THE INVISIBLE INTERNET, THE XEROX LEGACY, AND THE ARCHITECTURE OF Trust @2026-10-29 07:59:25 - Calle 15 de Febrero

District 69 California PO Box 312786 Avalon, California 90704 Most resumes are designed to minimize risk. Mine does the opposite. I've been a paperboy, septic tank cleaner, tire technician, dockworker, telemarketer, camp counselor, cemetery broker, mortuary transport driver, construction laborer, account manager, marketing specialist, office manager, IT consultant, web developer, and application programmer. I've started businesses, liquidated businesses, quit jobs, traveled through more than thirty countries, volunteered thousands of hours for youth programs and housing construction projects, and spent nearly five years in a Colombian prison. I have never earned a college degree. I attended community college and failed every class except Sociology and Physical Education. I have no cybersecurity certifications, no computer science degree, and no traditional technical pedigree. Yet I became an award-winning Xerox application developer because I learned technology the same way I've approached almost everything in life: by taking things apart to see how they work. My first exposure to computers came through AOL dial-up internet and chat rooms. Years later, when I was twenty-one, I downloaded Adobe Photoshop, Illustrator, InDesign, and Dreamweaver. More important than the software itself was what Dreamweaver revealed. Every time I dragged an object across a page, a panel displaying HTML, CSS, and JavaScript changed beside it. For the first time, I could see the relationship between action and code. Move a box. Observe the code. Change the code. Observe the result. That became my education. I learned programming by watching systems reveal themselves. Later I downloaded Linux and eventually Kali Linux, the penetration testing operating system used by security researchers. I wasn't interested in hacking because I wanted to break things. I was interested because breaking things was often the fastest way to understand them. That mindset has followed me through every stage of my life, including the parts that most people would rather leave out. On July 4, 2021, in Medellín, Colombia, I stole a Mercedes AMG C63 S from a closed dealership using a concrete block. When confronted by a police officer, I took possession of his revolver, removed the ammunition, handed the weapon back, and was arrested. I pled guilty to auto theft and was sentenced to seven years in prison. I served approximately four years and eight months between Envigado police holding cells and Bellavista Prison. I was released on March 18, 2026. After my release I crossed into Venezuela, was detained by security services, received an emergency United States passport through the U.S. Embassy, and eventually made my way back into Central America. People often ask whether I regret the decision that sent me to prison. The honest answer is that I still cannot fully explain why I made it. But prison gave me something most technologists never receive: uninterrupted time to think. A hammock, concrete walls, and years to examine the systems that govern human behavior, technology, trust, authority, and risk. Ironically, many of the conclusions I reached in prison began years earlier while sitting in front of Xerox multifunction printers. --- ## Xerox and the Foundation of the Modern Office To understand the cybersecurity implications of modern printing systems, it's necessary to understand Xerox itself. Xerox began in 1906 as the Haloid Company, a manufacturer of photographic paper and supplies in Rochester, New York. Everything changed when Haloid acquired the commercial rights to Chester Carlson's invention of xerography. The Xerox 914, introduced in 1959, became the first commercially successful plain-paper copier and transformed office work permanently. It was revolutionary enough that people began using "Xerox" as a verb instead of a brand name. The company later established the Palo Alto Research Center, or PARC, in California. PARC may be the most influential research laboratory in computing history. Researchers there developed technologies that became fundamental to modern computing: - Graphical user interfaces - Computer mice - Ethernet networking - Laser printing - Object-oriented programming - Foundations of personal computers Apple and Microsoft built enormous portions of their future products around concepts first developed at Xerox PARC. Xerox invented much of the future but largely failed to capitalize on it. The company remained known primarily for printers. But modern Xerox devices are not printers in the traditional sense. They are computers. Each device has storage, memory, networking, operating systems, credentials, software applications, web interfaces, cloud connectivity, and access to vast amounts of sensitive information. A modern multifunction printer is essentially a network server that happens to dispense paper. And that realization forms the basis of everything that follows. --- ## Discovering ConnectKey While working at Xerox Image Source, I became involved with Xerox's ConnectKey ecosystem. ConnectKey was designed to transform Xerox devices from standalone printers into integrated business platforms. Applications could be installed onto device touchscreens, allowing users to interact with cloud services, document repositories, workflow systems, and third-party applications directly from the copier interface. On the surface, this sounded revolutionary. Underneath, it revealed something much more interesting. Most ConnectKey applications were surprisingly simple. What appeared to be a native application on the copier was often little more than an icon connected to an externally hosted website. When the user tapped the icon, the Xerox device would render a remote web application. The actual logic frequently existed somewhere else entirely. One day I connected a Xerox hard drive to my Linux system. I began exploring. Directories. Files. Configurations. Architecture. Eventually I encountered a file I couldn't read. So I changed the extension. I renamed it as a ZIP archive. It opened. Inside I found application assets, icons, script files, URLs, and references to externally hosted resources. I followed those links. The websites looked identical to what appeared on the copier displays. I viewed source code. I examined scripts. I analyzed requests. Then I mirrored the applications locally to study how they worked. What I discovered wasn't a sophisticated exploit. It was something more fundamental. Many of the applications had simply been left exposed. The architecture