TI-2026-061H — The List That Becomes the Target

Classification: HIGH · Attribution / Targeting · "Threat Intelligence" & the Metadata Pipeline Confidence: HIGH on the facts (public quotes, leaked programs, in-corpus reports); the argument is that a defensive feed and a targeting list are the same object read by different customers. TLP:WHITE — public statements, published reporting, in-corpus documents; operator internals redacted. Series: The Fake Umbrella — Part H. H is for "Threat intelligence." It promises to tell you about the danger. It is also, unchanged, the document that tells someone else where the danger lives. Facts are facts. They are good for some and bad for others. You decide.

The seed: seven words that collapse the euphemism

In 2014, at a Johns Hopkins debate, the former director of both the NSA and the CIA, Michael Hayden, said it without flinching:

"We kill people based on metadata."

Sit inside that sentence, because the entire letter is in it. "Metadata" is the neutral, technical word — the who-talked-to-whom, from-where, when that never contains the message itself. It is exactly what a "threat intelligence" feed traffics in: indicators, connections, patterns, attribution. Hayden was not describing a different world from the SOC analyst's. He was describing the same data, at the far end of the same pipe, where the output is not a firewall rule but a Hellfire. Threat intelligence and a target list are not analogous. They are the same artifact, priced for different buyers.

That is Part H. The friendliest-sounding product in defensive security — intelligence to protect you — is, structurally and provably, the input to the least friendly act there is.

An indicator of a machine is an indicator of a person

The industry's comfort blanket is that threat intel is about infrastructure — IPs, hashes, domains, TTPs — not people. That comfort does not survive its own flagship product.

In 2013 Mandiant published the APT1 report: roughly 3,000 indicators, and an attribution of the intrusions to China's PLA Unit 61398 — down to a specific building in Shanghai and named individuals. It is the single most celebrated "threat intelligence" document of the modern era, and it is, in plain structure, a targeting dossier on named human beings. Mandiant itself wrote that the decision to publish was "painstaking," weighing exposure against collection — the agonised language of an organisation that knew it was naming people, not hashes.

Because that is the truth under every indicator: an IP is someone's shop, a phone is someone's pocket, a "TTP cluster" is a team of human operators with families and locations. The abstraction "indicator of compromise" is a costume worn by a sentence that always, eventually, ends in a person at an address.

The blocklist and the kill-list are the same data structure

Follow one indicator up the ladder of consequence and watch nothing about the data change while everything about the stakes does:

The row that should stop your breath is the last one. NSA's SKYNET (leaked, The Intercept, 2015) was a machine-learning classifier that scored the mobile-phone metadata of millions of Pakistanis to rank the likelihood that each was a terrorist "courier," feeding the targeting cycle. The same shape as a threat-intel confidence score. And its highest-rated "courier" was Ahmad Zaidan — Al Jazeera's Islamabad bureau chief. A journalist, scored by the machine as the most probable terrorist in the set. This is the pipeline's own documentation telling you exactly what it does at the top.

The point is not that your CrowdSec ban is a war crime. The point is that a ban and a strike are the same operation — match the entity against the list, apply the automated action — differing only in the consequence bolted onto the end. And once the pipe is continuous, the only thing standing between "block" and "target" is a policy decision made by someone you will never meet.

The hinge is automation, and the standard blesses it

How does an "indicator" become an "action" with no human weighing it? The industry's own bible tells you. NIST SP 800-150, the Guide to Cyber Threat Information Sharing, instructs organisations to enrich indicators and drive "automated workflows." That automation is the entire hinge of this dossier. It is genuinely good in a SOC — it cuts response from days to minutes. It is also the exact mechanism by which a score becomes a strike without a person in the loop. Efficiency does not know what is bolted to its output. The workflow that auto-blocks an IP and the workflow that auto-nominates a target are the same engineering pattern, and the same vendors sell both worlds the language of "intel-led automation."

The commercial-surveillance version does not even bother with the euphemism. In the WikiLeaks Spy Files, the interception vendor Qosmos markets metadata analytics to "monitoring centers" with the slogan "Leverage Metadata!" — automate "investigation tasks," handle the "exponential growth in the number of targets." That is threat intelligence with the courtroom translation removed: a machine for manufacturing and managing target lists from patterns.

