from the the-seashell-felonies dept

James Comey is not exactly someone we’ve ever been a fan of on Techdirt. He was a terrible FBI director in so many ways. We’ve spent years criticizing the man — for his crusade against encryption, his supporting the FBI’s ridiculously aggressive impersonation of reporters, his embrace of the FBI’s program to coerce and entrap people down on their luck into fake terrorist plots, and much more. And, while the impact has been exaggerated, it is true that he took multiple actions violating DOJ procedures that likely helped get Donald Trump elected in 2016. So it’s not like I’m rushing to support the guy. He’s a bad cop and has been for some time.

But the indictment the Department of Justice handed down against James Comey on Tuesday is a truly embarrassing legal document, and everyone involved in producing it should be professionally radioactive for the rest of their careers. I would have said it’s one of the most embarrassing legal documents that this DOJ has produced, but remember, just a day earlier they filed a legal brief that was indistinguishable from a Truth Social post.

The charge, in its entirety, concerns this Instagram post from May 2025:

If you can’t see that, it’s an Instagram post from Comey showing some shells on some sand with the shells spelling out 8647 and the caption on the post saying:

Cool shell formation on my beach walk

For this — for posting a photo of arranged seashells in a slightly sassy pattern and posting it to Instagram — Comey has been charged with two federal felonies: threatening the President under 18 U.S.C. § 871, and transmitting a threat in interstate commerce under 18 U.S.C. § 875(c). (For what it’s worth Comey has claimed he didn’t arrange the sea shells, but just found them. It’s unclear if that makes much of a difference, it’s protected speech either way).

Ken “Popehat” White, who has perhaps done more than any other lawyer in America to explain First Amendment doctrine to laypeople, didn’t mince words about what this is:

The charge is preposterous and no competent or honest prosecutor would bring it. It represents a betrayal of the professional and ethical obligations of every U.S. Department of Justice attorney involved, and reflects the complete collapse of the Department’s credibility and independence in favor of a cultish and cretinous devotion to Donald Trump.

He’s right, and the way to understand just how right he is requires understanding the path that brought us here.

Because this is the second time the Trump DOJ has tried to indict Comey. The first attempt collapsed in spectacular fashion last year, after Trump — in what was apparently supposed to be a private direct message but accidentally went out as a public Truth Social post — demanded that Pam Bondi install Lindsey Halligan, a former insurance lawyer with no relevant experience, as a U.S. Attorney specifically because she had promised to indict Comey. The problem: Halligan wasn’t legally appointed. The entire indictment got tossed before the court could dismiss it for being ridiculous (which would have happened) because the person who filed it wasn’t allowed to file it.

As we noted at the time, this pattern of procedural self-sabotage is a recurring feature of an administration that treats legal procedure as an inconvenience rather than the actual point of having a justice system.

So how did the DOJ respond to that humiliation? By coming back with something substantively even worse. In theory, they tried fixing the “wrong person filed it” problem by having an actually legally appointed person file something… even if that something has no legal basis whatsoever. Progress! Sort of?

The seashell indictment was filed by W. Ellis Boyle, the U.S. Attorney for the Eastern District of North Carolina, with Assistant U.S. Attorney Matthew R. Petracca listed as the prosecuting attorney. Remember those names. They put their signatures on this. Boyle is listed as the U.S. Attorney for the Eastern District of North Carolina, but he’s serving in an acting capacity — Trump has nominated him multiple times, yet the Senate has still refused to confirm him.

The legal problem with the indictment is pretty easy to spot: to convict someone under either of the threat statutes the DOJ is invoking, the government has to prove the communication constituted a “true threat.” Under controlling Fourth Circuit precedent (this case is in North Carolina), a true threat is something “an ordinary, reasonable recipient who is familiar with the context in which the statement is made would interpret as a serious expression of an intent to do harm.”

As Ken White noted, the Supreme Court established this framework in Watts v. United States, a 1969 case involving an 18-year-old draft protester who said:

They always holler at us to get an education. And now I have already received my draft classification as 1-A and I have got to report for my physical this Monday coming. I am not going. If they ever make me carry a rifle the first man I want to get in my sights is L. B. J.

The Court found this was protected political hyperbole, not a true threat. An explicit statement about wanting a President in your rifle sights — protected.

If Watts isn’t damning enough, there’s United States v. Bagdasarian, a much more recent Ninth Circuit case where a man posted online statements about wanting to shoot then-candidate Barack Obama, including some genuinely vile racially explicit language about hoping Obama would be killed. The court held that even that did not constitute a true threat under the relevant statutes.

I’d be curious to hear from anyone defending this indictment whether they think Bagdasarian was wrongly decided. Or do we change the “true threat” standard when the target is Trump?

