LSN โ€” Local Sovereign Network

The Bystander Cloud: The Accountability Gap at the Identity Layer

TI-2026-086O ยท Series: The Wardrobe ยท Case 15 ยท Classification: HIGH ยท Confidence: MEDIUM (a reasoned proposal on documented facts)

The whole series has built defences that live with the target: detect the fleet, score the mismatch, check the provenance, ban by name. This case is about the one defence that does not โ€” the one that lives with the landlord, and only the landlord. The corpus has long documented that reputable clouds host attacks they will not police; that is the accountability gap, and it is mostly intractable. But the mask abuse contains a corner of that gap that is not intractable at all โ€” it is cheap, unambiguous, and closable by exactly one party, because that party is the only one who can tell its own crawler from a tenant forging it, and it is that party's own name being stolen.

Executive Summary

The general accountability gap is old news in this corpus. The Google Cloud Anomaly (032G) noted that a two-trillion-dollar company with the largest private-sector threat-intelligence team hosts 157 tracked IPs, 77 of them at abuse score 100. Cloud Complicity (041D) named the mechanism: "the more the world depends on the platform, the safer the attack that hides inside it โ€” criticality is not a barrier the attacker overcame, it is the shield they leased." The Cloud Contractor (075B) drew the fatal conclusion for defenders: "AS396982 is where two decades of reputation scoring quietly breaks... it defeated reputation scoring by being essential."

All of that is about abuse in general โ€” traffic the provider genuinely cannot cheaply tell apart from legitimate use. This case is about the exception. For the mask abuse specifically, there is a signal that is trivial and unambiguous, and only the landlord can read it:

So Google is, on this one abuse, three things at once: the victim (its own crawler's name is the stolen good), the only party capable of catching it at the source, and currently inactive. The mask abuse is not the hardest instance of the accountability gap. It is the easiest โ€” and the one where the provider's self-interest and its capability point at the same act.

Why the General Gap Is Intractable โ€” and This Corner Is Not

Start with why the accountability gap usually wins, because the exception only matters against that backdrop.

The reason a hyperscaler cannot simply "stop hosting attacks" is that, for most abuse, the provider cannot cheaply distinguish the attack from legitimate use. A tenant VM sending a burst of HTTPS could be a scanner or a real application load-test; a tenant running SSH clients could be a brute-forcer or a DevOps pipeline. Telling them apart requires exactly the behavioural analysis the target does โ€” and the provider has millions of tenants, so doing it at egress scale is expensive and error-prone. That expense, plus the friction of identity-verifying every signup, is the honest core of why the gap persists (and the honest core of the enablers-for-profit critique in 080O).

The mask abuse escapes that entirely, and it is worth being precise about why. The provider does not need behavioural analysis to catch a forged Googlebot. It needs one string comparison and one fact it already owns:

Does this tenant's egress carry a major crawler's User-Agent that belongs to a crawler the provider knows is not a tenant?

For Googlebot the fact is airtight: Google publishes how to verify Googlebot (reverse-DNS under googlebot.com plus published IP ranges), and the real Googlebot lives on AS15169, Google's crawler network โ€” never on a customer VM in AS396982. So a GCP tenant egressing Mozilla/5.0 (compatible; Googlebot/2.1) is, with essentially zero false positives, an impostor. There is no ambiguous legitimate case to protect, because the legitimate case is not a tenant. This is the rarest thing in cloud abuse: a bright-line signal, readable at egress, with no false-positive class to worry about.

The Signal Only the Landlord Can Read

Here is the part that makes it the landlord's problem specifically, and not something a target can outsource back to itself.

An external defender โ€” this homelab, any site โ€” sees only the mask traffic that arrives at its own edge. It can catch the fleets that hit it (and this series shows exactly how), but it cannot see the fleets hitting everyone else, and it cannot remove the address space, because AS396982 is essential infrastructure that carries critical legitimate traffic from the same IPs (the un-blockability of 041D/075B). The target's defence is, structurally, local and partial.

The provider's view is global and complete. Google sees the egress of all its tenants, and it alone holds the discriminator โ€” the knowledge of which of its networks is the genuine Googlebot. One egress rule at the provider โ€” deny, or flag, tenant traffic presenting our own crawler's User-Agent โ€” would drain the credibility the entire Fake-Googlebot economy rents, at the source, across every target on earth simultaneously. No target can deploy that rule; only the landlord can. It is, in the exact sense the series has been circling, the one countermeasure that lives on the other side of the wall.

And note what makes it uniquely motivating: the reputation being spent is Google's own. The forged Googlebot works because it egresses Google's cloud (086A) โ€” the sibling-ASN adjacency that makes the naive check believe it. That credibility was manufactured by Google's genuine good conduct and its mature, legible abuse-response culture (045L). So the provider's clean name is simultaneously its asset, the attacker's borrowed good, and the reason the abuse succeeds. Every forged Googlebot is a small withdrawal from Google's reputation, made possible by Google not checking its own egress for its own name.

Victim, Enabler, and the Only Party Who Can Act

Put the three roles together, because their coincidence on one party is the whole finding.

Victim. The wardrobe steals trusted names, and 086C/D named the impersonated brands (the Internet Archive, Baidu, Yandex) as victims. Google is the victim too โ€” but with a difference no other victim has: Google is also the landlord the theft is committed from. The Internet Archive cannot police GCP egress; Google can.

