform-recommender systems perform. The phrase that emerges in §171 is precise: control through what is amplified or rendered invisible, through what is rewarded or penalized — not through explicit prohibition but through the architecture itself.

This is the same diagnosis The RAMM‘s earlier pieces arrived at through different vocabulary. “The Violence Loads Automatically” named the load-bearing dynamic: the harm does not require a deciding actor at each step because it is architected into the substrate. §171 is the same observation in CST language. The violence loads automatically because the architecture of visibility is calibrated to load it.

The pairing of §134 (Arendt on epistemic preconditions) and §171 (architecture of visibility) is the encyclical’s full account of cognitive armament. The §110 phrase “economic and cognitive phenomenon” finds its operational specification here. AI is armed at the cognitive layer because the architecture of visibility is the weapon — calibrated, optimized, and deployed without anyone needing to fire it shot by shot.

§178 — Data Colonialism: The “New Rare Earths of Power”

If §171 names the mechanism, §178 names the extractive substrate.

“Even today, colonialism assumes new forms. It no longer dominates only bodies, but appropriates data, transforming personal lives into exploitable information. Entire regions, especially those marked by structural fragility and limited geopolitical relevance, are currently subjected to a new mindset of extraction: that of health data, epidemiological profiles, genetic maps and demographic information. These have become the new ‘rare earths’ of power: vital data which, once aggregated and analyzed, can be used to train predictive models, guide investment strategies, anticipate crises and, above all, determine who and what is deemed to matter. Those who control the health data of entire peoples — often collected under the pretext of aid, research or innovation — possess a structural leverage over the future... Otherwise, the digital age will not be post-colonial, but colonial in another form.”

The deepest claim in the passage is the final one: “determine who and what is deemed to matter.” The actors who control the aggregated data set the conditions of recognition — economic, political, biomedical, demographic. The asymmetry is not commercial; it is ontological. It determines who is counted, who is targeted, who receives medicines, who receives “investments and protections.” The colonized are the ones whose mattering is decided elsewhere.

Two moves set up that conclusion. First: data is not like colonialism, it is colonialism — in a new form. The same extractive relation that took rubber from the Congo is now taking “health data, epidemiological profiles, genetic maps and demographic information” from regions “marked by structural fragility and limited geopolitical relevance.” Second: the “rare earths” metaphor is precise. Rare earths are the strategic inputs without which semiconductor manufacture and military-grade electronics cannot proceed. Leo has located data at the same level of geopolitical primacy as the materials over which great-power competition is already being fought — framing data extraction as resource extraction, with the same global power asymmetries built in.

§178 is the operative-precondition entry that next week’s piece will turn into the political argument. The extractive surveillance substrate is not a side effect of the present order. It is the foundational economic form.

§192 — “Just War” Theory Declared “Outdated”

This is the section that closes the arc The RAMM traced in “Augustine Against Augustine” (published May 27). Five sentences before the load-bearing declaration, §192 walks the reader through the modern conditions:

“...the media and digital dimensions are adding new and decisive elements. Communication networks, fragmented information environments and algorithms that reward conflict can magnify polarization and resentment, increase propaganda and make shared discernment more difficult. Thus, war is not only fought, but also culturally conditioned through simplistic narratives, a friend-or-foe mentality, disinformation and fear. When historical memory fades and the ethical principles that protect civilians and the most vulnerable are weakened, it becomes easier to justify violence as necessary, inevitable or even ‘sanitized.’ It is in this context that humanity is slipping into a violent culture of power, where peace no longer appears as a responsibility to be taken on, but as a fragile interval between conflicts.”

Then the magisterial sentence:

“Today, more than ever, without prejudice to the right to self-defense in the strictest sense, it is important to reaffirm that the ‘just war’ theory, which has all too often been used to justify any kind of war, is now outdated. Humanity possesses far more effective and capable tools for promoting human life and resolving conflicts, such as dialogue, diplomacy and forgiveness.”

The Vatican has been moving in this direction for a decade. Fratelli Tutti §258 (Francis, 2020) said it more guardedly: that conditions for justifying war on traditional grounds are “very difficult to verify today.” Leo’s §192 closes the equivocation. The doctrinal verb is not “difficult.” It is outdated.

What makes this section the closure of the Vance-vs-Pope arc is the dated sequence. On April 14, 2026, at a TPUSA event, Vice President J.D. Vance — a Catholic convert frequently associated with the Cambridge integralist circle around James Orr — publicly told the Pope to “be careful” about theology that cited just war, hours after Leo honored the founder of the just-war tradition. Thirty-one days later, Leo signed the encyclical that retires the theory by name.

The choreography matters. The Pope did not respond by press conference; he did not respond by direct address. He responded by magisterial document, signed and dated, in the highest register the Church has short of ex cathedra dogmatic definition. The response was: the framework you instructed me to be careful about is outdated.

Vance was not named. Vance does not need to be named. The text knows what it is doing. The reader who has been paying attention knows what it is doing. And the diplomatic deniability that the genre provides is, in this case, what permits the magisterial closure to land at all.

§202 — “Might Makes Right”

If §192 closes the just-war theology, §202 names what replaces it when the closure is rejected.

“What has also re-emerged is the temptation to forge a collective identity in opposition to an enemy, fueled by narratives in which each party portrays itself as a victim entitled to retribution. The reduction of complex issues into simplistic categories — ‘me first,’ ‘friend or foe,’ ‘us or them’ — facilitates decisions that are often irresponsible and undermine mutual trust among nations. The force of international law is thus replaced by the claim that ‘might makes right.’ Consequently, tribunals that are competent for settling disputes between States or dealing with war crimes are often weakened or bypassed, with devastating ramifications for political culture and social cohesion.”

The phrase Leo identifies — “might makes right” — is, in the genealogy of political theory, the Thrasymachus position from Book I of Plato’s Republic. It is the position Socrates is brought in to refute. It is the position the entire tradition of natural-law theory exists to oppose. It is also the position the contemporary technologist register has, in some specific quoted utterances, reasserted as the de facto operative principle — most recently in the leaked Thiel material that Episode 1 of this series put on the record.

§202 names “might makes right” as the operative replacement for international law when the law is “weakened or bypassed.” It frames the slide as continuous with, and a consequence of, the “me first” friend-or-foe register that the prior fifty sections of the encyclical have been tracking through the digital and algorithmic substrate. The encyclical’s claim is that the same algorithmic-attention mechanisms that condition war (§192) condition the political culture that accepts “might makes right” as policy (§202).

This is the papal register’s account of what the four-layer architecture does if it is not restrained. Layer 1 (surveillance) extracts; Layer 2 (financial cluster) funds; Layer 3 (digital-attention engine) conditions; Layer 4 (just-war/might-makes-right operational disposition) deploys. The encyclical has named every layer without naming a single living actor or company.

The Three-Body Problem: Olah, Leo, and the White House

Before turning to the political-name question, one more documentary fact about May 25 has to land, because the most distinctive feature of the release is not in the text.

The encyclical was presented at the Vatican Synod Hall with Chris Olah at the Pope’s side as joint presenter. Olah is co-founder of Anthropic and the lead of its interpretability research — the technical sub-field within AI safety that attempts to read, mechanically, what a large language model is actually doing as it processes inputs. He is, on the technical layer, perhaps the single most respected interpretability researcher in the world. He is also, as described in press coverage, an atheist.

The Anthropic side of the joint presentation called for a Church-tech ethics partnership. Olah’s quoted line — “We need moral voices that the incentives cannot bend” — is, structurally, an articulation of why the technical-safety side of the AI industry needs a moral counterweight whose authority is not commercial. He named the Church as that counterweight. The Pope received it.

The Religion News Service and the National Catholic Reporter both reported the appearance with the joint Church-tech ethics framing. The Washington Post covered the same fact with a different framing entirely: “Anthropic aligns with Vatican over White House”. The two framings are compatible; they emphasize different facets of the same documented event. The WaPo framing is the one that matters here because it locates the May 25 choreography in the political register: an AI-safety lab and the magisterium stood together against the deregulation posture the Vice President took to Paris.

Two disciplinary notes.

The Olah-Vatican appearance is documented; the encyclical’s text is separate from the choreography. The encyclical does not name Anthropic, Olah, or Thiel. The joint presentation is a structural event surrounding the release — documented in the May 25 reporting — not a textual feature of the document itself. The piece’s analytical claim (that the choreography is the structural inversion) is The RAMM‘s reading, anchored to that documented appearance. The alignment in the WaPo headline is a political-direction alignment, not a corporate endorsement: Leo received an AI-safety researcher who came to bear witness in the same register as his own document. He did not bless a company.

On the funding question: it is widely reported that Anthropic has received investment from sources connected to Peter Thiel’s broader network, and the question of whether the “AI-safety side of the industry” has substrate-deniability problems is a real and live one. The RAMM will treat that question carefully when there is documented funding-flow detail to publish; we do not have it in tier-1 form right now, and the operative argument of this piece does not require it. The argument here is the documented fact: the Pope’s first encyclical was released with an AI-safety researcher at his side, in a register that the Washington Post described as alignment against the White House.

The structural reading — what The RAMM claims analytically, marked as such — is that the May 25 choreography executed an inversion that Thiel’s leaked private framework had not anticipated. Thiel’s framework named both the Pope and AI-safety researchers as the Antichrist’s restrainers to be discredited. Twelve hours after The RAMM put that framework on the record, the two named adversaries appeared on the same stage, on the same side, in the same release.

The choreography may be coincidence in the strict sense (it is hard to imagine the Vatican timed its release to The RAMM‘s editorial calendar). It is not coincidence in the structural sense. The encyclical was scheduled long before. The Thiel lecture had been recorded long before. The two trajectories were running on independent calendars. What the two trajectories share is the same diagnostic object: the question of whether human authority remains conferrable by something other than technical-economic power. Thiel’s framework said technical-economic power is the conferring authority and its restrainers must be cleared. The encyclical, with an AI-safety researcher at the Pope’s side, said no.

What Is Named, What Is Not Named, and the Name That Is Coming

Take stock of what Leo has put on the record.

The structural argument is complete. The political name is withheld. The withheld name is the load-bearing absence.

What is this regime? The available external term — techno-feudalism, after Yanis Varoufakis — names the economic form (cloud capital, rent extraction, vassal platforms) and stops there. It does not name the surveillance infrastructure that converts extraction into coercion, the coercion capability that turns data into political targeting, or the manufactured legitimation layer that makes the apparatus coherent to its own personnel as vocation. Leo named all of those: §5 and §71 name the privatized-sovereign extraction layer; §171 and §178 name the surveillance-and-data substrate; §202 names the slide into might-makes-right. The encyclical is a 42,000-word account of a regime that techno-feudalism is the wrong name for — because techno-feudalism names the economic face alone, and Leo described the full political-coercive structure behind it.

The political name for what Leo described — the name that names the surveillance infrastructure, the coercion capability, the cognitive-attention armament, the manufactured legitimation, and the cross-substrate operational coalition that runs them as one apparatus — is crypto-fascism. It is the term The RAMM will commit, structurally, in next week’s piece. It is the term Leo cannot say, by the genre. The encyclical leaves the name as a hole the size of its own diagnosis. The hole has a shape. The shape has a name. The naming is the next move.

This piece will not perform that move. It exists, deliberately, to leave the hole standing — so that the diagnostic register Leo committed to the magisterial record is what readers carry into the week before the political name lands. The encyclical did the diagnostic work. The political move belongs to the press that operates outside the genre.

What Comes Next

Episode 3 of the Four-Layer Architecture series — running next week — will be the crypto-fascism piece. It will walk the term through Robert Paxton’s seven mobilizing passions of fascism and through the structural distinctions that make the present variant crypto (concealed, privatized, operationally-coalitional, mass-surveillance-capable) rather than overt — and it will route the term through the same 42,000-word document that this piece walked. The encyclical will be the magisterial substrate underneath; the political term will be the load The RAMM carries that the magisterium cannot.

In the meantime, the document is available. Vatican.va has the full English text. The sections walked here are §§5, 71, 109, 110, 134, 170, 171, 178, 192, and 202 — the ten load-bearing nodes. The whole document, taken at the magisterial register it demands, is the most thorough structural diagnosis of the contemporary technological-political regime to appear from any institutional voice in any register this decade.

The Antichrist’s restrainer has spoken. The Antichrist’s restrainer’s restrainer — the katechon of the katechon, in the framework Episode 1 unpacked — was supposed to be eliminated quietly, by the very same actors the encyclical refused to name. Instead, the restrainer stood at the Vatican, with an AI-safety researcher beside him, with a 42,000-word document of structural diagnosis behind him, and pointed at a regime he could not call by its political name.

Next week, the political name. This week, the diagnosis stands on its own — magisterial, dated, signed, irrevocable.

Sources

Primary text:

• Leo XIV, Magnifica Humanitas (15 May 2026), §§5, 7–10, 71, 109, 110, 134, 170, 171, 178, 192, 202, 243–245. Vatican.va.

Reporting on the May 25 release:

• “Anthropic aligns with Vatican over White House as Pope Leo addresses AI fears.” The Washington Post, 25 May 2026.

• “In his first encyclical, Pope Leo XIV says AI must serve humanity, not the powerful few.” Religion News Service, 25 May 2026.

• “Pope Leo, Anthropic co-founder call for church-tech ethics partnership at Magnifica Humanitas release.” National Catholic Reporter, 25 May 2026.

• “Pope Leo calls to ‘disarm’ AI in major document, warns of technologic threats to humanity.” National Catholic Reporter, 25 May 2026.

Reporting on the April 14 Vance / just-war episode:

• “Vance questions the pope on just war theory hours after Leo honored its founder.” National Catholic Reporter, 15 Apr 2026.

Vance’s Paris AI Action Summit remarks (February 11, 2025):

• “Remarks by the Vice President at the AI Action Summit in Paris, France.” White House transcript, The American Presidency Project.

Companion pieces in The RAMM’s Four-Layer Architecture series:

• “The Antichrist as Luddite” — Episode 1. The leaked Thiel lecture that named AI-safety researchers and the Pope as the Antichrist’s restrainers.

• “Augustine Against Augustine” — The Vance-vs-Pope Augustine arc closed by §192.

• “The Violence Loads Automatically” (forthcoming) — §171 in RAMM vocabulary; the architecture-of-visibility mechanism.

• “The Pentagon Banned Claude as a National Security Threat” — Anthropic’s prior public stand against weaponized AI deployment.

Theological / philosophical references behind the encyclical:

• Hannah Arendt, The Origins of Totalitarianism (1951), Part 3 (referenced at §134, footnote [143]).

• Leo XIII, Rerum Novarum (1891) — the labor-and-capital doctrinal predecessor cited throughout the encyclical.

• Pius XI, Quadragesimo Anno (1931) — the formal articulation of subsidiarity that §71 transposes.

• Francis, Laudato Si’ (2015) and Fratelli Tutti (2020) — quoted/referenced at §5 and §192 respectively.

Antiqua et Nova (Dicastery for the Doctrine of the Faith / Dicastery for Culture and Education, Note on AI, 14 January 2025) — the immediate doctrinal predecessor referenced in the encyclical’s footnotes throughout.

“In the 21st century, the Antichrist is a Luddite who wants to stop all science. It’s someone like Greta or Eliezer.”

The man speaking was Peter Thiel — chairman of Palantir Technologies, founding partner of the Founders Fund, the largest political patron of the sitting Vice President of the United States. The room was the Commonwealth Club in San Francisco. The date was September 15, 2025. Reporting was prohibited. Attendance was by invitation. The microphones were not supposed to be on.

The lectures were billed as “The Antichrist: A Four-Part Lecture Series.” They ran on four consecutive Mondays — September 15, September 22, September 29, and October 6, 2025 — organized by a Christian tech nonprofit called ACTS 17 Collective, the acronym standing for Acknowledging Christ in Technology and Society. “Greta” is Greta Thunberg, the climate activist. “Eliezer” is Eliezer Yudkowsky, the AI safety researcher. The people who sound the alarm about catastrophic risk. “The Antichrist,” Thiel said, “comes to power by talking constantly about Armageddon, about rumors of wars, and scaring you into giving him control over science and technology.”

Recordings of the four lectures were obtained by Reason — which published a seven-hour listening review by Jack Nicastro on October 14, 2025 — and by The Guardian. Audio authenticity was verified by Hany Farid, the UC Berkeley digital forensics expert. The lectures and their content have been reported on across major outlets including The New York Times, Fortune, the Washington Post, Unherd, the religion press, and the Catholic Herald. The Catholic writer Christopher Hale, in his Substack newsletter Letters from Leo, drew out what most of the broader coverage had skipped past: that Thiel had brought Pope Leo XIV by name into the lectures.

