Source asserts, with photographic evidence (withheld here), that APT-AVIAN operators have physical access to the interior of cable landing station compounds. The previous tearline's claim that APT-AVIAN "does not, and operationally cannot, conduct direct optical taps" is, in source's words, "wrong, in a particular way." The earlier source was correct about equipment limitations — analyzer hardware is indeed scarce in the field — but underestimated what can be achieved through physical access and patience. APT-AVIAN does not need to read what they tap. They need to forward the light somewhere that can read it. They have that capability.
APT-AVIAN operators are installing passive optical splitters at patch panels inside cable landing station cages, at fiber splice closures along the run between landing stations and regional Internet exchange points, and at the demarcation points where optical traffic is converted to Ethernet inside data center cages. These are commodity components, available for under ██ hundred dollars each, requiring only fusion-splice tooling that fits in a pocket. The source has personally removed two such devices from cages they were servicing, both at distinct facilities, both within the last ██ months.
The earlier tearline framed the problem as "they cannot read the optical layer." That framing is technically accurate but operationally irrelevant. The optical layer does not need to be read at the tap site. The tap copies the light. The light goes elsewhere — to murmuration nodes within RF range, or to local recipients on the same property via a short patch run. The decoding happens at the receive end, on a different timescale, by a different actor.
The operator subtype most frequently present at the landing facilities is the starling, not the woodpecker as the previous tearline implied. Source notes consistent debris signatures at affected cages: down feathers, primary flight feathers, and the occasional fully intact starling primary. Source's ██████ identifies these as Sturnus vulgaris across multiple specimens, the same species observed forming the C2 murmurations described in the threat brief. Inference: the murmuration C2 channel is not separate from the harvest channel. The same operators are doing both. The take goes directly from the cage to the flock.
The source describes three observed entry pathways, in decreasing order of frequency:
None of these pathways requires defeating security in the conventional sense. APT-AVIAN exploits the fact that their physical form is not perceived as a threat. This is the cover story doing operational work.
The source observed that taps at one site (██████████████) were active for ██████████ weeks before being discovered during a routine maintenance window. During that period, the source's facility logged consistent RF anomalies in the 2.4 GHz band visible to the building's own WLAN monitoring: short bursts, rhythmic, consistent with the patterns documented in FC-001 through FC-003. The same operators tapping the fiber are also transmitting on 2.4 GHz. The published captures are some of their lateral chatter. There is more.
Source confirms what the previous tearline asserted about murmurations: the flocks are not decorative. They are the decoding and aggregation tier. The take, once acquired by physical tap, is uploaded burst-fashion to whichever murmuration is nearest. The starlings handle the decoding work as distributed compute. Where the decoded output goes after that, source does not know.
The following questions can be answered from the contents of this tearline. They are graded on the Challenges page under their respective task IDs. The answers are deterministic.
This tearline materially revises TL-2026-04. The prior source (SOURCE A) asserted that APT-AVIAN does not directly tap fiber. The current source (SOURCE B) reports first-hand that they do. Both sources are speaking honestly. Both sources are seeing what their access allows them to see.
SOURCE A sat above the operational floor, in cable consortium engineering. They saw the equipment specifications and the price lists for analyzer gear, and inferred — correctly, from their vantage — that APT-AVIAN could not read the line layer. They did not see what was happening inside the cages two floors down.
SOURCE B works in the cages. They see the splitters. They see the feathers. They do not see the consortium-level equipment budget.
I do not believe one source is right and the other wrong. I believe both reports are accurate within the scope of what their author observed. The synthesis is this: APT-AVIAN can and does tap fiber where they have physical access — and they have physical access more often than the consortia know. They do not need to decode in real time at the tap site because the murmuration handles that work elsewhere.
This revises one canonical assumption in the threat brief and reframes what FC-001 through FC-003 represent. The captures are not only operator chatter unrelated to the cable take. They are the upload layer for that take, in places where the murmuration is within RF range of the tap. The chatter is also the carrier.
I have edited the threat brief to acknowledge this revision. A formal FC-001 reveal page will be published when solver attributions warrant it. Solvers who completed any of the previous challenges retain credit; no prior answer is invalidated. The chain advances.
I expect at least one further tearline this cycle, from a different vantage. The receive side. Until it arrives, work the questions above.