Monday, June 01, 2026

Fwd: Resource Usage Summary for rauterkus1





--
Ta.
 
 
Mark Rauterkus       Mark.Rauterkus@gmail.com
Mark@Rauterkus.com    <--- causing lots of missed messages, sadly.
Webmaster, International Swim Coaches Association, SwimISCA.org
Coach at The Ellis School for Varsity & Middle School Swimming

412 298 3432 = cell


---------- Forwarded message ---------
From: <support@pair.com>
Date: Mon, Jun 1, 2026 at 12:18 AM
Subject: Resource Usage Summary for rauterkus1
To: <Mark.Rauterkus@gmail.com>
CC: <mark@rauterkus.com>


This summary covers the most recent month of service, and charges have
been posted to your billing records, if any over-usage is shown below.
These charges will appear on your statement within the next few days.
This is NOT a bill, but it does represent upcoming charges.

This is an automated report generated by Pair Networks, Inc.  If this
has been misdirected, please let us know at support@pair.com.

This summary covers the dates April 30, 2026, through May 30, 2026,
inclusively.

  Date       Bandwidth Usage
  ----       ---------------
 Apr 30                 6.87 GB
 May  1                 9.42 GB
 May  2                20.57 GB
 May  3                27.41 GB
 May  4                29.63 GB
 May  5                11.91 GB
 May  6                13.37 GB
 May  7                15.01 GB
 May  8                17.59 GB
 May  9                31.56 GB
 May 10                33.57 GB
 May 11                    0 GB
 May 12                35.33 GB
 May 13                27.54 GB
 May 14                33.31 GB
 May 15                35.66 GB
 May 16                30.05 GB
 May 17                27.76 GB
 May 18                24.96 GB
 May 19                20.22 GB
 May 20                19.99 GB
 May 21                16.22 GB
 May 22                16.85 GB
 May 23                18.09 GB
 May 24                34.11 GB
 May 25                22.07 GB
 May 26                 4.75 GB
 May 27                 5.51 GB
 May 28                 0.48 GB
 May 29                11.32 GB
 May 30                 5.59 GB
  ----       ---------------
 TOTAL                571.05 GB
 Total Bytes:     613,156,425,436 =        571 GB
 Allowance:                              12288 GB

This summary includes all resource usage for the most recent calendar
month.  Charges for over-usage, if any, are shown above, and will appear
on your next billing statement.


1 Gigabyte (GB) is equal to 1024 Megabytes, or 1,073,741,824 bytes.
Pair Networks pricing policy is to always round down fractional Gigabyte
transfer amounts.  For example, if you had a total monthly transfer of
314,159,265,358 bytes, this would be 292.583615 GB, which is rounded
down to 292 GB.

If you have any questions about your usage or this report, please contact
us at support@pair.com.

Thank you for choosing Pair Networks!

Sunday, May 31, 2026

Loud Noises and Sounds at Baseball Parks

https://frontofficesports.com/newsletter/how-ballparks-got-so-loud/

Memo to Wordfence folks - Malware Samples and Reappearing WordPress File Writer: Have You Seen This Pattern?


Request for Guidance: Persistent WordPress Malware Reinfection and Reappearing File Writer


Hello Wordfence Team,

I am writing to document a difficult, ongoing WordPress security incident and to ask whether your team has seen this pattern before.

I am the webmaster for multiple small nonprofit, sports, coaching, and community websites hosted under a Pair Networks account, rauterkus1. I use Wordfence on a number of these WordPress sites. Wordfence has helped identify many of the bad files, but the larger issue is that some malware directories and files are reappearing after deletion. I am trying to move from cleanup mode to root-cause mode.

I would be open to a phone conversation if someone at Wordfence is interested. I can also supply more detail, saved files, logs, screenshots, and possibly a backup/archive for inspection. Forensics is not my strength, but I have preserved some useful evidence.

Summary of the incident

This began as what looked like a normal WordPress malware cleanup: Wordfence alerts, unknown files in core locations, modified core files, suspicious .htaccess files, and unauthorized WordPress administrator accounts.

