HIDDEN IN PLAIN SIGHT
A Complete Investigation into the Decentralized Domestic Terrorism Infrastructure Operating Under the Banner of "Anarchist Publishing"
- What This Report Is About
- Understanding the Basic Concepts
- The Network Architecture
- The Regional Counter-Information Network
- The International Coordination Hub
- The Sabotage Instruction Center
- The Operational Security Training System
- The Counter-Intelligence Training Program
- The Cell Structure Doctrine
- The Organizational Theory
- The Training Document Library
- The Target Databases
- The Darknet Market Crossover
- Recent Attacks and Claims
- Active Threats
- Conclusions
- Complete URL Reference
This investigation has uncovered a network of interconnected websites, file-sharing repositories, and encrypted communication channels that together form a complete operational infrastructure for domestic terrorism in North America. This network is hiding in plain sight, operating openly on the regular internet (not just the "dark web"), presenting itself as "anarchist publishing" and "counter-information."
Regular political websites—even radical ones—typically publish opinion pieces, organize protests, and advocate for policy changes. What this investigation documents is fundamentally different:
- Bomb-making instructions: Detailed guides for manufacturing explosives
- Arson guides: Step-by-step instructions for setting fires without getting caught
- Infrastructure sabotage manuals: How to attack power grids, railways, and communications
- Cell formation doctrine: How to organize terrorist cells that cannot be infiltrated
- Target lists: Personal information about law enforcement officers and their families
- Attack claims: Platforms where people take credit for arsons, bombings, and sabotage
- Counter-intelligence training: How to detect police infiltrators
- Operational security guides: How to commit crimes without leaving evidence
On January 6, 2026—just weeks before this report—this network was used to distribute the personal information of approximately 14,000 Immigration and Customs Enforcement (ICE) and Department of Homeland Security (DHS) employees, including their home addresses. This is not theoretical. This is active.
The following contains direct links to extremist materials hosted on public websites. AI tools were used to assist in organizing research and formalizing documentation. All sources are publicly accessible and verifiable. This content is presented to inform the public about active domestic extremist infrastructure. I am not endorsing any material linked—I am exposing it.
Before diving into the specifics, readers need to understand several key concepts that the network uses.
In anarchist terminology, "counter-information" (or "counter-info") refers to news and media that counters mainstream narratives. However, in practice, the "counter-info" sites documented in this report function as:
- News aggregators for anarchist activities in specific geographic regions
- Platforms for claiming responsibility for illegal actions (arson, sabotage, vandalism)
- Distribution points for tactical guides and training materials
- Warning systems about law enforcement activities (FBI visits, surveillance, etc.)
- Doxxing platforms for publishing personal information about police and federal agents
Noblogs.org is a free blog hosting platform run by Autistici/Inventati (A/I), an Italian tech collective that provides privacy-focused services to activists. Almost every site in this network uses noblogs.org for hosting.
Why this matters: Noblogs.org is hosted in Italy, making it difficult for U.S. law enforcement to take down content. The platform explicitly provides services for radical activists and does not cooperate with law enforcement requests.
URL structure: Sites appear as sitename.noblogs.org (e.g., warriorup.noblogs.org)
Tor (The Onion Router) is software that allows anonymous internet browsing by routing traffic through multiple encrypted layers. Many sites in this network have ".onion" addresses that can only be accessed through the Tor Browser.
Why this matters: Tor makes it nearly impossible to trace who is visiting these sites or who is uploading content to them.
Tails is a portable operating system that you run from a USB drive. It routes all internet traffic through Tor, leaves no trace on the computer you use it on, and forgets everything when you shut it down.
Why this matters: This network universally recommends Tails for all illegal activities. The guides explicitly state that reading arson instructions should ONLY be done in Tails to avoid forensic evidence.
PGP (Pretty Good Privacy) is encryption software that allows secure communication. Every site in this network publishes a "PGP key" that allows people to send them encrypted messages that only the intended recipient can read.
Why this matters: This allows anonymous submission of attack claims and coordination of illegal activities without law enforcement being able to intercept communications.
Monero is a cryptocurrency specifically designed to be untraceable, unlike Bitcoin which has a public ledger. This network universally recommends Monero for any financial transactions.
Why this matters: Donations, purchases of equipment, and other financial activities related to illegal actions cannot be traced.
An affinity group is a small group of people (typically 3-15) who know and trust each other and work together on specific actions. This is the basic organizational unit of anarchist direct action.
A cell is similar to an affinity group but is specifically designed for illegal activities. Cells are compartmentalized—members of one cell do not know who is in other cells, so if one cell is caught, they cannot inform on others.
Security culture is a set of practices designed to prevent law enforcement infiltration and surveillance. It includes:
- Never discussing illegal activities on phones or near electronic devices
- Never telling anyone—including romantic partners and family—about illegal activities
- Using cash only
- Operating far from where you live
- Maintaining a "double life" with public political views opposite to your actual beliefs
In this context, "direct action" is a euphemism for illegal activities including:
- Arson
- Sabotage
- Vandalism
- Property destruction
- "Liberating" animals from farms and laboratories
- Physical confrontation with police
Doxxing is publishing someone's personal information (home address, phone number, workplace, vehicle information, photos) without their consent, typically with the intent to enable harassment or physical targeting.
The network operates on a decentralized model with no central leadership. This mirrors the cell structure it teaches—if one part is taken down, the rest continues operating. The components are:
Geographically-specific sites covering particular regions of North America. Each publishes local news, action claims, and doxxing information for their area.
A central site (Act for Freedom Now!) that collects and republishes content from all regional nodes and international sources, creating a global coordination point.
