RAINBOW. REICHSTAG. BATON.
The Three Pillars of Taylor Wessing: Fake Inclusivity, a Nazi Founder, and Violence as a Modus Operandi
Reichstags-Handbuch
PhishDestroy is independent of both parties. We are not Source 1. We do not take money from anyone, ever. We publish under our own name and take responsibility for our analysis.
We began examining this case in August. The documents led to three connected lines of inquiry: the use of legal pressure against a data requester; the treatment of homophobic and nationality-based abuse in an official disclosure; and the Nazi record of the firm's German founder. Each is set out below with the underlying records and sources. Professional reputation does not answer any of them.
OUR SCOPE. TWO ORGANIZATIONS. NO CAMPAIGN FOR AN UNBAN.
and the access response
and document processing
Account reinstatement does not settle either line of inquiry.
We have deliberately separated Valve from Taylor Wessing. Taylor Wessing did not have to become the subject of this dossier. The material could have stayed on Medium. We were using AI and large-scale data analysis to examine the Steam case and the falsehoods documented in that investigation when our review began flagging danger markers in the documents and correspondence themselves. Some of it looked so implausible that we began asking whether the documents were fake. The documents are official. The signatures in those files are not fake.
Source 1's ban is not our objective
Source 1's ban is irrelevant to our objective. We are not determining his guilt or innocence and do not ask anyone to determine it on our behalf. An unban, a settlement or any other change to his account would not alter this investigation. Source 1 has no authority to terminate it.
We received official documents from him. Additional information may also have been supplied, but it is not the basis of this dossier. Our work does not depend on his interests or the recovery of his account. It concerns the handling of official documents, the statements made in them, the personal data they contain and the risks created by the process.
We will assess a court decision or a comparably rigorous mathematical demonstration or refutation. A demand to stop publication does not answer the evidence. The letters' claims about German courts are examined in When a paid representative speaks for the court.
Why the lawyers' letters matter to the Valve investigation
The letters contain admissions and contradictions relevant to the neighbouring investigation into Valve, signed in the course of the lawyers' professional work.
Our concern also recalls the old Steam terms provision, since removed, concerning permanent account termination when a user sought legal assistance. In this case we identify another contradiction: the lawyers' account places an alleged transfer or sale first in May and then in July. Yet the incomplete access log supplied in response to the GDPR request does not record the account access that would substantiate that story. This is one of the discrepancies we ask the responsible authorities to examine against the full records.
Professional conduct, not private lives
Our examination of the two doctors of law stops at their professional actions and the descriptions published on their firm's own website. We have no interest in their relatives, personal relationships or private lives. Investigating those things is not our style, and we do not consider them relevant to the professional assessment made here.
Read the documents.
Inspect document ↗The biographical record
Rüdiger Graf von der Goltz · Der Großdeutsche Reichstag
- Source
- Bayerische Staatsbibliothek
- Location
- Printed page 223 · digital scan 224
Inspect document ↗The contemporary record
Deutsche Allgemeine Zeitung · Berlin · 11 July 1934
- Source
- ZBW / HWWA press archive
- Location
- Folder pe/006310 · document 00001
Inspect document ↗The findings on the page
Solicitors Disciplinary Tribunal · Case 12393-2022
- Source
- Solicitors Disciplinary Tribunal
- Location
- Judgment · page 2 of 19
Inspect document ↗The final order
Daniel Paul Hugh Hutchings · Judgment dated 30 March 2023
- Source
- Solicitors Disciplinary Tribunal
- Location
- Statement of Full Order · page 19 of 19
PART I. PRESSURE, FABRICATION, DISCLOSURE
A data-access request answered with accusations
A Ukrainian user requested his personal data under Art. 15 GDPR. Taylor Wessing's response to his lawyer introduced allegations of account purchase, document falsification and criminal conduct. The initiating act was a statutory access request. The correspondence must be read in that context.
Dr. Tobias Schelinski, August 15, 2025 (Doc. No. 42282474): the letter accuses the client of buying the account, refers to a "falsified utility bill", and describes it as "completely unclear" whose data is involved. It invokes 1,938 reports as evidence against the user: "the sheer volume alone shows that the agreement was violated multiple times." The asserted volume is being used to establish culpability before the authenticity of those reports is addressed.[11]
Dr. Patrick Zurheide, October 1, 2025 (Doc. No. 42603633):[12]
"It must obviously be assumed that your client or his accomplices intend to continue phishing attacks in a disguised form and want to find out how to do so without getting caught."
"The account, like almost no other, provides numerous grounds for a block... In our experience, any court would deem the block lawful."
The letter concludes with the prospect of criminal prosecution under §§ 263, 263a, 202a, 303a of the German Criminal Code and asks whether "the lawyer's mandate also extends to criminal proceedings." Our assessment is that this correspondence uses the threat of prosecution, accusations and months of delay to exert pressure on a person seeking his data. The statutory request remains unanswered by any of those measures.
Enlarge screenshot ↗
Enlarge screenshot ↗The disclosed sample: the basis of our fabrication finding
The eventual disclosure visually concealed 94.28% of the content — 70,717 words — "for the sake of third-party rights." Exactly 50 reports remained visible and were presented as "proof" against the banned user. Exhibit B records three independent grounds for challenging that sample:[13]
70,717 words
pᵢ = probability of symbol i
Character distributionIntersection / union
Report text similarity100% identical
report texts
Joint probability reported in Exhibit B
Logarithmic scale[adjective][noun][numbers]unhappyrat44132 · eagerotter54677 · crushedlard9764
- Chronology. The account was blocked on May 23, 2025. The visible reports are dated August and September and describe fresh invitations and phishing links. Our finding is that the activity alleged in those reports is incompatible with the account's blocked state.
- Nickname generation. Our audit identifies 62% of the visible complainants as synthetic names following
[adjective][noun][numbers], including unhappyrat44132, eagerotter54677, crushedlard9764. Reported Shannon entropy is 3.48, against 2.14 for the live-name comparison. The audit rejects independent generation under its probability model, reporting a joint probability of approximately 10⁻¹⁵³. - Text identity. The compared report texts are recorded as 100% identical, with a Jaccard index of 1.000. This is the text-similarity result; the fabrication finding rests on its combination with the chronology and nickname analysis.
The concealed material contains years of coordinated harassment directed at the user's Ukrainian nationality: "hohol", "Ukrainian Nazi", "SVO SVO GOIDA ZOV ZOV", "execute him". Cyrillic density reaches 61.58% in the hidden material, against 0.32% in the visible sample. Our conclusion is specific: Taylor Wessing concealed the nationality-based harassment and retained the sample our audit identifies as a botnet. The selection removed the context that explained the reports while preserving the material used to justify the ban.
Enlarge screenshot ↗Detail crop · the same three examples used in the quantitative audit.
Failed redaction, notice and suppression of publication
The PDF contained black rectangles over text that had never been deleted. No intrusion was required to recover it. The data travelled inside the file supplied by the firm. We identify this as professional negligence in the very process presented as protecting third parties.
