A copper line upgrade at a remote FAA site shut down every departure in the United States. Yeah. Telco engineers, you know what I’m talking about.

A contractor was switching the old line to new fiber on Friday afternoon. The router then flooded the rest of the air traffic network with more than 1,000 connection attempts every four to five seconds. That is about 250 a second, a trickle for any modern network. The FAA’s acting CTO said two sources were hammering the network and it settled down once both were switched off. That artificially created storm, as a self-Denial-of-Service, meant controllers lost reliable radio and radar.

This has been a known way to lose a whole network since way back in October 1980, when one faulty ARPANET node flooded every other node with bad routing updates and took it down for several hours.

Transportation Secretary Sean Duffy gave the above account on Saturday. The explanation came right from the top. On Friday night he had been singing a different tune. He told the White House briefing that it was the failure of old hardware and “our new IP switches did not go down.” Homeland Security Secretary Markwayne Mullin stood beside him and said the FAA was putting in new equipment and “it was overwhelming the older system.” Mullin was right, in the sense that a Friday afternoon upgrade went sideways. Yeah. Server engineers, you know what I’m talking about.

The FAA, unable to handle their own upgrade storm, held every departure from 3:54 p.m. to 8:15 p.m. Eastern. FAA Administrator Bryan Bedford counted 12,000 flights lost on Friday and expected 4,000 to 5,000 more cancellations on Saturday. The old network was fine carrying about 30,000 flights that day before a botched upgrade plan took it down.

On Friday a reporter asked Duffy directly whether FAA caused the outage with an upgrade. He answered by describing the old analog system. Cute. Asked what was different about the system that day, he said “we’re still working on the details of what went wrong today.” He named a cause and then claimed he didn’t know the cause in the same briefing. Because Duffy is actually spelled with two Ms. How do we know? He asked Congress for $50 billion to do more upgrades faster, and the next day said doing the upgrade is what caused the outage. Talk about a sense of fail-faster privilege.

The reporting was flying by this time, even though the planes could not. CBS sources described a botched network update within hours, and Bloomberg reported the FBI was examining whether a software update did it. CBS said the failure was Cisco routers built between 2001 and 2006 that fed out-of-sync data into the wider system.

Running Cisco gear that was built between 2001 and 2006, in other words staring down two decades of reliability, means having redundancy plans for redundancy plans for redundancy when anything is changed. Bedford said the FAA is replacing 2,000 of these Cisco routers with Juniper ones, so Friday’s swap is one of two thousand, supposedly following a playbook. Yeah. Disaster recovery engineers, you know what I’m talking about.

Saturday’s accounting brought more clarity about the same things. An upgrade job caused the outage. Duffy revealed himself to be a weak leader as he started calling the switchover straightforward work at a small location that should have had a small impact. Yeah, my man, I think everyone knows the truth that it was not a small impact at a small location. It was a national security level disaster caused by a cascading fail unsafe on your watch. Service returned once engineers isolated the work that should have been isolated from before anyone put hands on the network. I can’t emphasize enough the self-incrimination of someone in charge who looks at the Hindenburg in flames and gives only the explanation that it was supposed to be a straightforward landing at a small location.

Is there someone else we can put in charge here?

Duffy’s defense, almost unbelievably, is that doing nothing adds more risk. Ok, so Friday tested that claim and Duffy is exactly upside down and backwards. Doing something is what created the failure. The old copper line was carrying traffic until the switchover began. A rush into a changeover brought down the country. Without having any isolation, without having a clear idea of what could happen, doing nothing seems pretty damn smart. The line was due to be discontinued, so there was a need for work. The quality of a changeover, a safety procedure following decades of migration planning, was the FAA’s to manage. An upgrade managed this way is far, far more dangerous than the network it replaces.

The whole country had to be shut down! How much worse could the migration be managed?

Every part of the Duffy changeover plan failed.

The hour chosen was a peak moment of traffic, Friday afternoon with 3,500 aircraft in the air. Controllers told a Washington Examiner reporter that work like this is done midweek in the middle of the night (one of my favorite times to fly, especially into Dallas where you can skateboard all alone all night inside the airport). A reporter asked Duffy why the department did it at such a dangerously busy time, and he said small remote sites get switched over during the day while big facilities like Newark get done at night, and that the timing will be reevaluated. For what? Friday afternoon was the policy working as designed. It couldn’t be more obvious that the policy was approved on a dummy’s watch.

