When oil traders watch shipping lanes, they measure risk in nautical miles. The narrowest point of the Strait of Hormuz—21 miles across—sounds manageable until the actual shipping lanes in each direction are just two miles wide, separated by a two-mile buffer zone. That’s 1.2 miles of navigable water carrying 20% of the world’s oil. A single explosive mine floating in the wrong place doesn’t just threaten one tanker; it threatens the entire flow.

Iran demonstrated this leverage last week when the Islamic Revolutionary Guard Corps threatened to “set ablaze” any vessel using the strait. Within hours, hundreds of tankers came to a halt. Oil prices spiked from $69 to $119 per barrel in three days—the fastest surge since the 1970s oil shocks—before Trump’s hints of de-escalation sent them tumbling back to $90. The price spike matters, but the speed matters more: a credible threat to a 1.2-mile corridor can disrupt global energy markets faster than any policy response can contain it.

This is why arguments for reducing Middle Eastern engagement consistently stumble over basic arithmetic. Alternative routes keep appearing in policy briefs as theoretical solutions, yet the numbers reveal why they cannot substitute for an open Hormuz. Saudi Arabia’s East-West Pipeline can carry 5 million barrels per day, and the UAE’s Fujairah pipeline adds another 1.8 million. Against Hormuz’s current 20 million barrels daily—with Saudi Arabia alone exporting 5.5 million barrels through the strait—these alternatives represent supplemental capacity, not replacement infrastructure. Operating both pipelines at maximum capacity wouldn’t cover a single week of normal Hormuz traffic.

The gap between theory and reality widens further under operational scrutiny. The UAE recently upgraded refineries to process more crude domestically, meaning its bypass pipeline now runs near capacity during normal operations. Saudi Arabia increased use of its East-West route last year to circumvent Red Sea disruptions near Bab al-Mandeb. The “slack capacity” that appears in strategic assessments has already been absorbed. Building new pipelines requires 18 months minimum at costs exceeding hundreds of millions—timescales that make them irrelevant to crisis response and barely adequate for long-term hedging.

Storage constraints accelerate the cascade. Qatar’s energy minister warned that if Hormuz remains closed, Gulf producers will reach storage capacity within weeks, forcing oilfield shutdowns. Restarting a major field after shutdown takes weeks or months, not days. The temporary becomes prolonged through mechanical necessity, not political choice. A three-week closure could mean three-month supply disruptions regardless of diplomatic breakthroughs.

This physical reality explains why “letting the region sort itself out” proposals collapse under examination. When 84% of Hormuz oil flows to Asian markets—with China importing 5.4 million barrels daily through the strait—American withdrawal wouldn’t reduce U.S. exposure to price shocks. It would simply transfer control over those shocks to actors with different interests. China’s response illustrates what states do when facing irreplaceable chokepoints they cannot control: build 1.2 billion barrels of strategic stockpiles representing three to four months of buffer capacity. Stockpiling absorbs short-term disruption; it doesn’t eliminate structural vulnerability.

The United States released 172 million barrels from the Strategic Petroleum Reserve last week, dropping reserves to their lowest level since 1982. Even with reduced Gulf imports—the U.S. imported just 0.5 million barrels daily from Persian Gulf producers in 2024, only 2% of consumption—price shocks from Hormuz disruptions hit American consumers as hard as Asian ones. Oil trades globally; regional isolation doesn’t insulate from global price movements. The reserve release demonstrates this constraint: distance from physical dependence doesn’t create distance from economic exposure.

Geography determines the available moves. The Strait of Malacca carries slightly more oil—23.2 million barrels daily—but connects to alternative routes through the Sunda and Lombok straits. Hormuz has no such redundancy. Pipeline capacity exists but cannot scale to need. Some version of naval presence maintaining open shipping lanes isn’t a preference reflecting ideology; it’s a response to the fact that the global economy runs on diesel, jet fuel, and petrochemicals that flow through corridors narrow enough to close with tactical weapons.

