# RAINBOW. REICHSTAG. BATON. The Three Pillars of Taylor Wessing: Fake Inclusivity, a Nazi Founder, and Violence as a Modus Operandi Publisher: PhishDestroy Author: Agent Ellis (Pseudonym) Language: English Canonical: https://phishdestroy.io/steam_dossier/taylor_wessing **PhishDestroy — an independent digital forensics research group** **Case Files: VAL24.D1000 | AR-2025-BAN-FORENSICS | PD-VALVE-2026/01** **Taylor Wessing / 1 June 2026 / the split** Taylor left with its centuries of English history. **Wessing remains. Shall we talk?** The UK-led practice now operates as Winston Taylor. The German origins remain the subject of this dossier. [Official announcement]()[SEC filing · 2 June 2026]() ## ⚖️ FORENSIC & HISTORICAL DISCLAIMER: READ BEFORE PROCEEDING ### Content warning: explicit and discriminatory language This dossier contains uncensored profanity, homophobic and nationality-based slurs, threats, and descriptions of Nazi persecution and violence. These appear in quoted case materials, screenshots and historical discussion. Please take this into account before proceeding. ### 1. Empirical Data vs. Legal Verdicts The terms "fabrication," "forgery," and "cover-up" used in this dossier are strictly forensic and mathematical conclusions. They are derived from chronological impossibilities, Shannon entropy calculations, and Jaccard index metrics. We compute probabilities; we do not hand down legal sentences. The final determination of whether these forensic anomalies constitute intentional fraud, professional negligence, or criminal forgery under the law remains the exclusive jurisdiction of the regulatory bodies, bar associations, and courts to which these materials have been submitted. ### 2. The Historical Record and the "English Illusion" The historical facts regarding the firm's origins presented here are based on currently available archival data and Wikipedia (which, at present, we accept as a baseline). However, there is a glaring, systemic omission: the main Wikipedia pages for Taylor Wessing artificially emphasize their "elite English roots" dating back to 1782, while almost completely erasing the true identity and actions of their German creator, Rüdiger Graf von der Goltz. It is crucial to note that this "English heritage" is no longer relevant. The UK, Dubai, Netherlands, Ireland, and Belgium offices are officially splitting from the firm. What remains is exactly what this dossier exposes: the German core. ### 3. Academic Escalation This dossier is just the foundation. We are currently finalizing **two formal academic papers** detailing these findings. Once they pass peer review and are published, we will officially assist the open-source community, Wikipedia editors, and international translators in permanently correcting the public record across all languages. The truth will be structured, cited, and inescapable. PhishDestroy is independent of both parties. We are not Source 1. We do not take money from anyone, ever. **We publish under our own name and take responsibility for our analysis.** We began examining this case in August. The documents led to three connected lines of inquiry: **the use of legal pressure against a data requester; the treatment of homophobic and nationality-based abuse in an official disclosure; and the Nazi record of the firm's German founder.** Each is set out below with the underlying records and sources. Professional reputation does not answer any of them. ## OUR SCOPE. TWO ORGANIZATIONS. NO CAMPAIGN FOR AN UNBAN. **Valve:** Platform conduct and the access response. **Taylor Wessing:** Professional conduct and document processing. Account reinstatement does not settle either line of inquiry. We have deliberately separated Valve from Taylor Wessing. Taylor Wessing did not have to become the subject of this dossier. The material could have stayed on Medium. We were using AI and large-scale data analysis to examine the Steam case and the falsehoods documented in that investigation when our review began flagging **danger markers** in the documents and correspondence themselves. Some of it looked so implausible that we began asking whether the documents were fake. The documents are official. The signatures in those files are not fake. ### Source 1's ban is not our objective **Source 1's ban is irrelevant to our objective.** We are not determining his guilt or innocence and do not ask anyone to determine it on our behalf. An unban, a settlement or any other change to his account would not alter this investigation. Source 1 has no authority to terminate it. We received official documents from him. Additional information may also have been supplied, but it is not the basis of this dossier. Our work does not depend on his interests or the recovery of his account. It concerns the handling of official documents, the statements made in them, the personal data they contain and the risks created by the process. We will assess a court decision or a comparably rigorous mathematical demonstration or refutation. A demand to stop publication does not answer the evidence. The letters' claims about German courts are examined in [When a paid representative speaks for the court](). ### Why the lawyers' letters matter to the Valve investigation The letters contain admissions and contradictions relevant to the neighbouring investigation into Valve, signed in the course of the lawyers' professional work. Our concern also recalls the old Steam terms provision, since removed, concerning permanent account termination when a user sought legal assistance. In this case we identify another contradiction: the lawyers' account places an alleged transfer or sale first in May and then in July. Yet the incomplete access log supplied in response to the GDPR request does not record the account access that would substantiate that story. This is one of the discrepancies we ask the responsible authorities to examine against the full records. ### Professional conduct, not private lives Our examination of the two doctors of law stops at their professional actions and the descriptions published on their firm's own website. We have no interest in their relatives, personal relationships or private lives. Investigating those things is not our style, and we do not consider them relevant to the professional assessment made here. - [Official profile: Dr. Tobias Schelinski]() - [Official profile: Dr. Patrick Vincent Zurheide]() ## PART I. PRESSURE, FABRICATION, DISCLOSURE ### A data-access request answered with accusations A Ukrainian user requested his personal data under Art. 15 GDPR. Taylor Wessing's response to his lawyer introduced allegations of account purchase, document falsification and criminal conduct. **The initiating act was a statutory access request.** The correspondence must be read in that context. **Dr. Tobias Schelinski, August 15, 2025 (Doc. No. 42282474):** the letter accuses the client of buying the account, refers to a "falsified utility bill", and describes it as "completely unclear" whose data is involved. It invokes **1,938 reports** as evidence against the user: "the sheer volume alone shows that the agreement was violated multiple times." The asserted volume is being used to establish culpability before the authenticity of those reports is addressed. [Source 11]() **Dr. Patrick Zurheide, October 1, 2025 (Doc. No. 42603633):** [Source 12]() > *"It must obviously be assumed that your client or his accomplices intend to continue phishing attacks in a disguised form and want to find out how to do so without getting caught."