The impact was the whole country. Bedford said 17 of the 22 en route centers went unstable, and after 45 minutes of failing to find the cause the FAA grounded everything. He also said maintenance on this network is logged on paper, so officials had to dig through paper records to find out who was working where. Duffy said he was under the impression a small wire at a small site would have a small impact. Apparently his team assumed a network fault would stay local and not cascade everywhere. The recovery timeline was more than four hours, which itself negates the “small” framing. A day later the FAA is still choosing between contractor error and faulty equipment, which itself negates the “small” framing. The correctness of the installation and its configuration is still an open question requiring more research, even after it went live.

Richard Clarke, the former White House counterterrorism chief, told CNN Saturday morning that he expected a higher standard. New equipment is tested under high load in a sandbox before it goes live. Under Duffy, apparently America rams new equipment straight into the national airspace on a Friday afternoon without a clue.

Duffy pointed his finger at a contractor. He said L3Harris carried out the upgrade and it owns that legacy network. He told reporters he’s the victim of this story because “I’m stuck with L3Harris.” That seems suspect, because the FAA has had this contractor’s number for two decades. The technicians’ union warned after a 2007 Memphis outage that the network’s design made failures like it likely to happen again. In 2009 Harris installed a replacement router with a bad route configuration during planned maintenance, and the inspector general counted 129 air traffic facilities disrupted. Harris, now L3Harris, has held the contract since 2002. The FAA knew its performance, and even knew its priors in this exact context. After a Dallas outage in September 2025 the FAA said an L3Harris oversight failed to make sure the backup systems worked. In other words, when a manager already has faulted a contractor in writing, and then supervises that contractor’s next switchover, the finger pointing changes. The copper-to-fiber work is an FAA program on an FAA schedule. Who knows this? Duffy knows this. Why? Because in 2025 he was the guy who blamed Newark outages on a mishandled move of that airspace to Philadelphia. He called it the fault of… wait for it… the previous administration. Now his own FAA attributes those Newark outages in part to a move made before adequately testing the telecommunications lines. Friday was the same failure Duffy had criticized for failing before, now under his management.

You see the problem with him claiming he was surprised? It was supposed to be small. And the problem with him claiming it was the contractor? It was supposed to be someone else’s fault. And the problem with him claiming it was old equipment? It was supposed to be a win for upgrades.

The Government Accountability Office audited the program two months ago, just to give some idea of how this outage fits into Duffy’s risk management gaffe. Its September 2026 report records the FAA’s finding on the Newark failure. It also mentions that the FAA pulled the copper replacement deadline forward by 21 months, to December 2028. As of May it had replaced 2,560 of 5,170 copper lines. On Saturday Duffy said 69 percent are done, which works out to about a thousand switchovers in six months and about 1,600 still to go. Bedford called Friday’s router work routine maintenance outside the $12.5 billion modernization, yet GAO lists the copper replacement as a line in that very program. Each one of those 1,600, if Duffy doesn’t step up to the job required, has the risk we just witnessed on Friday.

To make a finer point, there’s other evidence Duffy is in a rush to fail faster. In August 2025 the FAA Administrator issued a blanket waiver that exempted the whole program from the agency’s acquisition rules, including its technology and security reviews. The waiver’s stated reason was that those reviews add months or years. GAO found 11,389 separate project schedules that the FAA had yet to join into one master schedule. FAA officials told the auditors that integrating them would be of little use. GAO said the installations were being scheduled with little attention to disruption of air traffic operations, and it warned of “more system outages, ground stops, flight delays, and safety incidents.” The Transportation Department partially concurred and claimed an integrated schedule already existed. GAO disagreed.

Speed was the stated goal. More national disasters, faster, as the predictable outcome. Just because someone put a Duffy in charge.