Enabler. Not by intent โ€” by omission. The fleets sit in Google's own egress telemetry, presenting Google's own crawler's name, and are not stopped there. That omission is what lets the credibility flow. Calling this "complicity" (as 041D did for the general case) is stronger than the evidence for intent supports, so this case does not; the accurate word is bystander. The cloud is standing next to a theft of its own reputation, holding the one tool that would stop it, not using it.

The only actor who can close it. Every other defence in this series is target-side and partial. This one is landlord-side and total. That asymmetry is why the case exists: the wardrobe persists in part because only half the board is being played. The target half โ€” everything 086A through 086N built โ€” is played hard. The landlord half โ€” one egress check for the provider's own crawler UA โ€” is not played at all.

Steelmanning: "This is naรฏve about scale and about the provider's real posture"

The strongest objection has three parts, and each deserves a straight answer, because the case is a proposal and a proposal must survive the practitioner's scepticism.

"Egress filtering at hyperscale is not one string compare โ€” it is a massive, latency-sensitive, privacy-fraught undertaking." Fair, and this case does not pretend the engineering is trivial; it claims the logic is unambiguous, which is different. The point is not "Google can do this by Friday" but "unlike general abuse, there is no false-positive class and no behavioural analysis required" โ€” the hard part is scale and plumbing, not deciding what is bad. That moves the problem from intractable-in-principle to merely-expensive-in-practice, which is exactly the category where a two-trillion-dollar provider's inaction becomes a choice rather than a limitation.

"Google is not a passive bystander โ€” it runs Threat Horizons, publishes abuse contacts, and takes down accounts." True, and 045L credited precisely that response culture as what distinguishes Western clouds. This case does not allege Google does nothing about abuse; it alleges Google does not do this specific, cheap, self-protective thing about this specific abuse โ€” the reactive takedown pipeline runs after a report, while the egress presenting Google's own UA is a pre-report signal Google alone holds. The critique is narrow and survives the "but they have an abuse team" rebuttal because it is about a proactive check the abuse team is not, apparently, running.

"Maybe they do run it, and these fleets are the residue." Possible, and this is the honest uncertainty: we cannot see Google's internal egress controls, so the claim is bounded to what is observable โ€” the fleets do egress GCP tenant space presenting Googlebot, are caught at our edge, and are not stopped at theirs before reaching us. If a provider-side control exists, it is not catching the pattern this series documents. The proposal stands as: whatever is or is not running, the observable outcome is an unpoliced-at-source forgery of the provider's own crawler, and the fix that would change the outcome lives only with the provider.

The objection is right to demand humility about scale and about Google's real efforts. The case keeps that humility and narrows the claim until it holds: the identity-layer forgery is the one abuse where the cheap, unambiguous, self-interested countermeasure exists solely on the provider's side and is not, on the evidence, closing the gap.

What Holds, and What Is Bounded

Documented, HIGH confidence: the general accountability gap and its corpus framing (032G/041D/075B); Google's published Googlebot-verification method and the AS15169-vs-AS396982 distinction; the fleets' egress of GCP tenant space presenting crawler UAs (086Aโ€“F); the provider's clean-reputation-as-the-stolen-good dynamic (045L/086A).

Inferred, MEDIUM confidence: the central proposal โ€” that a provider-side egress check for its own crawler's UA is near-zero-false-positive and would drain the mask economy's credibility at the source. The logic is sound (the real crawler is not a tenant); the feasibility at hyperscale and whether such a control already partially exists are outside our visibility and are explicitly held open. This is a reasoned recommendation on documented facts, not an assertion about Google's internal systems, and Google is named throughout as an unwitting host and impersonation victim, not accused of complicity.

Why It Matters

The Bystander Cloud is the case that completes the defensive picture by naming its missing half. Fourteen cases built a formidable target-side defence โ€” and it is, by construction, local: it protects the edge that deploys it, one estate at a time, against the masks that happen to arrive. The wardrobe survives that defence not because the defence is weak but because it can only ever be partial, and the reason it can only be partial is that the address space it would need to act against is un-blockable and the discriminator it would need is held by someone else.

That someone else is the provider whose name is being forged. The mask economy has found a beautiful equilibrium: it rents credibility from a landlord who is the sole party able to revoke it, and who has, so far, not. Breaking that equilibrium does not require solving cloud abuse in general โ€” the intractable problem the corpus has documented for years. It requires the provider to make one bright-line check on its own egress for its own crawler's name, in its own reputational self-interest. The whole series has shown targets how to survive the mask. This case is the one addressed past the target, to the bystander holding the only tool that would end it: it is your name they are wearing, from your network, and you are the only one who can take it back.

Cross-references

Next in the series โ€” TI-2026-086Z, The Identity Layer: the synthesis โ€” what the whole wardrobe means for trust, identity, and behaviour on the modern edge, and the single rule the series resolves to.

TLP:WHITE. Google named as unwitting host and impersonation victim, not accused of complicity. The provider-side proposal is a reasoned recommendation on documented facts; feasibility and any existing internal controls are explicitly held open.

โš  Personal capacity. Research published independently โ€” not reflecting employer views. Derived from passive observation of attacks against personal infrastructure. Full disclaimer โ†’
โ† Previous The Wardrobe โ€” 15 / 26 Next โ†’