* > *"The account, like almost no other, provides numerous grounds for a block... In our experience, any court would deem the block lawful."* The letter concludes with the prospect of criminal prosecution under **§§ 263, 263a, 202a, 303a of the German Criminal Code** and asks whether "the lawyer's mandate also extends to criminal proceedings." Our assessment is that this correspondence uses the threat of prosecution, accusations and months of delay to exert pressure on a person seeking his data. The statutory request remains unanswered by any of those measures. Public excerpts / complete originals for regulators Public case materials are limited to screenshots. The complete, unedited original documents are reserved for the regulators: they contain personal data and evidence extending beyond this case. #### E01 / Letter heading · 15 August 2025 - [Dr. Tobias Schelinski · Doc. No. 42282474]() [Source 11]() #### E02 / Letter heading · 1 October 2025 - [Dr. Patrick Zurheide · Doc. No. 42603633]() [Source 12]() ### The disclosed sample: the basis of our fabrication finding The eventual disclosure visually concealed **94.28% of the content — 70,717 words** — "for the sake of third-party rights." Exactly **50 reports** remained visible and were presented as "proof" against the banned user. Exhibit B records three independent grounds for challenging that sample: [Source 13]() #### Exhibit B — Quantitative forensic audit | Measurement | Value | | --- | --- | | Content redacted | 94.28% / 70,717 words | | Content visible | 5.72% / 50 reports | | Shannon entropy: flagged names | 3.48 | | Shannon entropy: live names | 2.14 | | Jaccard index | 1.000 / 100% identical report texts | | Nicknames matching [adjective][noun][numbers] | 62% | | Joint probability reported in Exhibit B | approximately 10⁻¹⁵³ | - Shannon entropy: `H(X) = −Σᵢ pᵢ log₂(pᵢ)`, where pᵢ is the probability of symbol i. - Jaccard index: `J(A,B) = |A ∩ B| / |A ∪ B|` (intersection / union). - Joint probability: `P ≈ 10⁻¹⁵³`. [Exhibit B — Source 13]() - **Chronology.** The account was blocked on **May 23, 2025**. The visible reports are dated **August and September** and describe fresh invitations and phishing links. Our finding is that the activity alleged in those reports is incompatible with the account's blocked state. - **Nickname generation.** Our audit identifies **62%** of the visible complainants as synthetic names following `[adjective][noun][numbers]`, including *unhappyrat44132, eagerotter54677, crushedlard9764*. Reported Shannon entropy is **3.48**, against **2.14** for the live-name comparison. The audit rejects independent generation under its probability model, reporting a joint probability of approximately **10⁻¹⁵³**. - **Text identity.** The compared report texts are recorded as **100% identical**, with a **Jaccard index of 1.000**. This is the text-similarity result; the fabrication finding rests on its combination with the chronology and nickname analysis. The chronology [Exhibit B]() 23 MAY 2025 **Account blocked** AUG — SEP 2025 **Visible reports** The concealed material contains years of coordinated harassment directed at the user's Ukrainian nationality: *"hohol"*, *"Ukrainian Nazi"*, *"SVO SVO GOIDA ZOV ZOV"*, *"execute him"*. Cyrillic density reaches **61.58%** in the hidden material, against **0.32%** in the visible sample. Our conclusion is specific: **Taylor Wessing concealed the nationality-based harassment and retained the sample our audit identifies as a botnet.** The selection removed the context that explained the reports while preserving the material used to justify the ban. #### E03 / The nicknames in the document - [AR-2025-BAN-FORENSICS · chronology, entropy and text similarity]() | Nickname | Adjective | Noun | Numbers | | --- | --- | --- | --- | | unhappyrat44132 | unhappy | rat | 44132 | | eagerotter54677 | eager | otter | 54677 | | crushedlard9764 | crushed | lard | 9764 | [Source 13]() ### Failed redaction, notice and suppression of publication The PDF contained black rectangles over text that had never been deleted. **No intrusion was required to recover it.** The data travelled inside the file supplied by the firm. We identify this as professional negligence in the very process presented as protecting third parties. #### E04 / PDF redaction - [Complete supplied screenshot of the PDF with black rectangles]() - [Complete supplied screenshot with underlying account names visible]() [Source 12]() We notified the firm and Dr. Patrick Zurheide personally. He described the information about the exposure as **"amusing"**. Our record covers a year of notice without remediation. Separately, server records show access from Valve gateways on **October 21, 2025**, **February 16–17, 2026**, and **August 31, 2026**. Our case analysis links the October access to a request from the parents of one of the report authors; the access exhibit preserves the network observations and their limitations. Our allegation remains that neither the supervisory authority under Art. 33 GDPR nor the affected individuals under Art. 34 were notified. **The response to notice is part of the case.** [Source 14]() #### Exhibit PD-VALVE-2026/01 — complete record EXHIBIT — ACCESS BY VALVE CORPORATION TO THE DATA SUBJECT'S PUBLISHED MATERIAL Reference: PD-VALVE-2026/01 Prepared: 1 September 2026 #### 1. SUMMARY OF THE FINDING Web server records for the website operated by the data subject (the requester in the Article 15 matter described at paragraph 3.1AA of the referral) show FOUR separate access events, over a period of ten months, from three different hosts inside Valve Corporation's own network. Two of the three hosts geolocate to BELLEVUE, WASHINGTON - the city in which Valve Corporation maintains its principal place of business. All four events were over HTTPS. Together they account for 164 requests, 32 page views and approximately 26.3 MB of transferred data. #### 2. THE RECORDS Verbatim, as held in the analyser's database (VISITOR section). Fields in order: host; page views; total requests; bytes; timestamp of last request in YYYYMMDDHHMMSS form. ```text (a) 208.64.203.11 11 34 6322782 20251021165923 -> 21 October 2025, 16:59:23 ``` ```text (b) 208.64.203.19 11 65 9286619 20260216190806 -> 16 February 2026, 19:08:06 ``` ```text (c) 208.64.203.20 9 62 8586044 20260217112356 -> 17 February 2026, 11:23:56 ``` ```text (d) 208.64.203.20 1 3 2152328 20260831175904 -> 31 August 2026, 17:59:04 ``` Source files (AWStats 8.0 build 20240604, SSL log databases, generated by the hosting provider from raw web server logs): ```text awstats102025..txt, line 7315 awstats022026..txt, lines 17524 and 19100 awstats082026..txt, line 7162 ``` #### 3. ATTRIBUTION OF THE HOSTS Each address was resolved and checked against registry and routing data: ```text 