However, the situation became more serious because after deleting malware files, certain directories and files reappeared.

The most important recurring infection path has been:

/usr/home/rauterkus1/public_html/waterpolo.cloh.org/wp-includes/sodium_compat/src/Core32/Curve25519/Ge

Files found or recreated there included:

queue_1.php
queue_1-3.php
16e2277f8b31_A
16e2277f8b31_B
.htaccess

Wordfence also found other unknown files in WordPress core locations, including examples under:

wp-includes/sodium_compat/
wp-admin/css/colors/sunrise/
wp-admin/maint/
wp-includes/certificates/KINGSMAN/
wp-includes/sitemaps/providers/

Some file names reported or observed included:

wp-olite.php
mjc0.php
mjc0-2.php
mjc0-3.php
outbound.php
dwn2.php
dwn2-2.php
dwn2-3.php
perl.haxor
py.haxor
bash.haxor
class-wp-sitemaps-cache.php

Important file behavior

The file queue_1.php appeared to start a PHP session, accept data from a request, store it in session data, and rename itself using the session ID and session path.

The file queue_1-3.php appeared more serious. It decoded hidden numeric strings into PHP functions such as file_put_contents and chmod. It accepted request variables such as x1 and x2 and appeared able to write arbitrary files.

That seems to explain why deleting visible files is not sufficient. If any web-callable copy of this writer remains reachable, a bot or attacker may be able to recreate the malware tree.

A local .htaccess file inside the infected folder included rules that allowed PHP files to execute from that deep location. In other words, the folder appeared to be prepared as an executable hideout, not merely a storage location.

What we have done so far

We have taken many containment and cleanup steps:

  • Deleted unauthorized WordPress administrator accounts.
  • Changed WordPress admin passwords.
  • Rotated WordPress SALT keys on affected sites.
  • Changed database passwords on some affected sites.
  • Reinstalled or reactivated Wordfence on multiple sites.
  • Used Wordfence to delete flagged unknown core files.
  • Added .htaccess hardening rules.
  • Blocked XML-RPC where not needed.
  • Blocked direct wp-comments-post.php where comments are not used.
  • Disabled or retired unneeded sites where possible.
  • Moved some mission-critical sites away from the compromised environment.
  • Nuked all old FTP accounts and plan to recreate only temporary, limited access accounts as needed.
  • Began inspecting raw logs from Pair Networks.
  • Kept some suspicious files and screenshots for evidence.

Complicating factor: web root disruption

During the response, the main web directory structure became disrupted. Many sites that had been under:

/usr/home/rauterkus1/public_html/

ended up under:

/usr/home/rauterkus1/public_html/public_html.bak/

Pair Networks has said they only renamed public_html as a test and did not restore a backup. They also said that any available backups may already be compromised.

The current working approach is not to restore the entire old tree blindly. We are treating public_html.bak as contaminated source material, not as trusted clean backup.

Host observations

Pair Networks reported that the suspicious files were being written as my account user. They did not see active cron jobs, SSH logins, or obvious FTP logins from unknown IPs in the basic account access records. FTP logins that were shown came from my own IP address. That does not rule out web-executed malware, compromised local credentials, or a surviving PHP writer elsewhere under the account.

The recurring theory is that a surviving web-callable PHP writer, possibly in another WordPress install or old site folder, is recreating the malware tree.

Questions for Wordfence

Have you seen this specific pattern before?

In particular:

  1. Have you seen malware hiding under paths like:

wp-includes/sodium_compat/src/Core32/Curve25519/Ge

  1. Have you seen payload pairs like:

16e2277f8b31_A
16e2277f8b31_B

  1. Have you seen writer files using request parameters like x1 and x2 to call decoded file_put_contents and chmod?
  2. Is this associated with a known malware family, campaign, or exploit chain?
  3. Is there a recommended way to search across an entire hosting account for related writer/dropper files, not just one WordPress installation?
  4. Can Wordfence scan outside the normal WordPress directory if multiple WordPress sites share one hosting account?
  5. Is there a Wordfence-supported method to identify the original vulnerable plugin, theme, upload folder, or entry point?
  6. Are there specific log patterns I should search for in raw Apache logs, such as POST requests to unusual PHP files under wp-includes, wp-content/uploads, or wp-admin?
  7. What should I preserve before continuing cleanup?
  8. Is this the kind of case where Wordfence Care or Wordfence Response would normally be appropriate, even if I am first seeking guidance or an estimate?