The question isn’t whether this dependency is wise—that’s a debate for timescales measured in decades of infrastructure investment. The question is what happens when the only actor positioned to keep those corridors open decides the cost isn’t worth it. The answer arrived last week in the form of $50 price swings across three days.

Break your wife’s bones, fifteen days in prison. Force dogs to fight, five months.

That’s the penalty structure in Afghanistan’s new Taliban penal code, issued in January 2026 and leaked last month to the Afghan rights group Rawadari. The decree specifies exactly how much violence a husband can inflict before the state considers it excessive, “a broken bone,” “an open wound,” or “a black and blue wound” that appears on her body. Anything short of that threshold remains legal.

You can read a society’s values through its penalty structure. The math here is unambiguous: animal welfare rates higher than women’s bodies. Teachers who break a student’s bone lose their jobs, fathers who beat children for failing to pray face no punishment at all unless bones break. The precision isn’t accidental. It’s administrative.

Subscribe now

Building to Last

These punishments aren’t new. The Taliban has always permitted domestic violence, always restricted women’s movement, always governed through intimidation. What changed in January is that they wrote it down.

Codification matters. When practices become policy, they create precedent. They train judges in what to enforce and signal to the population what’s permanent versus provisional. The decree’s clinical specificity, distinguishing between bruises that fade and wounds that mark, serves an institutional purpose. It removes discretion, standardizes rulings, and transforms ad hoc brutality into durable legal infrastructure.

This is what settling in looks like. The Taliban isn’t just ruling by force anymore; they’re building an administrative state with formal procedures, penalty schedules, and bureaucratic distinctions. The 119-article code covers everything from theft and sodomy (both punishable by death) to insulting the Taliban leader (39 lashes plus a year in prison). It’s comprehensive, detailed, and designed for longevity.

The Legitimacy Claim

The Taliban insists all its rulings align with Islamic Sharia law and carry religious legitimacy. That claim matters strategically, both domestically and internationally. It positions the decree not as political repression but as theological obligation, something beyond negotiation or reform.

The gap between claim and reality is enormous. Many Islamic scholars reject these interpretations as distortions of Islamic jurisprudence. But the Taliban’s use of religious authority as a legitimizing mechanism makes the system harder to challenge from within. Dissent becomes heresy. The code explicitly criminalizes spreading “doctrines contrary to Islam,” with death as the potential penalty.

This weaponization of religious authority isn’t unique to the Taliban, but the formalization marks a shift. Extremist interpretations that once existed in practice are now enshrined in state law, complete with judicial procedures and enforcement mechanisms.

The Silence

The decree received minimal media coverage despite being genuinely shocking. Part of this reflects Afghanistan fatigue, the sense that the story ended when American troops withdrew in 2021. Part reflects normalization. We’ve accepted Taliban control as a fact, and facts stop generating headlines.

But the decree tells us something important about trajectory. The Taliban isn’t moderating or adapting to international pressure. It’s consolidating. The legal infrastructure being built now will outlast any particular leader or crisis. It trains the next generation of judges, normalizes these standards for the population, and makes reversal exponentially harder.

Women’s rights activist Mahbouba Seraj, speaking from Kabul, described the practical reality, “the men have the right to rule completely the women. His word is the word of law—that’s it.” Even when women meet the injury threshold, they cannot leave home without a male guardian to report abuse. Their testimony in court is worth half a man’s. The decree creates the appearance of limits while ensuring those limits can never be enforced.

The UN’s top human rights official warned that “Afghanistan is a graveyard for human rights.” The metaphor is apt. What’s being buried isn’t just rights but the mechanisms for claiming them. That’s what makes codification different from practice, and why fifteen days versus five months isn’t just cruelty.

It’s architecture.