The same rows.
The text underneath.
Move the divider to compare the black overlay with the underlying account-name column.
Enlarge screenshot ↗With the black overlayEnlarge screenshot ↗Underlying text visibleComparison uses aligned detail crops at their original scale. Both complete supplied screenshots are available above.
We notified the firm and Dr. Patrick Zurheide personally. He described the information about the exposure as "amusing". Our record covers a year of notice without remediation. Separately, server records show access from Valve gateways on October 21, 2025, February 16–17, 2026, and August 31, 2026. Our case analysis links the October access to a request from the parents of one of the report authors; the access exhibit preserves the network observations and their limitations. Our allegation remains that neither the supervisory authority under Art. 33 GDPR nor the affected individuals under Art. 34 were notified. The response to notice is part of the case.[14]
Four access events.
Ten months.
Valve Corporation network · AS32590 · HTTPS
| Recorded timestamp | Host | Page views | Requests | Bytes |
|---|---|---|---|---|
| (a) | 208.64.203.11gw.valvesoftware.comSeattle, Washington | 11 | 34 | 6,322,782 |
| (b) | 208.64.203.19gw19.valvesoftware.comBellevue, Washington | 11 | 65 | 9,286,619 |
| (c) | 208.64.203.20gw20.valvesoftware.comBellevue, Washington | 9 | 62 | 8,586,044 |
| (d) | 208.64.203.20gw20.valvesoftware.comBellevue, Washington | 1 | 3 | 2,152,328 |
Preservation & limitations
The raw access logs for October 2025 and February 2026 have since been rotated by the hosting provider and are no longer retained. The analyser databases, generated from those logs and preserved separately, are the surviving record and are available to the authority in full.
Because the analyser aggregates, the specific URLs requested during each access are not recoverable from the surviving record, and neither is the duration of each session. Valve's own outbound records for the same dates are not subject to that limitation.
Read the complete exhibit 8 sections · method, chronology, preservation & SHA-256+
1. SUMMARY OF THE FINDING
Web server records for the website operated by the data subject (the requester in the Article 15 matter described at paragraph 3.1AA of the referral) show FOUR separate access events, over a period of ten months, from three different hosts inside Valve Corporation's own network.
Two of the three hosts geolocate to BELLEVUE, WASHINGTON - the city in which Valve Corporation maintains its principal place of business.
All four events were over HTTPS. Together they account for 164 requests, 32 page views and approximately 26.3 MB of transferred data.
2. THE RECORDS
Verbatim, as held in the analyser's database (VISITOR section). Fields in order: host; page views; total requests; bytes; timestamp of last request in YYYYMMDDHHMMSS form.
(a) 208.64.203.11 11 34 6322782 20251021165923 -> 21 October 2025, 16:59:23
(b) 208.64.203.19 11 65 9286619 20260216190806 -> 16 February 2026, 19:08:06
(c) 208.64.203.20 9 62 8586044 20260217112356 -> 17 February 2026, 11:23:56
(d) 208.64.203.20 1 3 2152328 20260831175904 -> 31 August 2026, 17:59:04
Source files (AWStats 8.0 build 20240604, SSL log databases, generated by the hosting provider from raw web server logs):
awstats102025.<site>.txt, line 7315 awstats022026.<site>.txt, lines 17524 and 19100 awstats082026.<site>.txt, line 7162
3. ATTRIBUTION OF THE HOSTS
Each address was resolved and checked against registry and routing data:
208.64.203.11 reverse DNS gw.valvesoftware.com location Seattle, Washington, USA
208.64.203.19 reverse DNS gw19.valvesoftware.com location BELLEVUE, Washington, USA
208.64.203.20 reverse DNS gw20.valvesoftware.com location BELLEVUE, Washington, USA
All three: Autonomous System AS32590 (VALVE-CORPORATION - Valve Corporation) Network name VALVE-V4-1 Registered org Valve Corporation (VC-2) Abuse/NOC contact [email protected] Announced prefix 208.64.203.0/24
Each hostname sits within valvesoftware.com, Valve Corporation's own second-level domain. None of these addresses is a consumer internet service provider, a content delivery network, a cloud host, a VPN exit or a shared proxy. The address block is allocated directly to Valve Corporation and announced by Valve Corporation's own autonomous system.
4. METHOD
The identification was not made by inspection or by assumption.
(a) The complete set of IPv4 prefixes announced by AS32590 was obtained from RIPE NCC routing data (44 prefixes).
(b) Every IP address appearing in the site's access records for the periods examined was compared programmatically against that set.
(c) The comparison was then re-run across every surviving analyser database for the site, covering October 2025 to September 2026.
Four records matched. They are the four set out at paragraph 2. All other addresses examined resolved to consumer ISPs, cloud providers, content delivery networks, search engine crawlers or unrelated hosting companies.
Any recipient may verify the attribution independently, without reference to us:
host 208.64.203.19 whois 208.64.203.19 https://stat.ripe.net/data/prefix-overview/data.json?resource=208.64.203.19
5. CHRONOLOGY
We set out the dates without comment as to what connects them. The sequence is a matter of record; any inference is for the authority.
1 October 2025 Valve's external counsel transmits the Article 15
response containing the defective redaction
(referral, paragraph 3.1AA)
21 October 2025 ACCESS (a) - 34 requests, 6.3 MBFebruary 2026 Proceedings commenced against Valve Corporation by
the Attorney General of the State of New York
16 February 2026 ACCESS (b) - 65 requests, 9.3 MB
17 February 2026 ACCESS (c) - 62 requests, 8.6 MB
(consecutive days, from two different Valve
gateways)17-19 August 2026 Publication of the technical findings concerning
the defective redaction
24 August 2026 Written notice served on Valve, seven-day period
31 August 2026 Period expires without response
31 August 2026 ACCESS (d), 17:59:04 - same day6. WHY THIS IS PLACED BEFORE THE AUTHORITY
We assert nothing as to purpose and we draw no conclusion. We record what the logs show: that hosts inside Valve Corporation's own network requested material published by the data subject, on the dates recorded, in the volumes recorded, repeatedly, over ten months.
Its relevance is to AWARENESS, which is the operative trigger under Article 33 and Article 34. The material published at that location concerned the defective redaction and the third-party personal data it exposed - the same data subjects who, to our knowledge, have never been notified.
ON THE VOLUME. Access (b) is 65 requests across 11 page views; access (c) is 62 requests across 9. That is not a crawler retrieving a single document, and it is not an accidental arrival. It is consistent with sustained reading. We state this as an observation on the figures.
We invite the authority to establish, from Valve's own records:
(a) whether any person acting for Valve accessed that material on 21 October 2025, 16-17 February 2026, and 31 August 2026, in what capacity, and on whose instruction; (b) what internal assessment, if any, followed each access; (c) whether at any point after those dates the affected third parties were notified under Article 34; (d) whether the supervisory authority was notified under Article 33; (e) if not, on what basis the obligation was considered not to arise.
