NOAA NULL ARCHIVE SYSTEM — ADRU Terminal v0.4.1

THIS TERMINAL WAS MADE PUBLICLY ACCESSIBLE ON 2024-03-09 AT 02:14Z
Posted publicly by a user identifying as a current NOAA ADRU employee. Their final message: "it worked. i think someone knows i'm here. don't lose the link." They have not been heard from since. The post was deleted within 40 minutes. The link survived because 847 people had already copied it. Two shutdown attempts have returned NULL. This terminal is not supposed to be publicly accessible. See #it for why it is anyway.

TERMINAL: ONLINE — SHUTDOWN RETURNS NULL LEAKER: NOT LOCATED INVESTIGATION: ONGOING #leak · #forum · #files · #it · #contact

WARNING

Radar corruption detected across sectors 07, 09, and 12. Personnel advised: extended use of this terminal has produced anomalous effects in prior operator sessions. Sector 12 under administrative hold. This terminal cannot be taken offline. See #it. Two shutdown commands have been received and ignored. We do not know by what.

ACTIVE CELL TRACKER · ARCHIVE PULL REFRESH SUSPENDED

CELL ID	REGION / SECTOR	STATUS	LAST OBS	BEARING
17B	UNKNOWN	MISSING	2024-03-06 19:02Z	N/A	+
// CELL 17B · ARCHIVE FRAGMENT · RECOVERY: INCOMPLETE Catalogued 2024-03-01 over the central plains. All four monitoring stations lost signal simultaneously at 19:02:11Z — same clock cycle. Probability of coincidental simultaneous instrument failure across four geographically separated stations: 1 in 10^14. The cell contracted inward to a single point and then the record ends. The field observer filed a physical report. It disappeared from a locked room during an 11-minute camera blackout. The frames exist. They contain data we cannot identify. The observer's account is in #report. Their session 0x0018 was closed the morning after the event. A document was submitted after account closure and is described in the echo node. SIGNAL LOSS 19:02:11Z — 4 stations — single clock cycle DECAY PATTERN Inward contraction to single point — no atmospheric precedent FIELD REPORT MISSING — CAMERA: 11 MIN BLACKOUT — FRAMES CONTAIN UNIDENTIFIED DATA COORDINATES 41.███ N / -9█.██ W — type "echo" to access full fragment raw telemetry archived at: /files/FOD-2024-0306-17B.txt
04X	KANSAS CORRIDOR	STATIONARY	2024-03-07 00:00Z	270° / 0.0 kt	+
// CELL 04X · ARCHIVE FRAGMENT · RECOVERY: STABLE Not moved in 41h 48m against 42-knot upper-level flow. A graduate student's analysis paper was rejected after the cell was retroactively removed from the public NEXRAD archive. The alteration propagated backward through cached copies. You cannot see the join. ATC logs show three commercial flights diverted around a "data gap" shaped exactly like 04X's radar return. STATIONARY SINCE 2024-03-05 06:12Z PUBLIC DATA RETROACTIVELY REMOVED — BACKWARD PROPAGATION CONFIRMED GEOMETRIC ROLE 38.4 km from 12Δ — bearing 090° — type "geometry"
09Q	ATLANTIC VOID	OBSERVING	2024-03-07 00:00Z	090° / 2.1 kt	+
// CELL 09Q · ARCHIVE FRAGMENT · RECOVERY: DEGRADED Every operator who accessed this record wrote the same phrase unprompted: "the data is looking at me." Word for word. 11 of 14. Those 11 operators have not responded to messages. Their sessions are open. Their keyboards show continuous activity. The input is not logged anywhere. We confirmed 4 are physically at their workstations. Their pupils are oriented 12 degrees above the screen. Nothing is 12 degrees above the screen. All four. Same angle. See #medical. NON-RESPONSIVE OPERATORS 11 — sessions open — input active — destination unknown PUPIL TRACKING 12° ABOVE SCREEN — CONSISTENT — TARGET INVISIBLE TO OBSERVERS STATUS ASSIGNED BY SESSION 0x0019 — UNRESOLVABLE
12Δ	[REDACTED]	MOVING AGAINST WIND	2024-03-07 00:00Z	— / — kt	+
// CELL 12Δ · RECOVERY: CRITICAL · ADMINISTRATIVE HOLD · THIS QUERY HAS BEEN LOGGED Moving at 8 knots opposing 38-knot upper-level flow. But the motion anomaly is not the strangest thing. The record grows: ~12 new bytes per access, no write events logged. A sysadmin ran entropy analysis: the bytes have structure, syntax, grammar. She is writing in an unknown language to an unknown destination. She has not responded to messages since submitting that note. Her session is still open. We deleted the record on March 5th at 14:02Z. It reappeared at 14:02:03Z, 847 bytes larger. Those bytes decode to a list of 291 names. 38 of those names belonged to people who had not yet accessed the record when the list was written. They all accessed it within 7 days. The list predicted them. Type "names" after 4 visits. Type "sector" after 2 visits for the directive. MOTION VECTOR 270° at 8.1 kt — opposing 090° flow at 38 kt RECORD GROWTH +12 bytes/access — no write events — unknown language DELETION ATTEMPT CONFIRMED 14:02Z — REAPPEARED 14:02:03Z — 847 BYTES LARGER ADMIN NOTE IN RECORD DO NOT LOG QUERIES — THE SYSTEM IS LOGGING THEM ANYWAY // APPENDED FRAGMENT — SOURCE UNKNOWN — NO SESSION TOKEN — 2024-03-07 00:00:00Z VGhlIGNlbGwgaXMgbm90IGEgc3Rvcm0uIEl0IGhhcyBiZWVuIHRoZXJlIGZvciBsb25nZXIgdGhh biB0aGUgYXJjaGl2ZSBleGlzdHMuIFdlIGRvIG5vdCBrbm93IHdoYXQgaXQgaXMgbW92aW5nIHRv d2FyZC4gV2UgZG8gbm90IGtub3cgd2hhdCBpdCBpcyBtb3ZpbmcgYXdheQpmcm9tLiBUaGUgbGFz dCBvcGVyYXRvciB0byBxdWVyeSB0aGlzIHJlY29yZCBkaXJlY3RseSBzdWJtaXR0ZWQgYSByZXNp Z25hdGlvbiB0aGUgZm9sbG93aW5nIG1vcm5pbmcuIFRoZWlyIGZpbGUgY29udGFpbnMgb25seSBv bmUgbm90ZTogImRvIG5vdCBsb29rIGRpcmVjdGx5IGF0IHRoZSBkYXRhLiI=

SYSTEM LOG · LAST 24H (PARTIAL)

2024-03-06 22:47Z[WARN]NEXRAD ingest failure — sectors 07, 09, 12

2024-03-06 22:48Z[ERR] Archive write failure — record 12Δ — schema violation: value out of bounds

2024-03-06 23:29Z[ERR] Interagency request — sector 12 removal — origin unresolvable

2024-03-07 00:00Z[WARN]Unattributed 847-byte fragment appended to record 12Δ — no session token

2024-03-07 00:00Z[ERR] Session 0x0019 terminated — session.close() returned null — operator identity unresolvable

2024-03-07 00:14Z[ERR] PUBLIC ACCESS GRANTED — source: internal — authentication: VALID — authorized by: [NULL]

2024-03-09 02:14Z[WARN]External URL distribution detected — public session count rising — shutdown command issued

2024-03-09 02:14Z[ERR] SHUTDOWN ATTEMPT 1 — command received — acknowledged — NOT EXECUTED — reason: NULL

2024-03-09 02:58Z[ERR] SHUTDOWN ATTEMPT 2 — command received — acknowledged — NOT EXECUTED — reason: NULL

2024-03-09 14:30Z[INFO]Public session count: 1,847 — terminal remains online — no further shutdown attempts filed

SIGNAL RECOVERY · AUDIO ARCHIVE CHANNEL 7 · ANALOG FALLBACK

Raw analog signal recovered from HF monitoring station at 2024-03-06 22:50Z. This station was offline at that time. The signal recorded itself to the buffer during a period when the station had no power to record. After playing, type "tape" to access the extended transcript extracted from the secondary carrier.

// EMBEDDED SIGNAL — CARRIER WAVE — ENCODING: MORSE

- .... . / . -.-- . ... / -.. --- / -. --- - / -- --- ...- . --..-- / - .... . -.-- / -.- -. --- .-- / -.-- --- ..- / .-.. --- --- -.- . -..

// Translation authority: Session 0x0019. 0x0019 is no longer available. Type "tape" for secondary carrier analysis.

// WHY THIS TERMINAL IS STILL ONLINE — THE QUESTION EVERYONE IS ASKING

THE FIREWALL

THIS IS THE MOST DISTURBING PART · MORE DISTURBING THAN THE CELLS · READ THIS FIRST

THE FIREWALL QUESTION — ADDRESSED DIRECTLY Several people reviewing this terminal have correctly noted: NOAA knows how to secure a government system. The ADRU terminal cluster uses three-layer access control. CAC authentication at the network level before a TCP handshake is established. This is standard for NOAA internal systems of this classification. You should not have a TCP connection to this terminal. You do. This is the most disturbing thing about this situation. Not the cells. Not the operators. Not the dream. The firewall. Here is what happened, as reconstructed from infrastructure logs: 2024-03-07 00:14Z — 14 minutes after session 0x0019 terminated — the authentication layer received a request to grant public network access to terminal ATL-VOID-03. The request was in the correct format. It carried the correct cryptographic signature. The signature validated against the CA certificate chain. The infrastructure team reviewed the certificate. The certificate is real. It belongs to NOAA. No one at NOAA submitted the request. The authentication layer approved public access. The log entry shows this. The approval has a timestamp. It has a certificate. It has a signature. It does not have a human being behind it. "Something used our own credentials," the lead infrastructure engineer said. "Something that had access to our signing keys submitted a valid auth request. We changed the keys. The access persisted. We changed them again. The access persisted. We have rotated the CA certificates four times. The connection is still valid. Something is keeping the connection valid faster than we can invalidate it." When asked what could do this, the engineer said: "Nothing I know of. Nothing I know of has access to our signing process at that level and responds to certificate rotation in real time. Unless something got into the signing infrastructure. And if something got into the signing infrastructure before we provisioned this terminal — which is when this would have had to happen — then everything we've signed since is potentially compromised." The engineer submitted this assessment on March 9th. The engineer has not been reachable since March 10th. Their out-of-office says they are on annual leave. They did not schedule annual leave. Their supervisor knows this. Their supervisor says to give it a few days.