208.64.203.11 reverse DNS gw.valvesoftware.com location Seattle, Washington, USA ``` ```text 208.64.203.19 reverse DNS gw19.valvesoftware.com location BELLEVUE, Washington, USA ``` ```text 208.64.203.20 reverse DNS gw20.valvesoftware.com location BELLEVUE, Washington, USA ``` ```text All three: Autonomous System AS32590 (VALVE-CORPORATION - Valve Corporation) Network name VALVE-V4-1 Registered org Valve Corporation (VC-2) Abuse/NOC contact noc@valvesoftware.com Announced prefix 208.64.203.0/24 ``` Each hostname sits within valvesoftware.com, Valve Corporation's own second-level domain. None of these addresses is a consumer internet service provider, a content delivery network, a cloud host, a VPN exit or a shared proxy. The address block is allocated directly to Valve Corporation and announced by Valve Corporation's own autonomous system. #### 4. METHOD The identification was not made by inspection or by assumption. (a) The complete set of IPv4 prefixes announced by AS32590 was obtained from RIPE NCC routing data (44 prefixes). (b) Every IP address appearing in the site's access records for the periods examined was compared programmatically against that set. (c) The comparison was then re-run across every surviving analyser database for the site, covering October 2025 to September 2026. Four records matched. They are the four set out at paragraph 2. All other addresses examined resolved to consumer ISPs, cloud providers, content delivery networks, search engine crawlers or unrelated hosting companies. Any recipient may verify the attribution independently, without reference to us: ```text host 208.64.203.19 whois 208.64.203.19 https://stat.ripe.net/data/prefix-overview/data.json?resource=208.64.203.19 ``` #### 5. CHRONOLOGY We set out the dates without comment as to what connects them. The sequence is a matter of record; any inference is for the authority. ```text 1 October 2025 Valve's external counsel transmits the Article 15 response containing the defective redaction (referral, paragraph 3.1AA) 21 October 2025 ACCESS (a) - 34 requests, 6.3 MB ``` ```text February 2026 Proceedings commenced against Valve Corporation by the Attorney General of the State of New York 16 February 2026 ACCESS (b) - 65 requests, 9.3 MB 17 February 2026 ACCESS (c) - 62 requests, 8.6 MB (consecutive days, from two different Valve gateways) ``` ```text 17-19 August 2026 Publication of the technical findings concerning the defective redaction 24 August 2026 Written notice served on Valve, seven-day period 31 August 2026 Period expires without response 31 August 2026 ACCESS (d), 17:59:04 - same day ``` #### 6. WHY THIS IS PLACED BEFORE THE AUTHORITY We assert nothing as to purpose and we draw no conclusion. We record what the logs show: that hosts inside Valve Corporation's own network requested material published by the data subject, on the dates recorded, in the volumes recorded, repeatedly, over ten months. Its relevance is to AWARENESS, which is the operative trigger under Article 33 and Article 34. The material published at that location concerned the defective redaction and the third-party personal data it exposed - the same data subjects who, to our knowledge, have never been notified. ON THE VOLUME. Access (b) is 65 requests across 11 page views; access (c) is 62 requests across 9. That is not a crawler retrieving a single document, and it is not an accidental arrival. It is consistent with sustained reading. We state this as an observation on the figures. We invite the authority to establish, from Valve's own records: (a) whether any person acting for Valve accessed that material on 21 October 2025, 16-17 February 2026, and 31 August 2026, in what capacity, and on whose instruction; (b) what internal assessment, if any, followed each access; (c) whether at any point after those dates the affected third parties were notified under Article 34; (d) whether the supervisory authority was notified under Article 33; (e) if not, on what basis the obligation was considered not to arise. These are questions only the authority can put. We supply the observation. The determination is not ours to make. #### 7. PRESERVATION AND LIMITATIONS The raw access logs for October 2025 and February 2026 have since been rotated by the hosting provider and are no longer retained. The analyser databases, generated from those logs and preserved separately, are the surviving record and are available to the authority in full. Because the analyser aggregates, the specific URLs requested during each access are not recoverable from the surviving record, and neither is the duration of each session. Valve's own outbound records for the same dates are not subject to that limitation. All source files, together with the routing data relied upon, are preserved and available to the authority through a protected channel. #### 8. INTEGRITY OF THE PRESERVED FILES The analyser databases were copied from the hosting account on 1 September 2026 and hashed at the point of copying. SHA-256: ```text 0704c0170e9e7ed103aec75af2feacd4a2584e0ae1da0cb88b68258630e4ff2c awstats102025.67a427a7...spacecharged.site.txt (contains record (a) - 21 October 2025) ``` ```text ef9cff2a423767aed192dd056177c86b0aaa0df1390994a5007a79c19b9a5722 awstats022026.67a427a7...spacecharged.site.txt (contains records (b) and (c) - 16 and 17 February 2026) ``` ```text 8bf0221608bdef2e84e523ff908aaaa46a299ae782e8f63b54773136c75b08f7 awstats082026.67a427a7...spacecharged.site.txt (contains record (d) - 31 August 2026) ``` Also preserved, from the second site configuration on the same account, for completeness of the record: ```text 7847f57203092b380a238c53303aa1fa650f325962679847851d69dc2ddbf889 awstats022026.a2a07414...spacecharged.site.txt 3a0f43e7ad9f7fcc2e435ff2bd2480de9e150184a3aa860495ec330ec1839fa5 awstats082026.a2a07414...spacecharged.site.txt ``` The authority may verify that any copy supplied to it is byte-identical to the file as held on the hosting account on the date of preservation. PhishDestroy - volunteer cybersecurity research group complains@phishdestroy.io | https://phishdestroy.io PGP 129F C7F3 9C40 C69D 2EF3 C329 BFCF 9E8D D295 EE01 After publication on Medium, Dr. Patrick did not dispute a single number. He invoked the **"right to be forgotten" under Art. 17 GDPR**, and our articles were removed from Google search results. The subject of those articles was his professional work for a billion-dollar client, a capacity expressly stated in the correspondence. We regard the use of data-protection law to suppress reporting about the data exposure as **an attempt to conceal the failure and obstruct independent security research**. Removal from search does not correct the PDF or answer the audit. ## PART II. HYPOCRISY: A RAINBOW OVER "PIDOR" Public commitments Stonewall · LGBTQ+ inclusion Taylor Wessing is a public LGBT champion. Three years in a row — **Stonewall Top 100**, top 10 in the legal sector. An interview with myGwork about "creative plans to advance LGBTQ+ inclusion." Posts for IDAHOBIT from the Head of Talent. The "Head of Responsible Business" talks about the importance of LGBTQ+ history. Dr. Patrick participates in briefings. [Source 9]() Now look at their document. Two months of claimed "manual review." An automated script painted over the reporter's login *zabolotov* — and "forgot" the adjacent column. In the materials prepared by an elite firm for a legal dispute, it explicitly states in plain text: Page 444 / understand the original wording ### What the first row says. - **Original entry:** pidor - **English equivalent:** faggot **A homophobic slur against gay men.