These are questions only the authority can put. We supply the observation. The determination is not ours to make.
7. PRESERVATION AND LIMITATIONS
The raw access logs for October 2025 and February 2026 have since been rotated by the hosting provider and are no longer retained. The analyser databases, generated from those logs and preserved separately, are the surviving record and are available to the authority in full.
Because the analyser aggregates, the specific URLs requested during each access are not recoverable from the surviving record, and neither is the duration of each session. Valve's own outbound records for the same dates are not subject to that limitation.
All source files, together with the routing data relied upon, are preserved and available to the authority through a protected channel.
8. INTEGRITY OF THE PRESERVED FILES
The analyser databases were copied from the hosting account on 1 September 2026 and hashed at the point of copying. SHA-256:
0704c0170e9e7ed103aec75af2feacd4a2584e0ae1da0cb88b68258630e4ff2c awstats102025.67a427a7...spacecharged.site.txt (contains record (a) - 21 October 2025)
ef9cff2a423767aed192dd056177c86b0aaa0df1390994a5007a79c19b9a5722 awstats022026.67a427a7...spacecharged.site.txt (contains records (b) and (c) - 16 and 17 February 2026)
8bf0221608bdef2e84e523ff908aaaa46a299ae782e8f63b54773136c75b08f7 awstats082026.67a427a7...spacecharged.site.txt (contains record (d) - 31 August 2026)
Also preserved, from the second site configuration on the same account, for completeness of the record:
7847f57203092b380a238c53303aa1fa650f325962679847851d69dc2ddbf889
awstats022026.a2a07414...spacecharged.site.txt
3a0f43e7ad9f7fcc2e435ff2bd2480de9e150184a3aa860495ec330ec1839fa5
awstats082026.a2a07414...spacecharged.site.txtThe authority may verify that any copy supplied to it is byte-identical to the file as held on the hosting account on the date of preservation.
After publication on Medium, Dr. Patrick did not dispute a single number. He invoked the "right to be forgotten" under Art. 17 GDPR, and our articles were removed from Google search results. The subject of those articles was his professional work for a billion-dollar client, a capacity expressly stated in the correspondence. We regard the use of data-protection law to suppress reporting about the data exposure as an attempt to conceal the failure and obstruct independent security research. Removal from search does not correct the PDF or answer the audit.
PART II. HYPOCRISY: A RAINBOW OVER "PIDOR"
Stonewall · LGBTQ+ inclusion
Taylor Wessing is a public LGBT champion. Three years in a row — Stonewall Top 100, top 10 in the legal sector. An interview with myGwork about "creative plans to advance LGBTQ+ inclusion." Posts for IDAHOBIT from the Head of Talent. The "Head of Responsible Business" talks about the importance of LGBTQ+ history. Dr. Patrick participates in briefings.[9]
Now look at their document. Two months of claimed "manual review." An automated script painted over the reporter's login zabolotov — and "forgot" the adjacent column. In the materials prepared by an elite firm for a legal dispute, it explicitly states in plain text:
What the first row says.
- Original entry
pidor
- English equivalent
faggot
A homophobic slur against gay men. “Pidor” is the Latin-script form of the Russian “пидор”. The translation makes its meaning explicit; the screenshot preserves the original entry.
Enlarge screenshot ↗A homophobic slur. In an official document. From a firm that is a top employer according to Stonewall. The rainbow is marketing. "Pidor" is their operational reality. And no, this is not an "unfortunate accident." This homophobia has a pedigree.
This is disrespect for the law.
The issue goes beyond disrespect for an opponent. It is disrespect for the law that gives that person a right to their data. An allegation against the requester does not answer an access request. A lawyer's confidence about a future judgment does not discharge the present obligation. Corporate money does not make that obligation optional.
Our position and requested scrutiny ↗PART III. NAZISM AT THE FOUNDATION OF THE FIRM
The firm writes on its website that it honors its history. Wikipedia mentions the founder of the German branch with a single sterile line — "in 1954, Rüdiger Graf von der Goltz took Kurt Wessing as a partner" — and not a word about who Goltz was. That won't do. We are filling the gap using the archives.[3][10]
Rüdiger Graf von der Goltz (1894–1976):
- April 1, 1932: voluntarily joined the NSDAP. Party member No. 1,033,215 — before Hitler came to power.[1][2][4][5]
- Until 1933 — lawyer for the Nazi elite: defended Joseph Goebbels in a 1930 trial and SA stormtroopers in political murder cases. Goebbels in his diaries: "Goltz ist Knorke. Er macht uns allen Spaß" — "Goltz is great, he is fun for all of us."
- 1933: President of the Pomeranian Landtag; Reich Trustee of Labour; member of the Prussian State Council appointed personally by Göring; co-founder of Hans Frank's Academy for German Law — the entity that rewrote German law to fit Nazi ideology.
- 1936–1943: Reichstag Deputy for the NSDAP. Member of the Criminal Law Commission under the Reich Ministry of Justice — the very machine that legally formalized repressions, including the persecution of homosexuals under Paragraph 175, which sent men to concentration camps with a pink triangle.
- 1938, the Blomberg-Fritsch affair. Goltz defended General von Fritsch against a fabricated charge of homosexuality. He won — by proving that the "real" homosexual was another officer, Achim von Frisch. Goltz didn't challenge the cannibalistic law. He pointed the executioners to another person.[6]
- Post-war: zero consequences. A practice in Düsseldorf. 1954 — partner Kurt Wessing. For decades, the firm bore his name: Graf von der Goltz, Wessing & Partner. His son later chaired the supervisory board of BMW. The system took care of its own.
Enlarge the original page ↗Bayerische Staatsbibliothek · printed p. 223 / scan 224.
The name.
The record.
Rüdiger Graf von der Goltz
Der Großdeutsche Reichstag, 1938.
- Collection
- Reichstag handbooks
- Catalogue ID
- bsb00000146
- Call number
- BA/Z 36.609-1938
Six documents. The full folder.
Full scan ↗
Full scan ↗
Full scan ↗
Full scan ↗
Full scan ↗
Full scan ↗Provided by ZBW — Leibniz Information Centre for Economics / Hamburgisches Welt-Wirtschafts-Archiv. Dates, publication names and issue numbers are transcribed from the archival sheets. Open all six in the ZBW viewer ↗ · Archive rights statement ↗
The appointment. The mandate. The printed law.
The record extends beyond a biographical entry. A contemporary newspaper names von der Goltz's appointment; the published commission records identify his political role; the official gazette states the institutions' mandate and the criminal provisions used by the regime.
A named representative of the party.
The scholarly edition of the commission's records identifies von der Goltz as the NSDAP representative during the later deliberations. It also records his introductory contribution to the 1936 publication Das neue Strafrecht, alongside Gürtner and Freisler, and his presentation on protection of honour in the proposed criminal law. The references are precise: printed pages XVI–XVII; biography on XXVII.[16]
A separate library catalogue records Nationalsozialistischer Ehrenschutz, published in Vienna in 1938, under the names Hans Frank and Rüdiger Graf von der Goltz. The title, authors and edition can be checked independently.[20]
Four pages from the record.