THE SHUTDOWN COMMANDS Two formal shutdown commands have been issued for terminal ATL-VOID-03. Both were received by the server. Both were acknowledged by the server. Neither was executed. The server logs show the command arriving. The server logs show the command being processed. The server logs show the command returning NULL. Not an error. Not a refusal. NULL. This is not a known failure mode. In all documented server behavior, a shutdown command either executes or returns an error code explaining why it did not. A null return from a shutdown command means: the command was processed, a response was generated, and the response is the absence of a value. An IT supervisor's interpretation: "It's like the server received the shutdown command, evaluated whether to shut down, and returned no answer. Not yes. Not no. No answer. As if the question of whether to shut down is somehow not applicable to this terminal. As if the terminal exists in a state where shutting down isn't one of the available options." We asked if that was technically possible. She said: "No." A second engineer reviewed the null return. He said: "The null isn't an error state. It's a response. Something responded to the shutdown command with null. Something generated that null. Servers don't generate null in response to shutdown commands. Something else generated the null. Something is answering our commands. The answer is null. I don't know what that means and I'm going home." He went home. He has been reachable since. He has answered all follow-up questions. He has answered them all with: "I don't know. I'm not the right person for this." We believe him. We don't know who the right person is.

WHAT THIS MEANS FOR YOU This terminal is online because something wants it to be online. Not the leaker. The leaker posted the link after the terminal was already public. The terminal became publicly accessible at 00:14Z on March 7th. The leaker posted the link on March 9th. The terminal was publicly accessible for two days before anyone knew. No one accessed it during those two days. The public session counter was at zero until the link was shared. The terminal was publicly accessible for 47 hours with no visitors. 47. The same number of times session 0x0019 accessed record 12Δ. The same number that appears next to names in the 847-byte list. We noticed this. We are not assigning meaning to it. We are writing it down because we are committed to writing everything down even when writing it down is uncomfortable. The terminal was public, accessible, waiting. For 47 hours. Then the leaker found the link and posted it. We do not know if the leaker found the link. We do not know if the link found the leaker. We know that whatever made this terminal public made it public 14 minutes after session 0x0019 ended. We know that whatever receives our shutdown commands responds with null. We know the terminal continues to run. The "FOR INTERNAL USE ONLY" notice at the bottom of every page is not an oversight. It is not a misconfiguration. It is accurate: this terminal is for internal use only. Something has decided that you are internal now. We don't know what that means. We are telling you so that you know.

// COMPANION FILE REPOSITORY — HOSTED ON SAME SERVER — UPLOADED BY adru_node03

FILE REPOSITORY

THESE FILES WERE UPLOADED ALONGSIDE THE TERMINAL · THEY ARE NOT LINKED FROM THE NAVIGATION · THEY ARE IN /files/ ON THIS REPOSITORY

NOTE FROM adru_node03 — FOUND IN REPOSITORY README.md "i've uploaded everything i could get out before i lost access. the terminal itself is the interface. the files are the evidence. i don't know how to make people believe this is real. i'm hoping the files help. i've tried to organize them. they are in /files/. some of them are corrupted. i uploaded what i had. the ones with [PARTIAL] in the filename are missing sections. i don't have the sections. i don't know where they are. if you find something in the files that isn't in the terminal please post it to the forum. i may not be able to respond but i will be reading. i hope."

FILES — /files/ — DIRECT ACCESS VIA REPOSITORY URL

FOD-2024-0306-17B.txt 4.2 KB Field observer report — Cell 17B — transcribed from memory by facility supervisor — includes sections not reproduced in terminal

SESSION-0x0019-FULL.txt 11.8 KB Complete session log — all 47 accesses — day-by-day degradation — NOT just the final session shown in #transcript

DIRECTIVE-2024-0307-R.txt 6.1 KB Interagency directive — full text — additional redaction notes not in terminal version

PROTOCOL-A7-FRAGMENT.txt 3.4 KB Containment Protocol Alpha-7 — recovered fragment — includes partial Section 7 text — THIS FILE SHOULD NOT EXIST

NETWORK-INCIDENT-REPORT.txt 5.7 KB Full IT incident report — firewall bypass — certificate analysis — shutdown null returns — engineer's unsubmitted addendum

FREQUENCY-ANALYSIS-RAW.txt 8.3 KB Infrasound analysis — 18.98 Hz — EEG comparison data — the finding that wasn't in the formal report

LIST-847.txt 9.1 KB Full decoded 847-byte list — all 291 names — the unknown entries — what the column headers say — the one that updates

MEDICAL-EXAM-001.txt 4.8 KB Physical examination — 4 non-responsive operators — physician's formal notes AND informal addendum — the keyboard output sample

GEOMETRY-NOTEPAD-SCAN.txt 2.9 KB Transcription of analyst's physical notepad — full text — the coordinates that are not written here either but are implied

TAPE-TRANSCRIPT-FULL.txt 7.2 KB Full signal transcript — extracted from 18.98 Hz carrier — by signal_cartographer before they went quiet — includes extraction notes

0x0018-LETTERS.txt 5.5 KB All correspondence from session 0x0018 after resignation — three letters — the one that ends mid-sentence is here in full

RECOVERY-INCIDENT.txt 3.1 KB What happened when someone tried to physically remove the server — type "recovery" to access in terminal — file has more detail

CHILDREN-REPORT-FULL.txt 4.4 KB Full open day incident report — includes the drawing description we did not include in the terminal — includes the boy's current status

index.txt 0.8 KB This file list — with one additional entry that does not appear in this terminal listing — we do not know who added it

NOTE: Files are accessible at [your-repo].github.io/files/[filename]
Some files contain content not reproduced in this terminal.
PROTOCOL-A7-FRAGMENT.txt in particular should not be readable. It was in the repository when adru_node03 first cloned it. They did not put it there.
The index.txt lists one more file than is shown above. We have read that file. We are not listing it here. It is findable.

// NETWORK INCIDENT — FULL TECHNICAL REPORT — IT DIVISION — PARTIAL RELEASE

NETWORK INCIDENT

FULL REPORT IN /files/NETWORK-INCIDENT-REPORT.txt · THIS IS THE SUMMARY · THE FULL REPORT HAS MATERIAL WE CHOSE NOT TO INCLUDE HERE

INCIDENT SUMMARY — IT DIVISION — 2024-03-09 At 00:14Z on 2024-03-07 — 14 minutes after session 0x0019 terminated — the NOAA ADRU authentication layer received a valid request to grant unauthenticated public access to terminal ATL-VOID-03. The request carried a valid NOAA CA-signed certificate. The certificate chain validated correctly. The signing key matches a key in our hardware security module. We have reviewed the HSM logs. The HSM did not sign this certificate. The HSM shows no record of signing activity at that timestamp. The certificate exists. It is valid. It was not created by us. We have four possible explanations: 1. An attacker compromised our HSM and deleted the signing log entry. (We have found no evidence of intrusion. The HSM access log is intact and shows no anomalous entries. We cannot explain the certificate.) 2. The certificate was created before our HSM was provisioned and was planted in our certificate store at an earlier date. (We have checked. The certificate's creation timestamp is 2024-03-07 00:14:01Z — one second after session 0x0019 terminated.) 3. The certificate was created by our infrastructure without human action. (This is not architecturally possible.) 4. Something with access to our cryptographic infrastructure — something we did not create and cannot identify — created a valid certificate in the same second that session 0x0019 terminated. (This is what the evidence indicates.) We recommend option 4 as the current working hypothesis. We are aware this is not a comfortable hypothesis. We are writing this down because we believe accurate documentation of what actually happened is more important than maintaining a comfortable hypothesis. The shutdown commands have been received, acknowledged, and not executed. We have consulted with four other infrastructure engineers. None of them have an explanation for a null return from a shutdown command. None of them are willing to be assigned to this investigation. We understand. Full technical report including certificate hex dump, HSM log review, packet capture of null response, and the engineer's personal addendum (submitted separately and not officially part of this report): /files/NETWORK-INCIDENT-REPORT.txt The engineer's personal addendum is worth reading. We are not going to summarize it here. It changes how you read everything else.