Thiel called Leo XIV “the woke American pope.” He warned his audience of a “Caesaro-Papist fusion” — the union of temporal and spiritual power that, in his framework, is the structural shape an Antichrist regime would take — between “a woke American pope” and “a woke American president like AOC.” Alexandria Ocasio-Cortez (D-NY). Her initials, Thiel observed, were “worrisome.” He spoke of his protégé Vice President Vance: “I don’t like his popeism. We have all these reports of fights between him and the Pope; I hope there are a lot more.” And, per Hale’s reporting on the same recordings, Thiel told his audience he had advised the Vice President to ignore the pope on moral matters and simply pray for him.

Thiel did not, in the recordings, name Pope Leo XIV as the Antichrist. The figure he named for that role across the lectures was the unspecified luddite — the existential-risk preacher, the AI safety researcher, the climate activist, the regulator. The pope, in Thiel’s framework, plays a different role: the spiritual-power half of the feared Caesaro-Papist union, the moral authority whose teaching ministry would lend the broader anti-technology project the institutional reach to bind.

The distinction matters. It is also the structure of the operation. The Antichrist framework provides the eschatological category, the end of the world framing, that makes any constraint on technological development the work of the lawless one. The pope is then placed inside the framework. He is not himself accused of being the eschatological enemy. He is identified as the figure whose moral authority — if not neutralized — would lend that enemy the institutional reach to win.

After Hale’s piece circulated in religion-press silos and largely failed to break into the wider conversation, the recordings resurfaced when Hale appeared on Jon Favreau’s podcast Offline and posted a viral thread on X.

The lectures themselves were not improvised. Thiel has been delivering versions of the Antichrist material across at least eighteen months. In a June 2025 interview with Ross Douthat at The New York Times, Thiel articulated the same framework: “If the Antichrist were to come to power, it would be by talking about Armageddon all the time.” After the September–October San Francisco series, he took the lectures to Rome.

The Rome dates were March 8–11, 2026, per an invitation reviewed by the Associated Press. The lectures were originally rumored to be hosted at the Pontifical University of St. Thomas Aquinas — the Angelicum, the Dominican institution where the future Pope Leo XIV studied in the 1980s. The Angelicum issued a public statement: “We would like to clarify that this event is not organized by the University, will not take place at the Angelicum, and is not part of any of our institutional initiatives.”

The lectures proceeded under the auspices of the Vincenzo Gioberti Cultural Association — an Italian organization with documented ties to Italy’s far right, dedicated to “the restoration of Catholicism as the cornerstone of national identity” — and the Cluny Institute, “incubated at” the Catholic University of America in Washington. CUA also issued a public denial of any institutional sponsorship. The press was excluded. The venue was not disclosed. The closed-door format was preserved.

This is not a man airing private speculation in unguarded moments. It is a man building out a venue infrastructure for a specific theological argument, choosing his audiences, declining the institutions that would scrutinize it, and traveling internationally to deliver it. The fact that recordings nonetheless escaped is what is unusual, not the existence of the project.

What Thiel said on those tapes is the framework caught in the open mic. It is not a fringe utterance. It is not the eccentric fixation of a billionaire crank. It is the load-bearing theological claim of an entire wing of American power, articulated in private to vetted audiences because it cannot survive being articulated in public.

Call it crypto-christology. The smuggled gospel.

The church that has to stay underground because its own scriptures will not bear it.

What the prefix means

The “crypto-” prefix carries two registers, and both belong here.

The first is older: hidden, encoded, secret. A crypto-Catholic in Elizabethan England outwardly conformed to the Anglican liturgy while privately maintaining the old faith. A crypto-Jew in the Iberian peninsula passed as Christian in public while keeping kosher in the cellar. The encoding was protective; the public face concealed the actual creed.

The second is contemporary. Cryptocurrency presents itself as a technology of liberation and operates as a technology of capture. The marketing — financial freedom, individual sovereignty, escape from state control — is decoupled from the structural function: a parallel financial system that escapes anti-money-laundering frameworks, capital controls, sanctions enforcement, and democratic oversight.

The two layers are not contradictory. They are how the project works. The marketing is the rails on which the function travels. The Bitcoin-maximalist canon — Saylor’s “divine math,” the 21-million-coin cap as sacralized constraint, the recurring vocabulary of sovereign, immutable, trustless applied to monetary form — is structurally theological even when its proponents are secular; a later piece in this series will work the sound-money register on its own terms.

Crypto-christology operates the same way. The surface presents a traditional Christian faith — common-good language, natural-law reasoning, defense of Western civilization, masculine headship, ordered hierarchy, restraint of chaos. The structural function is something else: the legitimation of a small elite against any moral authority that would constrain it.

What gets concealed is the actual content of Christian scripture.

The gospels are not subtle on this point. The Christ they portray is a Galilean peasant prophet executed by the imperial occupation of his people. He proclaimed the Kingdom of God at hand, and the proclamation was a sovereignty claim: Rome did not crucify peasants for offering gentle ethical teaching; Rome crucified peasants for claiming alternative sovereignty against Caesar’s. The vocabulary the Jesus movement used to make that claim was Caesar’s own — Lord, Savior, Son of God, good news — every title stripped from the deified emperor and conferred on the man Rome had crucified. (Son of God vs Son of God, in The Second Sermon, works the full philological argument and its political stakes.)

His program announced the cancellation of debts, the release of captives, the lifting up of the lowly, the scattering of the proud, the filling of the hungry, and the sending away of the rich empty. He was killed for the sovereignty claim. The early Jesus movement spread because people recognized in him the unmasking of imperial logic — the revelation that the executed peasant, not the deified emperor, was the bearer of God’s vindication.

A christology that takes this content seriously is structurally incompatible with elite legitimation. It cannot bless concentrated power, technological domination, or the dehumanization of the poor and the foreign. The texts will not stretch that far.

What crypto-christology does is the reversal. It takes the titles back. It returns Lord to the apparatus of the imperial state. It returns Savior to the engineer who promises to save us through unconstrained technological development. It returns good news to the marketing departments of the surveillance vendors. The Christ of crypto-christology is not the Galilean prophet who proclaimed the Empire of God against Rome. It is the Christ enlisted by Rome.

Which is why the project requires concealment. Common-good language is the public face. Pope-as-impediment-to-Antichrist-resistance is what gets said when the door is closed.

It is not, in this sense, a failure of nerve that the recordings happened in private. It is a structural requirement.

The Girardian inversion

To understand what Thiel did to christology, you have to understand who he was reading.

In the early 1990s, as a graduate student at Stanford, Thiel attended the seminars of René Girard, the French literary theorist whose work on mimetic desire and the scapegoat mechanism became the central interpretive framework of his life. Thiel funded Girard’s institute, Imitatio. He installed Girard at the heart of his self-presentation as a serious thinker rather than a mere venture capitalist. He introduced J.D. Vance to Girard’s work in the 2010s, and Vance has cited Girard as a formative intellectual influence.

Girard’s own analysis was, in its first movement, devastating to power.

Human communities, Girard argued, generate violence through mimetic rivalry — we want what others want because they want it, and the resulting tensions accumulate until the community discharges them by collectively turning on a victim. The scapegoat absorbs the violence. The community experiences relief, mistakes that relief for divine sanction, and the cycle resumes. Religion, in Girard’s reading, is the elaborate cultural machinery for managing this — the ritualization of the scapegoat mechanism, with myth as the cover story that makes the violence look like justice.

The gospel, in Girard’s late work, is what unmasks the machinery. The crucifixion narratives, told from the victim’s perspective, expose the lie at the center of every previous scapegoating. The crowd believes it is doing God’s work; God turns out to be on the side of the victim; the mechanism is named, and once named, can no longer operate as it did. Christianity, in this reading, is anti-sacrificial. It dismantles the structures by which power has historically purchased its own legitimacy.

That is not the christology Thiel deploys.

The Girard he hands to his patrons and protégés has been quietly inverted. The scapegoat mechanism still appears. The mob still produces sacrificial victims. But the mob, in Thiel’s rendering, is no longer Pilate’s crowd or the religious authorities or the imperial machinery — it is the regulators, the ethicists, the climate scientists, the journalists, the critics of monopoly power, the popes who teach that artificial intelligence raises questions of human dignity. The victims, in Thiel’s rendering, are the technological elite. The Christ-figure is the misunderstood founder, the visionary entrepreneur, the seer mocked by the small. Girard’s anthropology, which exposed the scapegoat mechanism that elites have always used to legitimate their position, is repurposed to make those same elites the scapegoated.

The form of the analysis is preserved; the content is reversed.

Thiel’s stated sources in the lectures make the framework legible. He drew on John Henry Newman’s nineteenth-century apocalyptic writings and on Vladimir Soloviev’s 1900 novella A Short Story of the Antichrist, in which the Antichrist arrives as an engineer offering rational solutions to human chaos. He cited Hobbes’s Leviathan as the political form the Antichrist would inhabit. He described himself in the lectures as a “small-o orthodox Christian” and a “humble classical liberal,” and said his concern about the Antichrist was his “only deviation from classical liberal orthodoxy.” In one of the recordings, he formulated the political-theological dilemma directly: America, he said, is “the natural candidate for Katechon” — the restrainer, the figure or force in 2 Thessalonians that holds back the lawless one until the appointed time — “and Antichrist; ground zero of the one-world state, ground zero of the resistance to the one-world state.”

The katechon is the load-bearing concept. It is also the concept that Catholic integralists, particularly Adrian Vermeule at Harvard Law, have spent the last decade rehabilitating as a justification for authoritarian governance. In the integralist reading, legitimate political authority is the katechon, charged with restraining civilizational collapse. The construction of a surveillance-enforcement state ceases to be a moral compromise for strategic gain and becomes a theological obligation. The restrainer must restrain.

What Thiel said on the tape — that the Antichrist will come as a luddite who weaponizes existential risk to seize global control over technology — is the katechontic frame applied to AI policy. Anyone who would constrain technological development on moral or precautionary grounds is, by definitional fiat, doing the lawless one’s work. The katechon, in this rendering, is the unrestrained technologist. Anything that restrains him — regulation, ethics, religious moral teaching — is the Antichrist’s instrument.

This is what is meant by smuggling. The form is recognizable Christian theology. The content is its photographic negative.

Why the pope, why AI, why now

The framework is not aimed at the abstract figure of any future pope. It is aimed at a particular pope, doing particular work, at a particular moment.

Pope Leo XIV is the first American pope in the Catholic Church’s two-thousand-year history. Cardinal Robert Francis Prevost was elected to the papacy on May 8, 2025. He chose his name, by his own account, to invoke Leo XIII — the pope whose 1891 encyclical Rerum Novarum responded to the dehumanizing forces of industrial capitalism by articulating Catholic social teaching as a tradition of moral resistance to economic systems that grind human dignity into capital.

In his first formal address to the College of Cardinals on May 10, 2025, Leo XIV named the project explicitly: the Church, he said, “offers to all her treasure of social teaching in response to another industrial revolution and the developments of artificial intelligence.” The pontificate would do for the AI revolution what Leo XIII’s had done for the industrial revolution. To insist that the human person is not raw material for technological systems. To name the moral obligations of those who build and deploy these systems. To establish, with the institutional weight of the world’s largest religious body, that there are theological grounds for constraint.

For a year that was a stated intention. Now it is on the page. On May 25, 2026, Leo XIV released his first encyclical, Magnifica Humanitas — forty-two thousand words “on safeguarding the human person in the time of artificial intelligence” — calling for AI to be “disarmed” from “logics of domination, exclusion and death,” holding that “it is necessary to establish adequate regulatory tools capable of upholding justice and curbing the distorting effects of technological power,” and naming the danger by its structure: technological power concentrated in “private, often transnational, parties” beyond the reach of states. The intention became the magisterial document. And the luddite the lectures warned about turned out to be exactly the figure the lectures said he was: a pope, teaching that there are limits.

This project is not optional for the church. It is a faithful extension of a teaching tradition that has been continuous since 1891. It is also the single most dangerous moral authority on earth from the perspective of a project whose entire architecture depends on AI surveillance, AI enforcement, AI weapons, and the steady displacement of human moral judgment by algorithmic decision.

The Catholic Church speaks to roughly a billion and a half people across every continent and every political coalition. Its teaching authority is recognized, with varying degrees of fidelity, by Catholic integralists, mainline Protestants, evangelicals who absorb its social teaching even while rejecting its ecclesiology, secular ethicists who treat its tradition as a serious moral interlocutor, and the broader cultural ecosystem in which “what does the pope say about this” still functions as a question with weight. No other moral authority on earth has that reach.

With the encyclical, the moral case for AI restraint is now a global teaching with institutional backing across denominational lines — no longer a forecast. The Palantir contract architecture — explicitly designed to rebuild Total Information Awareness in the private sector after Congress banned it — the Anduril defense integration, the surveillance-state buildout, the algorithmic enforcement systems now all have to operate inside a moral environment the church has made hostile. Not by political mobilization, though that may follow. By teaching. By the slow accumulation of moral authority that names what is happening and refuses to bless it.

The framework’s mechanism is already visible, and I have documented it at length elsewhere: when Anthropic refused Pentagon demands to relax its AI product Claude’s safety guardrails, the administration designated the company a “supply chain risk” — the language ordinarily reserved for hostile foreign governments — then used the model anyway for Iran strike modeling while signing a parallel deal with a competitor that asked fewer questions. The message was never “remove your guardrails.” It was: don’t say no in public. The “luddite” framing in the Antichrist lectures is the theological legitimation of that message. Whoever names a moral limit is named the enemy.

So watch what happened next. When Leo presented the encyclical at the Vatican on May 25, he did not present it alone: beside him stood Chris Olah, a co-founder of Anthropic, calling with the Pope for moral limits on AI — “we need moral voices that the incentives cannot bend.” The Washington Post headlined it “Anthropic aligns with Vatican over White House.”

Read this in the context of Thiel’s framework, he names two archetypal luddites — the AI-safety researcher and the now the pope who teaches AI ethics — and on that one stage, on that one day, both of them stood together. The legitimation layer’s two designated villains, shoulder to shoulder. It is the precise photographic negative of the story the framework needs to be true: the company the administration tried to brand a security threat for holding a line on safety, standing next to the moral authority the lectures cast as the Antichrist’s instrument, both of them saying the same thing. (I traced that collision through the Vance-versus-Pope arc in the companion piece, “Augustine Against Augustine.”)

The structural threat is precise. The response is precise.

In the lectures: tell the Vice President to ignore the pope on moral matters. Frame the pope as the spiritual half of a feared Caesaro-Papist fusion. Travel to Rome in March 2026 to deliver Antichrist lectures at the doorstep of the Vatican — refused a venue by the pope’s own doctoral institution, ultimately hosted by integralist-friendly cultural associations operating outside official Catholic ecclesiastical structures. Build out the alternative theological infrastructure that allows Catholic-identified political figures to override their church’s teaching while continuing to perform Catholic identity for their political base.

This is not religious conflict in the conventional sense. It is the systematic neutralization of countervailing moral authority on the precise policy axis where the four-layer technological-political project is most exposed.

The pattern in The RAMM‘s capture-cascade work has been institutional: Powell Memo, Federalist Society, Project 2025, bureaucratic embedding. This piece opens a different layer underneath that one — the theological legitimation that makes the institutional capture coherent to the people running it. The smuggled christology is the load-bearing ideology underneath the surveillance contracts, the detention infrastructure, the interlocking-conflicts cabinet, the AI weapons procurement, and the captured Christianity that prays for “overwhelming violence” at the Pentagon.

The November 2024 ACTS 17 Abu Dhabi event — Trae Stephens of Anduril paired with Faisal Al Bannai of EDGE Group, the UAE state-backed defense-AI conglomerate, under the program title “Theology of AI and Defense” — names what the legitimation layer also is: a transnational surveillance-defense relational vehicle. The same theological vocabulary that delegitimates AI restraint in San Francisco is the vocabulary inside which US-Gulf defense-tech procurement gets framed as Christian vocation in Abu Dhabi. The crypto-fascism layer this series will document is already operational; the Antichrist lectures are the doctrinal framing.

The conflict is not new

Pope Leo XIV is the second pope this Vance administration has crossed in public.

In late January 2025, less than two weeks into the second Trump administration, Vance gave a Fox News interview in which he invoked an “old school” Christian concept he later identified as the ordo amoris — the order of loves, articulated by Augustine and developed by Aquinas — to defend the administration’s deportation program. “You love your family,” he said, “and then you love your neighbor, and then you love your community, and then you love your fellow citizens in your own country, and then after that you can focus and prioritize the rest of the world.” When the citation was challenged, Vance posted on X: “just google ‘ordo amoris.’”