Open full page ↗Von der Goltz joins the commission.
Hamburgischer Correspondent · 25 November 1933 · front page
The report dated 24 November names von der Goltz among the new appointments to the Reich Ministry of Justice's criminal-law commission. The following day's newspaper supplies a contemporary record.[15]
Article crop · full newspaper page availableArchive record ↗
Open full page ↗The Academy's statutory mission.
Law of 11 July 1934 · RGBl. I, p. 605
Section 2 assigns the Academy the implementation of the National Socialist programme throughout the field of law, in continuing cooperation with the bodies responsible for legislation.[17]
Official gazette · complete page 605Archive record ↗
Open full page ↗Punishment beyond an express prohibition.
Law of 28 June 1935 · RGBl. I, p. 839 · Article 1
The rewritten §2 permits punishment by analogy, invoking the underlying idea of a criminal statute and “gesundes Volksempfinden”. The provision is printed on the opening page of the same amendment that tightened §175.[18]
Official gazette · complete page 839Archive record ↗
Open full page ↗The text used to persecute men.
Law of 28 June 1935 · RGBl. I, p. 841 · Article 6
Article 6 prints the revised §175 and the added §175a. The revision expanded criminalisation of sexual acts between men; §175a prescribed up to ten years in a penitentiary for the categories it listed.[18]
Official gazette · complete page 841Archive record ↗Newspaper: original and digitisation by Staats- und Universitätsbibliothek Hamburg, issue 551, 25 November 1933, front page; collection reference PPN689065124_19331125. Legal gazette: ÖNB / ALEX, reproduced through Wikimedia Commons. The newspaper preview is an identified crop; each full page remains available.
The Bundesarchiv lists R 61 — Akademie für Deutsches Recht among its digitised holdings. It provides a further route into the institution's files, alongside the personal papers already linked in this dossier.[22]
Bundesarchiv · digitised collections ↗And now the irony for which we simply must be published: the "elite English history" that the firm flaunted (a branch dating back to 1782) has split from them. The UK, Dubai, the Netherlands, Ireland, and Belgium are leaving the structure and, as of June 1, 2026, will operate under the brand Winston Taylor — an official notice hangs on their website. What remains is exactly what this dossier is about: the German core with its roots. Their ancestors. They can take their time — we will finish our academic work and help the Wikipedia community and the whole world not to make a mistake. How does their Wikipedia get by without an extensive section on the CREATOR?[10]
CHAPTER. ROW NO. 1
Pidor Comes First
Out of 2,002 reports, Taylor Wessing selected exactly 50 to display. The first visible row is reproduced below:
Enlarge screenshot ↗Detail crop of the first row. The complete supplied screenshot opens above.
First. A homophobic slur is the calling card of their "evidence base". Two months of claimed "manual review" — and they missed row No. 1.
Now look at the end of the cover letter that accompanied this attachment: "Dieses Schreiben ist qualifiziert elektronisch signiert" — a qualified electronic signature. Dr. Patrick Zurheide didn't "overlook" the document. He signed it. Under "pidor" lies the signature of a Doctor of Law from a Stonewall Top 100 firm.[12]
Enlarge screenshot ↗What Their Founder Created: The Law of Pink Triangles
Voting in the Reichstag from 1936 to 1943 was a ritual — they didn't "adopt" anything there, they rubber-stamped. The real work of Rüdiger Graf von der Goltz took place elsewhere: he was a member of the Criminal Law Commission under the Reich Ministry of Justice and a co-founder of Hans Frank's Academy for German Law — the bodies that wrote and legitimized the criminal law of the Third Reich.[1][2][5]
The jurisdiction of this machine included Paragraph 175 in its 1935 Nazi revision. The result of this machine's work is well known: around 100,000 arrests, tens of thousands of convictions, thousands of men in concentration camps — with a pink triangle on their robes, at the very bottom of the camp hierarchy, with a monstrous mortality rate.
He sat on the commission that wrote this norm, and in the academy that justified it. The 1938 Blomberg-Fritsch affair shows how he used that system: another's life as a fee.[6]
That is why row No. 1 with the word "pidor" under their doctor's signature is not irony. It is continuity.
The Erased Russian Trace
Now the main point: what exactly did they erase to put this row first?
In the hidden 94.28% of the document lies organic reality. Russian-language harassment of a Ukrainian, spanning years, with death wishes. Verbatim from the hidden part of the logs:
- "SVO SVO GOIDA ZOV ZOV ZOV SLAVA ROSSII HOHLI PIDORASI" (May 14, 2025)
- "Execute the hohol svo zov goida" (May 5, 2025)
- "He is Ukrainian Naci" (May 7, 2025)
- "GOOOOOOOOOL HOHLIIIIIIIII GOIDAAAAAAA" (November 29, 2024)
Hundreds of such reports. Cyrillic, politics, hatred for the nationality of the account owner. Taylor Wessing painted over all of this — under the slogan of "protecting third parties."
Most of the hidden reports were not in English.
By PhishDestroy's current estimate, approximately 64% of the redacted reports are in languages other than English. The concealed material must be read in its own languages to understand the harassment and the context removed from the visible selection.
The unit here is reports. The separate 61.58% figure measures Cyrillic-character density in the concealed material.
Enlarge screenshot ↗And in the visible spot, they placed 50 reports in sterile, calibrated English: "Got a sketchy invite from this account", "It's acting like a phishing account", "This account is clearly compromised". The chronology and nickname analysis establish why our audit identifies this visible sample as fabricated.
A qualified electronic signature does not negate arithmetic. And it doesn't negate the history of the firm, which 90 years ago learned to do exactly this: erase inconvenient people from documents and substitute them with others.
CHAPTER. PROFESSIONAL CONDUCT AND INSTITUTIONAL CONTROL
The Tribunal, the Mahiki Club, and £30,000
The record extends beyond this disclosure. It includes a published Solicitors Disciplinary Tribunal (SDT) decision and separately identified reporting in the legal press.
Daniel Hutchings, a solicitor in Taylor Wessing's London office, attended the annual Society of Construction Law lunch and then the Mahiki nightclub in Mayfair. The case materials describe "inappropriate, unwanted, and sexually motivated comments" to a female lawyer, lewd remarks about her body and touching her waist without consent. Three episodes resulted in a £30,000 fine and an order to pay costs. This is a disciplinary outcome that must be considered alongside the firm's public commitments on professional conduct and inclusion.[7]
Inspect document ↗Inspect document ↗Separately, RollOnFriday published discussion of a Taylor Wessing "Head of Department" who reportedly "hooked up with a trainee". That item concerns a reported rumour; the Hutchings matter is a tribunal decision. Both remain identified in the source record. They raise distinct questions about workplace hierarchy, supervision and the credibility of the firm's public standards.[8]
The use of professional authority against a data requester
A firm charging hundreds of euros an hour asks whether "your lawyer takes on criminal cases." The letters reproduced in Part I show how that authority was exercised.