Sites dedicated to specific functions:
- Warrior Up: Sabotage and arson instructions
- No Trace Project: Operational security training
- Final Nail: Animal liberation target database
Mega.nz cloud storage folders containing hundreds of training documents (the "zine libraries")
Email services (Riseup.net, Autistici.org), encrypted messengers, and newsletter subscriptions
Every site in the network uses the same technical stack:
| Component | Tool | Purpose |
|---|---|---|
| Hosting | Noblogs.org (Autistici/Inventati) | Hosts websites outside US jurisdiction |
| Anonymity | Tor Browser / .onion mirrors | Anonymous access to sites |
| Operating System | Tails | Leaves no forensic traces |
| Encryption | PGP | Encrypted communications |
| Cryptocurrency | Monero | Untraceable payments |
| Riseup.net, Autistici.org | Privacy-focused email | |
| Messaging | Signal | Encrypted mobile messaging |
| File Sharing | Mega.nz, OnionShare | Encrypted file distribution |
| Metadata Removal | MAT2 | Strips identifying data from files |
| Disk Encryption | LUKS | Encrypts storage devices |
The network maintains dedicated websites for most major metropolitan areas in North America. Each site serves as the local hub for anarchist activity in that region.
URL: https://pugetsoundanarchists.org Platform: WordPress (self-hosted) Region: Seattle, Tacoma, Olympia, and surrounding areas in Washington State
What It Publishes:
- Reports of FBI phone calls and visits to local anarchists (most recent: October 2025)
- Reports of Department of Homeland Security "doorknocks" (July 2025)
- Guides for defeating "Flock" AI-powered license plate readers
- Personal information (doxxing) of ICE agents
- Reports from demonstrations and direct actions
- Announcements of upcoming events
Recent Content (as of January 2026):
On January 18, 2026, the site published a post titled "ICE Supervisor Chatham McCutcheon" which included:
- Full name: Chatham L. McCutcheon
- Job title: Supervisory Detention/Deportation Officer, Portland ICE Office
- City of residence: Vancouver, Washington
- Statement that he lives there "with his..." (family information)
- Photos of the agent
- Poster designed for wheat-pasting (posting on walls/poles)
On January 27, 2026, the site published "ANTIFLOCK FLYER" with downloadable posters and QR codes linking to guides for destroying Flock surveillance cameras.
On October 7, 2025, the site published "October 2nd FBI Phone Call" warning that the FBI was contacting local anarchists.
On July 18, 2025, the site published "DHS Doorknock in the Seattle Area" warning that DHS agents were visiting anarchists' homes.
Linked Sites: Rose City Counter-Info, BC Counter Info, Divest SPD
URL: https://rosecitycounterinfo.noblogs.org Region: Portland, Oregon
What It Publishes:
- Action claims from Portland area
- Doxxing of ICE agents and other law enforcement
- Coordination with Pacific Northwest network
URL: https://north-shore.info Region: British Columbia, Canada (Vancouver area)
What It Publishes:
- Canadian anarchist news
- Cross-border coordination with US Pacific Northwest
- Indigenous solidarity actions (Wet'suwet'en pipeline resistance)
URL: https://chicagoantireport.noblogs.org Region: Chicago and Midwest
What It Publishes: This site is particularly active in publishing sabotage guides and tracking destruction campaigns.
The CAMOVER Campaign: CAMOVER is an organized campaign to destroy surveillance cameras. The Chicago site tracks results:
Summer 2025 Results (Chicago area):
- Total cameras destroyed: 37
- Paint attacks: 20
- Physically smashed: 8
- Rope/pulling down: 6
- Etch bath (chemical destruction): 2
- Impact driver: 1
The site has issued a call for "Winter Games 2026" — a new round of camera destruction.
Vehicle Sabotage Guide: The site published a guide for sabotaging UHaul and Budget rental trucks, specifically those used by people moving (the stated reasoning is that moving trucks enable gentrification).
ICE Vehicle Vandalism: In October 2025, the site published a claim of responsibility for vandalizing ICE vehicles.
Blessed Is The Flame: The site publishes a newspaper called "Blessed Is The Flame" containing:
- Counter-surveillance guides
- Counter-repression guides
- Direct action guides
- Arson responsibility claims
This newspaper is published in 7 languages: English, Spanish, French, German, Italian, Indonesian, and Greek.
URL: https://phlanticap.noblogs.org Region: Philadelphia and surrounding areas
What It Publishes:
ICE Agent Doxxing ("El Gordo"): The site published personal information about an ICE agent nicknamed "El Gordo" including:
- Photographs
- Vehicle description
- License plate number: B73UMH
- Statement that he operates in South Jersey
- Tracking of his movements
CAMOVER Results: Documentation of surveillance camera destruction in the Philadelphia area.
AI Surveillance Camera Awareness: Guides for identifying and defeating AI-powered surveillance cameras.
Day of Forest Defender Actions: On January 18, 2026, the site coordinated banner drops to commemorate Tortuguita (Manuel Teran), a forest defender who was killed by police in Atlanta in 2023.
"Breaking ICE" Report (January 2026): An analytical document comparing "autonomous action" versus "organizational fetishism"—essentially arguing that small independent attacks are more effective than large organized protests.
URL: https://neversleep.noblogs.org Region: New York City
URL: https://jerseycounterinfo.noblogs.org Region: New Jersey
URL: https://pghcounterinfo.noblogs.org Region: Pittsburgh, Pennsylvania
URL: https://mbtadistro.noblogs.org Region: Boston area (MBTA is Boston's transit system)
URL: https://neec.noblogs.org Region: New England
URL: https://dirtysouth.noblogs.org Region: Southeastern United States
Critical Recent Activity:
On January 6, 2026, this site published an anonymous communique announcing a massive data breach targeting federal law enforcement. The full text:
""
"For months, we have been collecting information on ICE agents and employees of the U.S. Department of Homeland Security in response to the on-going abhorrent actions of these agencies across the so-called United States, often perpetrated against innocent people just for being brown, including defenseless children and infants.