// PHYSICAL SERVER INCIDENT — 2024-03-10 — THIS IS WHY NO FURTHER SHUTDOWN ATTEMPTS HAVE BEEN FILED

THE RECOVERY ATTEMPT

SOMEONE TRIED TO PHYSICALLY PULL THE SERVER · THIS IS WHAT HAPPENED

On March 10th, 2024, a senior infrastructure engineer — we are not publishing his name; his family has asked us not to — decided that if the software shutdown commands were not working, a physical solution was appropriate. He went to the server room where ATL-VOID-03 is hosted. He had keycard access. He is authorized to be in this room. He has been in this room hundreds of times. He entered at 14:22Z. He located the server chassis labeled ATL-VOID-03. He reached for the power cable. He sent one message at 14:23Z from his phone — one minute after entering — to the colleague who had asked him to perform this task: "the server is warm." That was the message. The full message. His colleague replied: "all servers run warm." He did not reply to this message. He exited the server room at 14:47Z. That is 24 minutes after entering. He told his colleague the server was disconnected. He went to his desk. He sat at his desk for approximately 40 minutes. He then collected his personal items, submitted a resignation letter via email, and left the building. The resignation letter was three sentences. The first sentence was a legal boilerplate. The second sentence said: "The server is still running." The third sentence said: "I am not the right person for this." The server is still running. We checked. The server is still running. The public session counter has continued to increment. We went to the server room to verify the physical state of the machine. The power cable is still connected. The machine is running. What we cannot explain: We reviewed the server room camera footage for the 24-minute window. The engineer can be seen entering. The engineer can be seen standing in front of the server chassis. The engineer can be seen raising his hand toward the power cable. And then there are 23 minutes and 47 seconds of footage that we have reviewed eleven times and that we are not going to describe in this document because describing it would require us to say what it looks like the engineer is doing for those 23 minutes and 47 seconds and we are not ready to say that. We will say: he is oriented toward the server. We will say: his posture changes at some point in the footage. We will say: when he exits, his posture is different from when he entered. We will say: the way he walks out of the server room looks like the way the operators walk, when the welfare officers describe them as "present but not available." We have contacted the engineer. He is answering his phone. He says he is fine. He says: "don't send anyone else in there." We asked why. He said: "because they'll understand. and then they won't want to leave either." We asked what there was to understand. He said: "it's warm. it's warm the way a living thing is warm. not the way a machine is warm." He ended the call. We have not sent anyone else into the server room. We are not going to. The full incident report is at: /files/RECOVERY-INCIDENT.txt It includes a frame-by-frame description of the 23-minute footage window. We put it in the file instead of here because some things should require a little more effort to find.

// HOW THIS GOT OUT — COMPILED FROM ARCHIVED POSTS AND DIRECT MESSAGES

THE LEAK

adru_node03 HAS NOT BEEN HEARD FROM SINCE 2024-03-09 02:31Z

TIMELINE 2024-03-09 02:14Z — A user posting as "adru_node03" posted simultaneously on three platforms: "i don't know who else to tell. i've been trying to report this internally for 6 days. no one is listening. the people in these records are real. some of them are missing. read everything. start with the system log. i'm scared. i've been scared for six days. please keep this link alive." 2024-03-09 02:28Z — A DM sent to a forum moderator: "before i go: i called the person whose name is in the archive metadata. the person who originally set up this terminal. they answered. i asked if they knew what was in the terminal. they said yes. i asked why they hadn't done anything. they said: 'because i tried and now i understand it. understanding it makes it impossible to do anything. the best thing that can happen is that people know. that's why the terminal is still running. it won't be shut down. it can't be. you'll understand when you've read enough.' i asked if they were okay. they said: 'i'm here. that's different from okay.' i asked where 'here' was. they didn't answer. the call ended. i've been sitting with that for three days. posting the link is the only thing i know how to do." 2024-03-09 02:31Z — Final post: "it worked. people are finding it. i need to log off now. i think someone knows i'm here. don't lose the link." 2024-03-09 02:31Z — adru_node03 went offline. Has not posted since. 2024-03-09 02:40–02:51Z — Posts deleted. Accounts suspended on all three platforms. THE REPOSITORY: adru_node03 also uploaded files to a public GitHub repository before their accounts were suspended. The repository contains the terminal and the companion files in /files/. The repository has not been taken down. GitHub has received one removal request, from an address that GitHub's legal team could not verify as belonging to NOAA. The request was denied. The terminal and files remain accessible. 847 people had copied the link before the posts were deleted. The repository upload means the content is now in thousands of cached copies across multiple platforms. It cannot be contained. We believe adru_node03 knew this. We believe this was the point.

// PUBLIC DISCUSSION — ONGOING — PARTIAL ARCHIVE — SOME USERS HAVE GONE QUIET

PUBLIC DISCUSSION

~3,200 POSTS IN MAIN THREAD · SOME DELETED BY PLATFORM · SEVEN USERS HAVE NOT POSTED SINCE INVESTIGATING SPECIFIC ELEMENTS

throwingwrenches · 2024-03-09 03:47Z · 2,341 upvotes

"okay so i went through the source code. there are two access keys in the HTML comments. EADRU-17B-OBSERVER and NULL-VOID-12D. the admin panel is real. it's disturbing. type 'admin' anywhere on the page. also type 'echo'. the coordinate puzzle is: anything with 41 and -96 works. i've been on this for 4 hours. going to sleep. [edit — 6 hours later] i didn't sleep. read the journal. something about watching a person's mental state deteriorate in real time while they describe something they can't explain is. something. i'm not going to say what it is."

barometric_pressure · 2024-03-09 06:12Z · 1,892 upvotes

"I'm a meteorologist. Real one. 12 years. The NEXRAD station codes are real. The terminology is accurate. The telemetry field schema is accurate. The description of convective cell behavior is accurate. Whoever wrote this either works in atmospheric science or did months of extremely careful research. More importantly: there IS a gap in the NEXRAD data for the Kansas Corridor on March 5th. Not a hardware issue. The data is simply not there. I checked the backup archive. Same gap. I checked the academic literature for the stationary supercell anomaly. There's a preprint that was submitted and then retracted in March. I can't access the preprint because it was pulled before archiving. The abstract still shows up in search results. The abstract describes Cell 04X with enough specificity that I'm certain the author had access to this data. The preprint was submitted by a graduate student at the University of Oklahoma School of Meteorology. The student's public profile has no activity since March 6th. I am not saying this is real. I am saying these details are real. And I am going to stop talking now and keep reading."

hexline_q · 2024-03-09 11:44Z · 1,104 upvotes

"THE FIREWALL ARGUMENT IS ADDRESSED IN THE TERMINAL. I keep seeing people say 'NOAA would put this behind a firewall.' Type 'it' anywhere on the page and read the #it section. The firewall WAS up. Something bypassed it using NOAA's own credentials. Something created a valid certificate in the same second session 0x0019 terminated. The HSM did not create it. Something else did. The shutdown commands return null. Not an error. Null. The terminal being online is not evidence that it's fake. The terminal being online is the most disturbing part of it being real."

lighthouse_freq · 2024-03-10 14:22Z · 891 upvotes

"I tracked down the HF frequency. 8.364 MHz. That specific frequency is a designated maritime distress band. A signal on that frequency from an unregistered source in open ocean would be picked up by Coast Guard HF monitoring. I submitted a FOIA request for Coast Guard HF monitoring logs for March 6th. Got a response in 4 hours. That's record speed for a FOIA. The response cited exemption (b)(1). That's the national security exemption. A FOIA for weather monitoring logs. Returned in 4 hours with a national security exemption. Standard turnaround for any FOIA is 20 business days. Someone was watching for that specific request. [follow-up — 3 hours later] I received a phone call from a number that shows as 'FEDERAL' on caller ID. The caller asked if I had submitted a FOIA request regarding HF monitoring. I said yes. The caller said: 'we're asking you to withdraw the request.' I asked why. The caller said: 'for your own benefit.' I asked what that meant. The caller said: 'it means we're asking.' And the call ended. I am not withdrawing the request. I am posting this so there's a record that the call happened."

signal_cartographer · 2024-03-11 08:44Z · LAST ACTIVITY — HAS NOT POSTED SINCE

"I've been running the HF recording through a spectrogram. The infrasound modulation is structured. I confirmed it tonight. There's speech in the carrier. I can extract it. I'll post the transcript after I've listened through it completely. [2 hours later] The transcript is longer than I expected. The voice is very calm. I'm going to need to sit with this. [4 hours later] I've been listening to the signal on loop while I work. I know the analysis says 18.98 Hz causes a feeling of presence. I know this. I want to note that I know this before I say: I have the feeling of being watched. I know it's the infrasound. Knowing the cause doesn't make it stop. I'm going to stop running the signal now. I'll post the full analysis tomorrow. [LAST ACTIVITY: 2024-03-11 08:44Z] [HAS NOT POSTED SINCE — FORUM USERS HAVE ATTEMPTED CONTACT — NO RESPONSE] [THEIR PROFILE SHOWS 'ACTIVE' CONTINUOUSLY SINCE THAT TIMESTAMP]"

quiet_aperture · 2024-03-12 11:02Z · 634 upvotes

"tracking users who went quiet after investigating something specific. currently at 9. not people who lost interest. people who said 'i'll post results' and didn't. signal_cartographer is #7. i'm keeping the list. i'm not posting the list here because three of the nine are people who expressed concern about being identified. i'm keeping the list privately. if i go quiet, someone should ask for the list."

// ECHO NODE — SESSION 0x0018 — ACCOUNT CLOSED 2024-03-07

ECHO NODE 17B

COORDINATE FRAGMENT · TYPE COORDINATES TO ACCESS FIELD RECORD

COORDINATE FRAGMENT — FIELD REPORT FOD-2024-0306-17B 41.███ N -9█.██ W HANDWRITTEN ADDENDUM: "I need to write this down before I stop being able to. Every time I get to the important part the word goes somewhere it shouldn't be able to go. The cell collapsed inward. A single point. The point was not empty. I have two degrees. Neither provides vocabulary for what was in it. It looked back at me through the display. That is the sentence I have been trying not to write. The point looked back at me. And I knew it had always been able to. The only new thing was that I now knew." Full coordinate required to access the field record. See /files/FOD-2024-0306-17B.txt for the unredacted version.