** “Pidor” is the Latin-script form of the Russian “пидор”. The translation makes its meaning explicit; the screenshot preserves the original entry. #### E06 / Page 444 · first report row - [page 444 — zabolotov | Offensive Avatar | "pidor"]() [Source 13]() A homophobic slur. In an official document. From a firm that is a top employer according to Stonewall. The rainbow is marketing. "Pidor" is their operational reality. And no, this is not an "unfortunate accident." This homophobia has a pedigree. PhishDestroy / our assessment ### This is disrespect for the law. The issue goes beyond disrespect for an opponent. **It is disrespect for the law that gives that person a right to their data.** An allegation against the requester does not answer an access request. A lawyer's confidence about a future judgment does not discharge the present obligation. Corporate money does not make that obligation optional. [Our position and requested scrutiny]() ## PART III. NAZISM AT THE FOUNDATION OF THE FIRM The firm writes on its website that it **honors its history**. Wikipedia mentions the founder of the German branch with a single sterile line — "in 1954, Rüdiger Graf von der Goltz took Kurt Wessing as a partner" — and not a word about who Goltz was. That won't do. We are filling the gap using the archives. [Source 3]() [Source 10]() **Rüdiger Graf von der Goltz (1894–1976):** - **April 1, 1932:** voluntarily joined the NSDAP. Party member **No. 1,033,215** — before Hitler came to power. [Source 1]() [Source 2]() [Source 4]() [Source 5]() - Until 1933 — **lawyer for the Nazi elite**: defended **Joseph Goebbels** in a 1930 trial and SA stormtroopers in political murder cases. Goebbels in his diaries: *"Goltz ist Knorke. Er macht uns allen Spaß"* — "Goltz is great, he is fun for all of us." - **1933:** President of the Pomeranian Landtag; Reich Trustee of Labour; member of the **Prussian State Council** appointed personally by Göring; co-founder of Hans Frank's **Academy for German Law** — the entity that rewrote German law to fit Nazi ideology. - **1936–1943:** **Reichstag Deputy** for the NSDAP. Member of the **Criminal Law Commission under the Reich Ministry of Justice** — the very machine that legally formalized repressions, including the persecution of homosexuals under Paragraph 175, which sent men to concentration camps with a pink triangle. - **1938, the Blomberg-Fritsch affair.** Goltz defended General von Fritsch against a fabricated charge of homosexuality. He won — by proving that the "real" homosexual was **another officer, Achim von Frisch**. Goltz didn't challenge the cannibalistic law. He pointed the executioners to another person. [Source 6]() - **Post-war:** zero consequences. A practice in Düsseldorf. 1954 — partner Kurt Wessing. For decades, the firm bore his name: *Graf von der Goltz, Wessing & Partner*. His son later chaired the supervisory board of BMW. The system took care of its own. E07 / Archival document 1938 [Original 1938 handbook entry for Rüdiger Graf von der Goltz, describing his legal work and Reichstag membership]() Biographical entry, cropped from the original page. Bayerische Staatsbibliothek · printed p. 223 / scan 224. Bavarian State Library ### The name. The record. Rüdiger Graf von der Goltz *Der Großdeutsche Reichstag*, 1938. - **Collection:** Reichstag handbooks - **Catalogue ID:** bsb00000146 - **Call number:** BA/Z 36.609-1938 [Open the library record]() [Full-resolution scan]() ### Six documents. The full folder. #### 00001 · 11 July 1934 **Deutsche Allgemeine Zeitung (Berlin)** · No. 318 Keßler als Führer der Wirtschaft abberufen [Complete archival scan]() · [ZBW record]() #### 00002 · 12 July 1934 **Hamburger Tageblatt** · No. 190 Der neue Wirtschaftsführer [Complete archival scan]() · [ZBW record]() #### 00003 · 13 July 1934 **Deutsche Bergwerks-Zeitung (Düsseldorf)** · No. 160 Nach der Abberufung Keßlers [Complete archival scan]() · [ZBW record]() #### 00004 · 10 November 1934 **Deutscher Reichsanzeiger und Preußischer Staatsanzeiger (Berlin)** · No. 264 Verbandsauflösung und Preiskontrolle. [Complete archival scan]() · [ZBW record]() #### 00005 · 16 November 1934 **Frankfurter Zeitung (Frankfurt a. M.)** · No. 584 Aufruf des Führers der Wirtschaft zum Winterhilfswerk. [Complete archival scan]() · [ZBW record]() #### 00006 · 5 December 1934 **Völkischer Beobachter (Berlin)** · No. 339 Graf von der Goltz verabschiedet sich [Complete archival scan]() · [ZBW record]() Provided by ZBW — Leibniz Information Centre for Economics / Hamburgisches Welt-Wirtschafts-Archiv. Dates, publication names and issue numbers are transcribed from the archival sheets. [Open all six in the ZBW viewer]() · [Archive rights statement]() - [02 / Press archive ZBW · Rüdiger von der Goltz Six digitised documents]() - [03 / Archival collection Bundesarchiv · N 1548 Personal papers · catalogue]() - [04 / Biographical directory Deutsches Führerlexikon 1934–1935 · page 151]() - [05 / Collection reference Bundesarchiv · N 1548 Public archival inventory]() Further archival evidence / 1933–1938 ### The appointment. The mandate. The printed law. The record extends beyond a biographical entry. A contemporary newspaper names von der Goltz's appointment; the published commission records identify his political role; the official gazette states the institutions' mandate and the criminal provisions used by the regime. #### A named representative of the party. The scholarly edition of the commission's records identifies von der Goltz as the NSDAP representative during the later deliberations. It also records his introductory contribution to the 1936 publication *Das neue Strafrecht*, alongside Gürtner and Freisler, and his presentation on protection of honour in the proposed criminal law. The references are precise: **printed pages XVI–XVII; biography on XXVII.