Duffy told Friday’s briefing the FAA is moving faster than it ever has. As if we needed to be told that after a botched upgrade shut down national airspace. His 2025 announcement of the program promised “we will not let government bureaucracy get in the way of results.” Yeah, he’s turning off all the safety. Man in a rush to stomp on the accelerator for air travel says he has no time to think about consequences. The department’s September release described spending $12.5 billion at “breakneck speed” calling all 13 workstreams on track. More like derailed by speed as the only measure. The FAA hired Peraton in December 2025 to be their single integrator, with the end of 2028 as the deadline.

Duffy Statement	Reality
The old hardware went down.	A contractor’s copper-to-fiber switchover at a remote site flooded it.
The new IP switches stayed up.	The upgrade work was the trigger.
The fix points to a legacy network problem.	The fix was isolating the upgrade work at the remote site.
Doing nothing adds more risk.	The old line worked until the switchover began.
Congress owes the program $50 billion.	Congress gave $12.5 billion in 2025. GAO is still waiting for a reliable cost estimate.

The old network has been declared obsolete. A November 2023 safety review commissioned by the FAA said so and warned that an unexpected failure could cut an entire regional center off from the network. After Friday’s nation-wide outage I think we can all agree a regional one would be lesser. The report should have raised the standard of care for every change that is meant to upgrade anything. A fragile, obsolete system is a known state in technology circles. It gets a digital twin, a sandbox, a parallel with a fail safe, a tested change in a quiet hour, with a rollback plan. The Duffy version of the FAA waived its reviews to hit a deadline Duffy set by one man’s calendar, done by the time Trump leaves office, like a rushed SpaceX rocket exploding on the pad.

On Friday Duffy had said he is happy to take the blame when the fault lies with the FAA. On Saturday he blamed the contractor. In 2025 he blamed the previous administration. Now that Bedford has promised a root cause analysis, it will be written by the agency that ran the program. Will it name who approved a Friday afternoon switchover? Will he point fingers and rush the next 1,600 if it doesn’t?

The bottom line is congress should cut-off Duffy from the upgrades and certainly not give him any more money, unless he demonstrates the minimum level of competency for the job. You don’t get to run with scissors and shutdown the entire nation on the basis you’re trying to prevent a small regional outage.

Duffy’s proof that the old network keeps failing is the local outages at Newark and New York, and then his Friday switchover took down the whole country instead. What a complete Duffy, spelled with Ms.

It’s been over six months since I wrote “The Boy That Cried Mythos“, and Anthropic’s vulnerability dashboard has been growing.

Let’s take a look at the 8,527 findings added in its latest month. During this same month, human reviewers checked 253 findings and maintainers pushed 113 patches. These three numbers come from Anthropic’s own counts. I got them by comparing the 2 November snapshot of its disclosure dashboard with the 2 October snapshot.

In April, in my section 8 of “The Boy That Cried Mythos”, I presented eleven things that a security capability claim should carry (things the Mythos system card lacked). Seven months later Anthropic’s own dashboard and Patrick Garrity’s November audit at VulnCheck reveal where we are now.

Missing in April	November Review
CVSS distribution	Anthropic reports 88% severity agreement between Claude and its external triage firms on 1,868 findings. Against maintainers, VulnCheck’s September cut had Claude at 91.5% critical or high and maintainers at 51.3%.
CVE enumeration	VulnCheck traces 442 CVEs to Anthropic, 0.5% of the 93,450 published this year. Anthropic’s dashboard counts 230.
Disclosure timeline	A public ledger of 7,349 entries, updated in bulk batches. The other 30,617 findings, 80.6%, have no ledger entry.
Comparison baseline	Still absent. Anthropic now describes its OSS Scanner as inspired by Google’s OSS-Fuzz.
False-positive rate	94.2% true positive, measured on the 6,376 findings that humans reviewed. That is 17% of 37,966. The other 83% are unreviewed.
Rediscovery ratio	1,654 ledger entries are marked duplicate, up from two in September.
Patching velocity	629 patched, which is 1.7% of findings. The month to 2 November added 113 patches and 8,527 findings.
Independent replication	curl published all 45 Anthropic reports with its verdicts. Seven were confirmed, all low.

Then in May I laid out the funnel behind the headline: 23,019 findings, about 8% of them checked by a human, and a true positive rate that described only the checked ones. The funnel continues to have a similar look in November. It has 37,966 findings and 17% are checked, where the dashboard’s patched count has gone from 97 in May to 629. That’s not nothing, but it’s still hardly something to get excited about. I feel like I’m reading about a security team doing security work, which usually has to pay to get a press release.