When U.S. and Israeli warplanes began Operation Epic Fury on Saturday morning, they struck nuclear facilities in Tehran and Isfahan. But just as many bombs fell on missile production sites and launch facilities scattered across Iran. To understand why, you need a map and a compass.

The 1,200-Mile Circle

Draw a 1,200-mile radius from Iran’s missile bases. Inside that circle sits almost everything that matters in the Middle East: 40,000 U.S. troops spread across bases in Qatar, Bahrain, Kuwait, the UAE, Jordan, and Iraq. Saudi Arabia’s oil infrastructure at Ras Tanura and Abqaiq. The Strait of Hormuz, through which one-fifth of global oil passes daily. Dubai’s financial district. Every major energy chokepoint between the Mediterranean and the Indian Ocean.

Iran doesn’t need nuclear weapons to hold these targets at risk. It already does, with the largest ballistic missile arsenal in the Middle East, somewhere between 2,000 and 3,000 missiles, depending on whose count you trust. Most are short- and medium-range systems: Shahab-3s, Sejjils, Qadr missiles with ranges between 500 and 1,200 miles. They can’t reach Washington or even Europe. They don’t need to.

America’s Bases in the Crosshairs

Al Udeid Air Base in Qatar sits 615 miles from Iranian launch sites. It houses 10,000 American troops and serves as forward headquarters for U.S. Central Command, which is the nerve center for all American military operations in the region. When Iran retaliated for Epic Fury on Saturday afternoon, one of its first targets was Al Udeid. Qatari missile defenses intercepted the strike, but the message was clear: Iran can reach the bases that launch strikes against it.

Naval Support Activity Bahrain, home to the U.S. Fifth Fleet, sits 500 miles away. Kuwait’s Ali Al Salem Air Base, a staging ground for combat operations: 400 miles. The UAE’s Al Dhafra Air Base, which houses advanced fighter squadrons: 700 miles. Iranian missiles hit targets in at least five countries within hours of Epic Fury’s first wave. Not because Iran’s missile technology is sophisticated—many of these systems are liquid-fueled and take hours to prepare, making them vulnerable to preemptive strikes—but because the geography is unforgiving.

This explains why Operation Epic Fury prioritized missile infrastructure alongside nuclear sites. When Pentagon planners talk about Iran’s “threat radius,” they’re not being abstract. They mean the physical distance Iranian projectiles can travel, overlaid on the map of American commitments. It’s why Gulf states that host U.S. bases now face Iranian retaliation, why Saudi Arabia and the UAE (both of which allowed Epic Fury aircraft to use their airspace) issued statements about defending their territories with “all necessary measures.”

The Targets That Couldn’t Be Hit

The radius also explains decisions about what didn’t get hit. Iran’s Bushehr nuclear reactor, on the southern coast, survived Epic Fury intact. Not because it’s unimportant, but because Russian technicians operate it, and striking the reactor means killing Russians and creating radiological fallout that would drift across the Gulf. Every target inside that 1,200-mile circle matters to someone: American troops, Saudi oil infrastructure, Emirati ports. The reactor sits squarely in the middle of that circle, which makes it effectively untouchable despite being nuclear.

Israel understands this geography intimately. Tel Aviv sits roughly 1,000 miles from Iran’s western launch sites—just within range of Iran’s Shahab-3 and Sejjil-2 missiles. During Iran’s retaliatory strikes on Saturday, Israeli and U.S. missile defenses intercepted dozens of ballistic missiles aimed at Israeli cities. The interception worked, but the attempt demonstrated what Iranian military planners have known for years: they don’t need nuclear warheads to threaten Israel. Conventional explosives on ballistic missiles, launched in sufficient numbers, create their own form of deterrence.