** [Source 16]() A separate library catalogue records *Nationalsozialistischer Ehrenschutz*, published in Vienna in 1938, under the names **Hans Frank and Rüdiger Graf von der Goltz**. The title, authors and edition can be checked independently. [Source 20]() ### Four pages from the record. #### H01 / Von der Goltz joins the commission. Hamburgischer Correspondent · 25 November 1933 · front page The report dated 24 November names von der Goltz among the new appointments to the Reich Ministry of Justice's criminal-law commission. The following day's newspaper supplies a contemporary record. [Source 15]() Article crop · full newspaper page available [Complete original page]() · [Archive record]() #### H02 / The Academy's statutory mission. Law of 11 July 1934 · RGBl. I, p. 605 Section 2 assigns the Academy the implementation of the National Socialist programme throughout the field of law, in continuing cooperation with the bodies responsible for legislation. [Source 17]() Official gazette · complete page 605 [Complete original page]() · [Archive record]() #### H03 / Punishment beyond an express prohibition. Law of 28 June 1935 · RGBl. I, p. 839 · Article 1 The rewritten §2 permits punishment by analogy, invoking the underlying idea of a criminal statute and “gesundes Volksempfinden”. The provision is printed on the opening page of the same amendment that tightened §175. [Source 18]() Official gazette · complete page 839 [Complete original page]() · [Archive record]() #### H04 / The text used to persecute men. Law of 28 June 1935 · RGBl. I, p. 841 · Article 6 Article 6 prints the revised §175 and the added §175a. The revision expanded criminalisation of sexual acts between men; §175a prescribed up to ten years in a penitentiary for the categories it listed. [Source 18]() Official gazette · complete page 841 [Complete original page]() · [Archive record]() Newspaper: original and digitisation by Staats- und Universitätsbibliothek Hamburg, issue 551, 25 November 1933, front page; collection reference PPN689065124_19331125. Legal gazette: ÖNB / ALEX, reproduced through Wikimedia Commons. The newspaper preview is an identified crop; each full page remains available. The human consequences / documented by the US Holocaust Memorial Museum #### The law reached into people's lives. The 1935 revision broadened the acts punishable under §175. The US Holocaust Memorial Museum documents the case of **Friedrich-Paul von Groszheim**: imprisonment in 1937, renewed arrest and torture in 1938, and release made conditional on submission to castration. This is the human reality behind the printed provisions. [Source 19]() [USHMM · the law and the persecution]() Continue the archival research The Bundesarchiv lists **R 61 — Akademie für Deutsches Recht** among its digitised holdings. It provides a further route into the institution's files, alongside the personal papers already linked in this dossier. [Source 22]() [Bundesarchiv · digitised collections]() And now the irony for which we simply must be published: the "elite English history" that the firm flaunted (a branch dating back to 1782) **has split from them**. The UK, Dubai, the Netherlands, Ireland, and Belgium are leaving the structure and, as of June 1, 2026, will operate under the brand **Winston Taylor** — an official notice hangs on their website. What remains is exactly what this dossier is about: the German core with its roots. Their ancestors. They can take their time — we will finish our academic work and help the Wikipedia community and the whole world not to make a mistake. How does their Wikipedia get by without an extensive section on the CREATOR? [Source 10]() #### The Wikipedia Initiative ### A call to the Wikipedia community > "The German Wikipedia page for **Taylor Wessing** ([link]()) mentions their creation in 1954 by 'Graf von der Goltz' but completely sanitizes who he was. We urge editors to cross-reference his official historical profile ([Rüdiger von der Goltz (Jurist)]()) — a member of the Nazi Criminal Law Commission and Reichstag Deputy — and integrate this into the firm's history. A top Stonewall firm cannot hide its foundation in the machinery of Paragraph 175." - [01 / DE Rüdiger von der Goltz (Jurist)]() - [02 / EN Rüdiger Graf von der Goltz (lawyer)]() - [03 / DE Taylor Wessing · Geschichte]() - [04 / EN Blomberg–Fritsch affair]() - [05 / DE Blomberg-Fritsch-Krise]() - [06 / ARCHIVE Reichstags-Handbuch 1938 · p. 223]() ## CHAPTER. ROW NO. 1 ### Pidor Comes First Out of **2,002 reports**, Taylor Wessing selected exactly **50** to display. The first visible row is reproduced below: #### E08 / Row No. 1 - [page 444 — row No. 1: zabolotov | 2025-09 | Offensive Avatar | "pidor"]() [Source 13]() **First.** A homophobic slur is the calling card of their "evidence base". Two months of claimed "manual review" — and they missed row No. 1. Now look at the end of the cover letter that accompanied this attachment: *"Dieses Schreiben ist qualifiziert elektronisch signiert"* — a **qualified electronic signature**. Dr. Patrick Zurheide didn't "overlook" the document. He **signed** it. Under "pidor" lies the signature of a Doctor of Law from a Stonewall Top 100 firm. [Source 12]() #### E09 / The accompanying letter - [Doc. No. 42603633 · accompanying cover letter]() [Source 12]() ### What Their Founder Created: The Law of Pink Triangles Voting in the Reichstag from 1936 to 1943 was a ritual — they didn't "adopt" anything there, they rubber-stamped. The real work of Rüdiger Graf von der Goltz took place elsewhere: he was a **member of the Criminal Law Commission under the Reich Ministry of Justice** and a **co-founder of Hans Frank's Academy for German Law** — the bodies that wrote and legitimized the criminal law of the Third Reich. [Source 1]() [Source 2]() [Source 5]() The jurisdiction of this machine included **Paragraph 175** in its 1935 Nazi revision. The result of this machine's work is well known: around 100,000 arrests, tens of thousands of convictions, thousands of men in concentration camps — with a **pink triangle** on their robes, at the very bottom of the camp hierarchy, with a monstrous mortality rate. He sat on the commission that wrote this norm, and in the academy that justified it. The [1938 Blomberg-Fritsch affair]() shows how he used that system: another's life as a fee. [Source 6]() That is why row No. 1 with the word "pidor" under their doctor's signature is not irony. It is continuity. ### The Erased Russian Trace Now the main point: what exactly did they erase to put this row first? In the hidden 94.28% of the document lies organic reality. Russian-language harassment of a Ukrainian, spanning years, with death wishes. Verbatim from the hidden part of the logs: - *"SVO SVO GOIDA ZOV ZOV ZOV SLAVA ROSSII HOHLI PIDORASI"* (May 14, 2025) - *"Execute the hohol svo zov goida"* (May 5, 2025) - *"He is Ukrainian Naci"* (May 7, 2025) - *"GOOOOOOOOOL HOHLIIIIIIIII GOIDAAAAAAA"* (November 29, 2024) Hundreds of such reports. Cyrillic, politics, hatred for the nationality of the account owner. **Taylor Wessing painted over all of this** — under the slogan of "protecting third parties." The language behind the redactions ### Most of the hidden reports were not in English. By PhishDestroy's current estimate, **approximately 64% of the redacted reports are in languages other than English.