Help requested

I am not expecting free emergency remediation, but I am asking for guidance.

I would appreciate knowing:

  • Whether this pattern is familiar to your team.
  • Whether specific file names or paths indicate a known malware family.
  • Whether there are recommended searches or YARA-like signatures I should run.
  • Whether Wordfence has documentation for multi-site shared-hosting reinfection loops.
  • Whether you can suggest a safer sequence for cleanup, scanning, and password rotation.
  • Whether someone at Wordfence would be willing to review a small sample set of files.
  • Whether you offer an estimate or bid for this type of incident review.

I am also open to suggestions about other security professionals or tools that may help. If there is a more specialized forensic GPT, scanner, or incident-response workflow you recommend for WordPress malware on shared hosting, I would be interested.

Current status

This is still a work in progress.

Some sites have been stabilized. ACEN has been temporarily redirected to a clean Pairsite location. SwimISCA.org has been moved to a different server. Blog.SwimISCA.org was restored after fixing a missing PHP 8.4 wrapper. FTP accounts have been removed. Raw logs are being gathered.

The key unresolved issue is identifying and eliminating the surviving writer or entry point that caused malware files to reappear after deletion.

Thank you for any guidance you can provide.

Sincerely,

Mark Rauterkus




Friday, May 29, 2026

British Olympians Reject “Pointless” Offer To Meet Swim England Chair As Resignation Calls Grow Louder

---- Forwarded message ---------
From: J.Barry Healey <john.b.healey@gmail.com>
Date: Fri, May 29, 2026 at 10:04 AM
Subject: Fwd: Olympians Reject “Pointless” Offer To Meet Swim 


Swim England governors want to meet Olympians calling for resignations but swimmers, past and present, say 'no', one key reason stated like this: “Resignations will improve trust. And those associated with past failures are hardly likely to be the best future leaders."
 
Olympians Reject “Pointless” Offer To Meet Swim England Chair As Resignation Calls Grow Louder

Swim England governors want to meet Olympians calling for resignations but swimmers, past and present, say 'no', one key reason stated like this: “Resignations will improve trust. And those associated with past failures are hardly likely to be the best future leaders."

By Craig Lord • 29 May 2026 View in browser
View in browser
 
 

British Olympians have rejected a “pointless” offer to meet the Swim England Chair who is one of three governors they called on to resign in a letter last month focussed on three recent, damning reports into the association.

In their letter the Olympians expressed full confidence in the current CEO, Andy Salmon, but called for the resignation from governance positions of Chairman Richard Hookway, board safeguarding champion Neil Booth, and former Senior Independent Director Caroline Green, who still sits on the Aquatics GB board. 

State of Swimming understands that the three have not resigned, while a source said that they “had not been asked to do so” at an extraordinary Board meeting held to discuss the Olympians letter. 

When Swim England responded officially to SOS’s request for comment after it drew the board’s attention to the Olympians’ concerns, it noted in a statement:  

“We take the views expressed in the letter from the Olympians seriously. When people within our community take the time to share their perspectives, we want them to know they will be listened toWe're concerned that these individuals feel they need to remain anonymous to Swim England, but we absolutely respect their position.

We have invited the group, or some of its representatives, to meet with us so that we better understand their views, and we hope that invitation will be accepted.   

Swim England, including the Swim England Board, has undergone significant changes in recent years, with our stakeholders telling us that we’re making genuine progress, but we equally recognise how much more there is to do.”   

