ALEX STAMOS

Behavioral Archetype

THE OBSERVATORY — Subject is the security chief who stopped defending one company’s perimeter and built the instrument that watches the whole information space. He ran security at Facebook through the period the platform’s role in 2016 became the central question of American politics. Then he left, went to Stanford, and stood up the Stanford Internet Observatory — a university lab that would study, name, and document influence operations at internet scale. The throughline is not a single platform. It is the migration from defending one network to instrumenting the measurement of all of them. The Observatory’s outputs became the citations everyone else used. That is the position: not the thing that gets measured, the thing that measures.

Essence Indicators

• Served as Chief Security Officer at Facebook through 2018, the tenure that spanned the platform’s 2016-election reckoning, and before that as CSO at Yahoo

• Founded the Stanford Internet Observatory in 2019 — the university lab that became the most-cited node in the disinformation-research field
• SIO’s documented outputs: the Election Integrity Partnership and its “The Long Fuse” report, the Virality Project on vaccine-related narratives, and the LAION-5B CSAM finding (authored by SIO’s David Thiel) that forced the LAION dataset offline

• The pivot the apparatus turns on — foreign hawk to domestic flagger. At Facebook (2016–2018) Stamos pushed to investigate and publicly disclose Russian/foreign information operations and was sidelined for it; he later wrote he “deserve[d] as much blame (or more) as any other exec at the company” for the failed response, and founded SIO partly out of frustration that he was not permitted to publish the full account of Russia’s operations. He then convened the Election Integrity Partnership, which referred flags on domestic U.S. content to platforms — the House Judiciary Committee says it found “dozens of examples of EIP personnel, including then-Director of SIO Alex Stamos, making explicit recommendations to platforms for specific enforcement measures.” The man who built the instrument against foreign interference turned it inward. The contrast has been drawn explicitly in print: Jacob Siegel (Tablet) called the operation a “deputized domestic disinformation flagger.” Stamos’s rebuttal travels with the charge: EIP states the platforms “made their own determinations,” that it referred nothing on behalf of DHS/CISA, and — in his own framing — that it merely filled a gap because U.S. agencies hold authority over foreign but not domestic disinformation.

• The 2024 SIO wind-down occurred amid House Judiciary Committee subpoenas directed at the lab’s work; Stanford disputes the characterization that the lab was “dismantled,” describing the change as staffing and funding shifts rather than a shutdown. Both characterizations are on the record and both travel with this claim.

• Post-SIO diaspora: Stamos to SentinelOne as Chief Trust Officer and into Corridor; co-founded the Krebs Stamos Group with former CISA director Chris Krebs; sat on the Aspen Commission on Information Disorder (2021)
• The biographical fact the apparatus turns on: the man who ran a platform’s security built the lab that became the field’s measuring instrument, and the lab’s wind-down became a subpoena fight over who gets to do the measuring
• On camera at Web Summit as Facebook’s security chief, he states the builder-responsibility ethos the file argues later turned inward: “we have a responsibility, all of us as technology builders, to understand the impact we have on people,” and where “that impact is negative,” to act on it. It is the pre-SIO register — securing a platform used by “about 1.13 billion people… every day” — the same instinct that, on this file’s reading, was later aimed at domestic speech (talk below)

On Camera

Web Summit, 2016 — Stamos as Facebook’s Chief Security Officer on “designing security and safety for billions.” Not the Stanford Internet Observatory controversy this file turns on, but its prehistory: the builder-responsibility ethos (“we have a responsibility, all of us as technology builders”) stated at the scale that formed him. Embedded as a primary source for the apparatus-builder framing — the security executive’s own voice, before the instrument he later built became a subpoena fight. His account of the SIO dispute is documented in the essence indicators above and travels with it.

Social Persona / Impression Management

Immediate impression: Operator-academic. The bearing of an engineer who has been deposed, has testified, and has learned to say exactly as much as the record will bear and not one clause more.

Energy: Builder-first, institution-first. Does not litigate a single takedown. Stands up the lab, publishes the methodology, and lets the citations do the standing.

Impression management strategy: The public-interest researcher. The work routes to “studying influence operations” and “child-safety findings” — among the most defensible destinations a research program can choose, and the LAION-5B finding was, by any account, a genuine and serious one. Whether the broader program was neutral measurement or a thumb on the scale is the exact question the subpoenas were built to ask, and it is not a question the outside record settles. That is what makes the Observatory position effective rather than simply contested.

Forensic Archetype Comparison

Psychometric Assessment

Big Five (OCEAN):

Dark Triad:

MBTI: INTJ (“The Architect”) — Dominant introverted intuition, auxiliary extraverted thinking. Sees the information space as a system to be instrumented and measured before it is argued about. Built the instrument.

Threat Assessment

Alignment Analysis

Stated alignment: Study influence operations rigorously. Protect children online. Bring security discipline to the trust-and-safety field. Publish the methodology.

Observed alignment: Build and run the lab whose findings define the field. Instrument the information space. Hold the documentary high ground on what counts as a named operation.

Gap assessment: The stated and observed alignments overlap wherever “study influence operations rigorously” coincides with “be the institution that decides which operations are studied and how they are named.” The 2024 wind-down is the one place the record puts the overlap on the table — and the record is itself a dispute, with House Judiciary on one side calling SIO’s work something to be subpoenaed and Stanford on the other disputing the word “dismantled.” The Observatory measures the information space. The fight over the Observatory is a fight over who holds the instrument. The record does not settle which side is right, and for the lab it never had to.

But the wind-down dispute is not the only place the record speaks, and the earlier turn speaks louder. The executive who fought to expose foreign interference — and was sidelined at Facebook for forcing the disclosure — went on to build and run the program that referred domestic Americans’ speech to the platforms. He frames the pivot as gap-filling: U.S. agencies have authority over foreign threats and none over domestic ones, so the lab filled the space. Read it that way and it is public-interest plumbing. Read the direction of the instrument — built against Moscow, then pointed at the home audience — and it is the whole thesis of this series in one career. The motive is his to know; the trajectory is on the record. An instrument does not care which way you aim it, and this one got aimed inward.

Convergent Drive Classification

Self-preservation: Survives every institutional transition by carrying the instrument, not the employer. Yahoo, Facebook, Stanford, SentinelOne, Corridor — one method. Goal preservation: Builds the lab that defines the goal, so “what counts as a documented influence operation” is settled by the instrument before any single case is argued. Resource acquisition: Trades in the scarcest resource in the field — the citation everyone else has to use. Self-improvement: Each move is a higher-altitude application of the same instinct: instrument the problem, publish the methodology, become the node the field cites.

Subject is not an AI system. The drives appear anyway — in the security chief whose product is the instrument that watches the watchers.

Public footprint: X @alexstamos · corridor.dev.

Sources: Stanford Internet Observatory shutdown — Stamos, DiResta, SIO — Platformer. The 2024 SIO wind-down is presented with both characterizations on the record: House Judiciary Committee subpoenas directed at the lab, and Stanford’s dispute of the word “dismantled.” Our text asserts neither characterization as fact. Web Summit — “Designing security and safety for billions” (video, 2016).