** The concealed material must be read in its own languages to understand the harassment and the context removed from the visible selection. The unit here is reports. The separate 61.58% figure measures Cyrillic-character density in the concealed material. [Read the extracted examples]() · [Exhibit B · source record]() #### E10 / The erased Russian trace - [Exhibit B · dated report excerpts]() [Source 13]() And in the visible spot, they placed 50 reports in **sterile, calibrated English**: *"Got a sketchy invite from this account"*, *"It's acting like a phishing account"*, *"This account is clearly compromised"*. The [chronology and nickname analysis]() establish why our audit identifies this visible sample as fabricated. A qualified electronic signature does not negate arithmetic. And it doesn't negate the history of the firm, which 90 years ago learned to do exactly this: erase inconvenient people from documents and substitute them with others. ## CHAPTER. PROFESSIONAL CONDUCT AND INSTITUTIONAL CONTROL ### The Tribunal, the Mahiki Club, and £30,000 The record extends beyond this disclosure. It includes a published **Solicitors Disciplinary Tribunal (SDT)** decision and separately identified reporting in the legal press. **Daniel Hutchings**, a solicitor in Taylor Wessing's London office, attended the annual **Society of Construction Law** lunch and then the **Mahiki nightclub in Mayfair**. The case materials describe **"inappropriate, unwanted, and sexually motivated comments"** to a female lawyer, lewd remarks about her body and **touching her waist without consent**. Three episodes resulted in a **£30,000 fine and an order to pay costs**. This is a disciplinary outcome that must be considered alongside the firm's public commitments on professional conduct and inclusion. [Source 7]() #### E11 / Published tribunal judgment - [Findings and sanction · page 2]() - [Statement of Full Order · page 19]() [Source 7]() Separately, **RollOnFriday** published discussion of a Taylor Wessing **"Head of Department"** who reportedly **"hooked up with a trainee"**. That item concerns a reported rumour; the Hutchings matter is a tribunal decision. Both remain identified in the source record. They raise distinct questions about workplace hierarchy, supervision and the credibility of the firm's public standards. [Source 8]() ### The use of professional authority against a data requester A firm charging hundreds of euros an hour asks whether **"your lawyer takes on criminal cases."** The [letters reproduced in Part I]() show how that authority was exercised. The signed correspondence characterizes the opponent as a phisher, blackmailer and forger without supplying the evidence necessary to establish those accusations. **The question is which internal controls authorize the use of such claims in a response to a statutory request.** The professional document itself supplies the basis for examination. ### Our assessment: the operating model is unsafe We regard the combination of fabricated evidence, threats, defective data protection and suppression of reporting as an institutional safety failure. **Professional language and an established brand do not reduce the gravity of the conduct documented here.** **These matters warrant an institutional investigation.** The firm handles personal data belonging to thousands of third parties through GDPR processes. The adequacy of its supervision, release controls and response to reported failures therefore affects people far beyond this account dispute. ## THE LINK: ONE PATTERN, 90 YEARS Look at how perfectly their entire history aligns. The method hasn't changed. Only the signboard has changed. Look at the complete pattern: | 1932–1945 | 2025–2026 | | --- | --- | | Legal servicing of a repressive machine | Legal servicing of a billion-dollar client at any cost | | Forgery and procedural games (the Fritsch case) | Fabrication: 50 post-ban botnet reports instead of 1,954 real ones | | Working within the machine that persecuted gays (§175) | "Pidor" in an official document under a Stonewall rainbow flag | | Protecting the powerful, destroying the weak | Covering up the harassment of a Ukrainian, threatening his lawyer, and harassment in the City | | Impunity after 1945 | A year of silence over a leak + the "right to be forgotten" against journalists | Then — the uniform of the Reichstag and servicing the system. Now — a suit in the Hamburg/London office, threats under §§ of the Criminal Code, and absolute certainty of impunity. ## CHAPTER. PROFESSIONAL AUTHORITY IS SUBJECT TO REVIEW A doctoral title, a letterhead listing offices from Amsterdam to Shanghai and a billion-dollar client establish the professional capacity in which a lawyer acts. They do not turn that lawyer's assessment into a judicial finding, a threat into a verdict, or a black rectangle into deletion of the text beneath it. ### The evidential basis for the forgery finding The evidential grounds for our finding are set out in the [chronology, nickname and text-identity analysis](), supported by Exhibit B. [Source 13]() Our examination, conducted according to **ISO/IEC 27037 and 27042**, concludes that the evidence is fabricated on the combined grounds of chronology, probability and stylometry. A substantive response must identify an error in the records, the method or the calculation and demonstrate its effect on that conclusion. **A professional title does not constitute a rebuttal.** ### Notice makes the failure an institutional responsibility We notified both Dr. Patrick and the firm. **A year has passed.** Our record identifies the following failures by Taylor Wessing during that period: - did not correct the negligent redaction of third-party personal data — the black rectangles remained black rectangles; - did not recall or verify the fabricated sample of 50 "reports" submitted to the legal process; - did not inform the regulator of the data leak (Art. 33 GDPR) or notify the affected third parties (Art. 34 GDPR); - did not conduct an internal investigation — but found the time to file a request with Google to remove our articles. **Continued inaction after institutional notice is itself an institutional act.** Responsibility can no longer be confined to the original preparer or signatory. ### A common brand requires accountable supervision Taylor Wessing describes its structure as **"Decentralised"**. National offices and partners nevertheless provide services under a common professional brand. That structure must be capable of identifying who controls a disclosure, who reviews it, who receives notice of a defect and who requires corrective action. Referring the matter back to an individual partner does not answer a failure reported to the firm itself. Our assessment is that an organization which knows of these actions for a year and leaves them uncorrected **ratifies them through inaction**. Every partner receiving a share of the firm's profits since **October 1, 2025**, benefits from the continuing operation of that institution. Our criticism therefore extends to its governance and supervision, not only the signature on one letter. ### When a paid representative speaks for the court The correspondence raises a question of public authority: **what form of justice are its authors asking the requester to accept?** The statement that “any court would deem the block lawful” presents the corporate client's preferred outcome as the settled answer of courts that have not examined the record. The author writes as a paid representative of that client. **On what authority does he speak for the court?** We regard that posture as an attempt to replace independent scrutiny with corporate authority. Four concepts describe the institutional danger at issue: **1. Corporatocracy.