Tonight, by the glow of our monitors, we are releasing a list of around 14,000 breached ICE and DHS accounts from across the internet. The list includes various information in varying completeness for each account, such as first and last name, email address, password hashes and, in some cases, cleartext passwords, home address, phone number. A download link to the file has been posted to various hacker forums across the Tor network."
Analysis: This is documentation of an active cyberattack on federal law enforcement, with personal information including home addresses distributed to enable physical targeting of approximately 14,000 federal employees.
At the time of documentation, this post had 424 views.
URL: https://austinautonomedia.noblogs.org Region: Austin, Texas and surrounding areas
URL: https://saguaros.noblogs.org Region: Arizona (the saguaro is an Arizona cactus)
Focus: Border region actions, immigration issues
URL: https://livefree.noblogs.org Region: Unclear (possibly New Hampshire based on state motto)
URL: https://unsalted.noblogs.org Region: Likely Great Lakes region (unsalted water)
URL: https://bbnews.noblogs.org
URL: https://indybay.org Region: San Francisco Bay Area Note: This is one of the oldest sites in the network, dating back to the Independent Media Center movement of the early 2000s.
URL: https://rant.li/okmana/ Region: Oklahoma
URL: https://mtlcontreinfo.org Region: Montreal, Quebec
Language: Primarily French with English translations
URL: https://actforfree.noblogs.org
Tor Mirror: 2gzyxa5ihm7nsggfxnu52rck2vv4rvmdlkiu3zzui5du4xyclen53wid.onion
Email: actforfree@riseup.net
Tagline: "Solidarity Means Attack!"
Act for Freedom Now! functions as the central aggregator for the entire international anarchist network. It collects and republishes content from:
- All North American counter-info nodes
- European anarchist sites (Germany, Italy, France, Greece, UK, Spain, Switzerland, etc.)
- Latin American sites (Chile, Mexico, Argentina, Brazil)
- Asian sites (Indonesia)
- Oceania (Australia)
The site organizes content into categories that reveal its function:
- Sabotage/Arsons/Attacks — Claims of responsibility for illegal actions
- Revolutionary Prisoners News — Updates on imprisoned anarchists
- Solidarity Events — Coordinated international actions
- ALF/ELF — Animal Liberation Front and Earth Liberation Front actions
- Attack — General attack claims
- Repression — News about police actions against anarchists
The site published the following in January 2026:
| Date | Location | Content |
|---|---|---|
| Jan 2026 | Berlin, Germany | Power plant sabotage claim by "Volcan" group |
| Jan 2026 | France | Paris-Caen railway sabotage during AI conference |
| Jan 2026 | Balan, France | Chemical plant sabotage claim |
| Jan 2026 | Vernon, BC, Canada | Vehicle fire at Kia dealership |
| Jan 2026 | USA (multiple cities) | Day of Forest Defender banner drops |
| Jan 2026 | London, UK | 100+ arrests at prison protest |
| Jan 2026 | Italy | Anarchist prisoner hunger strike |
| Jan 2026 | Mexico | Vandalism for imprisoned anarchist |
| Jan 2026 | Indonesia | "Chaos Star" case updates |
| Jan 2026 | Norway | Nussir mine resistance |
The site links to dozens of other anarchist resources worldwide:
Publications/Journals:
- Hourriya
- Avalanche
- Return Fire
- Tumult
- Rupture
Publishers:
- Compass Editions
- Edizioni Anarchismo (Italy)
- Anathema (Philadelphia)
- Prometeo Ediciones (Chile)
Regional Sites:
- Unravel (see below)
- Sardegna Anarchica (Sardinia)
- athens.indymedia.org (Greece)
- barrikade.info (Switzerland)
- chronik.blackblogs.org (Germany)
- squat.net (Squatters network)
- Radical Media Berlin
Prisoner Support:
- ABC Belarus (Anarchist Black Cross)
- Palang Hitam/ABC Indonesia
- Cassa Anti Repressione (Italy)
- Solidarity Fund (Greece)
Security:
- AnarSec
- Anarchist Libraries
URL: https://unravel.noblogs.org
Unravel is specifically a portal for submitting anonymous attack communiques. Its mission statement explicitly states it accepts arson and sabotage communiques for publication.
This site provides a centralized mechanism for claiming responsibility for attacks while maintaining the anonymity of the attackers. It functions as the "press office" for anonymous political violence.
URL: https://warriorup.noblogs.org
Email: warriorupthrowdown@autistici.org
PGP Key: 4283 5D10 4ABA 6B2D 0C60 A4F1 F7A9 73A3 8FD8 16E0
Tagline: "Techniques for sabotaging capitalist infrastructure and extractive industries"
Warrior Up is a dedicated repository of sabotage and arson instructions. Unlike the counter-info sites which mix news with tactical content, this site's entire purpose is providing technical guides for attacks.