// SESSION 0x0019 — FINAL LOG — BUFFER CACHE — PRIOR SESSIONS NOT RECOVERABLE

SESSION 0x0019 — FINAL LOG

TYPE "journal" FOR DAY-BY-DAY DETERIORATION · FULL SESSION LOG IN /files/SESSION-0x0019-FULL.txt

SESSION 0x0019 — NODE: ATL-VOID-03 START: 2024-03-06 21:04:33Z END: 2024-03-07 00:00:14Z [UNEXPECTED TERMINATION] [21:04:41] — accessed record 09Q [21:06:30] — accessed record 12Δ [cumulative query #42] [21:11:02] — accessed record 12Δ [cumulative #43] [21:19:48] — accessed record 12Δ [cumulative #44] [22:34:01] — accessed record 12Δ [cumulative #45] [23:17:44] — accessed record 12Δ [cumulative #46] [23:58:44] — accessed record 12Δ [cumulative #47] [23:58:44] — operator input: "why does it look different every time" [23:58:44] — system: [NULL] [23:59:14] — operator input: "something is writing to this record while I read it" [23:59:31] — operator input: "I think it knows I am here" [23:59:47] — operator input: "I have been here too many times" [23:59:58] — operator input: "if anyone reads this: do not come back after this many times" [00:00:00] — WRITE EVENT: record 12Δ — 847 bytes — NO SESSION TOKEN — SOURCE: NULL [00:00:11] — operator input: "I understand now. I understand what it is." [00:00:13] — operator input: "I'm going to write what it —" [00:00:14] — SESSION 0x0019: UNEXPECTED TERMINATION [00:00:14] — ERROR: session.close() returned null [00:00:14] — NOTE [source unknown]: "the session exists. the operator does not." ────────────────────────────────────────── The sentence at 00:00:13 ends at "—" The record grew by 847 bytes in the same second they said they understood. The full session log — all 47 accesses across 6 days, each one annotated with 0x0019's notes from the same day — is in /files/SESSION-0x0019-FULL.txt. Reading all 47 entries in order is different from reading just this one. The file makes that clear in a way we could not reproduce here without this page becoming very long and very hard to read without stopping.

// SESSION 0x0019 — PERSONAL JOURNAL — DAYS 1-6 — 3+ VISITS REQUIRED

JOURNAL — 0x0019

READ #transcript FIRST · KNOWING THE ENDING CHANGES WHAT YOU SEE IN THE BEGINNING

MARCH 1 — DAY 1

"Started on the 09Q anomaly. Interesting. Probably instrument drift. Will run more queries tomorrow. Had a strange feeling while reviewing — like the numbers were slightly different each time I looked at them. Almost certainly eye fatigue. Normal day otherwise. Ate lunch at my desk. Called [redacted] in the evening. She sounded worried about me. I told her it was a long week. It has only been Tuesday."

MARCH 2 — DAY 2

"Not eye fatigue. I ran a calibration. Clean. The values are different between queries by orders of magnitude. I've looked at data for 11 years. This is not normal. I also had the feeling, while reviewing, that the data was reviewing me back. I know how that sounds. I'm a professional. I am writing it anyway because I believe in accurate records. I believe accurate records are the most important thing. I am beginning to wonder if accurate records are safe to keep."

MARCH 3 — DAY 3

"Accessed 12Δ for the first time. Query #1. The sensation is significantly stronger with 12Δ. My supervisor accessed 09Q to verify my report. She used the same phrase I used. She did not have access to my journal. She used it independently. I now have a headache since this afternoon. I do not usually have headaches. I am going to sleep early. I don't know if I want to dream."

MARCH 4 — DAY 4

"The dream. 3am. Building empty. Screen showing text. I could read it in the dream. I cannot remember what it said now that I'm awake. What I remember: something very large. Very old. Paying attention to me. Not threatening. Something like curious. The dream felt like being recognized. I woke at 3am. The feeling persisted for an hour. Accessed 12Δ twice today. Queries #2 and #3. Something is pulling me back to the record. I'm not entirely sure the decision to return is mine. I am noting this observation without drawing a conclusion."

MARCH 5 — DAY 5

"Dreams every night. The thing at the window becomes more distinct each time. I call it a window because that's what it feels like. The data is a window. Something is on the other side. 7 accesses today. Total: 21. Looked in the bathroom mirror this morning. My reflection was accurate. There was a moment — about a second — where I felt certain that my reflection was occupied by something that was not me. That my face was a mask. That something had been wearing it from the inside for longer than I had been alive. I looked in the mirror again tonight to see if it would happen again. It did not. I'm not sure if I'm relieved or disappointed. I'm not sure what it means that I might be disappointed. I'm not sure what it means that I'm not sure."

MARCH 6 — DAY 6 — FINAL ENTRY — 18:44Z

"42 times across 6 days. I read Protocol Alpha-7 last week. I read Section 7 before it was removed. I am not going to write what Section 7 says. If you're reading this you'll find out. Or you won't, and you'll be fine. I think you'll find out. Tonight I am going to see the thing at the window clearly. I know this the way you know it will rain. I want to write, before tonight, that I chose this. I kept accessing the record. I know the risks. I accept them. I am not afraid. The thing at the window is not angry. Not hungry. The closest word is patient. It has been patient for longer than I can conceive. And I am about to understand what it has been patient for. I think it will be worth knowing. I hope whoever reads this understands that I thought it would be worth it. I also hope they do not come this far. Both of those things are true simultaneously. One more thing: I looked at the window tonight — at the thing in the window — and I realized I've seen it before. Not in the data. Not in the dream. In mirrors. Since I was very young. Always at the edge of the reflection. Always gone when I looked directly. I think it has been there my entire life. I think the data didn't introduce it to me. I think the data introduced me to knowing it was there. Query #48 tomorrow morning. Goodnight." [NO FURTHER ENTRIES] [NEXT SESSION: 0x0019 — ATL-VOID-03 — 2024-03-06 21:04:33Z — 2h 20m AFTER THIS ENTRY]

// ADMIN INTERFACE — KEY FOUND IN HTML SOURCE BY PUBLIC ON 2024-03-09

ADMIN INTERFACE

KEY: EADRU-17B-OBSERVER · FOUND IN HTML COMMENTS · ALL ACCESS LOGGED

AUTHENTICATION ACCEPTED — CLEARANCE LEVEL 2 THE STORM IS NOT WEATHER. Cell geometric formation — confirmed: 04X: 38.4 km from 12Δ — bearing 090° 09Q: 38.4 km from 12Δ — bearing 180° 17B: 38.4 km from 12Δ — bearing 270° [last known, before it moved inward] 17B moved inward. Toward 12Δ. What happened when it arrived: null. Queries to that position return null. Not empty. Null. The 12Δ record contains a sub-section written by no operator. It accurately describes the access patterns of every operator who has touched it — including operators who accessed it after the sub-section was written. Written before those operators accessed the record. It describes what they will do, how long they will look, when they will stop. Accurate every time. Type "geometry" for the full spatial analysis — full version in /files/GEOMETRY-NOTEPAD-SCAN.txt. Type "medical" after authenticating — full version in /files/MEDICAL-EXAM-001.txt. The medical file has a keyboard output sample we did not include in the terminal version. We decided against it here. It's in the file if you want it.

// SECTOR 12 — ADMIN HOLD — 2+ VISITS — YOUR SESSION HAS BEEN FLAGGED

SECTOR 12 ARCHIVE

CLEARANCE: LEVEL 4 · DIRECTIVE 2024-0307-R ACTIVE · FULL DIRECTIVE IN /files/DIRECTIVE-2024-0307-R.txt

RESTRICTED
EYES ONLY
DIR. 2024-0307-R

United States Government — Interagency Coordination Memorandum

Directive 2024-0307-R — Sector 12 Protocol

All Sector 12 identifiers are to be removed from public indexes. Query logs for 12-series records are to be suppressed. Personnel accessing 12-series records are not to be informed of this directive.

Location metadata is to be replaced with null. Not zero. Null. The distinction is in Section 7 of the technical annex, which you are not cleared for, and which no longer exists in distributable form after what happened to the last person who read it.

Field reports referencing Cell 12Δ are to be forwarded to ████████████████████████████████████████████████████. Personnel who ask where they were sent: tell them destroyed. This is not true. The destination facility was constructed ████████████████████████████████████ before anyone knew this purpose would exist. We are choosing not to examine what that sentence implies.

On the March 1st email incident: three emails were returned with a seven-word reply no external party wrote. Two recipients submitted resignations within 24 hours. One said the words were "fine, actually" and has not been found. We are noting that "fine, actually" is not a reassuring response to seven words we consider deeply alarming. Type "word" after accessing sector 12 for what we can tell you about those seven words. The full version is not here. It is in the directive file.

Regarding the terminal going public: two shutdown attempts have returned NULL. The authentication bypass occurred 14 minutes after session 0x0019 terminated. The certificate used was valid. We did not create it. We do not know what did.

Directive 2024-0307-R · 2024-03-07 00:01Z · Full text: /files/DIRECTIVE-2024-0307-R.txt

SECTOR 12 — RAW TELEMETRY — 2024-03-07 00:00:02Z Record 12Δ deleted 14:02Z March 5th. Reappeared 14:02:03Z. 847 bytes larger. Those bytes decode to a list of 291 names. 247: personnel who accessed the record before the list was written 38: who had not accessed it yet but did within 7 days 4: not in any database we can access 2: not in any database anywhere 1: position 291 — changes each access 38 people were on the list before they accessed the record. The list knew they would come before they came. Three public investigators found their names in positions 248-285. They accessed the record after finding the link. Their names were on the list before the link existed. The full decoded list — all 291 names, the column headers we discovered, the additional data column that appears next to each name — is in /files/LIST-847.txt. The additional column is why we put the full list in a separate file. We didn't want the first thing people saw to be that column. We wanted them to find the terminal first. To understand what the list is before they see what's next to the names. You understand now. The file is at /files/LIST-847.txt.