** Corporate power displacing public decision-making. The danger is that law, legal procedure and judicial authority become instruments for securing a corporation's desired outcome, while the person asserting a statutory right is treated as an obstacle to remove. **2. Privatized or commercial justice.** Adjudication treated as a service purchased by an interested party. A corporation pays its advocate to represent it; that mandate supplies no authority to pronounce an independent verdict on the corporation's own conduct. Presenting advocacy as the predetermined judgment of every court collapses the distinction on which an impartial process depends. **3. Plutocracy.** Political power concentrated through wealth. The corresponding danger in legal practice is that money purchases the appearance of certainty and authority: the corporation can afford threats, prolonged correspondence and assertions of inevitable victory, while the requester is expected to abandon a right that the law grants him. **4. Kleptocracy and institutional corruption.** Kleptocracy describes power used for private enrichment; institutional corruption concerns the diversion of an institution from its public duties toward private interests. The conflict examined here is concrete: a corporation's paid representative defends the handling of data, asserts the expected judicial outcome and participates in the response to reporting about that same handling. Our allegation of concealment makes independent scrutiny of that conflict essential. **A corporate mandate is not a judicial mandate.** The signed assertion about what courts will decide belongs in the referral alongside the threats of prosecution, the selected reports, the defective redaction and the response after notice. Professional status increases the responsibility attached to those statements. It supplies no immunity from examination. This is a formal, documented escalation. Intimidation, delay or a change to Source 1's account will not terminate it. **We will pursue an answer for each signed assertion and each decision documented in this dossier through the competent authorities.** ### The competent authorities have the final determination German lawyers are subject to **BRAO (Federal Lawyers' Act)**, **BORA (Professional Code of Conduct)** and the duty not to mislead the court or the proceedings. Our forensic report is addressed to the **Hanseatic Bar Association of Hamburg** and the data-protection supervisory authorities. The firm's assertions about what a court would decide do not displace those bodies' authority. The competent bodies determine the legal consequences of forgery, concealment and negligence. We supply the documents, the calculations and the questions requiring an answer. Our conclusion remains explicit: > **Mathematics gives us the full right to call their forgery a forgery.** **A year of the firm's inaction gives us the full right to call it a corporate forgery.** **We consider these methods unacceptable and dangerous.** The referral requests scrutiny of the firm's conduct as a paid corporate representative: the signed statements, the handling of the evidence and the response after notice. ## PROFESSIONAL RESPONSIBILITY DOES NOT END AT THE SIGNATURE ### Their own professional record Taylor Wessing presents these lawyers in the context of technology law, data protection and corporate work. Its official profile for Dr. Tobias Schelinski also records teaching positions: | Period | Institution | | --- | --- | | Since 2010 | Hochschule für Angewandte Wissenschaften, Hamburg | | 2011–2013 | Heinrich Heine University, Düsseldorf | | Since 2017 | Nordakademie, Hamburg/Elmshorn | The teaching appointments above belong to **Dr. Tobias Schelinski**. They are listed on his [official English-language profile](). Dr. Patrick Vincent Zurheide's [separate official profile]() describes his technology, software and data-protection practice. Our first Medium article included a comment acknowledging that we had not considered the lawyers' teaching roles. We left that correction visible. An error in our own work must remain traceable. **We require the same accountability for the errors identified in the firm's documents.** The [claim about what any court would decide]() also concerns us in the context of those teaching roles. We take those words seriously. We do not dismiss them as casual email rhetoric or an empty bluff. In our assessment, claims made under a professional title and an electronic signature warrant a professional response and independent oversight. ### 01 / Duty of care — Sorgfaltspflicht Document sanitization requires the sensitive content to be removed from the released file. An opaque shape above it leaves the information extractable. For doctors of law entrusted with personal data and acting in their stated field of expertise, **we regard this failure as gross negligence — grobe Fahrlässigkeit**. The required check was basic; the consequences concern other people's data. ### 02 / Security of processing — Article 32 GDPR Article 32 requires security measures appropriate to the risk. The [released PDF]() retained third parties' personal data inside the file delivered to the requester. Our criticism concerns the actual handling of the data, not the appearance of a privacy notice or a statement of compliance on a website. [GDPR, Articles 32–34]() ### 03 / The claimed review and the QA failure The correspondence describes two months of manual preparation, including the phrase *“manuell die Daten bereinigt werden mussten”*. A selection or extraction check would have exposed the retained text. **Our conclusion is that the claimed review did not provide the quality control the document required.** ### 04 / Notice, silence and the cover-up allegation Article 33 requires notification of a notifiable personal-data breach without undue delay and, where feasible, within 72 hours of awareness; it contains an exception where risk to individuals is unlikely. Article 34 concerns communication to affected people where a breach is likely to result in a high risk, subject to its stated exceptions. Our position is that the handling of this exposure requires scrutiny against those duties. [Official GDPR text]() ### The missing records extend beyond a consumer account The disclosed material is incomplete; the correspondence itself acknowledges limits to what was supplied. Our minimum estimate is that **at least 35,000 pages are missing**, even before additional telemetry referred to by the lawyers and records of staff access to the user's data are considered. The account holder was also a verified Steamworks participant. His relationship with Valve therefore extended beyond that of an ordinary platform customer. The disclosed PDF does not include the tax-status and verification documents he says he provided to become eligible to publish games, nor the relevant records surrounding the **$100** submission payment. Whatever the legal characterization of that payment in the United States, it does not answer the access question: what information was collected, what remains stored, who accessed it, and why was it absent from the response? Instead, the user received an 830-page disclosure with 94.28% of its content visually covered, while the material singled out as evidence