trusted that nobody would look. But curiosity is often the strongest penetration-testing tool in existence. By studying the framework, I learned how applications communicated with Xerox devices, triggered scans, initiated print jobs, processed workflows, and interacted with users. I built my own applications. Some were practical. Some were experimental. One displayed prospect photographs on copier screens throughout offices. Another allowed Starbucks orders to be initiated directly from the device display. The applications won Xerox development competitions and were deployed across sales organizations. What fascinated me wasn't the software itself. It was what the architecture revealed about trust. --- ## The Printer Nobody Watches Most organizations spend enormous resources defending servers, laptops, cloud environments, and user accounts. Yet a multifunction copier often receives little scrutiny. It sits quietly in a hallway. Nobody thinks about it. Nobody monitors it. Nobody inventories its privileges. Yet that device may: - Store thousands of scanned documents - Contain email credentials - Maintain LDAP integrations - Hold Active Directory information - Communicate with file shares - Access cloud repositories - Authenticate to enterprise networks From a cybersecurity perspective, that is remarkable. An overlooked machine possessing extraordinary trust is precisely the type of system attackers seek. The problem is not unique to Xerox. It exists throughout enterprise environments. Organizations often view devices according to purpose rather than privilege. They see a printer. Security professionals should see a trusted network identity. That distinction matters. Because once a system is trusted, compromise becomes exponentially more valuable. The attacker is no longer attempting to enter the network. The attacker is operating as something already inside it. ## The Rise of Machine Trust The lesson I learned from Xerox is no longer confined to printers. It now defines the internet itself. The modern internet is increasingly operated not by humans but by machines. APIs communicate with APIs. Cloud services communicate with other cloud services. Automation workflows trigger additional automation workflows. Artificial intelligence agents interact with systems autonomously. Containers authenticate to platforms. Applications authenticate to databases. Machine identities now vastly outnumber human identities in many organizations. The traditional cybersecurity model focused on protecting people: - Usernames - Passwords - Multi-factor authentication - Security awareness training But attackers increasingly target trust relationships between machines. Every certificate, API token, service account, automation workflow, cloud credential, software key, and machine identity represents a potential pathway through an environment. Attackers no longer need to compromise a person if they can compromise trust. The Xerox device taught me this lesson years before the industry fully appreciated its implications. The printer's value was never the printer. Its value was the trust surrounding it. --- ## The Economics of Modern Cyber Offense Recent years have demonstrated how fragile the internet's foundations remain. Critical vulnerabilities continue to emerge inside software that governments, hospitals, universities, corporations, and infrastructure providers depend upon. These vulnerabilities are often not newly created. They are newly discovered. Digital infrastructure resembles archaeology more than engineering. Researchers constantly uncover assumptions embedded decades ago. Artificial intelligence is accelerating this process. The most significant near-term impact of AI is not that it creates entirely new attack techniques. It is that it compresses time. Reconnaissance becomes faster. Code analysis becomes faster. Pattern recognition becomes faster. Vulnerability research becomes faster. Decision-making becomes faster. The Xerox architecture I examined required human curiosity. An autonomous system could identify similar patterns at scale. Instead of investigating a single environment, it could evaluate thousands simultaneously. The economics change. When effort decreases, volume increases. And volume changes everything. --- ## Defense, Governance, and the Future The same technologies transforming offensive capability are equally transforming defense. Modern security systems increasingly: - Detect anomalies automatically - Revoke credentials automatically - Isolate devices automatically - Prioritize threats automatically - Scale expertise automatically The challenge is governance. Trust is becoming automated. Authority is becoming automated. Decision-making is becoming automated. The central security challenge of the next decade will not be protecting computers. It will be governing machine trust. Organizations must understand what systems exist, what identities those systems possess, what they can access, and whether those permissions remain justified. The future belongs to organizations capable of answering a simple question: **Which machines are trusted, and why?** Most breaches occur when nobody knows the answer. --- ## The Real Resume People often assume the most important part of my story is the prison sentence. It isn't. The most important detail is that I have spent my entire life asking the same question: What's actually behind this? Behind the copier interface. Behind the application. Behind the credential. Behind the assumption. Behind the locked door. That question made me a better developer. It made me a better investigator. It also led me into situations that changed the trajectory of my life forever. I am not presenting a polished version of myself. The felony happened. The prison happened. The failed classes happened. The endless job changes happened. The Xerox applications happened. All of it is part of the same story. Every meaningful technical discovery I've ever made started with refusing to accept that a surface-level explanation was the complete explanation. That's ultimately what cybersecurity is. Not code. Not software. Not firewalls. Not artificial intelligence. Cybersecurity is the study of trust. Who receives it. Who deserves it. Who abuses it. And what happens when nobody is paying attention. The next major cyber crisis will not begin with a dramatic hack, a movie-style breach, or an unknown superweapon. It will most likely begin exactly the way most serious vulnerabilities begin: With a trusted machine quietly doing something nobody realized it could do. Evan Winter District 69 California PO Box 312786 Avalon, California 90704