The signed correspondence characterizes the opponent as a phisher, blackmailer and forger without supplying the evidence necessary to establish those accusations. The question is which internal controls authorize the use of such claims in a response to a statutory request. The professional document itself supplies the basis for examination.
Our assessment: the operating model is unsafe
We regard the combination of fabricated evidence, threats, defective data protection and suppression of reporting as an institutional safety failure. Professional language and an established brand do not reduce the gravity of the conduct documented here.
These matters warrant an institutional investigation. The firm handles personal data belonging to thousands of third parties through GDPR processes. The adequacy of its supervision, release controls and response to reported failures therefore affects people far beyond this account dispute.
THE LINK: ONE PATTERN, 90 YEARS
Look at how perfectly their entire history aligns. The method hasn't changed. Only the signboard has changed. Look at the complete pattern:
| 1932–1945 | 2025–2026 |
|---|---|
| Legal servicing of a repressive machine | Legal servicing of a billion-dollar client at any cost |
| Forgery and procedural games (the Fritsch case) | Fabrication: 50 post-ban botnet reports instead of 1,954 real ones |
| Working within the machine that persecuted gays (§175) | "Pidor" in an official document under a Stonewall rainbow flag |
| Protecting the powerful, destroying the weak | Covering up the harassment of a Ukrainian, threatening his lawyer, and harassment in the City |
| Impunity after 1945 | A year of silence over a leak + the "right to be forgotten" against journalists |
Then — the uniform of the Reichstag and servicing the system. Now — a suit in the Hamburg/London office, threats under §§ of the Criminal Code, and absolute certainty of impunity.
CHAPTER. PROFESSIONAL AUTHORITY IS SUBJECT TO REVIEW
A doctoral title, a letterhead listing offices from Amsterdam to Shanghai and a billion-dollar client establish the professional capacity in which a lawyer acts. They do not turn that lawyer's assessment into a judicial finding, a threat into a verdict, or a black rectangle into deletion of the text beneath it.
The evidential basis for the forgery finding
The evidential grounds for our finding are set out in the chronology, nickname and text-identity analysis, supported by Exhibit B.[13]
Our examination, conducted according to ISO/IEC 27037 and 27042, concludes that the evidence is fabricated on the combined grounds of chronology, probability and stylometry. A substantive response must identify an error in the records, the method or the calculation and demonstrate its effect on that conclusion. A professional title does not constitute a rebuttal.
Notice makes the failure an institutional responsibility
We notified both Dr. Patrick and the firm. A year has passed. Our record identifies the following failures by Taylor Wessing during that period:
- did not correct the negligent redaction of third-party personal data — the black rectangles remained black rectangles;
- did not recall or verify the fabricated sample of 50 "reports" submitted to the legal process;
- did not inform the regulator of the data leak (Art. 33 GDPR) or notify the affected third parties (Art. 34 GDPR);
- did not conduct an internal investigation — but found the time to file a request with Google to remove our articles.
Continued inaction after institutional notice is itself an institutional act. Responsibility can no longer be confined to the original preparer or signatory.
A common brand requires accountable supervision
Taylor Wessing describes its structure as "Decentralised". National offices and partners nevertheless provide services under a common professional brand. That structure must be capable of identifying who controls a disclosure, who reviews it, who receives notice of a defect and who requires corrective action. Referring the matter back to an individual partner does not answer a failure reported to the firm itself.
Our assessment is that an organization which knows of these actions for a year and leaves them uncorrected ratifies them through inaction. Every partner receiving a share of the firm's profits since October 1, 2025, benefits from the continuing operation of that institution. Our criticism therefore extends to its governance and supervision, not only the signature on one letter.
When a paid representative speaks for the court
The correspondence raises a question of public authority: what form of justice are its authors asking the requester to accept? The statement that “any court would deem the block lawful” presents the corporate client's preferred outcome as the settled answer of courts that have not examined the record. The author writes as a paid representative of that client. On what authority does he speak for the court?
We regard that posture as an attempt to replace independent scrutiny with corporate authority. Four concepts describe the institutional danger at issue:
Corporate power displacing public decision-making. The danger is that law, legal procedure and judicial authority become instruments for securing a corporation's desired outcome, while the person asserting a statutory right is treated as an obstacle to remove.
Adjudication treated as a service purchased by an interested party. A corporation pays its advocate to represent it; that mandate supplies no authority to pronounce an independent verdict on the corporation's own conduct. Presenting advocacy as the predetermined judgment of every court collapses the distinction on which an impartial process depends.
Political power concentrated through wealth. The corresponding danger in legal practice is that money purchases the appearance of certainty and authority: the corporation can afford threats, prolonged correspondence and assertions of inevitable victory, while the requester is expected to abandon a right that the law grants him.
Kleptocracy describes power used for private enrichment; institutional corruption concerns the diversion of an institution from its public duties toward private interests. The conflict examined here is concrete: a corporation's paid representative defends the handling of data, asserts the expected judicial outcome and participates in the response to reporting about that same handling. Our allegation of concealment makes independent scrutiny of that conflict essential.
A corporate mandate is not a judicial mandate. The signed assertion about what courts will decide belongs in the referral alongside the threats of prosecution, the selected reports, the defective redaction and the response after notice. Professional status increases the responsibility attached to those statements. It supplies no immunity from examination.
This is a formal, documented escalation. Intimidation, delay or a change to Source 1's account will not terminate it. We will pursue an answer for each signed assertion and each decision documented in this dossier through the competent authorities.
The competent authorities have the final determination
German lawyers are subject to BRAO (Federal Lawyers' Act), BORA (Professional Code of Conduct) and the duty not to mislead the court or the proceedings. Our forensic report is addressed to the Hanseatic Bar Association of Hamburg and the data-protection supervisory authorities. The firm's assertions about what a court would decide do not displace those bodies' authority.
The competent bodies determine the legal consequences of forgery, concealment and negligence. We supply the documents, the calculations and the questions requiring an answer. Our conclusion remains explicit:
Mathematics gives us the full right to call their forgery a forgery. A year of the firm's inaction gives us the full right to call it a corporate forgery.
We consider these methods unacceptable and dangerous. The referral requests scrutiny of the firm's conduct as a paid corporate representative: the signed statements, the handling of the evidence and the response after notice.
PROFESSIONAL RESPONSIBILITY DOES NOT END AT THE SIGNATURE
Their own professional record
Taylor Wessing presents these lawyers in the context of technology law, data protection and corporate work. Its official profile for Dr. Tobias Schelinski also records teaching positions:
| Period | Institution |
|---|---|
| Since 2010 | Hochschule für Angewandte Wissenschaften, Hamburg |
| 2011–2013 | Heinrich Heine University, Düsseldorf |
| Since 2017 | Nordakademie, Hamburg/Elmshorn |
The teaching appointments above belong to Dr. Tobias Schelinski. They are listed on his official English-language profile. Dr. Patrick Vincent Zurheide's separate official profile describes his technology, software and data-protection practice.