The Geometry of Deterrence

This is why the phrase “Iranian nuclear capability” misses half the strategic picture. Yes, Iran was enriching uranium to 60 percent, a short technical step from weapons-grade material. Yes, dismantling that program was Operation Epic Fury’s stated objective. But the missiles matter just as much, perhaps more. A nuclear Iran with no delivery systems is a regional problem. A non-nuclear Iran with 2,000 ballistic missiles that can hit every U.S. base and oil facility in the Middle East is also a regional problem—just a different one.

The map explains why negotiations collapsed in Geneva three weeks ago, why Epic Fury targeted missile sites as aggressively as enrichment facilities, why Gulf states that allowed overflight are now facing retaliation, and why this conflict won’t end with destroyed centrifuges. Draw that 1,200-mile circle. Everything inside it is connected to everything else by Iranian missile range. That’s not speculation or analysis. That’s geometry.

At 6:59 p.m. Eastern time on June 12, 2025, a Twitter account called Pentagon Pizza Report noticed something unusual. Four pizza establishments near the Pentagon had experienced sudden surges in Google Maps “popular times” activity—the kind of late-evening spike that suggests senior officials working through dinner. Hours later, news broke of major Israeli strikes against Iran. The pizza shops had predicted a geopolitical event before cable news.

Share

When Defense Secretary Pete Hegseth recently joked on Fox News about ordering random pizzas “just to throw everybody off,” the comment drew mockery from critics who saw it as unserious trolling. But the remark reveals something more interesting: a sitting defense secretary now openly acknowledges that adversaries can monitor operational tempo through commercial data aggregation, and he’s thinking about countermeasures. This represents a remarkable shift in how institutions approach operational security—one that traces back thirty-five years to a Domino’s franchise owner who noticed something odd about late-night deliveries.

On August 1, 1990, Frank Meeks delivered twenty-one pizzas to CIA headquarters in Langley, Virginia. It was a one-night record. Hours later, Iraqi forces invaded Kuwait, launching what would become the Gulf War. Meeks later told the Los Angeles Times that delivery drivers operated as inadvertent intelligence collectors: “The news media doesn’t always know when something big is going to happen because they’re in bed, but our deliverers are out there at 2 in the morning.” The anecdote became Washington lore—a quirky story about how pizza orders betrayed crisis management. But it remained just that for decades, an anecdote requiring human observation and local knowledge.

The transformation from amusing anecdote to systematic intelligence collection happened gradually through the datafication of everything. Google Maps began aggregating anonymous location data to show users when restaurants were crowded. Delivery apps tracked order patterns to optimize driver routes. What companies designed for consumer convenience became exploitable for operational intelligence. In August 2024, an X account launched to systematically monitor this data—no longer requiring a chatty Domino’s owner, just algorithmic observation of publicly available commercial information. The Pentagon Pizza Report’s June 12 prediction wasn’t luck; it was pattern recognition applied to metadata exhaust.

The pizza problem represents a single thread in a much larger fabric. In 2018, a fitness tracking app called Strava revealed the locations and internal layouts of secret military bases worldwide because soldiers jogged with GPS-enabled devices. The company’s heat map, intended to showcase global athletic activity, lit up forward operating bases in Afghanistan and Syria like beacons against empty desert. Analysts identified troop movements, mapped facility perimeters, and even spotted a lone cyclist at Area 51. A 2023 investigation purchased individually identified health and financial data about active-duty military personnel from data brokers with minimal vetting—using Singapore-based servers to demonstrate how easily foreign actors could do the same.

More recently, journalists tracked more than 3 billion mobile phone location signals near U.S. military installations in Germany, mapping personnel movements from barracks to bars and identifying devices inside Büchel Air Base, where nuclear weapons are reportedly stored. They bought this data legally from American brokers—the same brokers who sell to anyone with money and minimal questions. The reporters weren’t Russian GRU officers or Chinese Ministry of State Security operatives, but they easily could have been.