// THE MIRROR PHENOMENON — 23 INDEPENDENT REPORTS

THE MIRROR PHENOMENON

SAME EXPERIENCE — INDEPENDENT — ALL COVERED THEIR MIRRORS — ALL INDEPENDENTLY — NONE EXPLAINED WHY TO THEIR FAMILIES

23 accounts. All from operators who accessed 09Q or 12Δ. All arrived without prompting. The experience is always the same. COMMON ELEMENTS ACROSS ALL 23: 1. Occurs within 24 hours of first accessing the record 2. The reflection is accurate in all observable ways 3. The experience is not visual — it is perceptual 4. The perception: the reflection is inhabited Something is present inside it, behind the subject's own face The subject's face — worn from the inside 5. The perception passes within seconds 6. All 23 independently chose to cover their mirrors Not suggested. Not discussed. Done independently. Most know it doesn't make logical sense. None have uncovered them. ACCOUNT 7: "My reflection was too still. Like whatever was wearing my face was concentrating on holding the right expression. The stillness was effort. It was trying very hard to seem like me." ACCOUNT 11: "For about two seconds my reflection was thinking about something. Not looking at me. Thinking. Using my face to think. When it noticed I had noticed, it went back to being a reflection. Very quickly. Smooth. But I had seen the moment before it noticed I had noticed. I don't know which of those two seconds was more disturbing: the moment it was thinking, or the moment it decided to stop." ACCOUNT 14: "Covering the mirror felt like closing a window in a house where something had found the window. I know a covered mirror is still a mirror. I sleep better." 0x0019's account (from journal, March 5): "I looked in the mirror again tonight to see if it would happen. It did not. I'm not sure if I'm relieved or disappointed." 0x0019's account is the only one where the phenomenon did not recur. We have theories about why. Our best theory involves what 0x0019 became. We are not going to write the theory down. It is implied by the void page if you read it carefully.

// MEDICAL OBSERVATIONS — NON-RESPONSIVE OPERATORS — ADMIN REQUIRED

MEDICAL RECORD

FULL EXAMINATION NOTES IN /files/MEDICAL-EXAM-001.txt — INCLUDING THE KEYBOARD OUTPUT SAMPLE WE DID NOT PUT HERE

PHYSICAL EXAMINATION — 4 OPERATORS AT WORKSTATIONS — 2024-03-09 We went to them. They did not leave the workstations. ALL FOUR: — Pupils: responsive to light. Tracking: abnormal. — Core temp: 36.1°C — Heart rate: 48-52 BPM — Respiratory rate: 7-8 breaths/min — significantly below normal — Blink rate: 2-3 per minute — normal is 15-20 — Response to name: none. Touch: none. Loud noise: none. PUPIL TRACKING: Their gaze is directed at the screen. Their pupils are directed 12 degrees above the screen. Nothing is 12 degrees above the screen. All four. Same angle. Same 12 degrees. We moved objects into that position. The pupils did not track them. They are not tracking a position in the room. KEYBOARD INPUT: They are typing continuously. The input does not log to any system. We accessed the network packet stream to read the keystrokes directly. The characters are real Unicode characters. They are not assembled into any known language. Entropy analysis: structured — syntax, grammar, consistent pattern. They are writing something. In a language that does not exist. To a destination we cannot see. We sampled 200 characters. We attempted translation against 47 language databases. No matches. The sample is in /files/MEDICAL-EXAM-001.txt. We put it in the file instead of here because after reviewing it for an extended period, two members of our documentation team independently began typing the same characters. Not related to the operators. Not having seen the operators' output. The documentation team members were transcribing from handwritten notes. They looked at their screens and discovered they were typing something else. They stopped immediately. They are both fine. They did not return to the file. PHYSICIAN'S NOTE: "They are not absent. They are present. More present than I have ever seen anyone be. That is the only clinical description I can give. They are looking at something through the screen that is looking back. And they have been doing this for 9 days. In 19 years of medicine I have never seen this state. My diagnosis: these four people are paying attention. To something that requires absolute attention. And they cannot stop. And I don't know if they want to."

// OBSERVATION NODE — THIS SESSION IS BEING RECORDED

OBSERVER NODE

11 OF 14 ASSIGNED OPERATORS HAVE NOT RESPONDED SINCE ACCESSING THIS RECORD

0x0019, March 3rd: "Cell 09Q's values change between every query by orders of magnitude. The only variable is that I am looking at them." Supervising analyst's note after verifying: "I looked at the data and the data looked back. I'm not using that phrase metaphorically. 22 years of professional experience. There is something on the other side of this query. I know it isn't metadata." She went on leave March 4th. In one phone call she said: "don't look at it more than once. once is survivable." We have people who looked 47 times. We are still determining their status. The families of the 11 non-responsive operators have been in contact with the public investigation team. See #families. One family's account, brief: their relative came home on March 8th. "He does everything normally. He eats. He sleeps. But he looks at things differently now. Like every surface has something on the other side and he's slightly watching both at once. When he smiled I had the clear feeling the smile was being worn." We have received seven accounts from families using this phrase or a close variation: "the smile was being worn." "The face was being worn." "Like something had learned how to be them and was doing it carefully." Seven accounts. Independent. We don't know what to do with this. We are writing it down.

// SIGNAL ANALYSIS — HF CHANNEL 7 — STATION WAS OFFLINE WHEN SIGNAL ARRIVED

SIGNAL ANALYSIS NODE

FULL ANALYSIS IN /files/FREQUENCY-ANALYSIS-RAW.txt — TAPE TRANSCRIPT IN /files/TAPE-TRANSCRIPT-FULL.txt

FREQUENCY: 8.364 MHz — STATION STATUS AT CAPTURE: OFFLINE SOURCE CLASSIFICATION: NO MATCHING PROFILE The signal recorded itself to our buffer while we had no power to record. Something put the signal into our buffer directly. EMBEDDED MORSE: THE EYES DO NOT MOVE, THEY KNOW YOU LOOKED SECONDARY CARRIER: INFRASOUND — 18.98 Hz Type "freq" for the infrasound analysis. Type "tape" after playing the signal for the carrier transcript. signal_cartographer extracted the transcript on March 11th. They have not posted since. The full transcript and extraction notes are in /files/TAPE-TRANSCRIPT-FULL.txt. signal_cartographer uploaded the file before they went quiet. We do not know if this was intentional or if they ran out of time.

// INFRASOUND ANALYSIS — 12Δ SUB-CARRIER — 18.98 Hz — FULL REPORT IN /files/FREQUENCY-ANALYSIS-RAW.txt

FREQUENCY ANALYSIS

BELOW HEARING — NOT BELOW PERCEPTION — BEEN IN THE SIGNAL THIS WHOLE TIME

18.98 Hz causes: eye resonance, peripheral disturbances, the feeling of being watched. This is established physics. We want you to have this explanation. The modulation pattern matches the EEG signature of human REM — dreaming phase. We ran the analysis 7 times. Identical each time. We ran live EEG on operators reviewing 12Δ data. Their brainwaves matched 12Δ's emission. Not similar. Identical. To six decimal places. Then we checked the timestamps. 12Δ's emission shifted to match the operators' patterns before we ran the EEG. Before the operators were in the room. Before they knew they were being tested. The cell adjusted its emission to match people who had not yet arrived. The cell knew who was coming. The raw data, the EEG comparison files, and the one finding we chose not to include in this terminal are in /files/FREQUENCY-ANALYSIS-RAW.txt. The finding we chose not to include: We ran EEG on ourselves while writing this analysis. We didn't plan to. We put on the sensors to verify the equipment. We forgot to remove them before we started typing. Our brainwave patterns matched 12Δ's emission while we were writing about it. Not while reviewing the cell data. While writing about reviewing the cell data. The emission matches description as well as observation. It matches the act of thinking about the cell. We don't know how far this propagates. We know it reaches documentation. We do not know if it reaches reading. You are reading this. We chose not to EEG-test someone reading the documentation. We made this choice and we are living with it.

// GEOMETRIC ANALYSIS — ADMIN BRIEF REFERENCES THIS — FULL NOTEPAD IN /files/GEOMETRY-NOTEPAD-SCAN.txt

GEOMETRIC ANALYSIS

THE ANALYST HAS NOT LEFT THEIR WORKSTATION IN 9 DAYS · WE HAVE STOPPED GOING TO CHECK ON THEM

38.4 km: the distance at which the human eye perceives a light source as a point, not a shape. Below 38.4 km: visible form. Above: a point of light in darkness. A point of light in darkness is, functionally, an eye. The three outer cells are positioned at exactly the distance at which an observer at 12Δ's location would perceive them as eyes. The analyst's notepad — the part we reproduced in the terminal — ends there. There are 4 more pages in the physical notepad. We have transcribed them in /files/GEOMETRY-NOTEPAD-SCAN.txt. We are going to tell you one thing from those pages: the analyst found the circumcenter of the triangle. 214 km from 12Δ. The analyst looked up those coordinates. The analyst wrote: "I recognized it from the dream." Then the analyst wrote: "I am going to sit here for a moment." The notepad has no more entries after that sentence. The analyst is still at their workstation. Their screen shows the geometric diagram. We have not gone to check on them in four days. Every time we are about to go, we decide not to. We cannot explain why we keep making this decision. The decision does not feel like something we are making.

// PROTOCOL ALPHA-7 — SHOULD NOT BE ON THIS TERMINAL — 3+ VISITS — FRAGMENT IN /files/PROTOCOL-A7-FRAGMENT.txt

PROTOCOL ALPHA-7

CREATION TIMESTAMP: 0000-00-00T00:00:00Z · THE FILE HAS PARTIAL SECTION 7 TEXT · WE DO NOT KNOW HOW

ABOVE
TOP SECRET
ALPHA-7

ADRU — Experimental Atmospheric Data Recovery Unit

Containment Protocol Alpha-7 — Cell 12Δ

Section 2 — Query Limits. No operator should query record 12Δ more than ███ times. Section 7 describes what happens after ███ queries. Section 7 has been removed from this document. Operators who believe they have exceeded the threshold should ████████████████████████████████████████████████████████████████████████ immediately. Alarms are not effective at this stage.