Our first Medium article included a comment acknowledging that we had not considered the lawyers' teaching roles. We left that correction visible. An error in our own work must remain traceable. We require the same accountability for the errors identified in the firm's documents.
The claim about what any court would decide also concerns us in the context of those teaching roles.
We take those words seriously. We do not dismiss them as casual email rhetoric or an empty bluff. In our assessment, claims made under a professional title and an electronic signature warrant a professional response and independent oversight.
01 / Duty of care — Sorgfaltspflicht
Document sanitization requires the sensitive content to be removed from the released file. An opaque shape above it leaves the information extractable. For doctors of law entrusted with personal data and acting in their stated field of expertise, we regard this failure as gross negligence — grobe Fahrlässigkeit. The required check was basic; the consequences concern other people's data.
02 / Security of processing — Article 32 GDPR
Article 32 requires security measures appropriate to the risk. The released PDF retained third parties' personal data inside the file delivered to the requester.
Our criticism concerns the actual handling of the data, not the appearance of a privacy notice or a statement of compliance on a website. GDPR, Articles 32–34
03 / The claimed review and the QA failure
The correspondence describes two months of manual preparation, including the phrase “manuell die Daten bereinigt werden mussten”. A selection or extraction check would have exposed the retained text. Our conclusion is that the claimed review did not provide the quality control the document required.
04 / Notice, silence and the cover-up allegation
Article 33 requires notification of a notifiable personal-data breach without undue delay and, where feasible, within 72 hours of awareness; it contains an exception where risk to individuals is unlikely. Article 34 concerns communication to affected people where a breach is likely to result in a high risk, subject to its stated exceptions. Our position is that the handling of this exposure requires scrutiny against those duties. Official GDPR text
The missing records extend beyond a consumer account
The disclosed material is incomplete; the correspondence itself acknowledges limits to what was supplied. Our minimum estimate is that at least 35,000 pages are missing, even before additional telemetry referred to by the lawyers and records of staff access to the user's data are considered.
The account holder was also a verified Steamworks participant. His relationship with Valve therefore extended beyond that of an ordinary platform customer. The disclosed PDF does not include the tax-status and verification documents he says he provided to become eligible to publish games, nor the relevant records surrounding the $100 submission payment.
Whatever the legal characterization of that payment in the United States, it does not answer the access question: what information was collected, what remains stored, who accessed it, and why was it absent from the response? Instead, the user received an 830-page disclosure with 94.28% of its content visually covered, while the material singled out as evidence remained visible.
We also ask whether this was the first request of its kind to reach an actual disclosure instead of ending in withdrawal or rejection. The wider workflow review addresses that question.
FROM A PDF FAILURE TO A WIDER CORPORATE RISK
A 2020 document engine in a 2026 investigation
The PDF producer identified in our examination is Aspose.PDF for .NET 20.8, an August 2020 release. The release number follows the year-and-month convention: 20 for 2020, 8 for August. The vendor publishes both the 20.8 release notes and the 26.9 release notes, providing the comparison cited here.
The PDF has no evaluation watermark. Our working explanation is the use of a commercial licence and a retained older build; we are not alleging that the firm used a crack or pirated software. Aspose's perpetual licensing model allows continued use of eligible versions after an update subscription ends. A lawful licence and an up-to-date processing environment are separate questions. The exact licence purchase and renewal dates are not established by the output file. Aspose licensing · Vendor explanation of renewal and perpetual use
The firm advertises expertise in IT, data and cyber matters, including work for technology and financial businesses. Those representations make the processing failure directly relevant to its professional competence. A privacy notice describes an obligation; the system that handles the data must implement it.
What the scenario illustrates
We are modelling a risk, not reporting a successful intrusion. The scenario follows attacker-controlled content into a document converter and traces the consequences of successful parser exploitation. The supplied screenshots document the redaction failure and producer metadata; the diagram models the wider attack sequence.
The model begins with a document-production workflow that accepts profile descriptions, account names, report text and messages. The attacker places crafted content in a field carried into the data export. The access request moves that content through collection to the document worker. In the modelled vulnerable workflow, the converter processes the embedded structure and reaches the parser flaw.
Three different risk paths
External resource loading / SSRF. The SSRF branch models a converter that resolves a user-supplied resource address and permits requests to internal destinations. The request originates inside the processing environment and reaches services exposed to that worker. Cloud metadata is one sensitive destination; destination restrictions, metadata protections and network segmentation are the controls that protect it.
Parser memory corruption / RCE. In the RCE scenario, crafted document content reaches a vulnerable parser and triggers a memory-safety flaw. Successful exploitation gives the attacker code execution inside the document worker. The resulting foothold and its consequences are examined below.
External stylesheet or linked resource. In the external-resource branch, the converter fetches a remote stylesheet or linked object controlled by the attacker. The request exposes its outward-facing address and processing time to the resource operator. The downloaded content enters the next parsing stage, making resource policy and parser maintenance part of the same processing boundary.
From input to foothold.
A process accepts material influenced by a third party. The content remains untrusted when it enters an official data-access workflow.
The scenario assumes a reachable vulnerability in the worker. Successful exploitation establishes the first foothold; the attacker then targets accessible data, credentials and routes deeper into the network.
The historical CVEs and their exact scope
Cisco Talos documented CVE-2019-5042 and CVE-2019-5066 as memory-safety vulnerabilities in Aspose.PDF for C++ 19.2. The first concerns FunctionType 0 PDF elements; the second concerns LZW-compressed streams. Both reports describe potential remote code execution and record a vendor patch on 16 September 2019.
Assessing the .NET 20.8 workflow requires identifying the deployed components, their builds and the parsing paths reachable from user-controlled content. TALOS-2019-0809 / CVE-2019-5042 · TALOS-2019-0855 / CVE-2019-5066
A foothold is the beginning of the intrusion
Once code execution has been obtained, the attacker acts with the worker's identity and access. Other GDPR exports, confidential client material, service credentials and internal resources exposed to that identity become immediate targets. The next phase is reconnaissance and expansion: identifying additional systems, abusing accessible credentials and seeking greater privileges. The initial process permissions define the first foothold. Containment and removal are urgent because an attacker who retains that foothold has time to search for routes deeper into the infrastructure. Data theft, lateral movement and the sale of access to ransomware operators are the downstream risks examined here.
A document can appear ordinary to the person signing the accompanying letter while its automated processing has already crossed a trust boundary. That is why a qualified signature, a costly commercial library and reassuring language about manual review do not substitute for secure input handling and isolation.
Why notice cannot be treated as a one-client problem
We told the firm that we had grounds to suspect the redaction failure was not an isolated incident. Our hypothesis concerns repeated processing of a particular format of user data, rather than every file for every client. An old producer version raises questions about maintenance; the failed redaction raises a separate, directly observable question about how the release process was designed and checked.
