When every break becomes a pattern¶

Seven readings have produced seven different shapes, a revenue loop, a gradient, a ledger, a threshold, a revolving door, a standing contact, a mesh. That variety is either a lens finding real differences between states or a lens loose enough to fit anything, and from outside the two look the same. A frame that explains everything explains nothing, so the test is not where the reading fits but where it breaks. Four candidates present themselves, and the trouble is in what becomes of each.

The first is the unit of analysis. The vocabulary assumes a state cyber actor, a single hand to name and indict, and Lithuania has none, only a mesh of national, allied, commercial and volunteer bodies with no core to point at. But this is not the state actor exposed as a fiction. Lazarus and Sandworm are not people, and they are not inventions either; they are handles fixed to clusters of activity because the institutions that indict and sanction need stable objects to act on. The real observation is compression, not fiction: attribution squeezes networks into names because action requires a name. And that observation does not break the reading. It joins it. A state with a nameable actor has one substrate, a state with a mesh another, and both are read.

The second is a case that cuts the other way. Russia is read as tolerating a criminal market it can reach when it suits, and in 2022 it arrested REvil suspects, the state policing the very market the reading calls tolerated. That is a genuine challenge, and it is here that the reading is caught doing the thing it warns against. The first instinct was to say the arrests did not hold, no durable prosecution, the activity resumed, so the boundary was porous after all. But that is closing the edge after the fact, reading the later record to rescue the earlier claim. The evidence does not decide between selective enforcement, a diplomatic signal, and a policy that changed and failed. Tolerance, occasional enforcement and strategic use are not even exclusive; a state can do all three. The arrests show enforcement capacity, not an impermeable boundary and not a porous one. What would break the reading is not an arrest but a control case: a state with Russia’s conditions, the weak rule of law, the surplus of idle operators, the standing use for deniable proxies, that kept a clean line between itself and its criminals all the same. Same substrate, no overlap. Russia is not that, and no such case has been set beside it, so the challenge is neither met nor a break. It is unresolved, and the reading quietly kept its place.

The third is the edges that will not close: Iran’s intention behind the restraint, Israel’s arrow from a government’s want to a particular product, the offensive American operations behind the published doctrine. In each the reading reaches a wall and stops. Stopping is honest, but what it admits is this. These are all states picked because their cyber activity is loud enough to read. The seven were chosen for having vivid signatures, which is choosing cases on the very outcome the substrate is meant to explain. The states where the substrate might have predicted activity that never came were never in the row to be counted.

The fourth is the pattern itself. No shape rests on a single leak, the Russian gradient stands on prosecutions and sanctions and attribution as much as on a crew’s chats, the Chinese ledger on indictments as much as on the dump. But the leak is what made each legible, and a shape brought into focus by one disclosure is partly the shape of that disclosure. The worry is not only that a shape will move when the next leak lands. It is that some of the outline was drawn by the light it was seen in, and the question is not whether the shapes shift but how much of them was there before anyone looked.

Side by side, the four are worse than any one alone. A state with a named actor is a substrate; a state with a mesh is a substrate; a counter-example that does not hold is a substrate; missing evidence is a substrate; a distorting lens of leaks is a substrate. Every observation has been turned into confirmation, which is exactly the elasticity that marks a frame explaining nothing. The four breaks did not break anything. They were the frame declining the fight and calling the refusal depth.

The reason is structural. The reading runs backward, from a behaviour that occurred to the conditions that make sense of it, and anything that occurred can be made sense of that way. That alone does not condemn it; most useful frames begin as retrospective explanation. What it has not yet done is make a risky prediction, one it could be caught getting wrong. It could: where a behaviour becomes more likely, which kind of actor appears, what relationships hold, where the evidence collects. Making one would mean fixing the conditions before the intrusions are looked at, from sanctions exposure, the education pipeline, the control structure and the commercial ecosystem, with nothing like “has a Lazarus” admitted as a condition, since that is the outcome wearing the costume of a cause. Until it makes one and is checked against it, it works more as a lens, bringing a pattern into focus, than as a theory, which earns the name by being placed where it could be wrong.

What would place it there is not another vivid case but an awkward one, and there are two kinds. The first is a missing signature, a state with the same substrate conditions but not the expected behaviour. The second is a missing substrate, the same behaviour without the conditions the reading claims produce it. The first would show the mechanism incomplete; the second, unnecessary. Under both sits the simpler-account test, plain capability, opportunity and profit; if those explain the same cases equally well, the substrate has added vocabulary, not explanation.

The tests not yet run¶

Four of the seven make a prediction sharp enough to lose. Each names what it expects, what would count against it, the comparison that has not been made, and the simpler account it has to beat.

None of the four has been run, and the last column is where the reading would spend something. The North Korean alternative is the weakest of the four, since the Panel’s record of the groups’ subordination to the Reconnaissance General Bureau cuts against it, and an alternative that loses on the evidence is still the test being run; that would be the first row closed. So the reading has not failed, and it has not been vindicated. It has been tested for usefulness, and it does draw real distinctions between states; it has not been tested for discrimination, whether it could have drawn them otherwise. The essay that set out to catch the frame absorbing its challengers came nearest to absorbing one itself. Until one of those awkward cases is set beside it, the substrate reading is a way of seeing, not yet a claim that could be wrong.