So the descending ladder of seriousness looks like this:

• Explicit racial language about wanting a President shot: protected
• Telling a crowd you want LBJ in your rifle sights: protected
• Posting a photo of seashells arranged on a beach to spell “86 47”: two federal felonies

Any first-year law student who’s taken a basic First Amendment course could tell you the seashell post is constitutionally protected. Any prosecutor with five minutes of research time would know that Bagdasarian and Watts exist. But, of course, as we’ve seen over and over and over again in the Trump era, the point is not to bring a good case or a winnable case. The point is just to punish Trump’s enemies with vexatious, vindictive prosecutions in hopes of creating a chilling effect among the populace and stopping them from criticizing the President with the thinnest skin possible.

Now, “86” has had various meanings over the years — to “86” something in restaurant slang means to remove it from the menu or get rid of it. The DOJ’s theory is apparently that when used about a person, it means to kill them. No one else believes that. This is the kind of motivated reading that requires ignoring both the dictionary and how actual humans use language.

But fine, let’s grant the absolute most uncharitable reading and say “86 47” means “get rid of the 47th President through killing.” Even granting that — even doing all the work for the prosecution — it’s still obviously protected political expression, and still obviously not a true threat under the controlling case law.

Which brings us to the part that genuinely cannot be explained by anything other than pure vindictiveness. Here is a tweet from Jack Posobiec, a prominent Trump loyalist/conspiracy theorist, posted in January 2022:

That tweet is still up. I just made that screenshot minutes ago. As of this writing, it has been online for nearly four years. No FBI investigation. No federal indictment. No felony counts. Literally no one thought that was an actual threat. Because it’s not. Apparently the DOJ’s theory of criminal threats has a loyalty-based expiration date — the same numerical expression is a felony when arranged in shells by a Trump critic and a perfectly fine tweet when posted by a Trump supporter about a different President.

Indeed, the fact that Posobiec seems to have no issue keeping this tweet up is itself a sign that the MAGA world knows it’s engaged in purely theatrical vindictive prosecution — and wants you to know they know. To them, once again, nothing here is about justice or the rule of law. It’s just “will this make the people I dislike upset.” That is their only motivating factor.

The DOJ has baked the selective prosecution argument directly into its own theory of the case. Comey’s lawyers will surely refresh the selective prosecution motion they filed in the first, dismissed indictment, and the facial absurdity of this one — combined with the existence of identical, ignored expression by Trump allies — makes that motion approximately as easy to support as such motions ever get.

There’s a specific kind of institutional rot in play here, driven entirely by Donald Trump and his minions. Competent authoritarianism is dangerous in obvious ways. Incompetent authoritarianism that keeps trying anyway is dangerous in different ways: it normalizes the use of state power for personal vengeance while demonstrating that the people wielding it will stop at nothing — even on the most facially ridiculous grounds. That’s a chilling effect doubled: a politicized DOJ, staffed by people who can’t pass a First Amendment quiz.

White is right that the indictment is unlikely to survive. Comey’s attorneys can challenge it on its face, arguing that even taking every allegation as true, seashells spelling “86 47” are protected by the First Amendment as a matter of law. The assigned judge was appointed by a Republican but is reportedly not a partisan hack, and the case law here is so clear that it would take extreme judicial bad faith to let this proceed. The selective prosecution motion is also stronger now than it was the first time, with Posobiec’s untouched tweet sitting there as Exhibit A.

But as White notes, surviving the motion to dismiss isn’t actually the point:

The point of the indictment is to demonstrate that the United States Department of Justice is wholly an instrument of Donald Trump’s senescent pique, no more independent of him than a boil on his ass. The point is to show that the administration can, and will, use the Department’s mechanisms to punish enemies. The point is to show that the Department can, and will, punish protected speech. The point is to show that the Department is staffed by committed fanatics willing to do anything, however unethical and unconstitutional, to promote Trump.

The point is to show that in the war between Donald Trump and the U.S. Department of Justice, Trump has won. Now they’re on the field slitting the throats of the wounded and looting bodies.

W. Ellis Boyle and Matthew R. Petracca put their names on this indictment. They will, presumably, lose this case the way the previous Comey case was lost — embarrassingly, on grounds that any competent attorney not engaged in cult-like performative fealty to a wannabe authoritarian could have anticipated. And when this is all over, when there is some accounting for what was done to the Department of Justice in these years, the people who signed the seashell indictment should never be trusted with prosecutorial power, a bar membership, or any position requiring professional judgment ever again.

The shells, for what it’s worth, were on a beach. The tide has presumably long since rearranged them. The Instagram post was taken down fairly quickly when the MAGA world lost their minds over it. The federal felony charges, somehow, remain.

Filed Under: 1st amendment, donald trump, ellis boyle, free speech, jack posobiec, james comey, matthew petracca, true threats, vindictive prosecution

Gamers who remember the old days understand why CRT screens are so popular. Instant responsiveness to every command, no screen tearing, and images that feel alive in a way that newer flat screens cannot match. Found Tech has taken that magic and pushed it all the way to nearly 4K on something you wouldn’t expect, a dusty old IBM 275 monitor that’s been around since the turn of the century.