Attribution is a surface that can be faked — so the list burns the innocent

Everything above assumes the list is right. It often is not, and — worse — it can be made wrong on purpose.

• It is fallible. SKYNET's top "terrorist" was a reporter. A statistician reviewing it noted that even a 0.008% false-positive rate, scaled across millions, mislabels thousands of innocent people. At blocklist stakes that is a nuisance; at kill-list stakes it is a massacre by rounding error.
• It is spoofable. The Spy Files include Ntrepid — the persona-management vendor behind "Operation Earnest Voice" — whose own slides describe "Overt Attribution, Zero Attribution… Misattribution — Working." Attribution, the very foundation of threat intelligence, is a manipulable surface. A capable actor can plant indicators to frame someone else. A feed that consumes attribution as ground truth can be fed a lie, and then automate it.

And it is fallible even in careful hands — which this program can say without flinching, because it happened here. Our own automated web-threats blocklist once scored the operator's own phone (Orange RO, an okhttp Synology app talking to his own NAS) as a threat, before the allow-list check caught it. A well-instrumented, conscientious pipeline still very nearly banned its own author. If a list built with this much care can misfire on its own operator, no one should believe the ones with worse instrumentation and lethal consequences do not misfire on strangers. The only difference between our false positive and a fatal one is the consequence attached to the match — which is the whole argument.

The seven questions

Who is this? The threat-intelligence apparatus — commercial feeds (Mandiant/CrowdStrike-class), sharing standards (NIST 800-150), monitoring-center vendors (Qosmos), and the state targeting programs (SKYNET) at the top of the same pipe.

Why did it attack? It doesn't attack — it lists. It converts metadata into named entities and confidence scores, and hands the list to whoever is paying.

Who does it claim to be? Your early warning — intelligence that protects defenders by naming the adversary. Purely protective.

Whom is it related to? The observatories (061G) that feed it raw data; the brokers (061D) that resolve metadata to a person; the lawful-intercept boundary (027E); and, at the terminus, the lethal targeting cycle.

Where is the money? Feed subscriptions, "adversary intelligence" platforms, monitoring-center contracts, and government programs. The listed generate the value; they are not paid and cannot see their own row.

What is the official anchor? A standard (NIST 800-150) and the honourable tradition of IOC sharing — real, useful, and the exact respectability that lets the pipeline run unquestioned to its lethal end.

What if it is not who it claims? It is who it claims — protective intelligence. The finding is that protective intelligence and a target list are the same object, and the same automation, one policy decision apart.

What if…

• What if threat intel is mostly used defensively? It is — and that is not a defense of the pipe, it is the fig leaf on it. "Mostly defensive" describes the blocklist tier; it says nothing about the identical data structure two policy decisions up the ladder, at Qosmos and SKYNET.
• What if attribution is usually accurate? "Usually" is doing lethal work. A 99.99% accurate classifier that names a journalist as the top terrorist is not reassuring; it is SKYNET. Accuracy that is merely statistical is a catastrophe when the action is irreversible and the appeal process is a drone.
• What if without threat intel defenders are blind? True, and it is why the defensive tier must exist. It is also why the pipe is so dangerous: the thing defenders genuinely need is the same thing that, uphill, becomes a kill-list — so "we need it" cannot be where the analysis stops.

Steelman: the strongest defence — and why it fails

Built at full strength:

"Threat intelligence is indispensable defensive infrastructure. Shared IOCs stop real attacks; attribution deters and enables prosecution and sanctions; standards like NIST 800-150 make it responsible and confidence-scored. It is about protecting networks and holding attackers accountable — not killing anyone. Blaming the SOC feed for a drone program is a category error."