Our working conclusion is that the risk belongs to a repeatable corporate process. The investigation therefore extends beyond Dr. Patrick Zurheide to the personnel, scripts, review controls and disclosures that used the same processing route. A defect in that route calls for examination of every disclosure produced through it.
The review must trace the entire request population: replies released, requests delayed, requests abandoned after threats or accusations, and data never supplied. This case raises the question of how many requesters were deterred before reaching the disclosure stage at which the defect became visible.
This is also why notice to the firm matters. Our allegation is that Taylor Wessing and its client concealed the known exposure while leaving the wider scope unexplained. The responsible authorities must establish who knew, who had the authority to stop the process, which other disclosures were affected and what was done after notice. Responsibility follows the workflow and the decisions made about it.
OUR POSITION. A RIGHT IS NOT A CORPORATE FAVOUR.
We are not asking for an account to be restored. We are asking for a process to be examined. A corporation's budget, a law firm's reputation and a lawyer's academic title do not answer the questions in these documents.
We did not enter this as a party. We will not walk away as observers.
What makes this situation unusual is our independence from the original dispute. We did not arrive to represent Source 1. We arrived at documents whose contents, signatures and handling demanded examination. What we found has made neutrality about the conduct impossible. Our assessment is explicit: intimidation, delay, arrogance, incompetence and failure to comply with the law. The letters, the defective redaction, the notifications and the response are the basis of that assessment.
We regard the concealment of this exposure, and Dr. Patrick Zurheide's use of the right to be forgotten against reporting about it, as part of the same accountability problem. There is little we can add to the language of the letters themselves. Read them. Compare what they say about the requester, the courts and the firm's diligence with what the delivered PDF contains.
Suspicion is not a licence to cancel someone's data rights. A lawyer's prediction is not a court judgment. A black rectangle is not deletion.
A company cannot create a blanket exemption from Article 15 by declaring that the requester is a fraudster, a rule-breaker or a criminal. Access rights are not a reward for being a customer the company approves of. The EDPB's access guidelines address this directly: the controller should not assess the requester's intentions or refuse access merely because the data may be used in a dispute. EDPB Guidelines 01/2022 · right of access ↗
Three branches. Separate responsibility.
- Valve and Steam. The platform's statements, the data it holds and the material relevant to the parallel Steam investigation. The PDF supplied the evidence needed for that branch.
- Taylor Wessing and the signatories. The letters, the processing of documents, the redactions, the response to notification and the professional conduct of the people whose signatures appear on the documents. Valve cannot answer these questions in their place.
- The wider handling of GDPR requests. The methods used in neighbouring matters, the people affected beyond this account and the systemic questions being developed in our two academic papers.
Resolving the account dispute does not resolve the second or third branch. Source 1 cannot settle them on our behalf. We are seeking honesty, examination and accountability. This work cannot be disposed of as a private negotiation over one customer's ban.
What, exactly, is being taught?
Dr. Tobias Schelinski's published teaching appointments make the professional question broader than one letter. What are future practitioners being taught about a corporation's obligations to an individual exercising a statutory right? What does it mean when corporate counsel writes as though the outcome in any court is already known? We ask universities and the legal profession to examine those questions against Doc. No. 42282474 and Doc. No. 42603633, not against the prestige of a title.
We also ask the public, human-rights advocates and LGBTQ+ readers to examine the first visible report row. Could Dr. Patrick Zurheide fail to notice or understand that slur after the claimed two months of manual processing? Was leaving it visible a failure of review or a deliberate choice? His response found room for allegations and predictions. Where is the complete answer to the request for data? Our historical chapter and the present documents are available for readers to consider together.
The scope of the review must extend beyond this file.
This is not merely one case. In our reading, the correspondence and the choices made in the disclosure fit the historical pattern discussed above with disturbing precision. Compare what was hidden with what was left visible. Our position will not become softer because those comparisons are uncomfortable.
This is a question about the practical value of the GDPR when a corporation pays someone else to handle a request. How many requests processed by Taylor Wessing were answered completely and lawfully? How many were returned 94% blacked out, as in the case documented here? How many were prolonged until the requester no longer had the time, resources or energy to continue? Were threats or accusations used in neighbouring matters? The size of either company is irrelevant to those questions.
In our view, the service revealed here amounts to withholding data under the cover of professional authority. If corporations consider access rights commercially inconvenient, they should say openly that they want the law changed. They do not get to privately replace it with a paid prediction of what a court will do.
We call for a review of other PDFs produced through the same process, the handling of related access requests, the instructions given to those preparing the files, and the decisions taken after notification. We advised the firm to examine its PDFs. Whether that review happened, what it found and whom it notified are questions the firm must answer. The boundary of our own evidence is precisely where an authority's power to inspect becomes necessary.
If the same words appear in other files, examine the process.
If a regulator finds similarly retained homophobic slurs in neighbouring disclosures, we ask it to establish who prepared those files, who reviewed them and who authorised their release. Were the same methods used? Were the same assurances of manual review given? What happened after the problem was reported?
- Selection. Compare the language concealed with the language left visible.
- Approval. Trace the review, the sign-off and the instructions behind them.
- Response. Establish what changed after notification, and in which other matters.
We are not asking a German authority to import a binding common-law precedent. We are asking it to compare documented conduct. A comparable case can expose the same self-assurance and passive aggression and identify questions that require answers. The demand is an examination of the evidence and the process.
- Data protection supervision: completeness and timing of access responses, security of the supplied documents, the handling of notifications and the scope of the affected processing.
- Professional oversight: the conduct of the lawyers, the assertions in their signed correspondence and the supervision of document preparation.
- Prosecutorial review: examination of the original evidence wherever it gives the competent prosecutor grounds to investigate.
If German prosecutors, the bar or the relevant supervisory authorities see no reason to examine the wider process, we will put the systemic question before the European Data Protection Board and the European Commission. Our academic work is not an exit from this case. It is the next stage. We are preparing two papers. Once that work is complete, we will pursue the questions they document through the appropriate institutional channels. We will not abandon this matter.
A direct question for the firm's insurer.
The Valve matter warrants examination by Taylor Wessing's professional indemnity insurer. Our position is that the record cannot be reduced to an unknown, isolated mishap. The delivery method, our notifications, the reply and the dated accesses from the client's network belong in that examination. The access records and their preservation limits are set out in Exhibit PD-VALVE-2026/01.
No break-in was needed to reach the text under the rectangles. The sender supplied the text inside the document. We describe that mechanism as professional negligence: an exposure created during the preparation and delivery of the file itself. The insurer should examine when the risk became known, what was done about it and whether other matters used the same process.
Germany's data-protection history makes the question sharper.
Germany's experience of surveillance under the Gestapo and the Stasi is part of the historical background to its insistence on privacy and limits on institutional power. Hesse adopted the world's first data-protection law in 1970. That history should make an individual's right to obtain their data a serious obligation, not an obstacle to be exhausted through correspondence. Hessian data protection authority · history ↗ · Data protection authority of Baden-Württemberg · historical context ↗
We once imagined the distinction to be straightforward: lawyers might defend people whose conduct was objectionable while still respecting the limits of their own profession. Here we have doctoral titles, substantial commercial interests, a public history with conspicuous omissions, and documents that require far more scrutiny than their letterheads invite. A title does not close that inquiry.