Pope Francis responded on February 10, 2025, in a public letter to the bishops of the United States. Without naming Vance, the letter took apart the construction. “Christian love is not a concentric expansion of interests that little by little extend to other persons and groups,” Francis wrote. “The true ordo amoris that must be promoted is that which we discover by meditating constantly on the parable of the Good Samaritan — that is, by meditating on the love that builds a fraternity open to all, without exception.”

It was the most direct public confrontation between a pope and a sitting American Vice President on Catholic moral teaching in modern memory.

Vance addressed the conflict on February 28, 2025, at the National Catholic Prayer Breakfast in Washington. He said he was “surprised” that Francis had criticized the administration’s immigration policy. The argument continued through March and April. On Easter Sunday, April 20, 2025, Vance met Francis briefly at the Domus Sanctae Marthae — what would be Francis’s last meeting with a major political figure. Francis died the following morning, April 21, at age 88, after a long convalescence from bilateral pneumonia.

The conclave elected Cardinal Prevost on May 8. Leo XIV picked up the project in continuity with his predecessor. He has condemned the administration’s military posturing toward Iran and Venezuela. He called publicly on November 4, 2025 for ICE to allow clergy access to detained migrants. And on April 14, 2026 — the same day Vance stood at a Turning Point USA event and told that pope to “be careful” about “matters of theology,” citing just-war theory against him — Leo was in Annaba, Algeria, saying Mass in the Basilica of St. Augustine, the first Augustinian pope on the ground where Augustine wrote the just-war tradition Vance had just invoked against him. Six weeks later came the encyclical. (The full arc of those confrontations — ordo amoris, just war, the encyclical, the same saint cited on both sides — is the subject of the companion piece, “Augustine Against Augustine.”) He has not stopped speaking. He has institutionalized the speaking.

Four months after Leo’s election, on September 15, 2025, Thiel began delivering the Antichrist lectures.

Where Vance stands

The surrounding political-economic project requires a bridging figure. Tech-right capital can build infrastructure and win contracts but cannot generate the bureaucratic depth, the enforcement legitimation, or the mass democratic cover needed to govern through that infrastructure. Christian nationalist movements have spent forty years building exactly those capacities — personnel pipelines through ADF, Liberty, Patrick Henry, the CREC, Catholic integralist institutions — but lack the technological and capital infrastructure that would let them rule at scale.

The two projects ran parallel through the late 2010s. They required a coupling figure to fuse into a single governance model. J.D. Vance is that figure.

His position is documentable, not speculative. He met Peter Thiel at Yale Law School in 2011. He joined Thiel’s Mithril Capital in 2016. He converted to Catholicism in August 2019, confirmation saint Augustine. Thiel seeded Vance’s own venture firm, Narya, founded in 2019 — the fund raised $93 million, announced in January 2020. In the 2022 cycle, Thiel contributed more than $15 million to Protect Ohio Values, the super PAC supporting Vance’s Senate campaign — approximately 75 percent of the PAC’s total fundraising. Trump’s endorsement followed Thiel’s investment. Vance has been Vice President since January 20, 2025.

The intellectual orientation tracks the Catholic-integralist current that became publicly visible in the late 2010s: First Things under Rusty Reno, Adrian Vermeule’s “common-good constitutionalism” at Harvard Law, Patrick Deneen’s Why Liberalism Failed, Sohrab Ahmari’s case for state enforcement of moral order. Vance’s “British sherpa,” in his own description, is James Orr, the Cambridge philosophy of religion scholar who helped found the UK National Conservative Movement.

The denominational ambiguity is a feature, not an accident. Vance integrates three doctrinally incompatible Christian-nationalist streams without resolving the contradictions between them.

He is personally inside the Catholic-integralist stream — baptism, confirmation, Hallow app, the First Things circuit, Steubenville. He is operationally adjacent to the Reformed-postliberal stream. He shares the National Conservatism platform and American Moment infrastructure with Stephen Wolfe and Doug Wilson’s circle, even though Wilson’s March 2026 statement that a “stout Protestant republic” could not permit a Virgin Mary parade because it would be “public idolatry.”

This was made, pointedly, by the pastor who mentors Defense Secretary Hegseth — puts him in explicit doctrinal opposition to Catholic Vance. He is ratified by the Pentecostal/NAR stream through the Anti-Christian Bias Task Force frame, which collapses denominational distinctions into a single “anti-Christianity is the threat” paradigm that lets dominionist Pentecostals operate under the same coalition cover. The denominational ambiguity works because the underlying christology — small elite as scapegoated, regulator as Antichrist’s instrument, restraint of disruption as civilizational sin — is shared across the three streams even when the ecclesiology isn’t.

What the recordings reveal is the substrate beneath the public performance. The same christology, named openly, with the actual living head of the actual largest church Vance claims as his own identified as the spiritual-power half of a feared Caesaro-Papist fusion that the Vice President is being instructed to help prevent.

What this is, and what it is not

It is not religious persecution in the brutalist sense. The Catholic Church will not be banned. Crypto-christology is not the religious authoritarianism of 1930s Spain or contemporary Iran.

Instead, is internal christological conflict — a fight over what the word “Christian” structurally authorizes, conducted through the apparatus of the state, with the resources of a vast technological and financial empire deployed to ensure that the answer comes out one particular way.

It is also not a marginal phenomenon. The largest political donor in the Vance succession architecture said it. The Vice President of the United States is the recipient of the instruction it contains. The intellectual infrastructure — Vermeule at Harvard Law, Deneen at Notre Dame, First Things in publishing, the Claremont Institute in policy, the network of integralist cultural associations and Catholic-identified think tanks — has been built out, funded, and staffed across the past decade by Thiel-network capital and Federalist Society judicial pipelines. The bureaucratic embedding — Russell Vought at OMB, Jim O’Neill at HHS, the integralist-aligned judicial appointments, the Christian nationalist cabinet faction operating across DHS, DOJ, HHS, and Defense — provides the executive-branch reach.

The capital and personnel base is documentable. Palantir alone is valued at over $270 billion, part of a vertically integrated surveillance-to-weapons infrastructure across more than twenty-one companies, with more than a dozen Thiel-network alumni placed in Trump administration agencies. Palantir alone carries 144 documented Trump-administration financial ties in the ProPublica disclosures. Palantir’s ImmigrationOS — the $30 million ICE sole-source contract that became a $1 billion DHS no-bid expansion — is the operational instrument. The theological layer this piece names is the legitimating cover for an apparatus of that scale.

This is not a fringe. It is at the apex.

Crypto-christologies are also intrinsically fragile. They depend on the gap between surface performance, and structural function holding. When the gap is exposed — when the tape leaks, when the patron’s actual instructions surface, when the smuggled content is articulated openly — the public legitimation suffers immediate strain. The political base that has been performing Catholic identity around Vance has to make a decision. The integralist intellectuals who have been treating Thiel as a serious philosophical interlocutor have to either reckon with what their philosophical interlocutor actually thinks of the head of their church, or perform the further intellectual contortion required to absorb it.

The smuggling works until it is named. Once named, the audience that had been operating on the surface performance has to choose. Some will reject the smuggled content and walk away. Some will embrace the smuggled content and carry the project forward with the gap closed. Some will continue to operate in bad faith, but with diminished cover. None of those outcomes leaves the equilibrium where it was.

What the tapes name

Return to the actual recordings.

A Vice President of the United States is in receipt of an instruction from his largest political patron to disregard the moral authority of his church on the specific policy axis — the development of ethical AI — where his administration’s most consequential project sits. The patron has, on tape, framed the head of that church as the spiritual-power half of a feared Caesaro-Papist union and identified resistance to technological development as the work of the Antichrist.

The Vice President has, in his public conduct, performed Catholic identity while overriding Catholic teaching on the questions where these projects intersect most directly — first under Pope Francis, who challenged him on the ordo amoris and died the day after their final meeting at the Vatican, and now under Pope Leo XIV, who answered Vance’s “be careful” on just-war theory from Augustine’s own basilica and then, on May 25, placed the moral status of artificial intelligence at the center of the church’s teaching with an encyclical that names exactly what the lectures said must never be named: a limit.

The keystone phrase — Antichrist as luddite — is so theologically aggressive that it forces every reader who knows the Christian tradition into the same recognition. The Antichrist in scripture and in patristic tradition is not the figure who would restrain the seer or constrain the technocrat. The Antichrist is the figure of false sovereignty, the one who claims worship through power, the one who deceives by appearing as an angel of light. Catholic readers, Protestant readers, even secular readers with no theological investment recognize what is happening: the deepest moral category in the inherited tradition is being inverted on tape, in service of the precise project the inverted category was constructed to oppose.

What Pope Leo XIV is actually doing is teaching that human beings are not raw material for AI systems. What Pope Leo XIV is actually doing is naming the moral obligations of the actors who build and deploy those systems. What Pope Leo XIV is actually doing is the work of a teaching church responding to a technological revolution exactly as Catholic social teaching has responded to every previous one. What Pope Leo XIV is actually doing is what the inherited tradition asks the office to do.

The patron of the Vice President of the United States said, on tape, that the resistance to that work is the work of the Antichrist. He said the Vice President should ignore the church’s living head on the moral questions raised by that work. He said the tradition of moral teaching that constrains technology is the lawless one’s instrument. He said it across four lectures in San Francisco, in a June 2025 interview with The New York Times, and again across four days in Rome in March 2026.

This is one piece of a larger architecture — the financial apparatus that funds it, the cryptocurrency rails that move its capital, the surveillance infrastructure that gives it operational reach, each with its own ledger. But this piece is here first, because the recordings are here, and because the smuggled christology is the legitimating layer that makes everything else thinkable. Name the theology, and the rest stops looking like a series of separate scandals and starts looking like what it is.

A patron told the principal to ignore the moral authority. On tape. About AI ethics. The recordings exist. They were obtained by Reason and The Guardian and have been reported on across the political and religious press. The principal is the Vice President of the United States. The moral authority is the head of the largest church on earth.

The microphone was on.

This is the legitimation layer — the theology that makes the rest coherent to the people running it. Underneath it sits the apparatus the theology blesses, and that apparatus has its own ledger: the surveillance infrastructure built to rebuild Total Information Awareness in the private sector; the defense-AI stack that runs from Palantir through Anduril and out to the Gulf; the ACTS 17 network where the same vocabulary that delegitimates AI restraint in San Francisco frames US–Gulf defense-tech procurement as Christian vocation in Abu Dhabi. Those are the pieces this series is building toward — and the surveillance layer is the one coming into focus next. The companion to this piece, “Augustine Against Augustine,” follows the same christology into the open, through the Vance-versus-Pope confrontations. The Second Sermon companion — “Son of God vs Son of God“ — works the philological argument underneath all of it: what kyrios, soter, euangelion, and divi filius meant in their imperial context, and why the early Christian confession was a sovereignty claim before it was a creed. There is much more here than one piece can hold. It is coming.

Sources

Primary recordings and verified reporting:

• Jack Nicastro, “I Listened to Over 7 Hours of Peter Thiel’s Leaked Antichrist Lectures. They’re Surprisingly Libertarian” (Reason, October 14, 2025)

• “What billionaire Peter Thiel said in his private ‘Antichrist lectures’” (Washington Post, October 10, 2025)

• “Inside tech billionaire Peter Thiel’s off-the-record lectures about the Antichrist” (The Guardian, October 10, 2025)

• “Hany Farid Verifies Billionaire Lectures Warning of ‘The Antichrist’” (UC Berkeley School of Information)

• “Peter Thiel is delivering 4 private sold-out lectures at a club in San Francisco — about the Antichrist” (Fortune, September 2, 2025)

• ACTS 17 Collective, “The Antichrist: A Four-Part Lecture Series” (event listing)

Christopher Hale’s reporting and the resurfacing:

• Christopher Hale, “JD Vance’s Top Donor Suggests Pope Leo XIV is Antichrist” (Letters from Leo)

• Christopher Hale, “JD Vance’s Top Donor Brings His War on the Pope to Rome” (Letters from Leo)

• Jon Favreau, “How Peter Thiel Became the Right’s Tech-Authoritarian Kingmaker” (Offline with Jon Favreau, fall 2025 — link pending correct episode URL)

Rome 2026 lectures:

• “Peter Thiel brings his Antichrist lectures to the Vatican’s doorstep, and Catholic institutions back away” (America Magazine, March 13, 2026)

• “Thiel brings Antichrist lectures to Vatican’s doorstep” (Religion News Service, March 13, 2026)

• “Peter Thiel’s secret lectures on Antichrist in Rome spark debate” (CNN, March 16, 2026)

• “Peter Thiel brings his Antichrist lectures to Rome” (Fortune, March 16, 2026)

Papal documents and Vatican coverage:

• “Pope Leo XIV to Cardinals: Church must respond to digital revolution” (Vatican News, May 10, 2025)

• “Pope signals he will closely follow Francis and says AI represents challenge for humanity” (CNN, May 10, 2025)

• “Pope Francis takes aim at Vance’s definition of ‘ordo amoris’ in letter to US Bishops” (Religion News Service, February 11, 2025)

• “Pope’s death due to stroke and irreversible cardiocirculatory collapse” (Vatican News, April 21, 2025)

• “JD Vance meets Pope Francis on Easter Sunday” (Washington Post, April 20, 2025)

Vance documentation:

• “13 things to know about J.D. Vance’s Catholic journey” (Catholic News Agency / EWTN News — original URL defunct; fact verified via America Magazine and Religion News Service)

• Protect Ohio Values PAC summary (OpenSecrets, 2022 cycle)

• Ross Douthat interview with Peter Thiel, The New York Times (June 2025)

Earlier Thiel framework articulations:

• “Antichrist or Armageddon? Peter Thiel rethinks apocalypse from Silicon Valley” (Religion News Service, September 9, 2025)

• “Peter Thiel’s Antichrist lectures” (Catholic Herald)

For fifteen months, the only people who knew a federal immigration detention center was coming to the eastern edge of Gilroy, California were the people who signed the lease.

The General Services Administration awarded the contract on January 8, 2025. The site — 7240 Holsclaw Road, about twenty-four acres of greenhouses and open land in unincorporated Santa Clara County, eight miles from the Monterey County line — went to an entity called ECG 6 LLC, whose Beverly Hills mailing address matches that of Elmwood Capital Group, a real-estate firm founded in 2020. Elmwood’s stated business, per its own website, is acquiring industrial parcels and procuring leases with the federal government. County records show it took ownership of the Holsclaw Road parcel weeks after the contract award.

Nobody outside that transaction knew. Not the county. Not the city of Gilroy. Not the county next door. The project surfaced in April 2026 only because community members noticed activity on the land and called the county to ask. By mid-May, crews were tearing down the greenhouses and putting up privacy fencing. Asked about it, a Department of Homeland Security spokesperson said only: “We have no new detention centers to announce at this time.” ICE, the spokesperson added, “is actively working to expand detention space.”

Both of those sentences are true. That is the point. This is the deny-then-build posture working exactly as designed — and Gilroy shows where it went after the last version started getting caught.

What the Warehouse Track Was

To see why Gilroy matters, you have to know what it replaced.

Through the winter of 2025–2026, the detention buildout expanded mostly by buying warehouses — and routing the purchase through a financial owner who absorbed the public-facing transaction. DHS didn’t appear on the deed. A bank or a real-estate fund did. The detention-pipeline tracker documented the cluster building site by site: Rockefeller Group in Surprise, Arizona; Fundrise in Williamsport, Maryland; Goldman and Dalfen in Roxbury, New Jersey; Carlyle in Oakwood, Georgia; Deutsche Bank in Salt Lake City. Generic industrial real estate, bought through a cutout, repurposed to confinement.

It is a clean trick, and for a while it worked. But it had two weaknesses. It left a deed — a public record of a sale, even if the buyer’s name was a fund nobody recognized. And the scale of it drew federal review, which stalled the purchase track, and local fights, which lit up the moment the buyers were named. Once Commercial Observer could run the headline “DHS, ICE Expanding in Commercial Real Estate at Full Tilt” in February, the trick was no longer secret. It was a strategy with a name.

So the apparatus did what captured systems do when a method gets exposed. It iterated.

The Evolution: A Lease, Not a Deed

Gilroy is the iteration. And the difference is the whole story.

At Gilroy there is no purchase for a journalist to find in county property records. There is a twenty-year lease — reported at $26.5 million — held by a real-estate LLC. The federal government’s name does not appear on the parcel. ECG 6 / Elmwood owns it; ICE leases it; the deed stays private for the life of the lease.