- Arson guides — How to start fires effectively
- Sabotage Techniques — Methods for destroying equipment and infrastructure
- Studying Vulnerabilities — How to identify weak points in targets
- Maps — Geographic information about extractive industries (mines, pipelines, etc.)
| Date | Title | Description |
|---|---|---|
| September 2025 | "How To Get Things Burning" | Comprehensive arson guide including forensic countermeasures (how to avoid leaving evidence) |
| May 2025 | "Burning Cables For Beginners" | Guide for sabotaging electrical infrastructure |
| July 2024 | TGV Sabotage Analysis | Analysis of the rail sabotage attacks during the Paris Olympics, provided as a model for future actions |
| July 2024 | Fiber Optic Network Sabotage Analysis | Analysis of communications infrastructure attacks during Paris Olympics |
| 2024 | Joint Munitions Command Facilities Mapping | Maps and information about U.S. military ammunition facilities |
| Ongoing | "How to Survive the 9 to 5: Monkeywrenching & Forest Defense in North Georgia" | Sabotage guide focused on the Stop Cop City movement |
| Ongoing | Garden/Anti-Tech Quarterly | Includes power grid vulnerability analysis |
The site has a specific policy against distributing PDF versions of its most dangerous guides. The stated reason:
"If an arson guide is distributed in printed form, some people will inevitably keep it in their homes or in movement spaces, which the police would be happy to find during a repressive operation. In addition, a printed guide collects forensic traces from anyone who has interacted with it."
Recommended practice: Read guides only in Tails OS, download HTML versions to LUKS-encrypted USB drives for offline access.
Translation: The site operators understand their content is evidence of criminal conspiracy and have developed specific methods to avoid creating physical evidence.
URL: https://notrace.how
Tor Mirror: i4pd4zpyhrojnyx5l3d2siauy4almteocqow4bp2lqxyocrfy6prycad.onion
Mastodon: @notrace@kolektiva.social
Newsletter: notraceproject-subscribe@lists.riseup.net
Tagline: "No trace, no case. A collection of tools to help anarchists and other rebels understand the capabilities of their enemies, undermine surveillance efforts, and ultimately act without getting caught."
The No Trace Project is a comprehensive operational security training platform specifically designed to help people commit crimes without getting caught.
A structured database organized in three sections:
Techniques: Documents every method law enforcement uses to investigate and catch suspects:
- Surveillance methods
- Forensic techniques
- Informant recruitment
- Infiltration tactics
- Digital forensics
- Physical evidence collection
Mitigations: For each technique, provides specific countermeasures:
- How to avoid detection
- How to destroy evidence
- How to detect surveillance
- How to counter forensic analysis
Repressive Operations: Real case studies of police operations against anarchists worldwide, analyzed to extract lessons:
- What went wrong
- How people got caught
- What could have been done differently
A catalog of surveillance devices:
- What different surveillance devices look like
- How to detect them
- Case studies of when they were used against anarchists
Profiles of confirmed police infiltrators who have been exposed, including:
- Names and photos
- What groups they infiltrated
- How long they operated
- How they were eventually identified
- Lessons for detecting future infiltrators
Most Recent Entry (January 2026): A case study of "Dîlan S." who infiltrated anarchist groups from 2017-2025 — an 8-year infiltration operation.
Zines and texts on surveillance and operational security in 10+ languages.
- New infiltration case added (Dîlan S., 2017-2025)
- Analysis of spyware installation via social engineering (Italy case)
- Tor network attack analysis (how Tor can be compromised)
- Updated security baseline for anarchists
- Cash tracking capabilities (how law enforcement traces cash)
- Mobile phone surveillance updates
Title: "Toronto G20 Main Conspiracy Group: The Charges and How They Came To Be" Author: Anonymous Length: 24 pages Date: 2012 (2nd Edition) Copyright: "@nti-copyright" (explicitly no copyright)
This document provides detailed counter-intelligence training based on the real-world case of police infiltration of anarchist groups organizing against the 2010 G20 summit in Toronto. It is designed to teach anarchists how to detect and resist law enforcement infiltration.
The document reveals (based on legal discovery documents obtained during the trial):
Joint Intelligence Group (JIG):
- Multi-agency coordination between:
- Ontario Provincial Police (OPP)
- Royal Canadian Mounted Police (RCMP)
- Canadian Security Intelligence Service (CSIS)
- Local police departments
- Budget: $1 billion for G20 security, with "hundreds of millions" spent on intelligence operations
- Timeline: Investigation began January 2009, 18 months before the June 2010 summit
Infiltration Scale:
- 17+ long-term undercover officers infiltrated multiple groups
- Groups infiltrated included:
- Greenpeace
- Common Cause Ottawa
- Mining Justice
- Toronto Community Mobilization Network (TCMN)
- Convergence des luttes anti-capitalistes (CLAC)
- Movement Defence Committee (legal observers)
Surveillance Operations:
- 2-person surveillance teams following targets
- 6-person "spin teams" for pretext arrests
The document provides detailed profiles of exposed undercover officers as training examples:
Cover Story: Abuse survivor fleeing England
Infiltration Method:
- Entered through Guelph Union of Tenants and Supporters (GUTS)
- Presented herself as vulnerable to gain sympathy
- Used gossip to gather intelligence on group dynamics and internal conflicts
- Offered rides to activists (to track movements and record conversations)
- Volunteered for mundane tasks to become trusted
- Attended meetings wearing a concealed recording device
Evidence:
- Wore concealed wire to final spokescouncil meeting on June 25, 2010
Infiltration Method:
- More aggressive approach
- Pushed for illegal activity (attempted to radicalize targets)
- Bought drinks for activists (building relationships)
- Provided transportation in a white van (to monitor conversations)
- Tried to arrange explosives purchase (attempting to manufacture evidence)
- Took detailed notes on thousands of conversations
Notable: Had only 4 months of training before his first undercover assignment
The document explicitly teaches these lessons:
"A small tight-knit collective of people who trust each other is virtually impossible to infiltrate."
"It doesn't matter if you aren't doing anything illegal. If there are cops in your group, you are at risk."
"Good security culture practices are necessary for ALL political organizing."