Found Tech began with a vintage IBM 275, which is roughly 20 years old and fairly strong for an office monitor constructed around a cathode ray tube. The problem is that modern graphics cards cannot generate the necessary signal to drive such high resolutions, therefore he relied on the “free” Intel graphics in his system. An RTX 4080 Super handled all the heavy rendering work while the Intel chip generated the final video feed. Custom Resolution Utility software let him dial in a 2880-by-2160 interlaced mode that standard drivers refuse to allow. After testing dozens of driver versions, the combination finally locked in.

Sale

LG 27UP650K-W 27-inch Ultrafine 4K UHD (3840 x 2160) IPS Computer Monitor, 60Hz, 5ms, DisplayHDR…

• Stunning Image Quality in 4K Display – The 27-inch UHD 4K (3840 x 2160) IPS display reproduces clear images and vibrant colors with up to 95% DCI-P…
• 4K UHD HDR – To more fully realize content creators vision, this monitor is compatible with VESA DisplayHDR 400 high dynamic range, supporting…
• Color Your World – Explore HDR content the way it was meant to be seen with up to 95% DCI-P3 color gamut expression—an elevated color spectrum that…

CRTs can support this high-resolution setup because they function differently than modern monitors. Instead of a set grid of pixels, a CRT projects an electron beam across a layer of illuminating phosphors. The beam may draw lines as close together as the signal desires, and at this very high density, interlacing concerns simply vanish. The impression is that the lines mix together so smoothly that it resembles progressive scan. The tube’s analog nature takes care of the rest, providing edges with a softness that digital sharpening cannot imitate.

However, at this resolution, motion truly shines. LCD and OLED screens maintain each frame on the screen for a fraction of a second, resulting in a slight but consistent blur during fast panning and quick character movements, whereas a CRT lights up each phosphor for as long as the beam is over it and then fades away quickly. The result is incredibly crisp action, even with things racing across at full speed, and games feel much more immediate because you can see every frame just as the graphics card created it.

The depth is difficult to understand without seeing it for yourself, as the image looks to be sitting inside the tube rather than on its surface. Dark places remain pitch black, with no light leaking in. Bright highlights are super intense, and when speeding through the large open world of Crimson Desert at this resolution and 60 frames per second, the scenery begins to feel like it has depth and distance to it.
[Source]

Hackers are exploiting two authentication bypass vulnerabilities in the Qinglong open-source task scheduling tool to deploy cryptominers on developers’ servers.

Exploitation started in early February, before the security issues were disclosed publicly at the end of the month, according to researchers at cloud-native application security company Snyk.

Qinglong is a self-hosted open-source time management platform popular among Chinese developers. It has been forked more than 3,200 times and has over 19,000 stars on GitHub.

The two security problems impact Qinglong versions 2.20.1 and older and can be chained to achieve remote code execution:

• CVE-2026-3965: A misconfigured rewrite rule maps ‘/open/*’ requests to ‘/api/*’, unintentionally exposing protected admin endpoints through an unauthenticated path
• CVE-2026-4047: The authentication check treats paths as case-sensitive (/api/), while the router matches them case-insensitively, allowing requests like ‘/aPi/…’ to bypass authentication and reach protected endpoints.

The root cause in both flaws is a mismatch between middleware authorization logic and Express.js routing behavior.

“Both vulnerabilities stem from a mismatch between the security middleware’s assumptions and the framework’s behavior,” Snyk researchers explain.

“The auth layer assumed certain URL patterns would always be handled one way, while Express.js treated them differently.”

Snyk reports that attackers have been targeting these two flaws on publicly exposed Qinglong panels to deploy cryptominers since February 7.

This activity was first spotted by Qinglong users, who reported about a rogue hidden process named ‘.fullgc’ utilizing between 85% and 100% of their CPU power.

The name deliberately mimics “Full GC,” an innocuous but resource-intensive process, to evade detection.

According to Snyk, the attackers exploited the flaws to modify Qinglong’s config.sh and injected shell commands that downloaded a miner to ‘/ql/data/db/.fullgc,’ and executed it in the background.

The remote resource located at ‘file.551911.xyz’ hosted multiple variants of the binary, including for Linux x86_64, ARM64, and macOS.

The attacks continued with multiple confirmed infections across various setups, including behind Nginx and SSL, while the Qinglong maintainers only responded to the situation on March 1.

The maintainer acknowledged the vulnerability and urged users to install the latest update. However, the mitigation in pull release #2924 focused on blocking command injection patterns, which Snyk says was insufficient.

The researchers report that the effective fix came in PR #2941, which corrected the authentication bypass in the middleware.

AI chained four zero-days into one exploit that bypassed both renderer and OS sandboxes. A wave of new exploits is coming.

At the Autonomous Validation Summit (May 12 & 14), see how autonomous, context-rich validation finds what’s exploitable, proves controls hold, and closes the remediation loop.

Claim Your Spot

For a few hours recently, global cloud platform Cloudflare went down – and a noticeable chunk of the internet went with it.

Services stalled, platforms froze, and businesses were left dealing with failures they didn’t trigger and couldn’t control – from broken checkouts to lagging internal tools.