OSINT Digest: Palantir Contracts, RT Mirror Domains, AI Debt and Russia's Retreat From Syria
Ten recent pieces, grouped by the thread that actually connects them rather than the order they went out. Some of it is procurement, some of it is money, and a surprising amount of it is the same story told at different layers of the stack.
The picture below is a decent illustration of the problem this site keeps circling. Two men stand at a wrought-iron railing above a dense hillside city, backs to the camera, everything in front of them thrown soft by a long lens. One is shooting stills handheld. The other has a Sony video body on a fluid-head tripod, shotgun mic on top, a phone clamped above the monitor, presumably running a second angle or a live feed. Between them they are operating four recording devices pointed at the same view. None of that tells you what is happening down in the streets. It tells you where they were allowed to stand, what focal length they brought, and which slice of the city fits in the frame from that terrace. Open-source work runs on the same constraint. The material is abundant, the vantage point is not neutral, and most of the analytical effort goes into working out what the position itself is excluding.
Europe is unpicking its American software stack
The clearest procurement story of the season is the slow European exit from Palantir. Contracts that looked locked in eighteen months ago are being allowed to lapse, and the interesting question is not why they are lapsing but who is positioned to take them. We looked at why European governments are dropping Palantir and which companies want the contracts, including the domestic vendors who have spent years losing these bids and are now writing sovereignty into their pitch decks. Worth watching how many of them can actually deliver at the scale being vacated.
Influence, funding, and the infrastructure that carries it
Two pieces here that sit closer together than they first appear. The first is an open-source assessment of Qatari and Turkish funding of European Islamist networks and the protest link, which tries to do something harder than it sounds: trace money through registered charities and cultural foundations without collapsing into assertion. The finding is about proximity and repetition, not a smoking gun, and the piece is explicit about where the evidence thins out.
The second is a methods piece. RT was banned across the EU in 2022 and is still readable in most of it, because banning a broadcaster and banning a domain are different problems. RT’s mirror domains outlasted the EU ban walks through how researchers actually map that network, using certificate transparency logs, shared hosting fingerprints, and the registration patterns that give away a bulk operation.
For historical context on all of this, Room 3603 is a reminder that running a foreign influence campaign out of a friendly country’s commercial real estate is not a new idea. British Security Coordination occupied two floors of Rockefeller Center and ran the largest wartime intelligence station of the war from an address you can still visit.
The AI trade turns into a credit story
Four pieces on this, and they build on each other. Start with the argument that the AI trade is entering a new phase, where the equity story stops being about who has the best model and starts being about who can finance a decade of concrete and copper.
Then the financing itself. Intel’s $20 billion upsize and Cloudflare’s zero-coupon converts are two very different instruments telling the same story about how much appetite there still is for this paper. Zero-coupon converts getting done at all is the signal.
Underneath that sits the layer problem. CoreWeave’s $2.6B loan, Point2’s $136M Series B and MaxLinear’s rack control plane covers the gap between where the capital is going and where the constraint actually lives. Billions land on GPUs and buildings. The thing holding the rack back is interconnect and control.
And the bill lands somewhere. The AI buildout shifts to debt and household bills follows the part that gets less coverage, which is grid interconnection costs and what happens to retail power rates when a hyperscaler moves into your utility district.
Russia’s contracting perimeter
Two datapoints from opposite ends of the map. In Syria, Damascus has taken back Hmeimim and Tartus, with the bases rebranded as joint training centres. That phrasing is doing a lot of work, and the flight and shipping data suggest the practical footprint has already shrunk well below what the agreement implies.
In Germany, US intelligence has tied the Leipzig airport drone bomb to Russia while Berlin stays silent. The gap between what Washington is briefing and what the German government is willing to say publicly is itself the story here.
More next week.