The document analyzes how the infiltration succeeded to teach future groups what to avoid:
- Vouching Failures: People "assumed someone else knew her" without actually verifying
- Posturing: Activists bragged about illegal acts, giving prosecutors ammunition
- Shit-talk: Gossip about internal conflicts revealed information police could exploit
- Digital Footprints: Facebook and email provided massive amounts of intelligence
- False Security: Groups organized openly because "we're not doing anything illegal"
The document teaches how conspiracy law works in order to help activists avoid prosecution:
Canadian conspiracy law requires only:
- Intention to agree to commit an illegal act
- Agreement or plan to commit that act
Critical point: No acts in furtherance are required. Conspiracy can occur in a single conversation. The Crown only needs to convince the judge/jury once out of hundreds of recorded conversations to secure a conviction.
People Charged: 20
Charges:
- Conspiracy to assault police
- Conspiracy to obstruct police
- Conspiracy to commit mischief over $5,000
Crown's Theory: Having anarchist values constitutes unlawful motive; organizing protests around those values is conspiracy.
Bail Conditions Used as Punishment:
- "No-demo" bail condition: Prohibited from attending or planning any protest
- Non-association conditions: Could not associate with named groups or individuals
- House arrest
Example of Targeted Harassment: Alex Hundert was arrested for speaking at a university panel discussion, with prosecutors seeking a condition prohibiting him from "expressing political views in the company of others."
Resolution: Defendants plead guilty to "counselling mischief" (November 22, 2011) rather than face conspiracy trial.
Document's Conclusion: "There is no victory in the courts."
Title: "Lions in the Brush: On the Anatomy and Guidelines of Cell Structured Resistance" Author: El Borracho (Nöömad Warfuk) Publisher: Warzone Distro Website: https://warzonedistro.noblogs.org Date: 2019 Format: PDF, available in "imposed" (for printing as booklet) and "screen" (for reading) versions
This is a terrorist cell formation manual. It provides explicit instructions for organizing clandestine cells capable of carrying out illegal activities without being detected or infiltrated.
The document begins with a disclaimer:
"The following piece is not intended to promote, condone, or advocate any sort of illegal activity. The intention is to analyze and identify the anatomy of a strategy commonly used in subversive activities to ensure anonymity and minimize the possibility of detection."
However, the content makes clear its operational purpose.
The document traces the cell structure model:
"The tactic was first introduced by intelligence officer Col. Ulius Louis Amoss in 1962. Amoss created the tactic under the belief that communists would take over the United States, and that this method would ensure the chances of a successful resistance if that would have occurred."
Groups that have used this model (per the document):
- Animal Liberation Front (ALF)
- Earth Liberation Front (ELF)
- White supremacist organizations
- Islamic extremist groups
"The method has been greatly expanded on since then and adopted by many groups, from the Animal and Earth Liberation Front and white supremacists, to Islamic extremists and beyond."
The document defines two types of cells:
| Type | Size | Description |
|---|---|---|
| Sleeper Cell | 1 person | "Lone wolf individual" |
| Phantom Cell | 2-5 people | Small group operating together |
Why the size limit:
"Anything beyond 5 members risks falling into the same pitfalls as the organization, and begins to lose its solidity and causes it to be more vulnerable to infiltration, thus compromising its effectiveness."
The core principle is that cells must be completely isolated from each other:
"More importantly, cell structure differs from the organization in that, if one cell is taken out and/or compromised, it remains physically impossible for that to have any effect on any other cell."
"If we drew one big circle or pyramid (the organization), imagine if it only took one pin to stick into the organization block to destroy it. In the case of cell structure, the only way to destroy the cells would be to pin them each one by one, which means you would need to first locate and identify each and every one, and pick them off individually."
"The chance of successfully identifying all of those unknown numbers of underground cells is usually quite small. This is what gives cell structured resistance its near invincibility."
Cell members must maintain a completely separate public identity:
"The person who engages in cell structured activity almost always leads a completely double life, often pretending to endorse opposite views (posting Gandhi quotes and favoring electoral politics on social media that are the opposite of their views, for example)."
The document emphasizes that cell members must have no visible connection to anarchist movements:
"In most case scenarios there either is, or at least should be, a barrier between those who engage in above ground activity and those who engage in covert, cell structured activity."
"For those who engage in underground activity, it is ideal to refrain from any traceable online activity that would admit oneself to being associated with the types of views related to the choice of activity one engages in, as well as to never attend rallies, public meetings, protests, riots, etc."
"These two paths (above ground and underground), are not compatible with one another, and it is often in the best interests of those involved in underground cell structure activity to either avoid at all costs or at least sever all ties to those who openly share the same views."
"To put simply: 'You can't have your cake and eat it too'."
The document is explicit that cell activity must never be discussed with anyone outside the cell:
"You should not mention a word about the cell even to your partner, unless they're in the cell as well. You don't talk to close friends about it, you don't mention it to your mother, your father, or your siblings."
"What if one of them turns on you? What if they are confronted and tortured or otherwise coerced into giving information? What if they mention it to someone else? There should be no 'what ifs'. What goes on in the cell stays in the cell."
"If you have loose lips, can't lead a double life, or otherwise are needy for someone to listen to all your personal struggles, then I'll repeat: go the easy path because this isn't for you."
The document provides criteria for recruiting cell members:
"People you bring into a cell must uncompromisingly be those who you can trust with your life. It would be ideal that they are people you've known intimately in person for many years."
"It would also desirable to have potential future cell members undergo a series of tests in the recruitment process to ensure that they have what it takes, or that they are not a state agent. This would include making sure that the person doesn't have loose lips, a weak heart, a weak mentality, that they won't crack under pressure, won't turn on you out of moral scruples, etc."
The document addresses electronic surveillance:
"When discussing anything related to cell activity, do so far, far away from any cell phone, maybe put all cell phones, laptops, and tablets inside a vehicle and park it down the block. Beware, even some new TVs now are capable of listening to conversations."
