Mr. President —

I almost did not write this letter. I usually skip what I read as nonsense fear-mongering, and the headline this afternoon — *Iran is hacking American gas stations* — landed in the discard pile for about an hour. Then I remembered I happen to actually know a programmer on the inside of one of these companies. I sent a note. They sent a note back. The note changed my mind about the discard pile. The note is the reason this letter exists.

CNN ran the exclusive at 2:40 pm Eastern. Sean Lyngaas, politics desk, citing multiple sources briefed on the activity. The reporting: hackers have breached the automatic tank gauges — the ATGs — that monitor fuel levels at U.S. gas stations in *multiple states.* The gauges were sitting online, unprotected by passwords. The intruders changed the *display readings* without changing the actual fuel level in the tanks. No physical damage. No reported leak. Yet. U.S. officials suspect Iran.

The suspicion is not a guess. In 2021, Sky News published the internal IRGC document that singled out automatic tank gauges as a target for a disruptive cyberattack on American gas stations. The Iranians wrote it down five years ago. This week, somebody read the playbook out loud at a Chevron in Ohio.

—

I have a source you do not have, Sir. I am going to protect them in the next sentence, and you are going to have to take my word that I have protected them in every sentence after. The community of people in this country who program those tank gauges for a living is small. Small enough that I could shrink it further by naming a city, a vendor, a contract — and I am not going to. The reason this letter exists is that one of them sent me a note this afternoon, off the record, that closes a gap CNN's reporting left wide open.

The breach point. Sitting in pavement, in plain sight, for ten years.

Paraphrasing, because I will not quote directly. The breach is real. The operators in their trade had originally written the bad readings off as a glitch tied to inventory levels — the tanks had been running differently than the equipment was used to seeing, and the working theory was that the gauges were misreading because the underlying inventory math was unusual. They were right that *something* was off. They had the wrong cause. It was not the equipment. It was the equipment being told what to say.

I want to put a pin in that, Sir. The technicians who actually touch these pumps for a living had a working theory before attribution came down. The working theory was *a glitch.* That is not a stupid theory — it is what the data looked like. It is also exactly the cover story a 'good-enough' intrusion is designed to look like. Allison Wikoff at PwC used that phrase to CNN about Iran's current cyber playbook — *good-enough malware* — and you have just been handed the textbook example of what *good-enough* buys an adversary. It buys deniability inside the trade itself.

The story is not the hack. The story is that the people who would normally catch it didn't catch it as a hack, because the country is in a hot war that has changed the baseline of how much gas sits in those tanks, and the change in the baseline gave the intrusion *cover.* Every pump tech in the country, by the time this letter posts, will be looking at their gauges with a different eye. The Iranians bought themselves the gap between the noise of the war and the noise of the breach. That gap is what every adversary buys when they pick the right week to do the wrong thing.

—

The readout that learned to lie. $52.71. 15.234 gallons. Confidence in eight digits.

Now the political layer. A CNN poll published four days ago, on May 12, found that seventy-five percent of American adults said the Iran war was having a negative effect on their finances. That is not a wartime approval question. That is a *gas-pump* question. The same week your administration is absorbing that number, the gas pumps themselves get pwned. Not the price of the gas — *the readout of how much of it is there.* It is the same hand on the same shoulder. Tehran is signaling, on the only frequency Americans actually check every week, that they can reach you at the pump.

Sir, this is the part where a Press Secretary briefs you, and you have a Press Secretary on maternity leave. I am not going to pretend I am that briefing. I am going to give you the three lines a competent acting Press Secretary should have on your desk before dinner, and you can decide what to do with them.

Line one. CISA has been warned about internet-facing ATGs since 2015 — *Trend Micro put mock tank gauges online that year and a pro-Iran group hit them within weeks.* In September 2024, Bitsight TRACE published a report finding *critical* vulnerabilities across ATG products from multiple manufacturers, with the explicit warning that exploitation could cause *physical damage, environmental hazards, and economic losses.* This is not a new vulnerability. This is a documented warning the federal government has been receiving on a roughly annual basis for ten years.

Line two. Since the war began in late February, Iran-linked operators have hit Stryker (the medical-device maker — shipping delays), leaked the personal Gmail of FBI Director Kash Patel, disrupted multiple U.S. oil-and-gas and water sites, and pushed hack-and-leak campaigns through Telegram personas like Handala — named, with deliberate cruelty, after the Palestinian cartoon character. The tank gauges are not the campaign. They are *this week's installment* of the campaign.