None of the Olympians has accepted a specific invitation to meet the Chairman that was transmitted through this author. Many replied to reiterate their strong fear of disclosing their identity, as well as suggesting that a meeting is pointless and will change nothing when the letter itself makes their position clear. In the words of one:

“Resignations will improve trust. And those associated with past failures are hardly likely to be the best future leaders. Those two simple messages are crystal clear in our letter. There’s no need for the board to meet us to be able to understand our views.  It is pointless for the Chair to offer us a meeting.

"If the Chair or others finally have something meaningful to say to us about why they refuse to resign, surely they can say it in public to all stakeholders? That way everyone who feels as we do will be able to see why they still believe that they are the best option for our sport.” 

As some also pointed out, it is not just about whether this group of athletes trust their governors, but about the very widespread lack of trust revealed in the Listening Report, for which they believe that only a change of personnel can provide an effective solution.

Concerns Over Apparent Current-Board Backing Of Status Quo

Since SOS revealed the concerns of the Olympians,  more swimming stakeholders, including other GB internationals, holders of key roles in the sport, and representatives of groups of stakeholders in both Britain and England, have been in touch to express their strong support for the call for resignations. 

They believe that accepting responsibility for what went wrong, and allowing the sport to move on under new management, would be a way for Swim England to show that it had understood why trust cannot be built if those in charge of reform are the same people who either oversaw events described in the damning reports, and/or defended those responsible. 

If anything, the situation is now all the more concerning because it would appear that recent arrivals on the board have chosen to support the status quo over joining Olympians in their call for a new start. 

Like most of the Olympians, others who contacted SOS did not generally want to be identified for fear of repercussions. One willing to be named, however, is Professor Sue Arrowsmith, Professor Emerita of the University of Nottingham. The professor, an honorary KC, governance specialist and Masters swimmer, has worked on sport governance with the OECD and United Nations, among others.

She has battled for nearly a decade to improve aquatics governance, lobbying successfully for reform and helping numerous stakeholders with successful complaints and legal processes.

She summed up many of the sentiments expressed to SOS when she commented: 

“Swim England has a fantastic CEO in Andy Salmon. There is a real chance to turn the culture around and create an organisation that is trusted and admired. But the work he is doing to build trust is surely going to be undermined if those at the very top of the sport don’t inspire the same trust.”

“The Listening Report mentioned concerns that those responsible for the problems were themselves overseeing reforms. To me that remains a major problem. But most disappointing of all is that by continuing to support its fellow members from the “old guard” the current board sends out a depressing message about the board as a whole.

"I think many of us hoped that with some recent membership changes the board would take a different approach. The fact that it hasn’t will surely just perpetuate the lack of trust in the board and the concerns in the Listening report about protecting those with power and influence. It’s all very dispiriting for the future of the sport.” 

Change “drastically needed” 

Another leading figure in aquatics who did not wish to be named commented: 

“I hear the views of participants from all areas of the sport and have never known such a level of dissatisfaction with the National Governing Body…… A change in Board management is what is drastically needed to restore confidence.” 

Some of those who approached SOS also say that, in the absence of any meaningful response to the Olympians letter, they intend now to take up complaints and actions over board leadership elsewhere. 

SOS will continue to report on any developments.

More like this

More like this

Less like this

Less like this

Comment

Comment




 


 


SOS+ Contact for Enquiries: craig.lord@stateofswimming.com



 

We Found a Backdoor: Lessons From a WordPress Intrusion

Website security is one of those topics that most people ignore until the moment they can't.

This week, I found myself deep inside a WordPress security incident that unfolded across several websites hosted on the same account. What began as a routine investigation of strange activity eventually revealed unauthorized administrator accounts, hidden files, malicious code, and a site that appeared determined to resurrect itself after deletion.

The experience reinforced several lessons that every website owner should know.

The First Signs

The initial clues were subtle.

Wordfence security scans began reporting unusual activity. Login attempts were pouring in from around the world. Some sites became difficult to access. Administrator accounts appeared that nobody remembered creating.

At first, it was tempting to believe this was merely a configuration problem. After all, security plugins can sometimes lock out legitimate users. Wordfence itself was causing some confusion as settings were adjusted and security measures were tightened.