The true positive rate is the number Anthropic naturally leads their overheated marketing with, and it rose from 92.7% to 94.2% in a month. That’s a 1.5. Over that month the reviewed count rose by 253, from 6,123 to 6,376. The confirmed count rose by 335, from 5,674 to 6,009. That seems to show the confirmations were higher than reviews by 82. The dashboard shows a single snapshot instead of explaining the trend line. It does state that a duplicate counts as valid finding, and on that note the same update marked 1,654 entries as duplicates.

I’m not sure why duplicates are valid except as an attention inflationary tactic. Accountants know better, and so does every bug bounty program that credits the first report and cancels every single duplicate as nothing to see.

The dashboard’s count of findings reported to maintainers fell in the same month from 6,157 to 5,087, and Garrity’s own count reaches even lower to 4,866. The count that maintainers replied to fell from 5,103 to 3,635. The 94.2% covers only findings that went through triage. Of the 5,087 the dashboard counts as reported, 3,225 went out untriaged and carry this rather inconvenient label:

May contain false positives.

Yeah. Probably should say will contain false positives.

Anthropic’s two versions actually disagree on fixes. Garrity counts 217 marked fixed in Anthropic’s ledger while Anthropic’s dashboard says 629 patched. In September the same pair read 202 and 421. This interesting integrity gap has nearly doubled. I use the larger number in the table because it is the most generous reading available, and it still comes to only 1.7%.

I think it makes sense to check curl, because it has been so well documented.

First, in May a Mythos report claimed five confirmed vulnerabilities in curl and one survived as a low.

Second, in October the scanner found a real one. Daniel Stenberg called CVE-2026-92392, a high-severity use-after-free in HTTP/2 uploads, “one of the worst vulnerabilities in curl in a long time” and credited it to Luna Tong at Anthropic using OSS Scanner. curl fixed it in 8.23.0 on 14 October. That is a scanner working as a patch accelerator, which is exactly what section 10 of the April post predicted.

Third, this month Stenberg received 45 more reports from the scanner, each filed as a vulnerability, with one rated medium and 44 rated low. He estimated four hours of triage per report, so about four weeks of full-time work, and published all 45 as GitHub issues. His tally on 10 November accounts for all 45: seven confirmed at low severity, 37 “just a bug” and one completely false. Seven of 45 is 16%. Anthropic told maintainers at launch to expect a true positive rate above 90%.

The scanner can claim 44 real defects out of 45 as a headline driving announcement, while curl can count seven vulnerabilities, all low. The difference between them is the marketing, because Anthropic filed all 45 as vulnerabilities. It’s like when Ed Bernays ran propaganda to get people to eat more fatty, unhealthy bacon. He had a doctor ask 5,000 physicians whether a hearty breakfast beats a light one, about 4,500 agreed, and the newspapers ran it as 4,500 physicians urging hearty breakfasts, with bacon and eggs served up as the example. Nine out of ten doctors recommend. Recommend what? Look away, don’t check the details. That’s how disinformation tactics in America made bacon so popular, manipulating a report that never said eat bacon.

One report claimed request smuggling. Hah, gotta love that phrase. Stenberg’s verdict:

Sounds like a bug, not a vulnerability.

Classic. Every security professional hates to hear that. It’s like nails on a chalkboard. Each report now arrives with a reproducer and candidate patches, which answers some of what I was talking about last May. It still drops a bill of four hours on a maintainer. The same morning Stenberg counted 218 bugfixes merged from 49 authors in the 27 days since the last curl release, with 19 CVEs queued for the next one. Anthropic accounts for at most seven out of those 19.