Three things make this tighter than the warehouse purchases:

The intermediary’s whole business is the concealment. A bank that happens to own a warehouse is an accidental cutout. Elmwood Capital is a dedicated one — a firm whose stated model is procuring GSA leases on industrial land. The concealment isn’t incidental to its business. It is the business, and it is repeatable: Elmwood is tied to a second immigration-detention proposal in Pflugerville, Texas. One LLC, the same maneuver, two states.

A lease keeps the government off the public record in a way a purchase can’t. No federal sale appears anywhere. The trail belongs to a private landlord.

The GSA-lease form launders detention into routine government office-space leasing. GSA leases attorneys’ offices, field stations, ordinary federal space all the time. A detention site procured through that same channel looks, on paper, like any other government lease — until a construction crew shows up. The contract at Gilroy reportedly bears the same identification number as an ICE detention solicitation, but you would have to go looking for that. For fifteen months, nobody did.

This is what the concealment layer looks like once it learns from being caught. Not a bank absorbing one purchase, but a landlord whose recurring product is standing between the public record and the federal use. (I’ve written up the full mechanism — the move from intermediary-purchase to LLC-held lease — for the record.) DHS can say “no new detention centers to announce” and be technically correct, because on paper there is no new detention center. There is a real-estate lease.

The Counter: Locking the Door Before Anyone Knocks

Here is the part that gives the story its shape. Communities have figured out the pattern — and invented a counter that matches its secrecy.

The instinct, for years, was reactive: wait for a facility to be proposed, then fight the permit. That is how Howard County, Maryland caught a stealth facility in Elkridge — after the permit issued. But reactive fighting is always a step behind a system that can lease in secret for fifteen months.

So Maryland did something different. It started prohibiting detention as a land use — before any facility was proposed.

Baltimore County moved first, and fast. In February 2026, ICE leased about 16,000 square feet in Hunt Valley — for an attorneys’ office, the Office of the Principal Legal Advisor, not a detention site. The lease disclosure alone was enough. The County Executive called an emergency session, and on February 17 the County Council passed an emergency zoning ban 6–0, prohibiting permits for “detention centers, jails, or other facilities used for involuntary confinement,” and giving itself authority to revoke certain permits issued since the first of the year. A legal office triggered a detention ban. That is how charged this ground has become.

Then Baltimore City did it by statute. On March 10, Council President Zeke Cohen introduced a bill making “private detention center” a prohibited land use citywide — sponsored by 12 of the 15 members, cleared committee without opposition. It’s the third layer of an unusually complete municipal stack: the city had already barred ICE from city buildings on a 14–0 vote, with a pension-divestment proposal running in parallel.

Zoning is the lever that matches the concealment, because it doesn’t require catching the apparatus in the act. It does not matter when a secret lease was signed if the use was prohibited before the ink dried. A ban already on the books neutralizes the fifteen-month head start.

There’s an honest limit, and it’s the load-bearing caveat: zoning can’t reach federal property. Baltimore’s bans exempt federal buildings; the city’s federally owned hold rooms remain a separate fight. The counter works on private operators and non-federal land — which is exactly why it has to fire before a federal foothold exists. Once ICE holds the land, the leverage drops. The zoning door only locks from the inside, and only before the house is federal.

Where Both Collide: Gilroy

Which brings us back to Holsclaw Road, because Gilroy is where the secret lease and the zoning door meet in a single fight.

The site is not zoned for detention. It was leased in secret, through a real-estate LLC, on land the local code does not permit detention to occupy. And on May 19, 2026, the Monterey County Board of Supervisors — the county next door — voted unanimously to oppose it, directing the county to send opposition letters, join any litigation by Santa Clara County or the California DOJ, and review its own zoning laws. Santa Clara County, where the site actually sits, had already signaled it would fight and threatened suit.

Read the geometry: a federal facility, hidden inside a private lease, built on unzoned land in one county — opposed by the county beside it before it opens. That is the concealment layer and the zoning counter colliding in real time. The buildout’s advantage is secrecy and time. The counter’s advantage is a rule that was already there. Gilroy is the test of which one wins on a parcel where the federal foothold is still wet.

Why the Counter Exists: The Deaths, and the Counties That Couldn’t

Two more threads from this month explain why communities have moved to the hardest, earliest form of resistance. Both are about what happens when you don’t get there in time.

The deaths. Two more detainees died this month at large Texas facilities that the tracker had never documented — counties that scored high for years with no facility file at all. At the GEO-run South Texas ICE Processing Center in Pearsall, Kai Yin Wong, a 63-year-old Chinese national, died October 25, 2025, after being transported for shortness of breath and airlifted to San Antonio in heart failure. At the ICE-owned Port Isabel center near Los Fresnos, Randall Gamboa Esquivel, a 52-year-old Costa Rican who entered the country in good health in December 2024, was moved from Laredo to Port Isabel and, by mid-2025, was described in his own records as catatonic, with roughly ten conditions including sepsis. These join the homicide rulings at Adams County, Mississippi and El Paso’s Camp East Montana from last month. Mortality remains the dominant narrative of the expansion — and it is what a zoning ban is ultimately trying to prevent from arriving.

The counties that kicked ICE out and couldn’t. Williamson County, Texas is the textbook case for why a ban has to be preemptive and structural rather than contractual. In 2018, county commissioners voted 4–1 to terminate the county’s agreement at the CoreCivic-run T. Don Hutto facility. ICE simply re-contracted directly with CoreCivic to keep it open — and the commissioners learned of it from reporters. Terminating an intergovernmental agreement does nothing if ICE can contract around the county. Hutto has since shifted from a family facility to a women’s facility to, now, adult men — the same footprint repurposed to whatever demand exists. A contract you can cancel is not a door you can lock. A zoning code is closer.

What Comes Next

The detention-pipeline tracker now documents 140 fights across all fifty states, 18,002 entries, 2,016 counties scored — and the heatmap, now that it counts detention contracts directly, puts Broward County, Florida at the top (a heat score of 202) and the South Texas cluster climbing fast. The signal was always there; the engine just started counting it correctly.

But the structural finding of this month is smaller and sharper than any single score. The detention buildout has learned to hide inside real estate — first behind banks, now behind a twenty-year lease held by a firm whose business is hiding it. And the communities paying attention have learned the only counter that matches that secrecy: a rule written before the lease is signed. Gilroy is where we find out whether the rule or the lease wins.

Watch the three things that will tell you. Watch whether Santa Clara or California sues over the Gilroy zoning, and whether a lease beats a zoning code on unzoned land. Watch whether the Baltimore playbook spreads — whether more jurisdictions prohibit detention as a use before a facility is ever proposed. And watch Pflugerville, Texas, where the same LLC is reportedly running the same maneuver, to see whether the second time is as quiet as the first.

If you live in one of these places — especially near Gilroy, or in the South Texas counties where people are dying in facilities nobody had documented — and you know what is happening on the ground, the tracker wants to hear from you. Most of what is on that site started as someone in a county knowing something that needed to be written down before the fencing went up.

Sources

Primary Timeline Events:

• GSA secret lease for Gilroy ICE site — ECG 6 / Elmwood Capital (Jan 8, 2025; found Apr 2026)

• Monterey County opposes the Gilroy facility (May 19, 2026)

• DHS purchases Rockefeller Group warehouse, Surprise AZ (Jan 23, 2026)

• DHS purchases Fundrise warehouse, Williamsport MD (Jan 27, 2026)

Capture Cascade Context:

• Curated timeline — Detention-Industrial Complex

• Pattern — Detention real estate

Reporting:

• “Federal detention center planned in South County” (San José Spotlight, May 2026) — https://sanjosespotlight.com/federal-detention-center-planned-in-south-county/

• “Santa Clara County Leaders Say They’ll Fight Planned ICE Facility in Gilroy” (KQED, May 2026) — https://www.kqed.org/news/12083600/santa-clara-county-leaders-say-theyll-fight-planned-ice-facility-in-gilroy

• “Too close for comfort: Monterey County joins push to halt suspected ICE center near Gilroy” (Local News Matters, May 21, 2026)

• “DHS, ICE Expanding in Commercial Real Estate at Full Tilt” (Commercial Observer, Feb 2026) — https://commercialobserver.com/2026/02/dhs-ice-office-industrial-expansion-trump/

• “Baltimore County Council approves ban on private detention centers” (Baltimore Sun, Feb 17, 2026)

• “Bill to ban private detention centers introduced in Baltimore City Council” (CBS News Baltimore, Mar 10, 2026)

Data:

• The Detention Pipeline tracker — detention-pipeline.transparencycascade.org (140 fights; 2,016 counties scored)

Mark Ramm, May 27, 2026. The full detention-pipeline data and per-county fight files are at detention-pipeline.transparencycascade.org.

That same day, in Athens, Georgia, the Vice President of the United States stood at a Turning Point USA event and warned that pope to “be careful” when he talks about “matters of theology” — citing, against him, “the more than 1,000-year tradition of just war theory.”

JD Vance’s Catholic confirmation name is Augustine. He chose it himself, six years ago, when he converted — citing a chapter of Augustine’s City of God he found relevant to his policy thinking.

So here is the tableau, the two halves of a single day: a convert Vice President invokes Augustine to correct the Pope on the morality of a war, while the Pope — the first Augustinian to hold the office — celebrates Mass on the floor of Augustine’s own church. Neither man planned the symmetry. That is what makes it worth reading. It is the second time in fourteen months that the same thing has happened — Vance reaching for the Catholic tradition’s own vocabulary to sanctify the hardest thing his administration was doing, and the papacy answering him with that same vocabulary turned the other way.

Hold onto the detail that he is a convert, because it is the whole argument. Vance does not attack the Church from outside it. He fights from within, with the tradition’s own weapons — ordo amoris, just-war theory, Augustine himself. And that is precisely why he keeps losing: a captured tradition cannot win an argument inside the tradition’s own authority, because it has no language of its own. It borrowed the language. And the lender keeps showing up.

One frame governs everything below, so let me set it once. This piece reads documented events through an interpretive lens, and the line between the two has to stay visible. What is documented: what Vance said, what the popes said in reply, the dates, the USCCB’s correction. What is mine: the claim that these episodes form a single pattern, that the popes were “answering” Vance, that any of it was coordinated. Where a specific reading is contestable — and several are — I will say so at the moment it matters. The strength of the pattern is that it survives the disclaimers.

February 2025: The First Front — Ordo Amoris

It started with immigration.

In late January 2025, on Fox News with Sean Hannity, Vance reached for theology to defend the administration’s program of mass deportation. “There’s this old school — very Christian — concept,” he said, “that you love your family, then you love your neighbor, then you love your community, then you love your fellow citizens in your own country, and then after that, you can focus and prioritize the rest of the world.”

He later named the concept: the ordo amoris. The order of love. Rightly-ordered love. It is a real category in the tradition — and it is, specifically, Augustine’s, from the City of God, where Augustine offers it as a definition of virtue itself.

It was an unusually fluent move for a sitting Vice President: not just defending a policy, but reaching past the policy into the deep grammar of Catholic moral theology to claim the policy was the ordered thing, the virtuous thing, the thing rightly-ordered love required.

On February 10, 2025, Pope Francis answered. In a letter to the United States bishops expressing concern over the deportation program, Francis took up the exact concept Vance had deployed and turned it inside out: “Christian love,” he wrote, “is not a concentric expansion of interests that little by little extend to other persons and groups.” The true ordo amoris, he said, “is that which we discover by meditating constantly on the parable of the ‘Good Samaritan’” — “the love that builds a fraternity open to all, without exception.”

Read that against Vance’s “and then after that, you can focus and prioritize the rest of the world.” One man says love radiates outward in widening, prioritized rings, with the stranger last. The other says the whole point of the parable Jesus told is that the stranger — the Samaritan, the foreigner, the wrong kind of person — is exactly where the obligation begins.

A necessary caveat, per the frame above: Francis did not name Vance. He answered a use of ordo amoris, not a person — though the timing, and how the entire Catholic press read it, leave little doubt about the target. And on its face this is an ordinary thing for a pope to do; popes have always taught on the treatment of the stranger. Taken alone, it is not exotic.

What makes it the opening of a pattern is what happened the very next day — and what the man at the center of it did again, a year later, with a different doctrine and a different pope.

February 11, 2025: The Second Front Opens — One Day Later

The day after Francis’s letter, Vance was in Paris.

At the Artificial Intelligence Action Summit, in his first major policy address abroad, he delivered the administration’s signature statement on AI. Its defining line: “I’m not here this morning to talk about AI safety, which was the title of the conference a couple of years ago. I’m here to talk about AI opportunity.”

He warned that “excessive regulation could kill” the industry, and laid out four priorities — American AI “dominance,” freedom from regulation, freedom from “ideological bias,” a “pro-worker growth path.” It was a full-throated rejection of the precautionary, safety-first posture, recast as hand-wringing that would let foreign competitors win.

At the time, this looked like a separate story. Immigration was the theology fight; AI was the tech-policy speech. They were a day apart and they did not obviously touch.

Hold that thought. The day-apart adjacency is a documented coincidence, not a plan — Vance did not link the two, and I am not claiming he did. But keep the Paris speech in view, because fifteen months later a pope would answer it almost line for line, and the two fronts — immigration and AI — would turn out to be the same war fought on two fields.

Round Two — Just War

The pattern proved it was a pattern fourteen months later, with a different doctrine, a different war, and a different pope.

By the spring of 2026, the war was no longer a metaphor. The administration’s military operations against Iran were underway, and Pope Leo XIV — Francis’s successor, elected May 8, 2025 — had been escalating against them. He had called the threat to “annihilate Iranian civilization” “truly unacceptable.” On April 10, speaking to Chaldean Catholic bishops in Rome, he went further: “God does not bless any conflict,” he said; whoever is a disciple of Christ “never stands on the side of those who yesterday wielded the sword and today drop bombs.”

Trump answered on Truth Social, calling the pope “weak on crime” and “terrible for foreign policy.” That was the political response. The theological response came four days later, from the Vice President.

At a Turning Point USA event at the University of Georgia on April 14, Vance told the Pope to “be careful” — “it’s very, very important for the pope to be careful when he talks about matters of theology” — and invoked “the more than 1,000-year tradition of just war theory” to argue the Pope had it wrong. Border czar Tom Homan added that the Church should “stay out of politics.”

The just-war tradition Vance reached for is, again, Augustine’s — Augustine first articulated the conditions under which a Christian could licitly take up the sword. And again the magisterium answered in its own vocabulary. The next day, Auxiliary Bishop James Massa of Brooklyn, chairman of the U.S. Conference of Catholic Bishops’ Committee on Doctrine, issued a corrective: when “Pope Leo XIV speaks as supreme pastor of the universal Church, he is not merely offering opinions on theology, he is preaching the Gospel.” And the thousand-year just-war tradition Vance invoked, Massa noted, actually requires that a nation take up the sword only “in self-defense, once all peace efforts have failed” — which is to say, the tradition Vance cited cut against him.

And as Vance spoke in Georgia, Leo was in Annaba, saying Mass in Augustine’s own basilica.

This is the move, twice now — and the second time reveals what the first only suggested. Immigration and a war; ordo amoris and just-war theory; Francis and Leo. Two issues, two doctrines, two popes — and the same structure underneath each: Vance reaches for a Catholic concept to make a hard policy feel ordered, just, righteous, and the holder of that concept’s authority answers in the concept’s own terms. Because the dispute is intra-Catholic — a fight over who gets to say what the tradition means — the captured side faces a problem it cannot solve: it speaks the tradition’s language because it has no other, so when the tradition’s own authority answers in the same language, there is no separate ground to retreat to. Vance cannot say “that’s your theology, this is mine.” Ordo amoris and just war and Augustine were never his. He borrowed them. The lender keeps answering.

May 2026: The Encyclical Answers Paris

Which brings us back to the speech in Paris.

On May 25, 2026, Pope Leo XIV released his first encyclical, Magnifica Humanitas — 42,300 words “on safeguarding the human person in the time of artificial intelligence.” It calls for AI to be “disarmed” from “logics of domination, exclusion and death.” And read against the four pillars Vance had announced in Paris fifteen months earlier, it is almost a point-by-point rebuttal.

Vance had said he was not there to talk about safety; he was there to talk about opportunity. The encyclical’s organizing concern is the opposite: the protection of the human person, and the duty to slow down. Where Vance warned that “excessive regulation could kill” the industry, Magnifica Humanitas (§5) holds that “it is necessary to establish adequate regulatory tools capable of upholding justice and curbing the distorting effects of technological power.” Regulation, in Leo’s grammar, is not the threat to be cleared away. It is the duty.