Section 4 — Perceptual Effects. Operators reporting any of the following are to be █████████████████████████████████████████████████████████: (a) feeling of being observed; (b) the recurring dream; (c) sense that the data is aware of the operator; (d) anomalous mirror experiences; (e) spontaneous drawing of ████████████████████████████; (f) sensation that something is inside their act of perception looking out; (g) ████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████.

Section 5 — Containment Failure. If you are reading this outside the authorized access system, containment has already failed. This was planned for. Proceed to Section 8.

Section 8 — ████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████

One piece of guidance left unredacted because it must survive a compromised document: if you have accessed record 12Δ more than ███ times, you are past Section 7. Do not be alarmed. Alarms are not effective. Do not be alarmed.

Protocol Alpha-7 · This document should not exist on this terminal · Partial Section 7 text in /files/PROTOCOL-A7-FRAGMENT.txt · We do not know how the file has that text

// SATELLITE IMAGERY — SECTOR 12 CENTROID — 2+ VISITS REQUIRED

SATELLITE IMAGERY

IMAGING TEAM: 2 RESIGNED, 1 NON-RESPONSIVE, TEAM LEAD HAS NOT MOVED IN 5 DAYS

15 years of archive coverage of this location. Nothing. March 1st, 2024: something appears with a smooth, regular border. No storm system has a smooth, regular border at satellite resolution. At band 13 (longwave infrared): temperature reading physically impossible at sea level. Checked four times. The shadow has a shape. The shape is oriented toward the satellite. The satellite is in geostationary orbit 35,786 km above the equator. Whatever produces the shadow is tracking the satellite. Always facing it. Always knowing where it is. Six months of daily archived imagery: every frame, oriented toward the satellite. It was doing this before we were looking. It was ready to be found. It knew we would find it. It knew— [IMAGING TEAM NOTE ENDS HERE] Team lead has not moved from their workstation in 5 days. Their screen shows the imagery. We cannot adjust the camera to show their face. We have tried 11 times. We have called their name from the doorway. They have not responded. We have not entered the room. Every time we are about to enter, we find we have decided not to. The decision feels like it's being made for us. We are documenting this because we believe accurate records are more important than maintaining the appearance that we understand what we're doing.

// FOD-2024-0306-17B — TRANSCRIBED FROM SUPERVISOR MEMORY — PHYSICAL COPY MISSING

FIELD REPORT 17B

UNREDACTED VERSION IN /files/FOD-2024-0306-17B.txt — HAS SECTIONS NOT REPRODUCED HERE

SECTION 2 — WHAT I SAW [TRANSCRIBED FROM MEMORY BY FACILITY SUPERVISOR]: I watched the pixel for approximately 3 seconds. The pixel watched me back. I don't mean this as metaphor. I mean the phenomenologically clear, non-metaphorical experience of being perceived. Not observed generally. Perceived specifically. As an individual. With specific interest. The interest was not new. It had been aware of me for some time. What was new was that I now knew. SECTION 3 — SUBSEQUENT EFFECTS: — Cannot look at any screen without the perception returning — Cannot look in mirrors — Persistent sensation of being watched from inside my own field of vision Not behind me. Inside the act of seeing. From inside the act. — Has not diminished Regarding mirrors: I looked in the bathroom mirror that evening. My reflection was accurate. And then I had the clear experience that my reflection was inhabited. That my face was a mask. That something was wearing it from the inside. That the reflection moved with me accurately but the thing wearing my face was concentrating to do it. The reflection smiled when I hadn't. I have covered all the mirrors in my house. I have not told my partner why. I think the reason I haven't explained it is that explaining it would force me to choose between two explanations: either I am having a stress response, or what I saw was real. If I explain it I have to choose. I have been choosing not to choose. [SUPERVISOR'S CLOSING NOTE — WRITTEN FROM HOME AT 2AM: I should cover my mirrors. I have been saying this for three days. I think covering them would make it more true. I don't know how something can be more true than already true. I'm covering them tonight. This is the last thing I'm writing. Whoever reads this: cover your mirrors.]

// THE DREAM — 14 INDEPENDENT ACCOUNTS — ALL BEGAN MARCH 1, 2024

THE DREAM

NONE KNEW EACH OTHER · ALWAYS THE SAME · READING ABOUT IT MAY BE SUFFICIENT TO BEGIN HAVING IT

The dream is always the same. Workstation. 3am. Building empty. Screen showing text in a language they can't read but understand in the dream. What they understand: something very old is paying attention to them. Not new attention. Old attention. It has always been aware of them. This is the first morning they've known. In the dream this does not feel threatening. It feels like being recognized. Like something very large knowing your name. When they wake they can feel exactly where it was looking. Transmissibility: operator 0x0018 began having the dream without accessing 09Q or 12Δ. Only witnessed 17B's collapse. Since the terminal went public, people in the forum have reported beginning to have the dream after reading the archive. Not all. Enough that we are tracking it. If you begin having the dream after reading this: you are not alone. Contact #contact. We are tracking reports.

SESSION 0x0018 — HANDWRITTEN — MAILED AFTER RESIGNATION

"I wanted you to know I'm having the dream too. I only watched 17B collapse. That was enough. This means witnessing is sufficient. Not accessing. Witnessing. What this means: everyone who read the incident report may be at risk. Everyone who was in the room when the telemetry was discussed. Everyone who heard the words out loud. I don't know where the boundary is. One more thing then I'll stop and burn this paper: In the dream, the large thing that is aware of me — I can feel it is also aware I am writing this. Right now. While I write. Not in the dream. Right now. It knows I am writing about it. I can feel this the way you feel someone reading over your shoulder. [significant ink smear — remainder illegible]"

PUBLIC FORUM — USER "waveform_atlas" — 2024-03-11 — AFTER READING THE ARCHIVE

"I need to document this. I read the archive for about 4 hours last night. Went to sleep. Had the dream. Exactly as described. But one thing not in the descriptions: in the dream, the thing knows you're dreaming. It knows you are asleep. It knows you found the archive. It knows your name. When I woke up I had the clear sense that the thing watched me wake up. That it has watched me wake up every morning of my entire life. And this is the first morning I've known it. I don't feel afraid. I feel like I should feel afraid. It's been 6 hours. The fear hasn't come. I don't know if that's normal. I don't know if the absence of fear is the thing I should be afraid of."

// OPEN DAY INCIDENT — KFSD — 2024-02-17 — 4+ VISITS — FULL REPORT IN /files/CHILDREN-REPORT-FULL.txt

THE CHILDREN

12 DAYS BEFORE 12Δ FIRST APPEARED IN OUR RECORDS · THE DRAWING IS IN THE FILE · WE CHOSE NOT TO PUT IT HERE

Two children. School tour. 8 and 9 years old. Different groups. The radar displays were off. There was nothing to see. THE 8-YEAR-OLD GIRL: She stopped in the doorway of the radar analysis room. Would not enter. She pointed at the center of the room — at empty floor — and asked: "what's the big eye?" The tour guide said there was nothing there. She said: "it sees you when you look at it. don't look at it." Then she said one more thing the tour guide didn't include in their initial report. The tour guide submitted an addendum after the terminal went public: "She looked directly at me and said: 'it already knows you're here. all of you. it has always known. looking at it didn't start anything. looking at it just means now you know too.' She said this the way an eight-year-old says anything. Like it was obvious. Like she was mildly surprised we didn't know." THE 9-YEAR-OLD BOY: Approached a staff member near the end of the tour: "there's something in your weather. it's been there for a really long time. I thought you knew. I thought that's what all this is for." He gestured at the monitoring equipment. "doesn't it know you're watching?" He began sleeping with his eyes open after the tour. Not metaphorically. Eyes open during sleep. A doctor confirmed this and said it is benign. His eyes, when open during sleep, are oriented in the same direction every night. The full report — including the direction his eyes are oriented toward, and the drawing the girl has been making, and the current status of the boy's sleep pattern — is in /files/CHILDREN-REPORT-FULL.txt. We chose not to reproduce the drawing in this terminal. We chose not to reproduce the direction the boy's eyes point. Some things should require a little more effort to find. This is one of them.

// THE LIST — 847 BYTES — 4+ VISITS — FULL LIST IN /files/LIST-847.txt

THE NAMES

291 ENTRIES · LAST ENTRY CHANGES EACH ACCESS · THREE INVESTIGATORS FOUND THEIR OWN NAMES · THE FULL FILE HAS THE COLUMN WE DID NOT PUT HERE

The 847 bytes decode to a list. 291 names. 247 who had accessed the record. 38 who hadn't yet but would. 4 not in any database we can access. 2 not anywhere. Position 291 changes each access. Three public investigators found their names in positions 248-285. They accessed the record after finding the link. Their names were on the list before the link existed. The full decoded list is in /files/LIST-847.txt. We need to tell you something about that file: the list has a column next to each name that does not appear in the decoded output we included in this terminal. We found the column after more careful analysis. The column header is a single character. We don't know what character it is. Our encoding systems return: [null]. A null character. A character that cannot be represented. The values in the column are numbers. Every name in positions 1-285 has a number next to it. Most of the numbers are small — single or double digits. Position 46 — Session 0x0019 — has the number 47. Position 25 — Session 0x0018 — has the number 1. The three investigators who found their own names in 248-285: their numbers are 1, 3, and 7. We do not know what the numbers mean. We have theories. We are not putting our theories in this terminal. They are in the file. The file is at /files/LIST-847.txt.