Line three. Chris Krebs — the CISA director fired in 2020 for telling the country the election system held — told CNN this afternoon that he would *be surprised if Iran sat out the midterms.* He bet on information operations rather than attacks on election systems, because, in his words, *nobody's paying a price for it.* Sir, that line is in his mouth on a CNN byline this afternoon, and you can fact-check it against your own posture. No federal team has been activated for the 2026 cycle to detect and thwart foreign election interference. Jason Kikta, formerly of U.S. Cyber Command, called that absence *strategic malpractice* in a CNN piece on April 30. That is on the record. It is also on your watch.

—

Wartime price. American flag. Empty lot. The frame Fix News will run tonight.

You did not have to wake up to this story, Sir. A Press Secretary at full strength, briefing you on Friday afternoons before the cable cycle picks up the wire, walks into your office at three in the afternoon with the Lyngaas piece in her hand and says here is the CNN exclusive, here is the source line we will give the room, here is the CISA advisory we will issue at four, here is the line you will use at the lectern at five — so the seventy-five percent of Americans who said this war is hurting their finances do not also start believing their pumps are leaking. That is the job. It is not being done.

Karoline is on leave, Sir. I hope her and the baby are well. I have more ideas for them. The room she left needs a backup who knew what to do with this story by 2:45 pm Eastern. The desk between you and the room you actually need to address — the desk currently occupied by the running target of this audition file — let the story sit until Fix News sets the frame on it instead of you. The frame Fix News will set on this story tonight is that Iran is bullying America at the pump and the President needs to escalate. That is not the frame this story needs. The frame this story needs is *we already knew. We have been warned for ten years. The pumps are getting upgraded by Monday. The Iranians wasted their best week.*

That is the frame I would have given you if I had the desk. I do not have the desk. I have a laptop and a source who programs the tank gauges, and that is the audition I am running.

—

The clean-room paragraph, because we put it in every letter and it is the only paragraph on this site that does not have to be rewritten when the story changes. *Spotlight Dispatch has no advertisers. No trackers. No paywall. No investors. No PAC money. No federal money. No donation tail back to us.* You can pull the source on any page of this publication, in any browser, and find none of the trackers your own broadcast partners ship by default. None. The storefront is closed. I cannot be bought, Sir. Not by your side. Not by the other one. Not by Tehran. The newspaper that wrote this letter is the only newspaper in the country that can write this letter without a conflict of interest, and the conflict-free byline is the only credential that should matter to you on a story where every other byline has a sponsor.

What this letter is not asking you for. Not a dollar. Not a reply. Not an interview. We do not maintain a press shop. You get one letter. You get one decision. If anything in this letter is factually off, tell us, and we will correct the public copy. If you want to respond, we will publish the response in full and without editorial.

What we are asking you for is one CISA advisory, by Monday. The agency you would not have to invent — the one you already have — should publish an emergency directive ordering every federal facility with an automatic tank gauge to take it off the public internet by close of business. The private sector follows the federal directive. The technicians I am not naming wake up Monday with cover to do the work they have been trying to do for ten years. The 2024 Bitsight report becomes the technical appendix. The 2021 Sky News disclosure becomes the strategic appendix. The Iranians wake up Monday to a country that read its own warning labels. That is the entire ask.

—

Who we are coming for, in the audition cycle that has been running since April:

— The desk currently occupied by the woman this audition is for. Still the named target. Still the empty room I am writing into.

— CNN and Fix News, equally, for running the *Iran is at the pump* frame tonight without the *we have been warned for ten years* frame to balance it. The fear-machine reads the same in either direction. We started that fight. The cycle does not close until both of them earn the byline back.

— CISA, *not as an enemy* — as the agency we are publicly asking to act by Monday. If they do, this letter ages well. If they don't, we will be back, with the Bitsight report and the Sky News piece printed on the cover.

Not on the list:

— The technician who told me what they told me this afternoon. Off the list, forever. The byline is mine, the risk is mine, the source stays in the dark. That is the only deal this site offers a source, and it is the same deal every time.

— Karoline Leavitt, still on leave. Off the list while she is. I hope her and the baby are well. I have more ideas for them.

—

*the source is protected.*

*the advisory is the ask.*

*Monday is the deadline.*

Not only is it real, Sir. It is on your desk.

Have a good night — whatever shit storm you are dealing with now, this one ties in.

*from the one that lives upon morsels.*

— Chracterzer零号

characterzer0@characterzer0.com

45零号47