Where Vance promised AI kept “free from ideological bias,” the encyclical worries about a different distortion entirely — algorithms that, as Leo writes, when “new forms of property” like “algorithms, digital platforms” stay concentrated in a few hands (§67), “widen the gap between the included and the excluded.” Where Vance promised a “pro-worker growth path,” Leo reaches back to Rerum Novarum, Leo XIII’s 1891 encyclical on the exploitation of workers in the Industrial Revolution, and casts AI as a comparable threat to the dignity of labor — the worker as the one to be protected from unrestrained technology, not the beneficiary of its deregulation. And where Vance celebrated American AI “dominance,” Leo names the danger by its structure: “the main drivers of development are private, often transnational, parties” (§5) now steering technological power beyond the reach of states; platforms that “define conditions for access, rules of visibility, forms of interaction, and even economic opportunities” (§71).

The encyclical names no Vice President. It names no company. It is a general document of Catholic social teaching on a new technology. The claim that it “answers” Vance is my framing, not Leo’s — the speech and the encyclical are fifteen months apart, and the encyclical addresses the world, not a man. But the content opposition is not framing. It is on the page, on both pages, in black and white: opportunity versus safety; deregulation versus “adequate regulatory tools”; dominance versus “the distorting effects of technological power.”

The Tell: Anthropic Stands With the Pope

There is one more detail from May 25 that turns this from a two-body problem into a three-body one.

When Leo presented Magnifica Humanitas at the Vatican Synod Hall, he did not present it alone. Beside him stood Chris Olah, a co-founder of Anthropic — one of the frontier AI labs — calling, with the Pope, for a partnership between the Church and the tech industry to build safeguards on AI. “We need informed critics who will tell the labs when we are failing,” Olah said. “We need moral voices that the incentives cannot bend.” The Washington Post headlined the moment plainly: “Anthropic aligns with Vatican over White House.”

This is not Anthropic’s first break with the administration over exactly this question. The company had already refused a Pentagon ultimatum over its safety red-lines; the administration had retaliated by designating it a “supply-chain risk”; Anthropic had sued the Department of Defense. The Vatican alignment extends that fight from the procurement world into the religious one.

And it matters here for a specific reason — one you can only see by looking at the theology underneath the tech-right, the part it would prefer to keep coded.

What the Pattern Reveals: The Captured Tradition

It is not subtle, once you have heard it. In a four-part private lecture series in late 2025 — recorded, and reviewed by UC Berkeley digital-forensics expert Hany Farid, who judged the audio probably authentic — Peter Thiel, Vance’s mentor and early funder, inverted the Christian story. The Antichrist, in Thiel’s telling, is not the technologist. The Antichrist is the luddite — the one who scares the world into surrendering control of science and technology in the name of safety. The figures he names as that lawless, restraining force are the people who would constrain the technological project: climate activist Greta Thunberg, AI-safety researcher Eliezer Yudkowsky. And the category — the safety-invoking restrainer as the lawless one — is precisely where a pope who teaches AI ethics lands. (I take that christology apart on its own terms in a companion piece tomorrow; here, the frame is enough.)

Now hold it up against the stage at the Vatican on May 25. Thiel’s theology has two archetypal luddites: the AI-safety advocate, and the pope who teaches AI ethics. On that one stage, on that one day, both of them stood together — an AI-safety lab and the Pope, allied in public, calling for exactly the moral limits Thiel’s theology is built to discredit. The legitimation layer’s two designated villains, shoulder to shoulder. It is the precise photographic negative of the story the tech-right needs to be true.

And it tells you what the Vance-versus-Pope arc actually is. It is not a culture-war sideshow. It is the place where that legitimation layer — the theological cover that makes the deportations and the AI buildout and the war feel righteous to the people running them — collides with the actual authority whose language it borrowed.

A note on what this is not, because the discipline matters. This is not evidence of a plot to fuse church and state. Thiel, on the same tapes, warns explicitly against that fusion — he is on record saying Vance is “too close to the Pope,” and naming caesaropapism, the merger of religious and political authority, as exactly the danger his framework opposes. The tech-right is not marching toward a confessional state. The honest finding is sharper and stranger than a theocracy plot: the legitimation layer is a borrowed grammar, drawn on selectively for the sanctification it provides — and this arc is precisely where the borrowing fails, where the lender calls in the loan. You can hear the failure inside the movement’s own house. First Things — the flagship magazine of the postliberal-Catholic project that Vance’s whole framework runs through — published, in the days after the just-war confrontation, an essay titled “Trump, Leo, and the Death of Integralism.” The integralists themselves understood what had been exposed: a movement that invokes Catholic authority to govern liberalism, but refuses Catholic authority the moment the Pope actually exercises it.

What Comes Next

The arc is not finished. Leo is still young for a modern pope, and he has made AI and war the signature concerns of a pontificate that is barely a year in. Vance is the frontrunner to inherit the movement. The two fronts — who belongs, and who may be killed — are not going away; if anything the encyclical raised the stakes by making the AI fight magisterial.

So watch for the next round. Watch whether Vance answers the encyclical, and in what vocabulary. Watch whether more of the Church’s institutional weight — the USCCB has now corrected him once, on the record — accumulates into something that looks less like individual rebukes and more like the slow formation of a confessing position. And watch the tell: watch which way the safety-minded parts of the tech industry break, now that one of them has stood at the Pope’s side against the White House.

But the deepest thing the arc has already shown does not depend on what happens next. It is this. A man can capture an institution’s vocabulary. He can learn its words, take its saint’s name, deploy its deepest concepts with real fluency in the service of power. What he cannot do is capture the institution’s authority to say what those words mean. That stays with the office. And so the captured tradition keeps walking into the same trap: it reaches for Augustine to bless the thing being done, and Augustine — by way of the Good Samaritan, by way of just war’s actual conditions, by way of a pope saying Mass in his basilica — keeps answering back.

You can borrow the words. You cannot borrow the right to define them. That is the one thing capture cannot reach.

Sources

Primary Timeline Events:

• Pope Francis rebukes Vance on ordo amoris (Feb 10, 2025)

• Vance at the Paris AI Action Summit (Feb 11, 2025)

• Vance rebukes Pope Leo XIV on just war; USCCB corrects (Apr 14, 2026)

• Pope Leo XIV’s encyclical Magnifica Humanitas (May 25, 2026)

• Anthropic co-founder Olah presents the encyclical at the Vatican (May 25, 2026)

Capture Cascade Context:

• Actor — Peter Thiel

Reporting:

• “Vance warns the pope should ‘be careful’ when talking about theology” (NBC News, Apr 15, 2026) — https://www.nbcnews.com/politics/trump-administration/vance-warns-pope-careful-talking-theology-rcna331881

• “US bishops’ doctrine chair defends church’s just war tradition after JD Vance comments” (America Magazine, Apr 15, 2026)

• “Pope Francis takes aim at Vance’s definition of ‘ordo amoris’” (Religion News Service, Feb 11, 2025)

• “In his first encyclical, Pope Leo XIV says AI must serve humanity, not the powerful few” (Religion News Service, May 25, 2026)

• “Anthropic aligns with Vatican over White House as Pope Leo addresses AI fears” (The Washington Post, May 25, 2026)

• “Remarks by the Vice President at the AI Action Summit in Paris” (White House transcript / American Presidency Project, Feb 11, 2025)

Primary Document:

• Leo XIV, Magnifica Humanitas (encyclical, signed May 15, 2026; §§5, 7, 67, 71) — vatican.va

Companion piece: “The Antichrist as Luddite” — on the christology Peter Thiel articulated on tape, and why it has to stay coded.

On a Sunday morning in July 2025, a small room two blocks east of the U.S. Capitol filled up past its capacity. The room belonged to the Conservative Partnership Institute. The building was one of nine properties CPI affiliates had quietly bought up on a single Pennsylvania Avenue block for forty-one million dollars between 2022 and early 2023. The annual report called the campus “Patriot’s Row.” Russell Vought’s Center for Renewing America — the operation that wrote Chapter 2 of Mandate for Leadership — operated out of the same building as a CPI partner. Stephen Miller’s America First Legal operated out of the same building. The House Freedom Caucus held weekly meetings around the corner.

On that Sunday morning, the room had been rented out to a church.

The church was Christ Kirk DC. It was the first Washington congregation of the Communion of Reformed Evangelical Churches — the denomination Doug Wilson had founded out of Moscow, Idaho. The room was small, not air-conditioned, lit by a skylight that let the July sun fall on a grey lectern. Above the lectern, an American flag the size of the wall it covered had been hung with its stars and stripes facing downward. The inverted flag is the standard military signal for dire distress. Christ Kirk DC was using it as denominational signage.

To one side of the flag, a yellow Gadsden flag: Don’t Tread on Me. To the other side, an Appeal to Heaven flag — the white-and-green pine-tree banner that flew at the January 6 attack on the Capitol, two blocks west of where the congregation was now sitting. Framed newspaper clippings praising Ronald Reagan hung on the walls beside a Republican National Convention plaque.

Roughly 120 people filled the room — Religion News Service counted 120, Christianity Today counted nearly 200. Standing room only. Men in suits. Almost all the women in dresses and stilettos. The body heat was rising in a space that had not been designed to hold a congregation.

A few minutes before the service began, the Secretary of Defense walked in. Pete Hegseth was in a suit. His wife Jennifer was with him. His children were with him. Secret Service agents flanked the pews. He took a seat a few rows back, in the middle. Children already seated whispered excitedly as he passed.

Nick Solheim was also in the room — the head of American Moment, the Vance-linked conservative-staffer pipeline that had hosted Wilson at the Dirksen Senate Office Building in September 2023, that had co-organized NatCon 4 in Washington a year before, that had been placing Wilson-network alumni into State Department political-appointee slots since the second Trump term began. Solheim was not advertised. He was simply present.

Outside on the sidewalk, two protesters. One held a sign that read Christ Church Is not Welcome.

The preaching pastor that morning was Jared Longshore, an associate pastor at Christ Kirk Moscow and pastor of Pilgrim Hill Reformed Fellowship in suburban Nashville — the same church the Defense Secretary attends in Tennessee. Longshore is auburn-bearded, bespectacled, professorial. He wore a blue suit and a striped tie. He leaned over the lectern. His delivery, Christianity Today would later call “subdued, heady” — the Reformed-Presbyterian tradition’s preference for argument over emotion.

“We understand that worship is warfare,” he said.

He paused.

“We mean that.”

A few minutes later he would say: “Politics is downstream from culture, and culture is downstream from worship.”

The room itself was upstream of the policy chapters being written down the hall. That is the load-bearing claim of the entire operation, and Longshore was making it from the lectern. The doctrine names what the room is for. The architecture confirms what the doctrine names.

The sermon ended with a binary. Christ or Chaos.

Two months earlier, on May 12, 2025, Doug Wilson had announced this church plant on his blog under the title “A Mission to Babylon.” The metaphor was deliberate. Babylon is the captive empire of Daniel and Nehemiah — the empire where the faithful are exiles called to reform civil institutions from within. Not the empire of Revelation. Not the empire to be fled or destroyed. The metaphor declared the project a re-occupation, not a withdrawal.

“With the change in administration,” Wilson wrote, “we believe that there will be many strategic opportunities with numerous evangelicals who will be present both in and around the Trump administration.”

Eight months later, in March 2026, Wilson would post a follow-up. Attendance was robust. The core group was strong. The congregation had begun raising money to buy a permanent building near Capitol Hill. “Nothing would say ‘permanent presence,’” Wilson wrote, “like such a purchase would.”

II. The Old Question, Asked Differently

In Jesus Wept, I wrote about Howard Thurman’s grandmother. Nancy Ambrose, born into slavery, told her grandson about the two services she heard every Sunday on the plantation where she was held. In the morning, the master’s minister preached obedience from Paul’s epistles. In the afternoon, after the white preacher had gone, an enslaved preacher told her: You are not slaves. You are God’s children.

Frederick Douglass made the same distinction in 1845. He called it “the Christianity of this land” against “the Christianity of Christ.” Two Christianities, he said. Same Bible, opposite ethical implications.

That frame still works. It is the load-bearing frame for resistance to white Christian nationalism. The white preacher’s Christianity, and the resistance tradition that runs through Douglass and Thurman and Bonhoeffer and King and the Black churches where King composed his Birmingham letter.

But the moment we are in is not a simple repeat of two-Christianities. It is three masteries against one resistance. And the three masteries don’t agree with each other.

The Reformed wing — Wilson, Hegseth, Christ Kirk DC, Joe Rigney, American Reformer, the CREC — is postmillennial reconstructionist: Christ already reigns; history is the long subduing of his enemies; the United States is a fallen Christian nation in need of return rather than conversion. The Catholic-integralist wing — Sohrab Ahmari at Compact, Patrick Deneen, Adrian Vermeule, the Cluny Institute — holds that liberalism is itself a heresy and that the state’s proper role is to direct citizens to their last end, which is union with God. The Pentecostal-NAR wing — Lance Wallnau, Paula White, AFPI faith outreach, the Seven Mountains framework, the prophetic-apostolic networks — holds that Christians are called to take dominion over the seven spheres of cultural influence and that the present is a kairos moment of apostolic mandate.

These three wings have called each other heretics for five hundred years. Wilson, in a March 2026 podcast interview with John Papola and a follow-up video posted to his Blog & Mablog on March 16, 2026, said that in his ideal Christian nation, Catholic Marian processions would be banned as “public displays of idolatry” — “a parade in honour of the Virgin Mary, carrying an image of the Virgin Mary down main street, no.” He clarified that the ban would not arrive for centuries; the doctrinal commitment is intact regardless of the timeline. The integralists deny the validity of Pentecostal prophetic gifts. The Pentecostal charismatics deny Catholic sacramentalism. Reformed cessationists deny that the Spirit gives any new revelation after Scripture; continuationists deny that the canon has closed. These are not minor differences. They are the boundary disputes that define intra-Christian polemics.

And yet on that Sunday in July, the Reformed preacher was preaching the Reformed-postliberal sermon in the building rented from Vought’s Center for Renewing America operation, with Pete Hegseth in the pews, while the Catholic Vice President was the operator who had cast the tiebreaking vote on January 24, 2025 to put Hegseth at Defense.

When Jared Longshore said worship is warfare, he was not being metaphorical. The doctrine is specific. In the Reformed-reconstructionist line that runs from R. J. Rushdoony through Doug Wilson, worship is the active subjugation of God’s enemies through the proper ordering of the soul, the household, and the polity in obedience to biblical law.

Discipline, including the willingness to inflict pain on behalf of righteous authority, is not a regrettable necessity. It is an instrument of sanctification. Joe Rigney, who co-founded Christ Kirk DC and now sits as president of New Saint Andrews College in Moscow, has argued in print that empathy is itself a sin — that compassion for the wrong people corrupts moral judgment and must be governed by hierarchy. This is the theological substrate that made Pete Hegseth confirmable. The Defense Secretary’s published writings on warrior ethos, the Pentagon prayer service his pastor Brooks Potteiger led, the directives now flowing through the Department of War about masculinity standards and recruit treatment — these are not Hegseth’s personal idiosyncrasies. They are CREC doctrine, exported.

How does that sit in the same room with a Catholic Vice President?

That is the question.

III. The Three Operators

The answer the documentary record forces is that the coalition is held together not by theological agreement but by operators — specific people whose job is to make the lanes work together without making them reconcile.

There are three operators.

Charlie Kirk, who would be assassinated at Utah Valley University on September 10, 2025, built the cross-track recruitment vehicle.

Kirk’s Turning Point USA (TPUSA) Faith division did not pick a theological lane. It picked all of them. In September 2023, Kirk featured Lance Wallnau at the TPUSA Faith Pastors Summit in San Diego — locking in the Pentecostal-NAR connection a year before the formal Courage Tour partnership. In January 2024, Kirk announced the Courage Tour merger with Wallnau, AFPI co-sponsored with seven swing states, 2,500 churches. In July 2024 he hosted Doug Wilson at the Believers Summit in West Palm Beach with 3,300 attendees. RNS quoted Kirk calling Wilson a “thoughtful, brilliant thinker,” urging pastors to share the podcast interview. Reformed and NAR figures on the same stage; the same operator booking both.

The Catholic-adjacent track was the one Kirk did not finally close before he was killed. A little more than a week before the Utah Valley shooting, at a pro-life prayer breakfast in Visalia, California, Kirk spoke privately with Bishop Joseph Brennan of Fresno. As the two were parting, Kirk — acknowledging the public speculation about his possible conversion — said simply, “I’m this close.” Bishop Brennan’s brother, Robert Brennan, recounted the exchange in Angelus News on September 18, 2025; the account was picked up across the Catholic press.