But then came the discovery that changed the story.

Unauthorized administrator accounts appeared.

Not one.

More than one.

Deleting them did not immediately restore confidence because the obvious question remained:

How did they get there?

Following the Trail

The investigation quickly moved beyond WordPress settings.

Files that did not belong inside WordPress core directories began appearing in security scans.

Examples included:

  • outbound.php
  • wp-olite.php
  • mjc0.php
  • dwn2.php
  • perl.haxor
  • py.haxor

These files were located inside directories where WordPress core files normally reside.

That was a major warning sign.

WordPress core directories should contain WordPress files. They should not contain mysterious PHP scripts with odd names.

Wordfence identified twenty-three such files.

They were deleted.

The Site That Would Not Die

One website in particular, waterpolo.cloh.org, became the center of the investigation.

The infected site was renamed so it could no longer function normally.

The directory was moved out of service.

The malicious files were removed.

And yet parts of the directory structure appeared again.

A hidden .htaccess file surfaced inside a deep WordPress directory. Its purpose was clear: permit PHP execution in places where it normally should not occur.

That was a significant discovery because many malware families attempt to hide inside legitimate-looking folders and then use .htaccess files to bypass normal restrictions.

The site had effectively become untrustworthy.

At that point, the goal shifted from repair to containment.

Containment Steps

Several actions were taken immediately.

Remove Unauthorized Administrators

Every WordPress site was reviewed.

Unknown administrator accounts were deleted.

Known administrator accounts were reviewed.

Passwords were changed.

Enable Two-Factor Authentication

Administrators gained two-factor authentication.

A stolen password becomes far less useful when a second factor is required.

Rotate WordPress SALT Keys

WordPress security keys were replaced.

This forced existing login sessions to become invalid.

Anyone who had obtained a session cookie suddenly found that cookie worthless.

Change Database Passwords

Database credentials were rotated.

Fresh credentials were stored in Bitwarden.

Harden .htaccess

Additional protections were added.

Directory browsing was disabled.

XML-RPC access was blocked.

Direct comment posting was blocked.

The resulting additions looked like this:

These protections now form part of my standard WordPress hardening process.

Review Unknown Files

Security scans identified files that did not belong.

Rather than ignoring warnings, each item was investigated.

Unknown files inside WordPress core locations should never be dismissed casually.

What the Attackers Were Doing

The Wordfence live traffic screen provided a fascinating view into the reality of operating a public website.

Login attempts arrived from:

  • Vietnam
  • Turkey
  • Lithuania
  • Spain
  • Brazil
  • The Netherlands
  • The United States

The attackers probed:

  • wp-login.php
  • xmlrpc.php
  • wp-plain.php

They searched for known vulnerable plugins.

They tested common backdoor locations.

This activity was not targeted specifically at me.

It was automated.

Every exposed WordPress site on the internet receives similar attention.

The difference is whether the defenses hold.

An Important Realization

One of the most useful lessons from this experience was recognizing the difference between noise and evidence.

The internet is noisy.

Bots hammer login pages constantly.

Wordfence blocks many attacks every day.

Most of that activity is routine.

What changed this case was the appearance of unauthorized administrator accounts and malicious files in WordPress core directories.

Those are not normal events.

Those are evidence.

The Human Side

The process was frustrating.

Files appeared, disappeared, and reappeared.

FTP and hosting control panel views sometimes disagreed.

Security tools occasionally became obstacles themselves.

At several points it felt impossible to determine whether the problem was malware, caching, configuration mistakes, or all three.

That uncertainty may be the hardest part of dealing with a website intrusion.

You rarely receive a flashing sign that says:

"Here is the exact problem."

Instead, you collect clues.

You test theories.

You eliminate possibilities.

Eventually a picture emerges.

The Final Lesson

The biggest takeaway from this experience is simple.

Security is not a product.

It is a process.

No plugin can completely protect a website whose passwords are weak.

No password can completely protect a site running vulnerable software.