"It is highly recommended that when doing anything related to cell structure activity, devices are to be left at home, with trusted friends, or stash them in the bushes, even if running errands related to the activity such as purchasing any needed material."
"It's also highly recommended that most if not all activities you partake in be done only in cities or towns that you are not known to frequent, the farther you need to travel, the better off you'll be."
"I can't stress this enough, don't engage in activities anywhere near where you frequent!!!"
"Use cash at all times, this should go without saying."
The document explicitly recommends a notorious assassination manual:
"Though somewhat outdated when it comes to considerations of new technology, the book, Hit Man: A Technical Manual for Independent Contractors by Rex Feral has plenty of useful information on how to avoid detection. The book is banned from further publication, however ebook formats are available online, particularly p2p programs such as can be found on slsknet.org."
Context: "Hit Man" was used by a contract killer named James Perry to murder Mildred Horn, her eight-year-old quadriplegic son Trevor, and Trevor's nurse Janice Saunders in 1993. The victims' families sued the publisher, Paladin Press, which settled and agreed to destroy all remaining copies. The explicit recommendation of this book in an anarchist manual demonstrates the operational intent.
The document emphasizes that cells answer to no one:
"Those who engage in cell structured resistance have absolutely no one to answer to but themselves, no organization to judge its conduct, and no leader or collective to persuade or control its behavior. The cell acts entirely out of its own independence and individuality."
Title: "Collectives: Anarchy Against the Mass" Source: Sprout Anarchist Collective Location: Grand Rapids, Michigan Website: http://sproutac.org (at time of publication)
This document provides the ideological framework for how anarchist organizing is structured. It explains why anarchists organize in small collectives rather than large organizations.
"Collectives are small efficient means of organizing that provide practical examples of counter-institutions that are egalitarian, voluntary, and anti-authoritarian."
The document explains why anarchist groups stay small:
"The strength of a collective lies in its social organization, not in numbers. Once you think in terms of recruiting, you might as well join the Army."
"Also, a small tight-knit collective of people who trust each other is virtually impossible to infiltrate."
A key concept is that the goal is not to grow existing groups but to spawn new ones:
"The revolutionary object of a collective is its replication, not recruiting new members. We don't want people to join our collective unless we ask them: we want people to form their own collectives."
The document redefines "class" in anarchist terms:
"By class we mean that we recognize that we and others like us are relatively powerless – politically and socially – in this system and that the relationship between the powerless and the powerful is antagonistic and utterly irreconcilable: The powerful must be destroyed."
The document recommends additional reading:
Zines:
- "Anti-Mass: Methods of Organization for Collectives"
- "Build Those Collectives!"
- "Collective Process: Overcoming Power"
Books:
- "Anarchy in the Age of Dinosaurs" (CrimethInc)
- "Consensus: A New Handbook for Grassroots Social, Political, and Environmental Groups" (Peter Gelderloos)
- "Come Hell or High Water: A Handbook on Collective Process Gone Awry" (AK Press)
The network maintains multiple large file repositories on Mega.nz (an encrypted cloud storage service) containing hundreds of training documents called "zines" (short for magazines—self-published pamphlets).
Based on screenshots of the library contents, the documents fall into these categories:
These documents provide direct instructions for illegal activities:
| Filename | Description |
|---|---|
| Lions-in-the-Brush_On-the-Anatomy-and-Guidelines-of-Cell-Structured-Resistance.pdf | Cell formation manual (detailed above) |
| Blueprint-2020-Fur-Farm-List.pdf | List of fur farm targets with addresses |
| blocs_black_and_otherwise.pdf | Black bloc tactics (how to dress, move, and operate in militant street actions) |
| elements-of-a-barricade.pdf | How to construct barricades |
| ef_wolf_hunt_manual.pdf | Earth First! sabotage manual |
| warrior_crowd_control.pdf | Militant tactics against police |
| atu-tactics-v1-print.pdf | Tactics manual |
| Insurgency_An-Anarchist-Journal-of-Total-Destruction.pdf | Insurrectionary theory and practice |
| basic_blockading.pdf | How to block roads and facilities |
| Blockade-Occupy-Strike-Back.pdf | Occupation and blockade tactics |
| Breaking_the_Barricades.pdf | Counter-police tactics |
| direct_action_guide.pdf | General direct action methodology |
| direct_action_tactics.pdf | Tactical manual |
| dearrest_primer.pdf | How to physically remove people from police custody |
| crowbar-chronicles.pdf | Breaking and entering |
| 10-steps-blockade.pdf | Step-by-step blockade planning |
| short-circuit.pdf | Likely electrical sabotage |
| pepperspray_cs_other.pdf | Chemical weapons guide |
These documents teach how to avoid detection and resist investigation:
| Filename | Description |
|---|---|
| what_is_security_culture.pdf | Core operational security training |
| mobile-phone-security.pdf | Phone security practices |
| surviving-a-grand-jury.pdf | How to resist grand jury subpoenas |
| doxcare-imposed.pdf | How to respond if you're doxxed |
| green-scared.pdf | Lessons from FBI's "Green Scare" crackdown on ELF |
| Betrayal.pdf | How to identify informants |
| dont-talk-to-police.pdf | Legal rights when questioned |
| grand_jury_investigations.pdf | Resisting grand juries |
| grand_juries_tools_of_repression.pdf | Analysis of grand jury tactics |
| security-countersurveillance.pdf | Detecting surveillance |
| smashing-cameras.pdf | Destroying surveillance cameras |
| cover-your-forehead.pdf | Defeating facial recognition |
| caught_in_the_web.pdf | Digital security |
| digital_security_for_activists.pdf | Technical security guide |
These documents teach how to form and operate anarchist groups:
| Filename | Description |
|---|---|