We focus on curl when it is among the most fuzzed and audited C codebases known. The May report and this month’s batch produced eight lows between them, and October produced the one high. Results on other targets are notably different. Grav, a PHP content management system, turned 99 scanner findings into 22 advisories, and wolfSSL’s founder told Anthropic that 72 of 74 reports were valid. Stenberg wrote in May that any project new to this generation of tools will find a large pile of bugs, because that’s how technology works. New tools, new batches of bugs. It’s the obvious progression. A new analyzer behaves newly on code it has yet to see. By August Stenberg posted that Mythos was delivering nothing more in curl, and AISLE says its own tool still produced 29 reports and six CVEs. AISLE is the firm in April that reproduced the Anthropic launch showcase bugs on small open models, throwing a wet blanket on the whole announcement. Each tool, each pivot, will deliver bugs that others missed. In other words, finding bugs continues to be a commodity market.

Attackers are also ignoring the marketing, making use of bugs found by other means. Jeremiah Grossman’s Vulnpocalypse Report for Root Evidence went looking for an AI surge in exploitation across 253,912 CVEs published since 2018, of which 3,769 were exploited. The exploited share held flat to falling and the median time from patch to exploitation widened. Its conclusion:

AI has changed one group so far, and we can name it: researchers.

That’s basically what this blog has argued since April. The proof is in. A follow-up Root Evidence chart of this year’s CVEs entering VulnCheck’s exploited list shows weekly additions rising from six in the first quarter to 16 in the third, with WordPress plugins left out. The bars sum to roughly 500 exploited CVEs through 8 November. Root Evidence notes that later weeks draw on a larger pool of CVEs, so part of the climb is just dumb math. VulnCheck’s list holds two CVEs credited to Anthropic. Glasswing launched on a claim of thousands of high-severity vulnerabilities in every major operating system and browser. Shocking if true! But then all but two of the bugs that attackers used this year came from NOT the cartel of Anthropic. When Mythos 5 came out in June, the successor to the preview that had been billed as too dangerous to release, Anthropic put the same underlying model on general sale as Fable 5 behind a filter.

Also in June I set a test for the 90-day report Anthropic promised at launch. A verified CVE list with reproduction steps would substantiate the claims they had made. Headline figures restated without independent verification would confirm the pattern. The deadline passed by July 6th and the May update remained our only report to chew on. What exists for us since is just the dashboard and an October announcement. The open source side of the program met part of it with 230 CVE records on the dashboard and scanner reports that ship with a reproducer. However, the partner side is what the consortium launch was supposedly all about, and it closed with… a survey. Glasswing ended as a named program on October 6th (what is it about the 6th?), when Anthropic merged it into its Cyber Verification Program. The closing number was 129,000 verified vulnerabilities found by partners, based only on a survey from some of those partners. It all seems shady, because the two partner counts I checked earlier both shrank against the published advisories. Mozilla’s 271 reconciled to three Anthropic-credited CVEs, and Palo Alto’s 26 falls to 20 once its own exclusion is applied.

Section 9 of my Cried Mythos post said this about speed:

A tool that accelerates discovery without accelerating remediation grows the backlog; it does not shift the threat model.

In May I called the result a firehose in a blizzard.

Section 10 of my Cried Mythos post said a defensive tool calls for a CVE velocity report in place of a fire alarm. The dashboard is that report, and it reads 113 patches against 8,527 new findings.

On 8 October Anthropic wrote that verifying, disclosing and fixing vulnerabilities “is slow and still depends on people”.

The billions and billions of dollars spent on Anthropic now pumps out raw sewage reports unreviewed to the projects that opt in, while the humans cleaning up the spill are volunteers known as maintainers.

The creed Pete Hegseth wears is Christian holy war over Jerusalem. Jews were among its first victims. His support for Israel sits inside that theology.

“Deus Vult” is a white supremacist whistle tattooed on his bicep and stamped on the Bible he swore his oath on. He explained the phrase himself in his 2020 book American Crusade, where he calls it

the rallying cry of Christian knights as they marched to Jerusalem

It gets the last words of the book. He says he is proud to belong to the church network that Doug Wilson founded. Doug Wilson says giving women the vote was a bad idea, and his churches teach wives to submit to their husbands. Hegseth shared a video of the network’s pastors arguing that women should not have the right to vote.

Hold that thought, because it’s especially important for this story.