No scan can protect a site that nobody reviews.

Security comes from layers:

  • Strong passwords
  • Password managers
  • Two-factor authentication
  • Software updates
  • Security monitoring
  • Regular reviews of administrator accounts
  • Backups
  • Healthy skepticism

Most website owners will never face a major compromise.

But if they do, preparation matters.

The best time to improve security is before you need it.

The second-best time is tonight.

Thursday, May 28, 2026

Old Paper Wars

Paper Wars on Grant Street

There was a season in Pittsburgh politics when democracy felt like paperwork.

Not speeches.

Not television ads.

Not viral videos.

Paper.

Petitions.
Signatures.
Affidavits.
Notaries.
Court filings.
Election codes.
Deadlines.
Technicalities.
Challenges.
Objections.

The entire machinery of local democracy often came down to who filed what, when, with which signatures, under which party designation, before which clerk, in which room of the City-County Building.

And for a brief moment in the mid-2000s, I found myself wandering directly into that machinery.

Not as a lawyer.

Not as a party insider.

Not as a wealthy donor.

But as a citizen candidate armed with petitions, election law printouts, handwritten notes, and an increasing fascination with how fragile the system actually was.

Looking back now, these court filings read almost like artifacts from another civilization.

A slower political era.

A more procedural era.

A more local era.

An era before social media swallowed politics whole.

At the center of these filings were challenges to nomination petitions involving candidates for Pittsburgh City Council District 3, including Bruce Kraus and Bruce Krane.
The legal arguments themselves now feel wonderfully specific and almost antique.

Could candidates gather signatures while aligned with a major political party and then pivot into an “independent” or political-body candidacy?

Could someone simultaneously navigate both tracks of the election system?

Did the timing of party changes matter?

Did the signatures remain valid?

Did the paperwork comply precisely with election law?

Was the Bureau of Elections properly enforcing standards?

These were not abstract philosophical questions.

These were ballot-access knife fights.

The filings argued that election law existed for reasons larger than mere technical compliance. They cited court decisions warning against “splintered parties,” “voter confusion,” “frivolous candidacies,” and manipulations of the political process.

At the time, Pittsburgh politics still carried strong traces of old machine culture.

Party endorsements mattered enormously.

Committee structures mattered.

Relationships mattered.

Who got frozen out mattered.

Who had institutional support mattered.

And perhaps most importantly, who understood the procedural rulebook mattered.

Outsiders rarely won.

But outsiders could disrupt.

That was part of the energy of the moment.

The filings themselves were intensely pro se. Citizen-driven. Improvised. Long before ChatGPT, legal templates, or modern digital organizing tools, ordinary people pieced together court challenges using photocopies, law library research, election code citations, conversations, rumor, persistence, and stubbornness.

There is something beautifully chaotic about that now.

One section argued that candidates could not legally ride both horses at once: pursuing Democratic primary legitimacy while simultaneously maneuvering toward independent ballot status.

Another section drilled into the signatures themselves.

Who signed?

When?

Under what party understanding?

Which names were registered voters?

Which handwriting appeared suspiciously similar?

Which notary relationships raised concerns?

One filing bluntly claimed that an entire page appeared to be written “with the same pen and hand.”

Today, some readers may laugh at the hyper-focus on signatures and filing mechanics.

But ballot access is power.

Election procedure is power.

Administrative interpretation is power.

Democracy is not merely ideology. It is process.

And process determines who even reaches the ballot.

That reality remains true today, even if modern politics now performs itself through podcasts, cable news clips, fundraising emails, influencer culture, and algorithmic outrage.

Behind every election still sits a quieter world of filings, deadlines, certifications, technical disputes, and procedural leverage.

The old filings also reveal something deeper about Pittsburgh political culture during that period.

There was distrust everywhere.

Distrust of insiders.
Distrust of party structures.
Distrust of endorsements.
Distrust of city government.
Distrust of overlapping relationships.
Distrust of political maneuvering.

The ethics complaints from that same era carried similar themes.