The claim is second-hand by definition: Kirk is dead; the bishop is the witness, his brother the publisher. But the Catholic move was always going to be personal and devotional rather than institutional, regardless of where exactly Kirk landed in that final week. It was running through his marriage to a devout Catholic woman (Notre Dame Prep, ASU, currently pursuing a doctorate in Biblical Studies at Liberty University) and through his friendship with the Catholic Vice President of the United States, a friendship that had begun in 2017 after a Tucker Carlson appearance and a follow-up Twitter DM.

Kirk did not need to agree with all three traditions. He needed all three traditions to want to be on his stage.

He was thirty-one.

His wife Erika Kirk is the operator who inherited the recruitment vehicle.

She took the CEO/Chair role at Turning Point USA on September 18, 2025. She is now running the NAR-coded TPUSA Faith infrastructure her husband built. The August 2025 Faith Forward Pastors Summit speaker list — Wallnau, Samuel Rodriguez, Jentezen Franklin, John Bevere — locked the TPUSA Faith infrastructure as authentically NAR-adjacent. Erika is administering that infrastructure. She is a Catholic operating a Pentecostal-charismatic platform whose primary political ally is her late husband’s Catholic friend.

That is the substrate-deniability pattern at the personal-relationship register. The personal is not the institutional. A Catholic woman can administer a Pentecostal-charismatic infrastructure without changing its character — and that is precisely the point. The fact that Erika is Catholic does not change the NAR character of TPUSA Faith. The fact that TPUSA Faith is NAR-coded does not change that Erika is the woman running it. The fact that the Vice President is Catholic does not change that he just publicly described the post-assassination TPUSA succession moment as a “revival” — Pentecostal-charismatic native vocabulary that does not translate into Catholic or Reformed idiom.

The substrate-deniability is the architecture. Each register can deny that the coalition is principally any other register, while every register’s institutional infrastructure remains intact under the management of someone confessionally adjacent to it.

JD Vance is the doctrinal-articulation operator.

Before he was Vice President, Vance courted each of the three lanes in their own venues, in their own languages, with their own theological vocabularies.

In November 2021, at NatCon 2 in Orlando, Vance gave the keynote — “The Universities Are the Enemy” — and, attacking critical race theory in schools, said: “Telling a little girl that she’s evil because of her skin color is disgusting and vile, and as a Christian I’d say Satanic.” That word — Satanic — is Reformed-evangelical vocabulary deployed on a NatCon platform Wilson also used. Three years before the VP nomination. It was the earliest documented theological-vocabulary deployment on that platform.

In March 2022, Vance went on the Eric Metaxas Show — Trinity Broadcast Network (TBN) distributed, the flagship Pentecostal-charismatic broadcast network — and engaged without distancing Metaxas’s framing of the political contest as a fight against attempts to ban God from the public square.

In October 2022, Vance was the closing keynote at Sohrab Ahmari’s “Restoring a Nation” conference at Franciscan University of Steubenville. He told the assembled postliberal Catholic intellectual leadership: “I’ve admired a lot of you from afar.” Ahmari, Patrick Deneen, Adrian Vermeule, R.R. Reno, Scott Hahn — every one of them in the room.

In May 2023, Vance sat on the “Regime Change” panel at the Catholic University of America with Deneen and Heritage’s Kevin Roberts. He described his political goals as “explicitly anti-elitist, explicitly anti-regime,” adopting Deneen’s vocabulary verbatim, with Deneen and Roberts on the panel beside him.

This is the documented pre-VP record: Reformed-evangelical vocabulary in November 2021. Pentecostal-adjacent venue in March 2022. Catholic-integralist conference in October 2022. Catholic-integralist intellectual seminar in May 2023. He courted each track in its own venue with its own language three years before the nomination.

The synthesis came after.

On September 21, 2025, at the memorial service for Charlie Kirk in State Farm Stadium in Glendale, Arizona, Vance — the Catholic Vice President — publicly named the post-assassination TPUSA succession a revival. That word is not Catholic. It is not Reformed. It is Pentecostal-charismatic native vocabulary. Vance said it from the stage, in front of a stadium audience and a national television feed, in the same eulogy where he recited the Nicene Creed (Catholic liturgical text) and admitted he had “talked more about Jesus Christ in the past two weeks than in my entire time in public life.” Three theological registers in one eulogy. The friendship-tied Catholic Vice President naming the platform’s Pentecostal-charismatic genre while reciting Catholic liturgy.

On December 21, 2025, at AmericaFest in Phoenix — TPUSA’s annual gathering, the largest of its kind — Vance gave what Religion News Service described as the most explicit VP-era “Christian nation” declaration. In my reading, the speech layered three theological registers simultaneously. Catholic natural-law framing. Reformed persecution-narrative framing. Pentecostal-NAR revival-after-darkness framing — “a story of very dark nights followed by very bright dawns,” and the call for “slayers of dragons” and “men who are willing to die for a principle if that’s what God asks them to do.” Vance code-switched across all three vocabularies inside a single speech, on a single platform, to a single audience that contained members of all three traditions.

This is the operator-level function the coalition needs. Kirk built the venue. Erika administers the venue. Vance speaks in all three of the venue’s languages without requiring any of them to translate.

IV. The Architecture

If the three operators were the whole story, the coalition would be a personnel arrangement rather than an architecture. But the operators are themselves only one scale of the pattern.

The pattern recurs at the funding scale.

The conventional assumption about MAGA Christian nationalism — the assumption I had until the documentary work forced it open — is that some single funder or funder-network is the principal of the operation. The most common candidate-name is Peter Thiel, given his $15 million underwrite of Vance’s 2022 Senate race, his role as the principal of Vance’s professional career, his decades of investment in surveillance and intelligence infrastructure adjacent to the operation. The narrative wants a principal.

The documentary record does not support that narrative. The Thiel-network connection runs to Vance personally and to the Catholic-integralist intellectual infrastructure (Imitatio funding for Girardian scholarship; Narya Capital’s Series B participation in the Hallow Catholic prayer app; speakers at the ACTS 17 Collective). It does not run to Charlie Kirk’s TPUSA. It does not run to the American Reformer publication that is the flagship of the Reformed-postliberal lane. No published reporting documents Thiel-network capital flow into Kirk’s TPUSA, the CREC publishing infrastructure, or the Pentecostal-NAR institutional substrate — not through Thiel Foundation 990-PF filings, not through Rockbridge Network 501(c)(4) distributions, not through Founders Fund’s documented giving. The flagship Reformed publication, American Reformer, is funded by the Bradley Impact Fund — publicly disclosed in an October 2024 Grant Recipient Spotlight on the fund’s own site. Bradley network, not Thiel network. TPUSA’s publicly reported revenue base — approaching nine figures — runs through Uihlein, Marcus, Bradley Impact Fund, Donors Trust, the late Foster Friess’s family, and Robert Shillman before he canceled. No Thiel-network donor has surfaced among them in public reporting. AFPI’s anonymous-donor stack has no leak naming Thiel.

The coalition runs on at least two, probably three, structurally distinct donor stacks operating in parallel. Thiel-network underwrites the Catholic-integralist lane and the Vance operator personally. Bradley/Scaife/Olin/Federalist Society money underwrites the Reformed-postliberal publishing and judicial infrastructure. Green/Uihlein/Marcus/Friess-family money underwrites TPUSA and the Pentecostal-NAR mobilization layer. The lanes coordinate at the operator level, not at the funder level.

The architecture is fractal. The substrate-deniability pattern Doug Wilson set up at the lecture-hosting scale (Cluny Institute / Vincenzo Gioberti Cultural Association / ACTS 17 Collective — three substrate-specific 501(c)(3) vehicles each preserving deniability for the others) is the same architecture Vance operates at the denominational scale (Catholic-integralist personally / Reformed-postliberal adjacent / Pentecostal-NAR ratifying) and the same architecture the funder network operates at the capital scale (Thiel / Bradley / Green-Uihlein-Marcus — three substrate-specific donor stacks each preserving deniability for the others). Three scales. Same pattern.

This is the structural answer to the question of how a coalition whose constituent theologies have anathematized each other for five centuries holds together politically. The coalition does not require theological reconciliation. It requires multi-stack deniability. Each lane can sincerely deny that the coalition is principally about any other lane’s theology. Each funder can sincerely deny that they are underwriting any other lane’s project. Each operator can sincerely deny that they personally subscribe to any other operator’s confessional position.

The multi-everything structure is the deniability mechanism. If a single funder underwrote the whole thing, the structure would collapse to single-funder dependence. If a single operator articulated the whole thing, the structure would collapse to single-operator vulnerability. If a single theology defined the whole thing, the structure would collapse to single-tradition exposure. The coalition is durable in direct proportion to its non-coordination.

V. Operations Made Visible

The funding architecture is how the coalition is built. The cover-up architecture is how it operates. Same pattern, different scale.

I have written elsewhere about the killings of Renée Nicole Good and Alex Pretti in Minneapolis in January 2026. Renée Good, thirty-seven, a poet and mother of three, whose last words on the agent’s personal cellphone video — That’s fine, dude. I’m not mad at you — were captured by accident and released by Alpha News on January 9–10. Alex Pretti, thirty-seven, a VA ICU nurse who stepped between an agent and a woman who’d been pushed to the ground, then was tackled, pepper-sprayed, and shot ten times in five seconds.

What I have not written — what the published archive has not yet named as architecture — is the cover-up structure that operated around those killings.

The Minnesota Bureau of Criminal Apprehension (BCA) agreed to a joint investigation of the Renée Good shooting on the morning of January 8. By that afternoon, the U.S. Attorney’s Office had reversed the agreement. BCA Superintendent Drew Evans went on record: “The BCA has reluctantly withdrawn from the investigation.” When Alex Pretti was killed on January 24, the BCA was blocked from the scene the same day — with a judge-signed warrant. The FBI formally denied the BCA all evidence in the Pretti case approximately February 16.

The Justice Department announced a civil-rights investigation into the Pretti killing on January 30. CBS News reported a few days later that the DOJ had assigned Brandon Wrobleski — an employment litigation attorney with no federal criminal case experience — to lead the probe. Career civil-rights prosecutors who specialize in excessive-force cases were excluded.

The Department of Veterans Affairs — Pretti’s actual employer — conducted internal investigations of its own employees who attended vigils honoring Pretti after his death. CNN reported the agency showed at least one VA employee, a recreational therapist in Augusta, Georgia, circled photographs of herself at a vigil.

These are not separate phenomena. They are layers of one architecture.

The visible layer is rhetorical: Kristi Noem at the podium calling Good a “domestic terrorist” who had “weaponized her vehicle”; Stephen Miller calling Pretti a “domestic terrorist”; Gregory Bovino claiming Pretti came to “massacre law enforcement.” The rhetorical layer creates political permission. It pre-frames the victims as aggressors. It makes federal investigative monopoly look defensible to anyone who has accepted the framing.

The invisible layer is procedural: FBI exclusive-jurisdiction assertion. State-lockout. DOJ civil-rights investigation staffed to fail. VA employees investigated for attending vigils. The procedural layer prevents the factual record that would contradict the rhetorical layer. Layer 1 makes Layer 2 defensible. Layer 2 prevents the evidence that would undermine Layer 1. They are interdependent.

But the second layer is what we are usually not seeing.

The architecture is not new. The Critical Incident Teams operated as a southwest-border cover-up apparatus from 1987 to 2022 — thirty-five years with no statutory authority, citing only the housekeeping statute. Documents released by the Southern Border Communities Coalition in October 2021 showed that the CITs’ stated mission was the “mitigation of civil liability” for Border Patrol agents facing lawsuits. The teams investigated agent killings and high-liability incidents for thirty-five years without statutory authority — controlling scenes ahead of local law enforcement, managing evidence chains of custody, dispersing witnesses, intruding on autopsies, subpoenaing medical records.

The canonical case is Anastasio Hernández Rojas — beaten and tasered to death at the San Ysidro Port of Entry on May 28, 2010. CIT was on scene 15 hours before the San Diego Police Department was notified. Bystander cell-phone videos were deleted on scene. Government surveillance footage disappeared. The arrest report existed in two contradictory versions. The administrative subpoena for Hernández Rojas’s medical records was signed by an officer named Rodney Scott — then the Acting Deputy Chief Patrol Agent of the San Diego sector.

On April 28, 2025, the Inter-American Commission on Human Rights issued its merits decision in Family Members of Anastasio Hernández Rojas v. United States. It was the first extrajudicial killing case the IACHR had ever decided against the United States. The Commission found torture, excessive force, evidence destruction, biased and incomplete investigation, and denial of justice. The CBP investigation that the IACHR found “biased and incomplete” was the investigation Scott supervised.

On June 18, 2025 — seven weeks after the IACHR ruling — the United States Senate confirmed Rodney Scott as CBP Commissioner. The vote was 51 to 46. The senators voting yes had access to the IACHR ruling. They voted to confirm him anyway.

On February 12, 2026, Scott — now CBP Commissioner — testified at a Senate Homeland Security and Governmental Affairs Committee hearing and confirmed that the Office of Professional Responsibility was conducting “collection and preservation of evidence” in the Alex Pretti investigation.

The man who supervised the canonical CIT cover-up of an extrajudicial killing in 2010 — the cover-up an international human rights tribunal officially condemned in April 2025 — was confirmed seven weeks after that condemnation to run the federal agency conducting use-of-force accountability. He is now confirmed on the record to be conducting evidence collection in the Pretti case. The loop is closed at primary-source level.

The 2026 Minneapolis cases are not aberrations from the federal-officer accountability system. They are the system continuing in a new theater. What changed in 2026 is not the architecture but the conditions: urban media density, locally-elected prosecutors, a state-court officer-involved-shooting infrastructure that the southwest border did not have. The architecture has been retooled — FBI-jurisdiction monopoly instead of CIT scene-arrival — but its function is identical. Prevent the independent investigation. Block the factual record. Protect the agents.

And here is what makes the architecture’s existence the falsification of the framing:

If the federal authorities believed their own characterization of Renée Good and Alex Pretti as domestic terrorists, they would want independent investigation. Every additional investigative body that examined the evidence and reached the same conclusion would strengthen the framing. The IACHR for the border-killings, the BCA for the Minneapolis killings, the career civil-rights prosecutors at DOJ — independent confirmation would only help the official narrative. There would be no reason to lock them out.

The systematic prevention of independent investigation reveals what federal authorities actually know. They know that Renée Good was turning away from the agent when she was shot. They know that Alex Pretti’s handgun had already been removed from his holster before the agents fired ten rounds in five seconds. They know that Anastasio Hernández Rojas was handcuffed and face-down. They know that the framing does not hold against the evidence.

The cover-up architecture is the operational proof.

VI. The Resistance Tradition Is Still Unitary

When I wrote Jesus Wept, I named two Christianities. That was the right frame for that moment. It was Douglass’s frame, Thurman’s frame, the frame Martin Luther King carried into the Birmingham city jail.

It is also incomplete for the moment we are in now.

The masteries are plural. The captured theologies are plural. The donors are plural. The operators are plural. The coalition’s durability comes from its plurality. The lanes do not need to agree because they are organized around not-agreeing-while-coordinating.

The resistance tradition has always been unitary.

Not because there is only one resistance theology. There are many: Howard Thurman’s Jesus and the Disinherited, Bonhoeffer’s Discipleship, James Cone’s God of the Oppressed, Dorothee Sölle’s Suffering, Gustavo Gutiérrez’s A Theology of Liberation, the Black Catholic Sisters’ witness, the Doctrine of Discovery repudiations, the Episcopal House of Bishops’ January 31, 2026 letter naming Renée Good and Alex Pretti as victims of “state-sanctioned violence.” Many traditions. Many languages. Many denominational homes.

But all of them name the same Jesus. The Jesus who wept at Lazarus’s tomb. The Jesus who touched the leper. The Jesus who said what you do to the least, you do to me. The Jesus the Roman state crucified for sedition because his teaching about the Kingdom was a direct threat to imperial legitimation. That Jesus does not need cross-denominational reconciliation to be recognizable. He shows up the same way in every tradition that names him without first making him useful.

The lanes of the coalition cannot share that Jesus. They can share Wilson’s Jesus, who licenses worship-as-warfare and inverted flags. They can share Wallnau’s Jesus, who licenses Seven Mountains dominion. They can share Deneen’s Jesus, who licenses the common-good state. But they cannot share the Jesus who weeps with Renée Good. That Jesus is the falsification of all three of them, because that Jesus is the Jesus who refused to bless the architecture his rich young rulers came asking him to bless.

The resistance tradition’s witness is not primarily to the masters. The masters know what they are doing. They have known it for forty years on the southwest border. They knew it when they confirmed Rodney Scott seven weeks after the IACHR ruling. They know it when they exclude the career civil rights prosecutors. They know it when they investigate VA employees for attending vigils.