The crusade’s first mass killing was in the area today known as Germany. In May 1096, on the road east, crusader bands targeted the Jewish communities of Speyer, Worms and Mainz for total destruction. Solomon bar Samson’s chronicle describes Count Emicho’s men entering Mainz on May 27 and killing the Jews who had taken shelter in the archbishop’s palace. Emicho’s bands were destroyed in Hungary. The armies that followed took Jerusalem three years later and killed its Jews as well. That crusade is what Hegseth is tattooed with. The first people it killed were Jews.

Christians also created Zionism as a means of calling Jews outsiders and forcing them to leave (remigration). Lord Shaftesbury campaigned in 1840 for the powers of Europe to push the Jews to Palestine, and Foreign Secretary Palmerston listened. William Blackstone, a Chicago evangelist, petitioned President Harrison in 1891 with the question, “Why not give Palestine back to them again?” Theodor Herzl published The Jewish State five years after that. Jewish writers such as Moses Hess and Leon Pinsker made their own case for a return in those decades. Or course it was the Christians who reached government authority on this first. Blackstone read Jewish settlement in Palestine as a sign that the end times were near. For these men the return of the Jews was a step in their own Christian prophecy, where the Jews were the disposable means.

I have written here before about how Christians built Zionism and pushed Jews into it. Hegseth continues that tradition. In Jerusalem in 2018 he told an Arutz Sheva conference that rebuilding the Temple on the Temple Mount was a “miracle” that could happen. A miracle of antisemitism. A year later he went up to the Mount with the international director of the Temple Institute. These views are his own, and he published them loud and proud years before he was confirmed to head the Pentagon.

Israel’s government clearly has a use for this. Netanyahu told 60 Minutes that he wants American financial support drawn down to zero, and he described the replacement to a congressman as “my plan.” As usual with him, it’s a big bag of misdirection and corruption.

The plan moves the relationship out of State Department aid, which Congress votes on every year, and into Pentagon procurement. So the “zero” of the plan is in terms of accountability, not spend. NPR reports that AIPAC supports the arrangement, while experts expect less congressional oversight. Trump announced on November 3 that the $4 billion a year in aid is “stopping” at the end of 2026, meaning it loses proper visibility.

The bill text directs the Secretary of Defense to set up a joint defense technology initiative “with the concurrence of the Minister of Defense of Israel.” The House passed it in July as Section 219 of the defense bill, and the Senate bill carries it as Section 1217. The Secretary who would run this Israeli integration into the Pentagon is … wait for it … Hegseth. He told Israeli Defense Minister Katz in March, “Keep going to the end, we are with you.”

I wrote back then about his $200 billion war supplemental. Netanyahu’s plan looks like it’s about to put Israel’s funding under a crusader, a true believer in his own holy war.

Now, to the point of all this. On November 10 the House voted 211 to 204 to send Thomas Massie’s eight articles of impeachment to committee, which ends them for this Congress. Four of the eight concern the war on Iran that the United States launched with Israel. I had already posted the case for trying Hegseth in No Quarter.

Against Massie is AIPAC’s super PAC, which spent $3.58 million against him this cycle. Republican Don Bacon explained his vote by describing Massie as “anti-Iran, anti-Ukraine, anti-Israel.” Bacon said in the same breath that he is no fan of the secretary. He voted to fan Hegseth, while saying he wasn’t a fan, just to oppose Massie.

The part that seems to really matter, more than Republicans talking nonsense, is that eleven Democrats missed the vote, more than the seven-vote margin. Seven Republicans missed it too. Marcy Wheeler argues the “maths”, that the absences changed nothing because Republicans kept spare members nearby to deploy as necessary. The House floor record shows how many. On the next roll call Republicans had one more member than on the Hegseth vote, and on the one after that they had three more. Eleven Democrats would have made 215 against a Republican best of 214. Several said traffic held them on the way back from a reception hosted by Elect Democratic Women.

Remember when I said hold that thought? Women. In government. Something Hegseth very clearly opposes, along with the founder of his church network, who calls women’s suffrage a bad idea.

That women group’s super PAC also took $2.4 million from AIPAC’s super PAC, close to a third of what it raised. Most of the eleven Democrats have given their reasons for leaving Hegseth, from traffic to a medical procedure. Stevens is a different case. AIPAC’s super PAC put more than $30 million behind her in her Senate primary. She lost, endorsed the Republican two days before the election, and spent the votes of November 9 in the Republican cloakroom.