Who belongs to what organization?
Who watches whom?
Who owes favors?
Who can actually act independently?
Who gets protected?
Who gets excluded?

The election petitions were another front in the same larger civic argument.

Maybe all of it stemmed from a city trying to reinvent itself while still carrying the DNA of old industrial political culture.

Pittsburgh was shrinking in population but exploding with institutional complexity.

Nonprofits were rising.
Foundations were rising.
Universities were rising.
Development authorities were rising.
Political consultants were rising.
Public-private partnerships were rising.

Yet ordinary citizens often still felt locked outside the machinery.

So some citizens fought through procedure instead.

Through hearings.
Through filings.
Through technical challenges.
Through the courts.

Was that democratic accountability?

Or procedural trench warfare?

Maybe both.

One thing becomes very clear rereading these petitions now:

Local democracy used to require physical endurance.

People drove downtown.

Waited in offices.

Hand-delivered paperwork.

Made photocopies.

Read actual election law books.

Tracked filing deadlines manually.

Visited courtrooms.

Talked directly to election officials.

There was friction everywhere.

And strangely enough, that friction may have produced more civic literacy than today’s instant-comment politics.

Modern political participation is often emotional but shallow.

Back then, participation could become obsessive and procedural.

You learned how systems actually worked.

Or failed to work.

The petitions themselves repeatedly invoke “the integrity and stability of the political system.”

That phrase now feels almost haunting.

Because twenty years later, Americans trust institutions even less.

Trust in elections is weaker.
Trust in government is weaker.
Trust in media is weaker.
Trust in expertise is weaker.

And yet most citizens remain far less connected to the procedural mechanics underneath public systems.

Few people know how ballot access works.

Few people understand nomination petitions.

Few people know how local election boards function.

Few people have ever filed a formal challenge.

Few people know where power actually lives.

That ignorance creates openings for insiders.

Always.

Perhaps that is one lesson hidden inside these dusty filings.

Democracy belongs not only to charismatic candidates or wealthy donors or political parties.

It also belongs to citizens willing to read the fine print.

Citizens willing to ask annoying questions.

Citizens willing to challenge assumptions.

Citizens willing to stand in hallways holding paperwork.

Even when they lose.

Even when the system barely notices.

Even when history forgets the moment entirely.

These documents now feel less like attacks on individuals and more like attempts to stress-test democratic process itself.

Could the rules survive scrutiny?

Could election systems withstand citizen examination?

Could ordinary people meaningfully challenge institutional momentum?

Or were the outcomes largely predetermined by political gravity?

That question still matters.

Especially now.

Because modern politics increasingly trains citizens to become spectators instead of participants.

Consumers instead of investigators.

Cheerleaders instead of challengers.

The old paper wars on Grant Street remind us that democracy can still be touched physically.

Stamped.
Filed.
Questioned.
Objected to.
Argued over.
Verified.

Messy democracy may actually be healthier than passive democracy.

And perhaps the deeper point was never whether a particular petition succeeded or failed.

The deeper point was that citizens still believed the system could be confronted directly.

That belief may be rarer today than many people realize.

Ethics complaints from back in the day




PDFs of the three complaints sent to the Ethics Hearing Board in its infancy: 










Bonus reads:






Thursday, May 21, 2026

Fwd: ❇️ LifeguardEye Webinar Recording: A Rare Discussion with Aquatic Operators Using AI





--
Ta.
 
 
Mark Rauterkus       Mark.Rauterkus@gmail.com
Mark@Rauterkus.com    <--- causing lots of missed messages, sadly.
Webmaster, International Swim Coaches Association, SwimISCA.org
Coach at The Ellis School for Varsity & Middle School Swimming

412 298 3432 = cell


---------- Forwarded message ---------
From: LifeguardEye <mark@lifeguardeye.com>
Date: Thu, May 21, 2026 at 7:29 AM
Subject: ❇️ LifeguardEye Webinar Recording: A Rare Discussion with Aquatic Operators Using AI
To: <mark.rauterkus@gmail.com>


Click here to unsubscribe from this campaign.