Air-gapped and encrypted computer briefly brought online

[JFWooten4]

Today I was rearranging my office and changing most of the electric wire configurations on my desk. After moving equipment around, I plugged everything back into my computer. This was specifically the isolated system used in policies to store PII.

I noticed that I accidentally plugged the Ethernet into the computer when I booted it up to test everything. I ran two refresh cycles debugging displays, after which I logged into the computer again. Within about 20 seconds, I realized that I had connected the cable in error and removed it from the system.

Immediately after the disconnection, I ran a diagnostics test and checked all network logs. First is the list of active listening ports. I did not see anything unexpected.

[JFWooten4]

I've brought this up in the community forum and will continue monitoring that conversation for developments or input throughout the lifecycle of this incident response.

I provisioned this computer for investor data storage while I built out the Reg S-P infrastructure away from AWS. However, it took over one of my devices for asset management. Hence, I've been using it for offline drafting in my office, as well as for secure storage.

Even though I only drafted conceptual ideas and never exported any remarks,¹ this combined use was the root problem in my eyes. This accident specifically happened because I was moving around my asset management tools.

This is shown in the prior screenshot, as the computer has my old automatic Logitech and VS Code plugins running. These are programs I run on that device to connect with tools for my work. You can see the problem more clearly in this 5:10 PM screenshot (37 minutes before the last one):

The console clearly shows Logitech tools (with the plugin service and Options+) as leading network interfaces. These connect to different devices and generally communicate only software updates or key configurations.²

Notwithstanding, out of an abundance of caution, I've requested the deletion of all data associated with that account:

Code\x20H, seen in the Code Helper (Plugin) monitor list, is the most opaque open service. Substantially more investigation would be needed if it sent or received any information. However, both of these screenshots were taken after the Ethernet was unplugged again, and they show no sign of network access.

Footnotes

1. After my completion and effectuation of the policies in ⌛ Create, init versioned docs #49. The last exfiltration I initiated before the air gap was a public key generated with this for this on May 9, 2026, at 8:57 AM. ↩

2. Their documentation explains more about how they only store generalized optional and diagnostic data, not actual computer files. I further did not have Logi Flow on, which would optionally monitor clipboard contents. Thus, with this limited configuration, I do not think my mouse shared any sensitive customer information. ↩