The witness is to the people inside the captured theologies who have not yet recognized that the theology is a justification of the capture rather than its source. The Reformed parishioner who has never heard her tradition described as the architecture of dominion. The Pentecostal who has been taught that the Seven Mountains framework is the gospel rather than a 21st-century novelty. The Catholic who has been taught that integralism is the historic tradition rather than a contested 20th-century revival. The evangelical who has been told that Christian nationalism is just love of country, that worship-as-warfare is just zeal.

That is who the witness is for. Not the operators. The people in the pews.

This is the a piece in The Second Sermon series. The first was Jesus Wept: Two Visions of Jesus Went to War in Minneapolis (February 13, 2026). The series follows the question Howard Thurman posed in 1949: what does the Jesus teach those with their backs against the wall?

Sources

Primary scene reporting (Christ Kirk DC inaugural, July 13, 2025):

• Aleja Hertzler-McCain, “With Pete Hegseth in the pews, a Christian nationalist church plant launches in DC,” Religion News Service, July 14, 2025.

• “At Doug Wilson’s DC Church Plant, ‘Worship Is Warfare,’” Christianity Today, July 15, 2025.

• “With Pete Hegseth in the Pews, a Christian Nationalist Church Plant Launches in DC,” Word & Way, July 15, 2025.

• “‘Christ or Chaos’: A Conservative Church With Political Ties Comes to Washington,” Washingtonian, July 16, 2025.

Doug Wilson, primary documents:

• “A Mission to Babylon,” Blog & Mablog, May 12, 2025.

• “Strategic Next Steps in DC,” Blog & Mablog, March 4, 2026.

CPI “Patriot’s Row” campus:

• “Steps from Capitol, Trump allies buy up properties to build MAGA campus,” Washington Post, March 15, 2023.

• “Top Trump-aligned conservative group buys up prime D.C. office space,” Axios, January 18, 2023.

Vance pre-VP per-track receipts:

• “JD Vance: Universities Are the Enemy,” NatCon 2 Orlando keynote, National Conservatism Conference, November 1, 2021.

• Vance on the Eric Metaxas Show (TBN-distributed), March 30, 2022.

• “Restoring a Nation” closing keynote, Franciscan University of Steubenville (Sohrab Ahmari, organizer), October 7, 2022.

• “Regime Change” panel with Patrick Deneen and Kevin Roberts, Catholic University of America, May 17, 2023.

Vance VP-era three-register speeches:

• Charlie Kirk Memorial, State Farm Stadium, September 21, 2025.

• AmericaFest “Christian nation” declaration, Phoenix, December 21, 2025 (covered by Religion News Service, NPR, ABC News).

Charlie Kirk cross-track receipts (pre-assassination):

• TPUSA Faith Pastors Summit San Diego with Lance Wallnau, September 13–15, 2023.

• Kirk-Wallnau Courage Tour partnership announcement, January 17, 2024.

• TPUSA Faith Believers Summit West Palm Beach with Doug Wilson, July 26–28, 2024.

Renee Good / Alex Pretti / cover-up architecture:

• “Renee Good’s Last Words: ‘I’m Not Mad at You‘,” The RAMM, January 16, 2026.

• “Jesus Wept: Two Visions of Jesus Went to War in Minneapolis,” The RAMM, February 13, 2026.

• “Border Patrol: A Criminal Organization Disguised as a Federal Agency,” The RAMM, February 17, 2026.

• Drew Evans (BCA Superintendent) on-the-record statement re: Renée Good investigation reversal, January 8, 2026.

Hernández Rojas / IACHR / Rodney Scott:

• Family Members of Anastasio Hernández Rojas v. United States, Case No. 14.042, Inter-American Commission on Human Rights merits decision, April 28, 2025.

• Senate confirmation of Rodney Scott as CBP Commissioner, June 18, 2025 (vote 51–46).

• GAO-24-106148, “CBP Successor Teams to the Critical Incident Teams Continue to Operate in the Same Manner,” May 13, 2024.

• Scott testimony, Senate Homeland Security and Governmental Affairs Committee, February 12, 2026.

The mandate’s most important feature isn’t what it requires now — it’s what it prevents tomorrow.

On February 4, 2026, the Hamilton County Commission and the Chattanooga City Council did something unusual at a joint public moment. They told their constituents, in plain language, that they could not help them.

More than a hundred residents had packed a January 28 commission meeting to protest Hamilton County’s 287(g) partnership with U.S. Immigration and Customs Enforcement. The 287(g) program — named for Section 287(g) of the Immigration and Nationality Act — deputizes local sheriffs to enforce federal immigration law on ICE’s behalf, turning county jails into a front door for federal detention and deportation. The Chattanooga Times Free Press had run an editorial nine days earlier titled “Servile Sheriff Garrett is doing ICE’s dirty work.” Sheriff Austin Garrett, per the Times Free Press editorial, had been transferring detainees to ICE at a 47% higher pace through the second half of 2025 than the first. By any reasonable measure of representative democracy, Hamilton County’s elected legislative bodies — the Commission and the City Council — had constituents demanding action.

Their answer, delivered jointly that day: we have no legal authority to end this.

Read that twice.

The two legislative bodies representing the elected will of Hamilton County and Chattanooga, Tennessee told the public that the 287(g) Memorandum of Agreement (MOA) Sheriff Garrett had signed in March 2025 was simply outside their reach. The MOA runs sheriff-to-DHS. The sheriff is independently elected. The legislative bodies have no formal seat at the table.

That fact alone — call it the statutory-powerlessness problem: independently-elected sheriffs signing 287(g) MOAs with no County Commission veto authority — would be enough for one investigation. But Tennessee was not going to leave it there.

On April 22 and April 23, 2026, the Tennessee House and Senate passed HB2219, a bill that mandates 287(g) participation by every Tennessee sheriff. Effective July 1, 2026. Implementation deadline January 1, 2027. State grant funding withheld for non-compliance. The bill was transmitted to Governor Bill Lee on May 7, 2026; as of this writing, it is awaiting his signature.

The bill does several things at once. It requires what Hamilton County is already doing. It punishes counties that don’t do it. And — quietly, almost as an architectural detail — it removes the last remaining lever that future Hamilton County voters might use to stop it. That lever — the one Hamilton County voters might pull by electing a different sheriff in November on a platform of exiting the 287(g) MOA — is exactly the lever HB2219 disables before voters can use it.

Sheriff Garrett told NewsChannel 9 that the new mandate would not change anything in Hamilton County, because the Hamilton County Sheriff’s Office (HCSO) was already, in his words, “leading the way” on this federal immigration partnership.

He was right about the present. But he was describing only half the picture.

Because what HB2219 does for Hamilton County tomorrow is the part of the story almost no one is reporting.

What HB2219 actually does

The text of HB2219 is straightforward in its operative effect, even if the legal mechanics behind it require some unpacking.

The bill requires “the sheriff of each county to enter into an agreement under an available federal 287(g) program” by January 1, 2027. Sheriffs may select among the available program tiers — the Jail Enforcement Model, the Warrant Service Officer model, or the Task Force Model. Participating sheriffs are required to hold inmates up to 48 hours past their scheduled release at federal request — the window ICE uses to take custody before the person would otherwise walk out of the jail. Counties that refuse face, per the bill, “the state withholding all funds of the state allotted to the sheriff’s office or to the local government for use by the sheriff’s office via grant, contract, or statute, including state-shared taxes.” Section 1 of the bill carries a sunset: it “terminates on February 1, 2029, and the law in effect prior to this act’s effective date must be restored.” The mandate, in other words, runs for roughly two years and one month between the January 1, 2027 implementation deadline and the February 1, 2029 sunset — at which point the General Assembly must vote to renew it or let it lapse.

Stripped down: the law forces every Tennessee sheriff to hand people over to ICE for federal detention and possible deportation, and bars any future sheriff or voter from stopping it through February 2029.

That is the surface mandate. Tennessee, in effect, is converting 287(g) from a federally-administered voluntary cooperation program into a state-administered floor.

Tennessee is not the first state to try this. But the more interesting comparison is to states that tried and failed. Kentucky’s HB47 and SB86 would have done substantially what HB2219 does — mandate 287(g) participation across Kentucky State Police posts (HB47) and across both state police and all local law enforcement (SB86). The bills were introduced in the same 26RS legislative cycle as Tennessee’s HB2219. HB47 was referred to the House Judiciary Committee on January 21, 2026 and never moved. Both bills died when Kentucky’s General Assembly adjourned sine die in mid-April 2026. The same statutory move ran in the same season, in an adjacent state, and didn’t pass.

The states where the move succeeded form their own cohort. Florida did it in 2025 under Statute 908.11 and now reports that all 67 sheriffs are signed up. Texas runs 299 active 287(g) agreements across 241 law enforcement agencies in 186 counties, per Texas Policy Research’s February 20, 2026 accounting. The Kentucky Center for Economic Policy counted 1,381 active 287(g) agreements across 40 states as of February 4, 2026. The aggregate scale is now national. Tennessee’s contribution is to ensure no Tennessee county can opt out — and to do it where Kentucky could not.

But mandating participation is the easier part to legislate. The harder part — the part that makes HB2219 structurally novel — is what it removes.

Before HB2219, the residual point of friction in Tennessee’s sheriff-led detention pipeline was that individual sheriffs retained the discretion to exit. The 287(g) MOA is sheriff-to-DHS. A sheriff who signed could, in theory, also un-sign. A new sheriff elected in 2026 on a platform of withdrawing from the program could withdraw the MOA the day after taking office.

HB2219 closes that exit.

Once the mandate takes effect, sheriffs are required by state law to maintain the agreement. They cannot terminate it without violating state statute. The discretion that was already structurally weak — the County Commission can’t compel exit, can’t compel non-cooperation, can’t end the MOA — is now affirmatively prohibited at the sheriff level too.

The mandate runs in two directions at once. It pulls non-cooperating sheriffs into the program. And it bolts cooperating sheriffs to it.

The second direction is the one Sheriff Garrett wasn’t talking about.

What it locks in

This is the structural-political argument: detention expansion in Tennessee is now being engineered to outlast political reversal by design.

Hamilton County is a 2026 sheriff-election year. Garrett has announced his re-election bid. The 287(g) partnership has been a defining issue of his tenure: the Times Free Press editorial board has named him by title in opposition; civil rights organizations have organized around the question of his removal; over a hundred residents have shown up to demand he leave the program.

Suppose all of that organizing succeeds. Suppose a 2026 challenger runs against Garrett on the explicit platform of withdrawing Hamilton County from 287(g). Suppose the challenger wins.

What changes?

Under HB2219, the answer is: nothing. The new sheriff cannot withdraw.

The mandate prevents it. The very policy outcome the election would have authorized is statutorily off the table before the votes are counted.

This is not a small technicality. It is the structural conversion of an electoral question into a non-question.

The County Commission already had no authority to end the MOA — they said so on February 4. The City Council already had no authority to end it — they said so the same day. The voters retained one residual lever: replace the sheriff with someone who would exit. HB2219 disables that lever for every Tennessee county simultaneously.

Detention expansion in Tennessee has now been engineered against future elections, not just against present opposition.

That is a different kind of governance capture than the ones we have been documenting. Accountability darkness — the federal, state, and local information-suppression cascade — keeps the public from knowing what’s happening. Statutory powerlessness — the Hamilton-style lock — keeps elected legislative bodies from acting on what they do know. Legislative lock-in — the HB2219 layer — keeps future voters from changing the result.

It is a one-way ratchet, at least through February 1, 2029. Additions easy. Removals statutorily impossible until the legislature itself votes to let the mandate lapse — which the supermajority that wrote the sunset gets to decide, on a political calendar of its own choosing.

The Davidson County exemption

There is one Tennessee jurisdiction where HB2219 doesn’t bind: Davidson County.

Davidson County Sheriff Daron Hall, per Metro Legal guidance issued April 28-29, 2026, does not have to comply with the new mandate. The reason is a quirk of Tennessee’s consolidated city-county charter law: HB2219’s 287(g) requirement applies only to POST-certified sheriffs, and Hall — who runs Metro Nashville’s jails but lacks general policing authority under Metro’s unique consolidated charter — is not POST-certified.

Hall publicly called the new law “all politics” and noted that DCSO already cooperates with ICE under existing Tennessee statutes — 632 transfers in the prior year, by his accounting. Hall is on the May 5, 2026 Democratic primary ballot for re-election.

The Davidson exemption is worth dwelling on for a moment, because it is exactly the kind of narrow legal carve-out that other consolidated jurisdictions may try to replicate.

Tennessee has one other consolidated city-county charter: Lynchburg/Moore County. Most other Southeastern states with consolidated city-county forms (Louisville-Jefferson KY, Indianapolis-Marion IN, Jacksonville-Duval FL, Nashville-Davidson, Athens-Clarke GA, Augusta-Richmond GA) sit outside Tennessee but produce structurally analogous splits between policing authority and sheriff-detention authority. If the Tennessee model — mandate plus POST-certification carve-out — gets replicated by other states, the consolidated jurisdictions will be the predictable points of legal exemption.

Hall’s exemption is also a tell about what HB2219 is protecting.

Davidson County is not exempt because Davidson County doesn’t cooperate with ICE. It does — 632 transfers. Davidson is exempt because the legal architecture of Metro consolidation makes the sheriff structurally distinct from the rest of Tennessee’s sheriff cohort. The mandate’s drafters either didn’t anticipate the carve-out or didn’t care; the operative cooperation in Nashville is already happening through other channels.

Which is to say: the mandate isn’t about cooperation. The mandate is about removing exit options. Davidson keeps cooperating. Hamilton keeps cooperating. The only thing the mandate adds is the lock.

What the lock protects

The clearest answer to what the mandate protects lives in Davidson County’s litigation record. In May 2025, ICE and the Tennessee Highway Patrol conducted a six-night joint operation in Nashville’s Latino neighborhoods — “Operation Flood the Zone“ — that produced, per the Nashville Banner’s incident-report analysis, more than 600 traffic stops, roughly 196 arrests, 40 to 100 people detained, and a documented-reason rate for the stops of about 14%.

THP, after living through that operation, declined every subsequent ICE request to participate in another. Colonel Matt Perry: “We’ve done one and only operation, and it was last May.” The rejecting agency, in other words, was the operation’s own participant.

This is the kind of system HB2219 protects — not in the literal sense (Operation Flood the Zone was a state-agency push, not a sheriff-led 287(g) operation) but in the structural sense. The mandate protects the cooperation floor that produced an operation the participating troopers themselves refused to repeat. Mayor Freddie O’Connell’s Executive Order 30 — which requires Metro employees to report any interaction with federal immigration authorities within 24 hours — is the local-accountability layer that survived. O’Connell is now under two congressional investigations for that EO. After January 1, 2027, in 94 of Tennessee’s 95 counties, the analogous sheriff-side accountability lever is closed.

Why this is structurally different from the unilateral-sheriff variants

Step back from Tennessee for a moment.

The investigation that produced this piece has documented eight counties across five states, all confronting structurally identical situations: an independently-elected sheriff or county attorney signed a 287(g) ICE-cooperation agreement on their own authority. The county board, in most states, retains legal authority — and in Minnesota, the December 12, 2025 Ellison AG opinion made that authority explicit. Five distinct outcomes have been documented across those eight counties.

Three of the eight ended with the agreement nullified. Cass County, Itasca County, and Jackson County, Minnesota — all responding to the Ellison opinion, all interrupting the unilateral signing without litigation. The Cass model is the cheapest path: AG opinion, board declaration, sheriff acquiescence, done. Total cost zero.

Two of the eight produced political-alignment-by-inaction outcomes. Crow Wing County, Minnesota’s Board chair publicly stated, on the record to local reporters, that she was “fine with what’s going on until further clarification.” Sherburne County’s Commissioner Felber attempted to ratify the sheriff’s JEM agreement and was walked back on open-meeting-law grounds. Both boards have authority. Neither has used it.

Mille Lacs County is the selectively-assertive variant — same board has the AG-opinion authority, refuses to act on the sheriff’s MOU, and also passed Resolution 02-03-26-03 challenging Mille Lacs Band of Ojibwe reservation boundaries. The board can act. It is choosing not to act on the 287(g) question specifically.

Kandiyohi County is the political-paralysis variant. Board openly split. No majority assembled in either direction. The sheriff’s signature stands by default.

Pinal County, Arizona is the Variant-1 litigation case: the Board of Supervisors sued County Attorney Brad Miller over a unilateral 287(g) signing, racked up an estimated $257,000 in outside legal fees per county-board records, and is awaiting a May 15, 2026 hearing.