Sean Casten, an Illinois Democrat, put it down to lateness:

You’ve got to be on time for votes. No excuses.

He blamed Republicans for the outcome and said the House has yet to build the political case. That is the complicated explanation. It requires professional politicians to arrive late on the evening that their votes decided the result. Their leaders had chosen to leave the vote unwhipped. Caucus chair Pete Aguilar told reporters before the vote, “We didn’t put our finger on the scale.” And we’re not talking about just any old vote here. Trump and JD Vance both blamed the Iran War for the Republican losses in the midterms. Democrats failing to make the Hegseth vote are going to deserve harsh scrutiny for exactly the reasons we’re discussing here.

The simple explanation for the failure to vote starts with the reception called Elect Democratic Women. It was billed for new members from 4:30 to 6:30, with remarks at 5:00 and the House vote listed for 5:30. Drop Site obtained the RSVP list, which names 132 lobbyists, at least two of them from Lockheed Martin. Katherine Clark, the Democratic whip, is a founder of the group, and she voted against the motion. Julia Brownley sits on its executive board and Melanie Stansbury on its board of directors. Both were at the reception with Brittany Pettersen, and all three missed the vote. These are experienced members who know when the House votes. An empty seat on a motion that passed by seven counted the same as a yes. A group whose political arm takes AIPAC money held a reception that kept members of Congress from an impeachment vote, and that is corruption at work whatever each member intended.

Democratic women in a reception that interrupted their vote against one of the most openly mysoginistic leaders in history.

The filings show where the AIPAC money went this year. It went against the congressman who wrote the articles and into the group that hosted the reception. AIPAC supports the funding plan and Netanyahu calls it his own. Hegseth kept the job that would administer it.

The Christians who first lobbied for Zionism treated Jews as instruments of their own prophecy. Netanyahu’s plan hands Israel’s funding to a crusader’s office. Each side has reason to believe it is using the other.

But the real story here is the Elect Democratic Women reception. Six of the missing Democrats were voting again within twenty minutes, and eleven would have beaten every Republican who voted that evening.

Pete Hegseth spent sixteen minutes at the Pentagon podium praising his own wars and attacking Rep. Thomas Massie, the Kentucky Republican pressing articles of impeachment against him.

When the worst Defense Secretary in history reached the articles themselves, he answered them in one sentence:

Iran, the cartels, Maduro, Yemen, everyone was a lawful operation ordered by the commander-in-chief, then ordered by myself, notified to Congress and executed by American warriors who did their jobs.

That sentence closes the door on a case that the White House had kept open. The boat campaign began on September 2, 2025 with a strike that left two survivors clinging to the wreckage, and a second strike killed them. A war crime, or murder.

The White House had named Admiral Frank Bradley as the officer who ordered the second strike, and Hegseth told reporters he had moved on to his next meeting before it happened.

That same week Hegseth repeated that he had left the room before the order, and in the same answer said he would have made the same call.

Now he claims the whole cartel campaign, war crimes and all, as his own order.

The administration chose the legal frame for these unlawful killings. Its October 2025 notice to Congress declared a “non-international armed conflict” with the cartels and called their members unlawful combatants. That frame carries the Pentagon’s own rulebook with it. Section 18.3.2.1 of the DoD Law of War Manual requires every service member to refuse clearly illegal orders, and its example is “orders to fire upon the shipwrecked would be clearly illegal.” The War Crimes Act, 18 U.S.C. § 2441, makes the intentional killing of people placed out of combat a war crime in a non-international armed conflict, and 18 U.S.C. § 2 makes whoever willfully causes an offense punishable as a principal.

Hegseth delivered a death toll as his extrajudicial verdict: “218 narco terrorists dead where they should be.” The running count passed 230 in September. At least 22 of the dead survived an initial strike and were then hit again or died at sea. The families of two Trinidadian men killed in a strike have sued in federal court, and the relatives of a Colombian man say he was fishing when his boat was hit.

With regard to civilians, Hegseth focused on a charge easiest to deny.

As to the claim that the American military targets civilians, well, that is a lie.

He said he would “dignify this claim no further.”