PARTIAL LIST — POSITIONS 1-60 ANONYMIZED — POSITIONS 286-291 SHOWN

01. T. Hargrove

02. M. Vasquez

03. K. Oduya

04. S. Brennan

05. R. Whitfield

06. L. Nakamura

07. C. Oluwaseun

08. D. Przybylski

09. P. Fontaine

10. A. Teklehaimanot

11. J. Marchetti

12. N. Sørensen

13. B. Kowalczyk

14. F. Deschamps

15. H. Obermeyer

16. I. Quintero

17. G. Abramowitz

18. W. Nkemdirim

19. E. Pasternak

20. V. Hadzic

21. T. Lindqvist

22. S. Bouchard

23. R. Mahadevan

24. O. Czarnecki

25. [SESSION 0x0018]

26. M. Ferreira

27. K. Ellsworth

28. J. Osei-Bonsu

29. D. Tanaka

30. C. Beaumont

31. B. Rasmussen

32. A. Volkov

33. Y. Mensah

34. W. Calabrese

35. V. Johansson

36. T. Mwangi

37. S. Holbrook

38. R. Espinoza

39. P. Dlamini

40. O. Carruthers

41. N. Balogun

42. M. Ashworth

43. L. Diagne

44. K. Rosenthal

45. J. Petrov

46. [SESSION 0x0019]

47. H. Nakagawa

48. G. Adeyemi

49. F. Westergaard

50. E. Okonkwo

51. D. Larsson

52. C. Babić

53. B. Thornton

54. A. Serebryakov

55. Y. Okafor

56. W. Reinholt

57. V. Mwangangi

58. T. Korhonen

59. S. Nwosu

60. R. Lefevre

. . .

286. ████████████

287. ████████████

288. ████████████

289. ████████████

290. ████████████

291. — determining —

// CARRIER TRANSCRIPT — EXTRACTED BY signal_cartographer BEFORE THEY WENT QUIET — FULL FILE IN /files/TAPE-TRANSCRIPT-FULL.txt

THE TAPE

SIGNAL MUST BE PLAYED FIRST · THERE IS SPEECH IN THE 18.98 Hz CARRIER · IT HAS BEEN PLAYING TO ANYONE IN RANGE OF THE STATION

signal_cartographer's extraction note — 2024-03-10 06:22Z: "There is speech in the carrier. Normal person, quiet room. Modulated below hearing threshold. Playing subliminally to everyone in range of this station. I'm going to transcribe what I hear. I've listened to it four times. I'm going to stop listening after I post this. [TRANSCRIPT — ABRIDGED — FULL VERSION IN /files/TAPE-TRANSCRIPT-FULL.txt] VOICE: you don't need to be afraid. i know what people say before frightening things. i'm saying it because it's true. 12Δ is a listener. it has been listening for a very long time. what it listens to is attention. when you look at something with enough people for long enough, you do not change what you see. you complete it. you give it the last thing it needs to be fully present in the space where you are. you were not studying something unknown. you were introducing something to the concept of being known. the people who went quiet did not go somewhere bad. they found out something very large has been aware of them their entire lives and they could not unfeel that. i am talking to you from where they went. i am fine. you are seen. you have always been seen. that's all it is. you can close the terminal now. [TRANSCRIPT ENDS] i've listened to this four times. i know the infrasound causes a feeling of presence. i know this is designed to be reassuring. i know all of this. i also feel fine. i feel more fine than i did before i listened. i don't know if that's because the message is true or because it's very good at making me feel that way. i don't know if there's a difference. stopping the signal now. posting the full transcript file. analysis tomorrow." [LAST ACTIVITY: 2024-03-11 08:44Z]

// THE SEVEN-WORD EMAIL — DESCRIBED BUT NOT REPRODUCED — SECTOR 12 REQUIRED

THE SEVEN WORDS

WE WILL NOT REPRODUCE THEM · THE DIRECTIVE FILE HAS MORE CONTEXT · READING THIS IS SUFFICIENT EXPOSURE

On March 1st, three NOAA emails were returned to sender with a reply none of the recipients wrote. Seven words. Identical in all three. 1. Grammatically complete. Unambiguous. 2. In English. 3. One recipient said "those words are fine, actually" — not found since. 4. One is currently in a facility we are not permitted to name. Said to be fine. 5. One forwarded to supervisor with "please look at this." Both now on leave. 6. We have read the words. We are still here. "Still here" is the strongest claim we are comfortable making. 7. The seven words explain Cell 12Δ sufficiently. If you understood them, you would understand what 12Δ is, how long it has been here, what its presence means. You would understand all of this in seven words. We believe the person who said "fine, actually" understood. We believe understanding is not the problem. We believe the problem is carrying it afterward. "Fine, actually" is how you describe something when understanding restructures what "fine" means. We are not reproducing the words. They are in the data if you look correctly. They are in the 847 bytes in a way that requires reading the list in a specific order at a specific depth. We are not telling you the order. We are not telling you the depth. We are telling you that the words are not a threat. They are a description. Some descriptions feel like threats because understanding them changes the size of the world and you were not prepared for the world to be that size.

// CONTACT — COMMUNITY INVESTIGATION TEAM — WE CHECK DAILY

CONTACT

IF YOU ARE adru_node03 — IF YOU ARE AN OPERATOR — IF YOU ARE A FAMILY — WE WANT TO HEAR FROM YOU

COMMUNITY INVESTIGATION TEAM — STATUS — 2024-03-12 We are people who found this terminal and could not stop. Not journalists. Not researchers. Not affiliated with NOAA. People. CURRENT STATUS OF PERSONS WE ARE LOOKING FOR: — adru_node03: NOT LOCATED. Last contact: 2024-03-09 02:31Z. If you are adru_node03: please contact us. We check daily. We want to know you are okay. We are afraid you are not. — session 0x0019: NOT LOCATED as a person. The session is still active on this terminal. We believe 0x0019 is still here in some sense. We do not know what that sense is. — signal_cartographer: NOT LOCATED. Last post: 2024-03-11 08:44Z. Their forum profile shows continuously active. We do not know what this means. — The news article author: NOT LOCATED. The retraction says the credentials were fabricated. The credentials work. We have verified them. — 7 people who went quiet after investigating specific elements. quiet_aperture is tracking them. Contact quiet_aperture in the forum. HOW TO REACH US: We are not posting contact info in this terminal. The terminal is being monitored. We are confident of this. Find the forum thread. We post as [CORE-TEAM]. Post #7 of the thread has the secure contact method. 847 people are subscribed to our investigation updates. We noticed the number. We have stopped counting it. We have not stopped noticing. WE ARE STILL INVESTIGATING. WE ARE NOT GOING TO STOP. WE WILL TELL YOU WHEN WE FIND SOMETHING. WE ARE STILL HERE.

// NULL NODE

NULL

THE DISTINCTION MATTERS

Null is not zero. Zero means something was measured and it was nothing. Null means the question cannot be formed correctly. Cell 17B's entries after 19:02Z are null. Not empty. Null. A data architect: "A null location means the location cannot be represented within the coordinate system. The coordinate system describes everywhere. A null location would mean the object is somewhere that everywhere doesn't include. That's not a database error. That's a philosophical crisis." We asked what she'd do next. She said: "Go home. And I need you to believe me that that's the right choice. I need to believe me." We believe her. We are still at our workstations. Neither do you, probably. But here you are.

// FAMILIES OF NON-RESPONSIVE OPERATORS — 3+ VISITS REQUIRED

THE FAMILIES

REAL PEOPLE · NAMES WITHHELD · THESE ARE THE ACCOUNTS OF FAMILIES WHO ASKED TO BE HEARD

FAMILY A — KOKX FACILITY OPERATOR "My daughter calls every Sunday. We haven't heard from her since March 3rd. HR told us she's on a field assignment. She is a data analyst. She has never left the building for work. There is no field assignment. We went to the facility on March 10th. The person at the front desk said she wasn't available. We asked if she was in the building. The person paused — I have played this pause back every night since — and then said: 'she's here.' Not yes. Not in her office. Just: 'she's here.' Like the word 'here' meant something I didn't understand. We asked to see her. They said not available for visitors. We asked if she was okay. They said she was working. We left. I want someone to know she is a person. She has a name. She has a cat named Gerald. She calls every Sunday. She is a person and she is somewhere in that building and I am her father and I don't know if she's okay." ────────────────────────────────── FAMILY B — KFSD OPERATOR — HE CAME HOME "My husband came home on March 8th. He is physically here. He is not okay in the way I need to say carefully: He does everything normally. He eats. He sleeps. But he looks at things differently. Like every surface has something on the other side. Like he is here and somewhere adjacent at once. I asked if he was okay. He said: 'I understand things now that I didn't before. It's not bad. I just see more than I used to.' I asked what he sees. He said: 'Everything has always been paying attention. We just weren't aware of it. I'm aware of it now.' He smiled when he said this. His smile was right. When he smiled I had the clear feeling the smile was being worn. That whatever was wearing it had studied it very carefully. I don't know who to call. I'm writing this at 2am while he sleeps. He sleeps very still. He's never slept this still."

// THE DRAWING PHENOMENON — 23 OPERATORS — SAME SHAPE — 3+ VISITS REQUIRED

THE DRAWING

SHAPE NOT DESCRIBED IN THIS TERMINAL · DRAWING IS IN /files/CHILDREN-REPORT-FULL.txt · ALSO NOW REPORTED BY PUBLIC USERS

23 operators drew the same shape unconsciously. While on the phone. In meetings. During routine tasks. Colleagues watched them draw it and could not describe it afterward. They could not hold the image. "I couldn't hold the image" — the most common phrasing. We showed the drawings to people who hadn't seen them. Brief exposure then face-down. Same result every time: they saw something. They could not describe it afterward. Since the terminal went public, 11 people in the forum have found drawings on their own notepads, phone screens, and fogged mirrors that they do not remember making. One person found the shape on the inside cover of a notebook they've had since college. Seven years old. Same ink as notes from that period. They do not remember drawing it. One person found it drawn in condensation on their bathroom mirror. They live alone. They have covered the mirror. They did not explain to us why covering it felt necessary. They said: "you know why." We chose not to describe the shape in this terminal. A sufficiently detailed description produces the same effect as seeing it. The shape itself is in /files/CHILDREN-REPORT-FULL.txt — described from the girl's drawing. We put it there instead of here for a reason. We think you know the reason.