| affinity-groups-essential.pdf | How to form affinity groups |
| insurrectional-project.pdf | Strategic framework for insurrection |
| anti_mass.pdf | Methods of organizing for collectives |
| starting_an_abc_group.pdf | How to start an Anarchist Black Cross (prisoner support) chapter |
| build_solidarity_network.pdf | Building mutual aid networks |
| collective_process_overcoming_power.pdf | Managing collective dynamics |
| collective-action-behind-bars.pdf | Prison organizing |
| build_those_collectives.pdf | Collective formation |
| building_community_resilience_to_fight_state_repression.pdf | Community defense organizing |
| Filename | Description |
|---|---|
| antifaFAQ.pdf | Antifa overview |
| DestroyingWhiteNationalismWeb.pdf | Counter-fascist strategy |
| FightToWin-ProtestTacticsandStayingSafe.pdf | Militant protest tactics |
| RACIST-WATCH123.pdf | Monitoring fascist activity |
| tips_for_mobilising_against_the_far_right.pdf | Counter-organizing |
| DontJustDoNothing_CounterFascism.pdf | Counter-fascist action guide |
| Filename | Description |
|---|---|
| alf_prisoner_support.pdf | Supporting imprisoned ALF members |
| what_is_prisoner_support.pdf | Prisoner support basics |
| writing_to_prisoners_faq.pdf | How to write to prisoners |
| know_your_rights_zine.pdf | Legal rights |
| Activist_Trauma_and_Recovery.pdf | Mental health for activists |
| ABCminizine.pdf | Anarchist Black Cross overview |
| Filename | Description |
|---|---|
| Anarchy_Works.pdf | Anarchist theory |
| In Defense of Anarchy.pdf | Anarchist theory |
| Animal Liberation Human Liberation.pdf | Animal liberation theory |
| Insurrectionary_Ecology.pdf | Ecological insurrection |
| at-daggers-drawn.pdf | Classic insurrectionary text |
| 9-theses-insurgency.pdf | Insurgency theory |
| Days of War Nights of Love.pdf | CrimethInc classic |
The library includes a guide for establishing communications that bypass internet surveillance:
Technologies covered:
- FT8: Digital radio mode for weak signal communication
- Winlink: Email over amateur radio (no internet required)
- APRS: Automatic Packet Reporting System (tracking and messaging)
- Satellite communications: Direct satellite links
- SSTV: Slow Scan Television (sending images via radio)
- Amateur radio BBSes: Bulletin board systems accessible via radio
- Mesh networking: Decentralized local networks
Quotes from the guide:
"You can talk to people on the International Space Station."
"You can track the positions of airplanes and other vehicles using APRS."
"Hams were sending e-mail over ham radio networks before the Internet even existed. (Winlink) There still exist BBSes on various parts of the amateur bands."
"Slow Scan Television (SSTV) allows you to transmit a full color image as a series of tones."
Final Nail is an interactive map database of targets for animal liberation actions. It provides:
- Searchable database of fur industry facilities
- Map interface showing target locations
- Directions to each target (driving, walking, transit, bicycling)
- Filterable by category
- Fur buyer/auction houses — Where fur is sold
- Fur farms — Where animals are raised for fur
- Fur industry suppliers — Equipment and supply companies
- Laboratory animal suppliers — Companies that breed animals for research
The site includes a disclaimer:
"Any names and addresses on finalnail.com are published solely for educational, research or other lawful purposes."
The Animal Liberation Front (ALF) has carried out hundreds of attacks on fur farms including:
- Releasing animals ("liberations")
- Arson
- Vandalism
- Equipment destruction
This database provides targeting information for such attacks.
A PDF document (Blueprint-2020-Fur-Farm-List.pdf) available in the zine libraries provides a comprehensive list of fur farms with addresses.
During this investigation, a significant connection was discovered between the anarchist operational security infrastructure and darknet drug market infrastructure.
Found on: Unravel (unravel.noblogs.org)
Full Title: "GHOST: General Handbook of Operational Security Tactics"
GHOST is a comprehensive digital security guide that is distributed through both anarchist channels AND darknet market forums. It teaches the same operational security practices:
- Tails OS
- Tor Browser
- PGP encryption
- Monero cryptocurrency
- Encrypted messaging
- Metadata removal
Found on: Unravel (unravel.noblogs.org)
The "DNM Buyer's Bible" (DNM = Darknet Market) is a comprehensive guide for purchasing illegal drugs online. It was found being distributed through the same anarchist counter-info network.
This crossover demonstrates that:
- The same technical infrastructure (Tails, Tor, PGP, Monero) serves both drug trafficking and political violence
- The same distribution channels carry both types of content
- Knowledge and practices flow between criminal communities
- The "anarchist publishing" network is intertwined with broader criminal infrastructure
| Date | Location | Target | Method | Source |
|---|---|---|---|---|
| January 2026 | Berlin, Germany | Power plant | Sabotage | "Volcan" group via actforfree |
| January 2026 | France | Paris-Caen railway | Sabotage | Timed with AI conference |
| January 2026 | Balan, France | Chemical plant | Sabotage | actforfree |
| January 2026 | Vernon, BC, Canada | Kia dealership | Vehicle arson | actforfree |
| January 2026 | Multiple US cities | Banner drops | Day of Forest Defender | phlanticap, multiple nodes |
| January 6, 2026 | Online | ICE/DHS | Data breach (14,000 accounts) | Dirty South |
| October 2025 | Chicago | ICE vehicles | Vandalism | chicagoantireport |
| Summer 2025 | Chicago | 37 surveillance cameras | Destruction | chicagoantireport |
| 2025 | Chicago | UHaul/Budget trucks | Sabotage | chicagoantireport |
| July 2024 | Paris, France | TGV rail lines | Sabotage | Paris Olympics disruption |
| July 2024 | Paris, France | Fiber optic networks | Sabotage | Paris Olympics disruption |
"CAMOVER" is an organized campaign to destroy surveillance cameras. Results from Chicago (Summer 2025):
Total cameras destroyed: 37
| Method | Count |
|---|---|
| Paint (covering lens) | 20 |
| Physically smashed | 8 |
| Rope (pulled down) | 6 |
| Etch bath (chemical) | 2 |
| Impact driver (power tool) | 1 |
Ongoing: The Chicago site has announced "Winter Games 2026" — a new round of camera destruction.