Where it breaks:

• "Not killing anyone" is refuted by the operators' own words and programs. Hayden said the quiet part; SKYNET is the metadata pipeline terminating in a target. The category error is believing there are two separate pipes when the data, the method, and often the vendors are one.
• "Confidence-scored and responsible" is the SKYNET defense verbatim — SKYNET had confidence scores too, and its top score was a journalist. A score is not a safeguard when the action it triggers is automated and irreversible.
• "Attribution enables accountability" ignores that attribution is spoofable. Ntrepid sells the manufacture of false attribution. A system whose ground truth can be planted does not reliably deliver accountability; it reliably delivers an answer, which is not the same thing.
• The one true thing: defensive IOC sharing is real, necessary, and saves organisations daily — and this dossier does not tell anyone to stop. It tells them to see the pipe: that the very artifact protecting your network is, uphill and automated, the list that targets a person, and that the moral weight belongs to the whole pipeline, not just its friendly end.

Verdict: defensive threat-intelligence sharing is legitimate and load-bearing. The unbroken pipeline from that feed to an automated blocklist to a monitoring-center target to a metadata kill-list — running on spoofable attribution and human-out-of-the-loop automation — is HIGH. "Threat intelligence" is not a mitigation. It is the reassuring name for the front end of a targeting machine. Confidence: HIGH; the quote, the leaked program, and the reports are all public record.

Read between the lines

The word "intelligence" is the tell, because it is borrowed from the other meaning — spycraft — and quietly laundered into the corporate one. When your vendor sells you "threat intelligence," it is using a word whose native habitat is the agency that kills people based on metadata, and betting you will hear only the SOC-dashboard sense. The genius of the term is that it is literally accurate in both registers at once — it is intelligence, in exactly the sense Hayden meant — and the friendly reading provides cover for the lethal one. And notice the direction the euphemisms all point across this series: "analytics," "observatory," "fraud prevention," "intelligence" — every one drains agency and consequence from an act that is dense with both. Here the drained consequence is the heaviest there is: a name on a list, and a policy decision away, a name in a strike log.

The human layer

Ahmad Zaidan filed stories. To do his job he called sources, travelled to dangerous places, moved among people the state wanted dead — because that is what a war-zone bureau chief does, and every one of those calls, trips, and contacts is metadata. The machine did not read his journalism; it read his pattern, and his pattern looked, to a classifier, exactly like a courier's — because doing journalism about terrorism and being a terrorist produce similar metadata, and the machine only has the metadata. He was the top-scored name. He was also, demonstrably, a reporter. No one strapped a bomb to that score, as far as the record shows — but the record shows the score existed, at the top of a list feeding a lethal cycle, generated by the exact machinery a vendor would sell your company as "threat intelligence." Somewhere in every feed is a Zaidan: the person whose innocent life produces guilty-looking data, who cannot see their own row, cannot contest their own score, and will never know whether the list that named them was read by a firewall or by something with a trigger. That is the person the friendly word is standing in front of.

Defense — carry the weight of the list

(1) Attach confidence and consequence explicitly. Every indicator you publish or automate should carry its confidence and the worst action it could trigger downstream; an indicator good enough to log is not automatically good enough to block, and one good enough to block is never good enough to target. (2) Keep a human on any irreversible action. Automation is fine for reversible blocks; the moment the consequence cannot be undone, the human-out-of-the-loop hinge is the danger, not the feature. (3) Treat attribution as a claim, not a fact — it is spoofable (Ntrepid), so weight it, source it, and assume a capable adversary may be trying to frame someone through your feed. (4) Remember the false positive is a person. This program nearly banned its own operator; scale that error up the consequence ladder and you have SKYNET. Handle metadata with the weight of what it becomes at the far end of the pipe — because you rarely control who is standing there.

Investigation metadata

Next — TI-2026-061I: I is for "Interception" — the lawful-intercept vendors (SS8, Utimaco, Qosmos, the ISS "Wiretappers' Ball") that build the mandatory back door into every network, and sell the same box to the regime next door.

"We kill people based on metadata," said the man who ran the agency that does it — and metadata is what your vendor sells you as "threat intelligence." The feed that warns you about the target is the document that names them; the automation that de-noises your SOC is the hinge that removes the human from the trigger; and the attribution it all rests on can be faked. Somewhere in the list is a journalist scored as a courier. Facts are facts. They are good for some and bad for others. You decide.