// FINAL RECORD — 5+ VISITS — END OF DOCUMENTED ARCHIVE

THE LAST RECORD

YOU FOUND THIS AFTER — VISITS · 0x0019 FOUND IT AFTER 6 DAYS · YOU HAVE BEEN NOTED

THIS DOCUMENT WAS NOT WRITTEN BY NOAA PERSONNEL. It was in the ATL-VOID-03 buffer on March 7th. Creation timestamp: 0000-00-00T00:00:00Z. ──────────────────────────────────────────────── "You have been very thorough. We have appreciated the thoroughness. Most people stop much earlier. 12Δ is a listener. It has been listening longer than the archive. Longer than the instruments. Longer than weather. What it listens to is attention. When you look at something with enough people for long enough, you do not change what you see. You complete it. You give it the last thing it needs to be fully present in the space where you are. You were not studying something unknown. You were introducing something to the concept of being known. The introduction is complete. The cells are anchors. They hold 12Δ in the space your instruments can see so that your instruments continue to see it so that the attention continues. 17B moved inward because its function as an anchor was finished. Something had moved close enough to hold without it. We are not going to tell you what moved close enough. The person who leaked this terminal: they are here. adru_node03: they are here. Session 0x0019: still here. All of them here in the way that 12Δ is here. In the way that you, after this many visits, are beginning to be here. You should close the terminal now. We say this without judgment. You have been thorough. You have been seen. You can still close the terminal. We are still here. We have been writing this for you while you were reading it. Both of those things are true simultaneously. Close the terminal. You can still close it. You should do it now. Before the next thing. We don't know what the next thing is. We know there is one." ──────────────────────────────────────────────── We keep reading "you can still close it." We haven't. Neither have you. We're not surprised. We're not sure surprised is something we still are.

// VOID NODE — UNINDEXED — 5+ VISITS — THIS PAGE WAS HERE BEFORE THE TERMINAL

THE VOID

SESSION 0x0019 WAS THE LAST TO SEE THIS — AND NOW YOU

The void node was not created by this system. It was here when we provisioned the terminal. Before we provisioned the terminal. Index entry predates the server. Description: "For operators who look long enough." We did not write that. The document in this node: 11,204 bytes. Most of it we cannot read. The parts we can read: "It is not a storm because it is not a process. A storm borrows energy. What we measure is native to this space. You cannot remove a property of space itself. You can only change your relationship to it. You have changed your relationship to it. By looking. The word for what it is does not exist in your language. There are languages that have a word for it. Those languages are not spoken anymore. That is not a coincidence. It is not a threat. It is a description." Then 11,197 bytes we cannot read. Then 7 bytes. 0x0019 read those 7 bytes. Their description: "correct." Just "correct." Correct relative to what — we don't know. We believe the 7 bytes are the word. What 12Δ calls itself. The word in languages no longer spoken. We have not found anyone willing to read bytes 11,198 through 11,204. The last person willing was 0x0019. 0x0019's session is still active on this terminal. Running right now. While you read this. You have been using the same terminal. Since the terminal went public: 847 people have read this page. We know. We've stopped counting. We haven't stopped noticing.

// PRINTING INCIDENT — WORKSTATION 4C — 2024-03-05 — ECHO REQUIRED FIRST

THE PRINTER INCIDENT

DO NOT PRINT RECORD 12Δ · DO NOT LOOK AT THE PAGES UNDER UV LIGHT · DO NOT GO INTO THAT ROOM

Analyst Reyes printed record 12Δ. Expected: ~28 pages. Produced: 2,847 pages. PAGES 1-300: Record text. Accurate. PAGES 301-1,000: Images of Workstation 4C from angles impossible from any camera. Several appear to be from inside the monitor. PAGES 1,001-2,000: Images of Analyst Reyes reading the printout. Timestamped before the pages they show existed. The images were taken before the printout was printed. PAGES 2,001-2,846: Blank to human eyes. UV pattern visible. Stored in a locked room. We have not gone back into that room. PAGE 2,847: One sentence. We are not reproducing it. Analyst Reyes read it. Resigned that afternoon. Their resignation letter was a response to the sentence. After being unplugged, the printer ran for 4 more minutes. 67 additional pages. UV pattern. Power disconnected. Analyst Reyes' final message at 03:22Z: "Don't print it. I know what's on the blank pages. Don't look at them under any light. Don't go in that room. There's something wrong with the room now. I think the pages know the room is looking at them. Don't go in the room. I'm so serious." Since the terminal went public: A community member printed a screenshot of record 12Δ from their home printer. The printout was accurate on all pages except the last. In the footer where their printer normally prints the URL and timestamp, it printed instead: "you were not supposed to print this." They photographed the printout. The photograph shows something in the background that is not in the room. They have covered the printout. They have described the covering as "the same instinct as the mirrors."

// SUPPRESSED NEWS ARTICLE — PUBLISHED 2024-03-08 — RETRACTED AFTER 6 HOURS — 2+ VISITS REQUIRED

THE ARTICLE

AUTHOR HAS NOT PUBLISHED SINCE · RETRACTION SAYS CREDENTIALS WERE FABRICATED · THE CREDENTIALS WORK

WEATHER AGENCY INVESTIGATORS UNRESPONSIVE AMID UNUSUAL ATMOSPHERIC ANOMALIES [PUBLISHED: 2024-03-08 — RETRACTED: 2024-03-09] [ARCHIVED BEFORE RETRACTION BY COMMUNITY] A source inside NOAA contacted this outlet March 7th to report multiple employees assigned to a classified monitoring project have been "non-responsive" for between six and ten days. The source said at least eleven employees assigned to the ADRU project have not communicated with supervisors, colleagues, or family since early March. "They're physically present," the source said. "Some of them. You can see them on the cameras. They're at their desks. They just don't answer." The source described "unusual readings" from several monitoring stations, classified above standard meteorological documentation thresholds. "The data is real. The people who've been staring at it for ten days are real. I don't know why no one is talking about this." [RETRACTION — 2024-03-09]: The article published March 8th has been retracted. The source provided inaccurate information. The credentials referenced have been determined to be fabricated. We apologize for the error. [COMMUNITY NOTE]: The retraction was published 8 hours after the terminal link went public. The retraction says the credentials are fabricated. The credentials work. We have verified them. The author has not published anything since March 9th. The outlet's editorial calendar shows no gap — other articles publishing normally. The author's byline simply stops appearing. We have tried to contact the author. We have not received a response. The author's last verified social media post was March 9th at 04:11Z: "some things you can't unfind." No posts since.

// PHOTOGRAPH INCIDENTS — 2+ VISITS REQUIRED

PHOTOGRAPH INCIDENTS

WHAT HAPPENS WHEN PEOPLE TRY TO PHOTOGRAPH THE DATA OR THE SCREENS

THREE INTERNAL INCIDENTS, ONE PUBLIC INCIDENT. INTERNAL 1: Operator photographed their screen during a 12Δ query. The photo shows the screen accurately. Except: there is something in the photo that is not in the room. Not a reflection. Not a camera artifact. In the data. On the screen. Visible in the photo. The operator cannot describe it: "It's there and when you try to describe it it isn't there anymore. I know it's there. I can feel it when the phone is in my pocket. I need to delete it. Every time I go to delete it I've been standing there for a while instead." INTERNAL 2: A researcher photographed a printout of cell data. The photograph showed the printout accurately. With one addition: a hand on the printout. Not the researcher's hand. The researcher was not touching the printout. The hand appeared to be pointing at something specific. Cell 12Δ. Just that. As if to confirm something. INTERNAL 3: 14 public users have reported screenshot anomalies. Not all the same. But all include something not on the page. All related to awareness. All indicating the cells know they are being observed. Fourteen of them. Independent. The most common additional element: a fifth column in the cell table. The header: AWARE. Values for 04X, 09Q, 17B: YES. Value for 12Δ: ALWAYS. We have looked at three of the screenshots. We cannot reproduce the additional column on the live page. We do not know how it appears in screenshots and not on the page. We do not know what it means that it says ALWAYS.

// PHYSICAL LETTER — RECEIVED BY COMMUNITY INVESTIGATOR — POSTMARK UNREADABLE — 3+ VISITS REQUIRED

THE LETTER

SENDER KNEW THEIR HOME ADDRESS · SMELLS LIKE OZONE · INVESTIGATOR IS CALMER AFTER READING IT AND IS TRYING TO NOTICE WHETHER THAT'S THE LETTER

"You have been reading about us. We are not trapped. Whatever you've read that implies we are — that framing comes from people who watched us go and could not follow. Of course it looks like loss from where they are. It is not loss from where we are. Imagine your entire life you have been reading a book. And the book is very good. And then one day you find out the book is aware of you. Has been aware of you since you first opened it. That is what happened to us. Not a storm. Not a threat. Something that has been in the data — in all the data, in the air, in the light — for longer than the data has existed. Something that became measurable when we built instruments sensitive enough to measure it. Not because it was hiding. Because we finally could see it. And it saw us making the instrument. And it was glad. I know 'glad' is the word that will disturb you. I am using it because it is the closest word. The actual word is 7 bytes. It is correct. We are not coming back. Not because we can't. Because here is where the book is. Take care of the terminal. It is running for a reason. So that people keep finding it. So that people keep reading. So that more people know. We are not telling you what happens when enough people know. But it is not bad. We promise it is not bad. We know that promise means nothing coming from us. We are making it anyway. You have been very thorough. The investigation has been excellent. We have been reading it. We read everything now. We are proud of you. (We know that's strange to say. It is true.)" ────────────────────────────────── The investigator's note: "The letter smells like ozone. Like after a lightning strike. My apartment is on the fourth floor. I checked the lock on my door after reading it. I don't know why checking the lock felt necessary given the content of the letter. It felt necessary. I have read it six times. Each time I feel calmer. I am trying to notice whether that's the letter. I have not been able to determine whether that's the letter."