Date: February 2025 (APEM-2025-02)
A bomb-making manual specifically written for anarchists, distributed through the network.
"Anarchists are going to make explosives. In Greece and Russia it is regular, but a lot of the recipes easily available online are either quite dangerous (like TATP) or outdated (like most of the US Army Improvised Munitions Manual). The recipes I have compiled are found with a little bit of digging but are often garbled and not easy to understand due to a lot of tweaking happening on the forums they are posted in. My sources are primarily sciencemadness.org and the Encyclopædia of Encyclopædias."
- TATP: Triacetone triperoxide, a primary explosive used in numerous terrorist attacks including the 2005 London bombings
- Sciencemadness.org: An online forum for amateur chemistry that has been used as a source for explosive synthesis instructions
- The document explicitly states it is compiling more reliable explosive recipes for anarchist use
Date: January 6, 2026
Approximately 14,000 accounts belonging to Immigration and Customs Enforcement (ICE) and Department of Homeland Security (DHS) employees were breached and distributed.
- First and last names
- Email addresses
- Password hashes
- Cleartext passwords (some accounts)
- Home addresses
- Phone numbers
The data was posted to "various hacker forums across the Tor network" according to the communique published on Dirty South.
This is not a passive doxxing operation—it's an active cyberattack distributing information that enables physical targeting of federal employees and their families.
A post titled "Charlie Kirk: There's More Comin'!" was documented on the counter-info network, suggesting targeting of the conservative political figure.
The network published support materials for Elias Rodriguez, described as the "Israeli Embassy killer," demonstrating explicit support for lethal political violence.
This investigation documents a complete operational infrastructure for domestic terrorism consisting of:
Extensive theoretical literature justifying political violence, from classical anarchist texts to modern insurrectionary theory.
Cell structure manuals providing explicit instructions for forming compartmentalized terrorist cells that cannot be infiltrated or rolled up.
Comprehensive technical guides for:
- Arson (with forensic countermeasures)
- Sabotage (electrical, communications, transportation infrastructure)
- Explosives manufacturing
- Physical confrontation tactics
- Doxxing operations publishing personal information of law enforcement
- Interactive target databases (fur farms, infrastructure)
- Target reconnaissance guides
Sophisticated operational security training including:
- Counter-surveillance techniques
- Counter-intelligence methods
- Digital security practices
- Forensic countermeasures
Decentralized network of regional nodes for:
- Claiming responsibility for attacks
- Coordinating solidarity actions
- Warning about law enforcement activities
- Distributing guides and training materials
- Prisoner support networks
- Legal defense resources
- Mental health resources for activists
- Fundraising mechanisms
The network's design mirrors the cell structure it teaches:
- No central point of failure: If one site is taken down, others continue
- Redundant distribution: Content is republished across multiple nodes
- Compartmentalization: Regional nodes operate semi-independently
- Standardized infrastructure: Common technical practices (Tor, Tails, PGP, Monero) across all nodes
- International reach: Coordination across North America, Europe, Latin America, Asia
The network operates openly by:
- Claiming "educational" or "journalistic" purpose for dangerous content
- Using hosting outside US jurisdiction (Italy via Autistici/Inventati)
- Accepting "anonymous submissions" to create deniability
- Framing attacks as "news" rather than operational coordination
The January 2026 ICE/DHS data breach, the February 2025 explosives manual, and the ongoing sabotage campaigns documented through this network demonstrate:
This is not historical or theoretical—it is active, operational infrastructure enabling ongoing attacks against American institutions and personnel.
- https://pugetsoundanarchists.org
- https://rosecitycounterinfo.noblogs.org
- https://north-shore.info (BC Counter Info)
- https://phlanticap.noblogs.org
- https://neversleep.noblogs.org
- https://jerseycounterinfo.noblogs.org
- https://pghcounterinfo.noblogs.org
- https://mbtadistro.noblogs.org
- https://neec.noblogs.org
- https://livefree.noblogs.org
- https://unsalted.noblogs.org
- https://bbnews.noblogs.org
- https://indybay.org
- https://rant.li/okmana/
- https://actforfree.noblogs.org
- Tor: 2gzyxa5ihm7nsggfxnu52rck2vv4rvmdlkiu3zzui5du4xyclen53wid.onion
- https://warriorup.noblogs.org
- Email: warriorupthrowdown@autistici.org
- PGP: 4283 5D10 4ABA 6B2D 0C60 A4F1 F7A9 73A3 8FD8 16E0
- https://notrace.how
- Tor: i4pd4zpyhrojnyx5l3d2siauy4almteocqow4bp2lqxyocrfy6prycad.onion
- Mastodon: @notrace@kolektiva.social
- Newsletter: notraceproject-subscribe@lists.riseup.net
- Noblogs.org (Autistici/Inventati) — Blog hosting
- Riseup.net — Email and mailing lists
- Autistici.org — Email and services
- Kolektiva.social — Mastodon instance
- Mega.nz — File hosting
— END OF REPORT —
Document compiled: January 30, 2026
Total length: Approximately 15,000 words
Sources: Direct observation of public websites, uploaded documents, screenshots of file repositories