What makes this particularly vexing is that even aggregated data poses security risks. A foreign adversary doesn’t need to identify specific individuals if they’re simply looking for peak and low activity periods at sensitive facilities. Parking lot satellite imagery analyzed by hedge funds to predict retail earnings can just as easily reveal when defense contractors are working overtime before weapons system deliveries. HVAC power consumption patterns, cell tower activity near government buildings, delivery app traffic—all of it generates metadata trails that sophisticated actors can analyze to understand operational tempo without ever penetrating classified networks.

The Defense Department’s 2018 policy restricting wearable fitness trackers in deployed settings represented early recognition of this problem, but it addresses only the most obvious vulnerability. Preventing soldiers from wearing Fitbits in combat zones does nothing about the dozens of apps on their phones that continuously broadcast location data, or about Google’s aggregate traffic information showing when Pentagon parking lots fill up, or about food delivery platforms revealing late-night work sessions. The practical solution cannot be “leave your phone at home” for everyone handling sensitive information—modern operations require connectivity.

This is where Hegseth’s pizza joke becomes more than a quip. His comment demonstrates awareness that traditional operational security—keeping information classified, limiting access, securing communications—no longer suffices when commercial surveillance capitalism generates exploitable intelligence as a byproduct of normal activity. The countermeasure he describes, ordering decoy pizzas to introduce noise that degrades signal quality, reflects actual information security tradecraft for the digital age. It’s the same logic behind why intelligence agencies sometimes conduct random equipment movements or vary routine schedules—not paranoia, but recognition that adversaries systematically monitor patterns.

The challenge facing defense institutions is genuinely difficult. Democracies operating in open societies will always generate more observable metadata than authoritarian regimes that control commercial data flows and restrict civilian technology. Chinese military facilities don’t light up on Strava because Chinese citizens don’t have the same app ecosystem generating constant location broadcasts. Russian intelligence exploits open-source intelligence about U.S. operations while maintaining opacity around their own activities. This asymmetry creates a structural disadvantage.

Yet the alternative—comprehensive data controls that would prevent Google from aggregating location information or ban delivery apps from sharing traffic patterns—conflicts with both commercial interests and democratic norms around information freedom. Recent bipartisan legislation like the Protecting Americans’ Data from Foreign Adversaries Act represents early attempts to address these tensions, but comprehensive solutions remain elusive. The problem keeps expanding faster than policy can respond.

What’s striking about the evolution from Frank Meeks’ 1990 observation to Hegseth’s 2026 comment is the timeline itself. It took thirty-five years for the defense establishment to move from unaware to publicly joking about countermeasures. That progression—from ignorance to recognition to active mitigation—suggests institutions are learning to operate in an environment where every Domino’s order potentially broadcasts intentions. Whether decoy pizzas actually work matters less than the acknowledgment that operational security now requires thinking about commercial metadata the same way previous generations thought about encrypted communications.

The impossibility isn’t the task itself but rather maintaining the pretense that secrets can be kept the old way. When Google Maps aggregate data predicts airstrikes and journalists can legally purchase troop movement patterns, the traditional boundaries between classified and open-source intelligence have collapsed. Hegseth’s joke, intentionally or not, signals that someone is paying attention to this new reality.

When Anthropic disclosed yesterday that DeepSeek, Moonshot, and MiniMax ran roughly 16 million fraudulent Claude queries to extract capabilities, most coverage treated it like another skirmish in the AI arms race. That framing is too polite. If Anthropic’s account is accurate, this was not normal benchmarking, not curiosity, not the messy edge of open science. It was industrial-scale appropriation of a competitor’s work through fraud, at a scale large enough to look less like a one-off violation and more like a business process.

Share

The labs are the headline. The real story is the shadow infrastructure that made it possible, the commercial proxy services Anthropic mentions almost in passing. They are the brokers who turn restricted access into a product, and who make capability extraction cheap enough to repeat until it works.

The Mechanics of a Hydra

“Hydra cluster architectures” is Anthropic’s label for what it observed. The name fits because these networks are built to survive account bans through redundancy and churn. Cut off one head and the traffic simply reroutes through the next.