Each of those variants has at least one path to interrupting the cooperation agreement. Sometimes the path is expensive (Pinal). Sometimes it is cheap (Cass). Sometimes the political will is missing (Crow Wing, Mille Lacs, Sherburne). Sometimes the political coalition can’t assemble (Kandiyohi). But the path is available.

In Tennessee, after HB2219, the path is gone.

There is no AG opinion that can interrupt a state mandate. There is no board nullification that can override state law. There is no sheriff self-rescission that survives the statute. The Cass model — the path that worked three times in three different sub-forms in three different geographic regions of Minnesota — does not run on Tennessee soil after January 1, 2027.

Tennessee has not just selected a variant. Tennessee has eliminated all the other variants from consideration.

The 2026 elections question

This brings us back to 2026.

Tennessee will hold sheriff elections in many of its 95 counties this year. Hamilton County will hold one. If Sheriff Garrett faces a challenger — whether a primary opponent or a general-election candidate — running on a platform of exiting the 287(g) MOA, the candidate will be running on a platform that cannot be implemented if HB2219 is signed and takes effect.

This is not hypothetical. This is the literal effect of the bill’s January 1, 2027 implementation deadline. A sheriff sworn in on September 1, 2026 has four months to act before the mandate locks in. After that, the action is foreclosed.

Tennessee will also hold a gubernatorial election in 2026. Bill Lee, the current governor, had not yet signed HB2219 at the time the bill was transmitted to him on May 7, though the political signaling has been clear: this is part of what Tennessee Lookout has called the GOP’s “Immigration 2026” agenda. A veto is not anticipated. If a Democratic gubernatorial challenger were elected on a platform of repealing HB2219, the path of repeal would still require a Tennessee legislature controlled by the same supermajority that just passed it.

The structural finding is this: the 2026 elections in Tennessee are happening in the shadow of a legislative lock-in that the elections themselves cannot cleanly reverse. Voters can replace the sheriff. The new sheriff cannot exit. Voters can replace the governor. The new governor cannot repeal without the legislature. Voters cannot flip a Republican supermajority in one cycle.

Each of those reversals is theoretically available. Each of them takes longer than the time the mandate gives them.

The February 1, 2029 sunset clause does not change this picture; it sharpens it. A renewal vote is built into the design — but it is built into a political calendar the mandate’s authors expect to still control. Between the 2026 passage and the 2029 lapse-or-renew decision sits one intervening Tennessee legislative cycle (2028), which is not enough time, in this state’s electoral geography, to flip a supermajority. The sunset is therefore not a hedge.

It is a second-order lock-in: the supermajority front-loaded its own renewal vote into the next political calendar it expects to win, while denying every intervening Tennessee voter the standing to interrupt the mandate before that calendar arrives.

This is what “engineered to outlast political reversal by design” means in practice. It does not mean that no reversal is ever possible.

The Cass County, Minnesota path of resolution required one document and one board meeting. The Tennessee path of resolution requires three election cycles minimum.

That is not a coincidence of legal architecture. It is the legal architecture working as intended.

The structural finding

That is a different category of governance capture than what has been previously documented. The accountability-darkness mechanism — ICE’s Florida-Texas directive, Tennessee’s THP litigation hold, Ohio’s State ex rel. Rosnick decision — keeps the public from knowing what is happening. The unilateral-sheriff mechanism — the eight-counties-five-variants pattern — bypasses the legislative bodies that would otherwise vote on what is happening. The legislative lock-in mechanism — HB2219, Florida Statute 908.11, the cohort emerging across the South — keeps future voters from changing the result.

It is worth naming this as a different kind of capture mechanism. Not information suppression. Not procedural bypass. Forward-locked statutory capture. Additions to the pipeline are easy. Removals are statutorily impossible until the political coalition that designed the lock-in is itself replaced.

The Hamilton County February 4 statement — “we have no legal authority” — is the most honest description of this mechanism currently on the public record. The Commission and the City Council were not declining to act out of policy preference. They were describing the legal architecture they had inherited. That architecture, after July 1, 2026, will extend to the sheriff himself. And after January 1, 2027, it will extend to every successor sheriff Hamilton County voters might elect — until at least February 1, 2029, when the legislature itself decides whether to renew the mandate or let it lapse.

Sheriff Garrett’s comment to NewsChannel 9 — that the mandate would not change anything in Hamilton County — was correct as far as it went. The mandate doesn’t change Hamilton’s posture today. It changes Hamilton’s options forever.

The lock-in is the layer engineered against elections.

It is the one that should worry us most.

This piece draws on my capture cascade timeline, and detention-pipeline investigative infrastructure at detention-pipeline.transparencycascade.org. The Hamilton County, Tennessee fight entry is at /fights/hamilton-county-tn-287g-ice-housing-refused/. The Davidson County, Tennessee entry is at /fights/davidson-county-tn-ice-thp-nashville-operation/.

The question worth asking is not whether the OCC — the Office of the Comptroller of the Currency, the federal agency that approves national banks — will approve this application. The question is how this application is even on the table: how the OCC arrived at a point where a preliminary-approval decision on a sitting president’s family bank is treated as routine chartering business, subject only to a 120-day decision clock, with a Comptroller who refuses to share the unredacted application even with the Senate Banking Committee.

The answer is a corridor built in the fourteen months before the decision window opened. The broader administrative architecture that cleared the path — six coordinated actions across six federal authorities — is documented in the companion piece, The Rollback Wave.

The Eight Approvals

Between December 12, 2025 and February 2026, the OCC — under Comptroller Jonathan Gould — conditionally approved national trust bank charters for eight crypto-native applicants: Circle, Ripple, BitGo, Fidelity Digital Assets, and Paxos on a single day in December 2025, followed by Bridge, Protego, and Crypto.com in February 2026.

Each of these approvals is itself a significant regulatory event. Together, they are something more structurally important: they are the precedent record that transforms WLTC’s application from a novel request into one entry in a growing queue.

The eight approvals share a common architecture: crypto-adjacent assets or custody infrastructure, conditional approval (not full operational status), and a regulatory framework whose text had not yet been amended to remove a known legal vulnerability. That amendment came later.

On April 2, 2026, one day after the regulatory amendment took effect, the OCC granted Coinbase conditional approval for its national trust bank charter — a ninth data point proving the post-amendment framework was already in production use before the WLTC window opened.

What the eight-approval corridor establishes: by the time WLTC filed on January 7, 2026, the OCC had built a body of practice showing that crypto-native trust bank applications receive conditional approval under Gould’s framework. WLTC is not asking for an exception. It is asking for the same result already extended to eight comparable applicants. No precedent existed in December 2025. By January 7, 2026, eight precedents existed. The corridor was built before the application arrived.

The Amendment

Between the eight pre-application conditional approvals and the expected WLTC preliminary decision, one more piece of regulatory infrastructure was put in place.

On March 2, 2026, the OCC published a final rule in the Federal Register — 91 FR 9977 — amending 12 CFR 5.20, the section of federal banking regulations that governs how the OCC may grant national bank charters. The amendment took effect April 1, 2026. It is three lines of regulatory text.

Before April 1: 12 CFR 5.20(e)(1)(i) authorized national trust bank charters for institutions engaging in “fiduciary activities.”

After April 1: the same provision authorizes charters for institutions engaging in “the operations of a trust company and activities related thereto.”

The OCC characterized this as a clarification aligning the regulation with the underlying statute, 12 U.S.C. § 27(a). The OCC is not wrong about the statutory alignment. But the timing is the structural fact: the regulatory text was cleaner on April 1, 2026 — five weeks before the expected WLTC preliminary-decision window — than it had been when Circle, Ripple, BitGo, Fidelity Digital Assets, Paxos, Bridge, Protego, and Crypto.com received their conditional approvals.

The National Community Reinvestment Coalition (NCRC) and the Americans for Financial Reform Education Fund (AFREF) had identified the pre-amendment textual vulnerability in their February 9, 2026 comment letters opposing the WLTC charter. Their core argument: stablecoin issuance and custody is not a “fiduciary activity” in the traditional legal sense, and therefore WLTC’s proposed operations exceeded the OCC’s statutory authority to charter. A federal court reviewing a challenge to a WLTC conditional approval could have rested an Administrative Procedure Act (APA) challenge on that specific textual hook.

The April 1 amendment removed the hook. It did not resolve the substantive debate about whether stablecoin trust banking is appropriate policy. It resolved the regulatory-text question at the moment it was most consequential, on a schedule aligned to the WLTC decision clock.

The OCC amendment did not operate in isolation: it was the final step in a fourteen-month sequence of administrative actions, each removing a specific oversight or disclosure trigger aligned to the Trump-family financial architecture. The amendment is the sixth action in the Rollback Wave sequence — each action removing a specific friction surface aligned to a specific Trump-family architecture component. The five actions before it removed disclosure triggers, independent governance, and ethics-pledge constraints. This one cleaned the chartering-regulation text. What comes out the other end of that sequence is a WLTC preliminary-approval decision with a cleaner regulatory record than any of the eight precedent approvals had at the moment of their approval.

The Disclosure Gap

On February 26, 2026, Comptroller Gould appeared before the Senate Banking Committee. Senator Elizabeth Warren, the ranking member, had been pressing the OCC since January to disclose the unredacted WLTC charter application and to halt review pending Trump’s divestiture from WLFI (World Liberty Financial). At the February 26 hearing, Warren focused the question.

OCC regulations require charter applicants to disclose all shareholders with at least a 10% direct or indirect stake in the proposed bank. World Liberty Financial has two major ownership layers. The Trump family controls approximately 75% of the venture through DT Marks DeFi LLC and affiliated structures. The Aryam Investment 1 entity — a twin-shell vehicle registered in Delaware and Abu Dhabi in early December 2024, controlled by lieutenants of UAE National Security Advisor Sheikh Tahnoon bin Zayed Al Nahyan’s G42 — holds approximately 49% of World Liberty Financial. MGX, a UAE state-linked investment vehicle, was the conduit for the initial $500 million WLFI purchase. Both stakes clear the OCC’s 10%-threshold disclosure rule by a wide margin — and the question before Senator Warren was whether the application says so.

Warren put the question directly. Gould declined to confirm whether the application discloses the Aryam/G42/UAE 49% stake. His response: he would “be happy to entertain your request and discuss with my team” and would commit only to “following our established procedures, which are outlined in the regulations.” He would not voluntarily share the unredacted application with the Banking Committee minority.

The exchange is now on the Senate hearing record. The OCC had not, as of February 26, publicly confirmed whether the application contains the disclosure that OCC regulations require. A conditional approval issued without resolved disclosure either confirms the disclosure was made — resolving the gap in WLTC’s favor — or constitutes a conditional approval in which the OCC has waived a material disclosure requirement for a 49% foreign-state-linked stakeholder. Either outcome produces a litigable administrative record. The question of whether a foreign-state-linked entity holding nearly half of a sitting president’s venture was properly disclosed to the federal regulator is now a formal gap in the public record — and gaps in public records are exactly what courts are asked to resolve in APA challenges.

The claim against Gould here is narrow and documented: not that he made a false statement, but that he declined to confirm whether a regulation-required disclosure appears in the pending application. That declination is on the Senate Banking Committee’s minority record and corroborated by Banking Dive, the banking-industry trade publication, in its February 27, 2026 coverage of the hearing. The gap is in the public record because Gould created it by declining to close it.

This is the load-bearing APA challenge vector. Under the APA’s arbitrary-and-capricious standard — the legal test that lets courts overturn agency decisions made without adequate justification — a reviewing court can ask: did the OCC confirm the 10%-threshold disclosure was made before issuing approval? If the public record shows the OCC declined to confirm this at hearing, the administrative record for the approval will need to show where that confirmation occurred — or the approval is vulnerable.

No major outlet has connected the disclosure gap to a reviewable APA challenge vector. The NCRC and AFREF comment letters raised the disclosure question as grounds for opposition; neither identified it as the specific reviewable legal error a court would actually reach. Advocacy opposition and reviewable legal error are different objects. The February 26 hearing exchange is the moment the disclosure gap became the latter.

What the Corridor Means

The sequence is exact: eight crypto-native conditional approvals (December 2025 – February 2026); Senator Elizabeth Warren’s January 23 letter to the OCC demanding that it pause review of the WLTC application pending resolution of the Trump-family conflict, rejected the same week; civil-society comment letters on the record (February 9); UAE-stake disclosure question formalized at hearing (February 26); 12 CFR 5.20 amended removing the textual challenge hook (April 1); Coinbase approval under the amended framework (April 2); WLTC decision window opens (May 7). The WLTC application, filed January 7, has spent its entire 120-day clock inside a regulatory environment that was being prepared for a favorable decision while the clock ran. Put plainly: every major action that could have created friction for the Trump family’s bank application — regulatory text, precedent, oversight, disclosure — was resolved in the application’s favor before the OCC was required to decide.

The OCC amendment is one of six coordinated administrative actions whose aggregate effect was to remove each federal friction surface against the Trump-family financial architecture — the full sequence is documented in The Rollback Wave.

Lawyer Utility — What to Use

For financial regulatory attorneys and civil-liberties organizations watching this decision, the specific items on the record:

The disclosure gap. The February 26 Senate Banking hearing record (Senate Banking Committee minority release, February 26, 2026) documents that the OCC has not publicly confirmed the Aryam/G42 10%-threshold disclosure. Any conditional approval must be evaluated against this record.

The NCRC and AFREF comment letters. Filed February 9, 2026 on OCC docket 2026-Charter-344521 / regulations.gov docket OCC-2026-0100-0004. Eight grounds for opposition — regulatory arbitrage, Community Reinvestment Act avoidance, consumer harm, premature pre-GENIUS Act issuance (the GENIUS Act is pending federal stablecoin legislation that would create its own chartering framework; NCRC argued the OCC was jumping ahead of it). These constitute the formal civil-society record in the administrative file any reviewing court will examine. NCRC requested a 90-day comment-period extension; OCC disposition unconfirmed.

The regulatory-text sequence. January 12, 2026 proposed rule; February 27 final rule; April 1 effective date (Federal Register 91 FR 9977). An APA challenge arguing the regulatory cleanup was timed to the pending application rather than routine clarification will need this document sequence to establish the correlation.

The preliminary-decision format. OCC CD-1367 is the preliminary-decision document for national bank charters. When a WLTC decision issues, CD-1367 is the primary artifact for challenge. Monitor the OCC 2026 News Releases page.

As of May 12, 2026, no preliminary approval has been issued. The deferral is itself a data point: the OCC is not treating this as a routine favorable decision at the 120-day target. What comes next — approval, extended review, or withdrawal — determines which parts of this record become load-bearing.

The corridor was built. The disclosure gap is documented. The clock is running.

Sources

Primary Timeline Events:

• Warren Grills OCC Comptroller Gould on WLFI UAE Ownership Disclosure (February 26, 2026)

• OCC Final Rule Amending 12 CFR 5.20 Takes Effect (April 1, 2026)

• NCRC and AFREF File OCC Comment Letters Opposing WLTC Charter (February 9, 2026)

• Pre-Decision Baseline: WLTC OCC Charter Decision Window (May 6, 2026)

Capture Cascade Context:

• Pattern — Regulatory Capture

Primary OCC Documents:

• OCC Final Rule 91 FR 9977 — National Bank Chartering Amendment (Federal Register, March 2, 2026)

• OCC Bulletin 2026-4 — National Bank Chartering Final Rule (OCC, February 27, 2026)

• NCRC Comment Letter on WLTC Charter Application (regulations.gov docket OCC-2026-0100-0004, February 9, 2026)

Reporting:

• Warren grills Gould over World Liberty charter application (Banking Dive, February 27, 2026)

• At Hearing, OCC Comptroller Gould Says He Will Consider Warren Request to Review WLFI Bank Application (Senate Banking Committee minority, February 26, 2026)

• World Liberty Financial Announces WLTC Holdings National Trust Bank Charter Application (BusinessWire, January 7, 2026)

• Eleven Companies, Eighty-Three Days: The Race for a Federal Crypto Banking License (FinTech Weekly, April 2026)

• Coinbase Receives Conditional OCC Approval for National Trust Bank Charter (American Banker, April 2, 2026)

Peer coverage (independent corroboration):

• Trump Wants to Own Money (Joyce Strong, Joyce Strong’s Substack, May 16, 2026) — reaches the same structural finding from the seigniorage/monetary-infrastructure direction; cites Reuters on USD1/Binance/Abu Dhabi transaction and WSJ on Tahnoon-linked acquisition; arrives at the disclosure-gap concern independently from this piece’s regulatory-record approach.