To readers, rights advocates and other recipients.
Do not let the status of a corporation or its counsel intimidate you out of exercising your lawful rights. If you believe this record merits attention, you can bring it to organisations and authorities you consider appropriate. You may discuss, translate and reuse our work under the project's published licence and terms. We are asking for scrutiny of documented professional conduct and institutional practices.
Steam users who have experienced account or item theft may have a particular interest in what their access response contains. In the case documented here, a support exchange did not produce the complete disclosure sought, and the supplied material leaves substantial questions about missing data. If you received a complete, useful response from Valve, we also want to hear about it. A wider record needs those experiences too.
If you received a redacted PDF from Taylor Wessing, examine whether the black areas actually remove the underlying text. Our open-source PDF redaction toolkit supports local inspection. The Medium articles also describe basic checks using LibreOffice or selecting and copying text into a plain-text editor. Preserve the original file. An opaque rectangle alone does not establish that the concealed data has been removed.
Tell us what you requested, when you requested it and what response you received.
To the authorities: examine the neighbouring matters.
We would prefer not to circulate documents containing other people's information. Publicly, we publish selected screenshots. The complete, unedited originals are reserved for the authorities through a protected channel. They contain personal data and material extending beyond this particular case.
We are not asking an authority merely to repeat our examination of one account. We ask it to investigate what we cannot inspect: neighbouring requests, earlier exports, internal instructions, quality-control records and decisions after notice. Doc. No. 42603633 and Doc. No. 42282474 identify the starting point. They do not define the outer limit of the questions.
The Medium series: our earlier, informal reporting.
The four articles below use sarcasm and an informal voice in response to the correspondence. They do not contain the full account assembled in this dossier. They remain part of the publication record; the academic work develops the methods and evidence further.
- 01My Dog vs. Elite GDPR LawyersThe Valve Data Breach Nobody Is Talking About↗
- 02My Dog vs. Elite Lawyers — Part 2The 5-Year PDF Vulnerability Exposing Global Corporations↗
- 03My Dog vs. Elite Lawyers — Part 3Valve, GDPR and the Cover-Up↗
- 04My Dog vs. Elite Lawyers — Part 4Dr. Patrick, Your Own Document Just Destroyed Your Client↗
A right that survives only until a corporation hires a lawyer is not being enforced. That is the question we intend to keep before the public and the institutions responsible for answering it.
EPILOGUE. THE RECORD WILL REMAIN AVAILABLE.
Taylor Wessing must answer the record.
Public case materials are limited to screenshots. On October 14, the complete package — including the original letters, raw uncensored logs and supporting documents — is being handed directly to the regulators, without editing. The originals contain personal data and evidence extending beyond this case, and are therefore not attached to the public page. The dossier and its copy on IPFS preserve the public account of the findings despite attempts to remove it from search.
Every correction proposed through our Wikipedia initiative must remain linked to the record that supports it.
PhishDestroy knows how to wait
Our preservation horizon extends beyond a firm's correspondence strategy. Archival funding models already use a 200-year storage horizon: Arweave's protocol documentation describes upfront funding for replicated storage on that timescale. Arweave protocol overview — storage endowment
Removal from search changes discoverability; it does not change what the documents contain. We will continue to contest the use of personal-data protections to suppress examination of signed professional work performed for a corporate client.
The authors, dates, signatures and contents remain part of the record. We will preserve them, submit them and continue to demand answers.
SOURCES
The Nazi Past of the Founder (Archives and Reliable Sources):
- Rüdiger Graf von der Goltz (lawyer) — Wikipedia EN
- Rüdiger von der Goltz (Jurist) — Wikipedia DE
- Taylor Wessing — Geschichte — Wikipedia DE
- Reichstags-Handbuch 1938, Bavarian State Library, biographical entry for Rüdiger Graf von der Goltz. Printed page 223 · digital scan 224
- Lilla, Doring, Schulz, "Statisten in Uniform: Die Mitglieder des Reichstags 1933–1945", Droste, ISBN 3-7700-5254-4
- Blomberg–Fritsch affair — Wikipedia
Scandals and PR:
- Disciplinary decision of the SDT on Daniel Hutchings (£30,000 fine; covered by Law.com International and Legal Cheek), incident at the Mahiki club, London.
- RollOnFriday — rumors about a "Head of Department" at Taylor Wessing and a trainee.
- Official LGBT publications of Taylor Wessing: Stonewall Top 100, myGwork, IDAHOBIT (taylorwessing.com).
- Notice on the Taylor Wessing website regarding the exit of the UK, Dubai, Netherlands, Ireland, and Belgium offices from the Taylor Wessing Verein (Winston Taylor brand from June 1, 2026); Taylor Wessing — Wikipedia EN.
Case Materials (Full versions — with regulators):
- Letter from Dr. Schelinski, Taylor Wessing, 15.08.2025, Doc. No. 42282474.
- Letter from Dr. Zurheide, Taylor Wessing, 01.10.2025, Doc. No. 42603633, Anlagen 1–2.
- Exhibit B: Quantitative Forensic Audit of GDPR Disclosure Data, AR-2025-BAN-FORENSICS (Shannon entropy 3.48 vs 2.14; Jaccard index 1.000; chronological paradox; "pidor", page 444).
- Exhibit PD-VALVE-2026/01: access logs from Valve Corporation gateways (AS32590) — 21.10.2025, 16–17.02.2026, 31.08.2026; SHA-256 checksums attached.
Additional historical documents and the firm split:
- Hamburgischer Correspondent, Nr. 551, 25.11.1933: „15 Mitglieder der Strafrechtskommission“.
- Regge / Schubert (1988), Protokolle der Strafrechtskommission des Reichsjustizministeriums, Teil 1, S. XVI–XVII, XXVII. ISBN 3-11-011694-4.
- Gesetz über die Akademie für Deutsches Recht, 11.07.1934; RGBl. I, Nr. 78, S. 605 (§2).
- Gesetz zur Änderung des Strafgesetzbuchs, 28.06.1935; RGBl. I, Nr. 70, S. 839–843, insbesondere Artikel 1 und 6.
- United States Holocaust Memorial Museum: Gay Men under the Nazi Regime; Paragraph 175 and the Nazi Campaign against Homosexuality.
- Hans Frank / Rüdiger Graf von der Goltz: Nationalsozialistischer Ehrenschutz. Wien: Deutscher Rechts-Verlag, 1938. CiNii Books, BB17180010.
- Winston Taylor International LLP, letter of 2 June 2026, filed with the SEC as Exhibit 5.1: merger effective 1 June 2026.
- Bundesarchiv: Digitalisierte Bestände — R 61, Akademie für Deutsches Recht.
Independent digital forensics research group