Massie’s article is actually specific enough to withstand such amateur statements, and isn’t affected by such empty protest. The resolution says Hegseth cultivated a culture he boasts of as “maximum lethality, not tepid legality,” which chilled the offices responsible for preventing and responding to civilian harm, and it names the Shajareh Tayyebeh girls’ elementary school in Minab. A preliminary Pentagon investigation found that a US Tomahawk hit the school on the first day of the war, using target coordinates Central Command built from outdated Defense Intelligence Agency data. Senators put the dead at about 120 children and at least 175 people in total, and senior military leaders have held the finished investigation since April while those senators press for its release. Massie charges that the safeguards Hegseth dismantled foreseeably cost civilian lives.

Hegseth tried to shift focus to a charge of intent.

He counted the Iran war as “under 40 days of sustained combat”, which is a patently absurd way to describe months of war from the Department he insists on calling War. It’s not the Department of Sustained Combat. And he cited Reagan in Lebanon and Clinton in Kosovo as War Powers disputes that ended short of impeachment:

War powers resolution or not.

Congress is different, and went much further, this time. Invoking section 5(c) of the War Powers Resolution, the House voted 215 to 208 on June 3 and the Senate voted 50 to 48 on June 23 to direct the removal of US forces from hostilities with Iran. A concurrent resolution bypasses the president, so the vote was symbolic by design. The blockade imposed after the ceasefire remains in force, and by October MOAA was describing the Iran conflict as in its seventh month. The War Powers Resolution relies on Congress for enforcement, through funding and through impeachment. Massie’s first three articles are that enforcement.

The Hegseth torture of American history depends on one word.

In the 250 years of our American Republic, no Secretary of War or Secretary of Defense has ever been impeached for carrying out lawful military operations.

The first cabinet officer ever impeached was a Secretary of War. Arguably the rename to the Department of War should have jogged his memory of the impeachment. The House impeached William Belknap unanimously on March 2, 1876, over kickbacks from a frontier trading post, and a Senate majority voted against him on all five articles. It ran short of the two-thirds needed to convict. Belknap’s offense was graft, which Hegseth excludes with the phrase “military operations.” Then he tosses in the word “lawful.” It’s of course telling, since that is the exact word the articles dispute.

His other claims aren’t looking so good either:

Hegseth Statement	Reality
“Biden had let it happen.” (Houthis)	Biden launched Operation Poseidon Archer against the Houthis on January 11, 2024.
“We didn’t start this war. Iran did.”	The US and Israel launched the strikes that began it on February 28, 2026.
“Nothing has gotten through.” (blockade)	Iran-linked tankers ran it using fake flags, shell companies and disabled tracking.
“We control the Strait of Hormuz.”	After the ceasefire Iran kept routing ships through its own waters (CRS).
“Maritime smuggling down at least 65%”	The DEA found cocaine price and availability unchanged by the strikes.
“We, along with them, control the canal.”	The sites stay under Panama’s control, and Panama can end the deal on six months’ notice.
NATO “committed to 5% of GDP for their own defense”	3.5% for core defence and up to 1.5% for infrastructure and resilience, by 2035.
“Biden couldn’t recruit anyone.”	Every DoD branch met its FY2024 recruiting goal.
“Nobody was lost in the mission in Venezuela.”	About 75 people died in the raid, including 32 Cuban officers.
“Senators, in cute videos, have suggested the same.”	A grand jury declined to indict them, and a federal judge ruled Hegseth violated Kelly’s First Amendment rights.
“defeated ironically by a Navy SEAL”	Hegseth campaigned for that SEAL on the eve of the primary.

In the question period he described the doubt he says critics want to plant in the partner governments of his counter-cartel coalition:

if you go after these cartel members in your country, maybe someone will go after you later.

His answer to that was “we’re working really hard with these countries to prevent that kind of lawfare.” Really hard? Is that the best description he could come up with? He closed his statement with a message to the troops:

don’t blink, ignore the noise, please, never hesitate.

The Law of War Manual he oversees requires a sailor to refuse an order to fire upon the shipwrecked. Hegseth’s message to the same sailors, like a poison pill presented from the podium without blinking, is to never hesitate. This, minutes after attacking the patriotic senators who reminded troops they can refuse illegal orders.