The playbook is straightforward. A proxy service assembles access to frontier model APIs through hundreds or thousands of accounts. Those accounts can be created with fake identities, stolen payment instruments, or abused verification pathways that were designed for students and startups. Once the accounts exist, the proxy service sits between the client and the model provider. The client never touches the real gatekeeper. The broker does.

A normal API customer is easy to profile. Requests arrive from a consistent account with stable metadata and a coherent usage pattern. Hydra traffic is the opposite. Requests are sprayed across a large account pool, mixed across multiple clients, and shaped to resemble the noise of ordinary usage. To the platform, it looks like a crowd. In reality it is a single machine.

This structure is not only about evasion. It is also about throughput. Anthropic describes synchronized traffic patterns, with similar prompts arriving in staggered bursts across many accounts. That is load balancing, the same logic that makes a content delivery network efficient. The point is to move a lot of data without triggering alarms.

If you are trying to distill a model, you do not need one dramatic breach. You need a pipeline. Hydra provides the pipeline.

This Is a Market, Not a Hack

The proxy operators are not building models. They are selling access. Their product is plausible legitimacy at scale.

For clients facing geographic and policy restrictions on Claude access, the economic logic is brutal. Training from scratch is expensive and slow. It demands compute, expertise, and iteration. Buying access to a frontier model through an intermediary can be faster and cheaper, especially when the intermediary is willing to absorb the operational risk of bans and rebuild the account pool as needed.

In that sense, the hydra is not a side character. It is the enabling technology for capability extraction. It turns what should be a high-friction act into a routine expense line item.

And this is where the China angle stops being an abstract geopolitical mood and becomes a concrete operating reality. The PRC’s strategic posture treats AI capability as national leverage. When leading labs operate in an ecosystem that rewards rapid catch-up and tolerates corner-cutting, the incentives tilt toward extraction. The proxies supply the means. The labs supply the demand. The system supplies the justification.

The Coordination Trap

Why does this continue to work? Because no single actor can shut it down.

Anthropic can ban accounts, harden verification, and build detection systems. It can do all of that and still face a hydra that simply shifts routes. Tighten direct access and traffic migrates to a reseller channel. Close one loophole and a broker exploits another. The proxy service is platform agnostic. Its only loyalty is to continuity of access.

Cloud platforms are part of the trap. They serve an ocean of legitimate users and cannot treat every unusual pattern as malicious without breaking real businesses. The same features that make cloud computing useful, fast account creation, programmatic access, flexible billing, are the same features that make abuse scalable.

This is not a morality play about a single bad actor. It is a structural weakness in the way frontier model access is commercialized. It is also a strategic vulnerability when the most motivated abusers operate in jurisdictions with limited enforcement pressure and strong incentives to close the capability gap quickly.

What Changes If We Call It What It Is

The industry’s language matters. “Distillation” is a technical term and a euphemism. It makes an industrial extraction campaign sound like a clever optimization trick. If Anthropic’s evidence holds, a more accurate description is capability laundering through fraud.

That shift in language pushes the conversation toward the real questions.

Who are the proxy operators. Where are they registered. Which payment rails do they use. Which cloud providers and resellers are repeatedly implicated. What signals can be shared across companies without turning the entire AI stack into a private surveillance regime.

The practical response is coordination that does not yet exist. Shared indicators of compromise across model providers. Standardized identity and reseller controls. Stronger friction for bulk access patterns that look like automated harvesting. Clear consequences for brokers that exist primarily to circumvent restrictions at scale.

Until that ecosystem forms, the hydra will keep feeding.

And China’s most aggressive labs will keep buying. If you can copy your competitor’s expensive capabilities through a brokered fraud pipeline, then the temptation is not to innovate. It is to extract, strip the safeguards, and ship the product as if the hard work was yours.

Subscribe now