remained visible. We also ask whether this was the first request of its kind to reach an actual disclosure instead of ending in withdrawal or rejection. The [wider workflow review]() addresses that question. ## FROM A PDF FAILURE TO A WIDER CORPORATE RISK ### A 2020 document engine in a 2026 investigation The PDF producer identified in our examination is **Aspose.PDF for .NET 20.8**, an August 2020 release. The release number follows the year-and-month convention: 20 for 2020, 8 for August. The vendor publishes both the [20.8 release notes]() and the [26.9 release notes](), providing the comparison cited here. The PDF has no evaluation watermark. Our working explanation is the use of a commercial licence and a retained older build; we are not alleging that the firm used a crack or pirated software. Aspose's perpetual licensing model allows continued use of eligible versions after an update subscription ends. A lawful licence and an up-to-date processing environment are separate questions. The exact licence purchase and renewal dates are not established by the output file. [Aspose licensing]() · [Vendor explanation of renewal and perpetual use]() The firm advertises expertise in IT, data and cyber matters, including work for technology and financial businesses. Those representations make the processing failure directly relevant to its professional competence. A privacy notice describes an obligation; **the system that handles the data must implement it.** ### What the scenario illustrates **We are modelling a risk, not reporting a successful intrusion.** The scenario follows attacker-controlled content into a document converter and traces the consequences of successful parser exploitation. The supplied screenshots document the redaction failure and producer metadata; the diagram models the wider attack sequence. The model begins with a document-production workflow that accepts profile descriptions, account names, report text and messages. The attacker places crafted content in a field carried into the data export. The access request moves that content through collection to the document worker. In the modelled vulnerable workflow, the converter processes the embedded structure and reaches the parser flaw. ### Three different risk paths **External resource loading / SSRF.** The SSRF branch models a converter that resolves a user-supplied resource address and permits requests to internal destinations. The request originates inside the processing environment and reaches services exposed to that worker. Cloud metadata is one sensitive destination; destination restrictions, metadata protections and network segmentation are the controls that protect it. **Parser memory corruption / RCE.** In the RCE scenario, crafted document content reaches a vulnerable parser and triggers a memory-safety flaw. Successful exploitation gives the attacker code execution inside the document worker. [The resulting foothold and its consequences]() are examined below. **External stylesheet or linked resource.** In the external-resource branch, the converter fetches a remote stylesheet or linked object controlled by the attacker. The request exposes its outward-facing address and processing time to the resource operator. The downloaded content enters the next parsing stage, making resource policy and parser maintenance part of the same processing boundary. #### From input to foothold. [Conceptual risk diagram]() Five stages: untrusted content, data collection, document processing, exploitation of a reachable flaw, and code execution in the worker. The final stage exposes accessible files, credentials and internal services. This is a conceptual attack scenario. 1. **Untrusted content** — Profiles · reports · messages. 2. **Data export** — Request assembles the records. 3. **Document worker** — Parsing · conversion · export. 4. **Reachable parser flaw** — Affected build + crafted input. 5. **Worker-level execution** — Within the process permissions. Controls that interrupt the attack chain: - Encode untrusted text - Restrict outbound requests - Patch reachable parsers - Isolate each job - Limit worker permissions The scenario assumes a reachable vulnerability in the worker. Successful exploitation establishes the first foothold; the attacker then targets accessible data, credentials and routes deeper into the network. ### The historical CVEs and their exact scope Cisco Talos documented **CVE-2019-5042** and **CVE-2019-5066** as memory-safety vulnerabilities in **Aspose.PDF for C++ 19.2**. The first concerns FunctionType 0 PDF elements; the second concerns LZW-compressed streams. Both reports describe potential remote code execution and record a vendor patch on **16 September 2019**. Assessing the .NET 20.8 workflow requires identifying the deployed components, their builds and the parsing paths reachable from user-controlled content. [TALOS-2019-0809 / CVE-2019-5042]() · [TALOS-2019-0855 / CVE-2019-5066]() ### A foothold is the beginning of the intrusion Once code execution has been obtained, the attacker acts with the worker's identity and access. Other GDPR exports, confidential client material, service credentials and internal resources exposed to that identity become immediate targets. The next phase is reconnaissance and expansion: identifying additional systems, abusing accessible credentials and seeking greater privileges. The initial process permissions define the first foothold. Containment and removal are urgent because an attacker who retains that foothold has time to search for routes deeper into the infrastructure. Data theft, lateral movement and the sale of access to ransomware operators are the downstream risks examined here. A document can appear ordinary to the person signing the accompanying letter while its automated processing has already crossed a trust boundary. That is why a qualified signature, a costly commercial library and reassuring language about manual review do not substitute for secure input handling and isolation. ### Why notice cannot be treated as a one-client problem We told the firm that we had grounds to suspect the redaction failure was not an isolated incident. Our hypothesis concerns repeated processing of a particular format of user data, rather than every file for every client. An old producer version raises questions about maintenance; the failed redaction raises a separate, directly observable question about how the release process was designed and checked. Our working conclusion is that the risk belongs to a repeatable corporate process. The investigation therefore extends beyond Dr. Patrick Zurheide to the personnel, scripts, review controls and disclosures that used the same processing route. A defect in that route calls for examination of every disclosure produced through it. The review must trace the entire request population: replies released, requests delayed, requests abandoned after threats or accusations, and data never supplied. This case raises the question of how many requesters were deterred before reaching the disclosure stage at which the defect became visible. This is also why notice to the firm matters. Our allegation is that Taylor Wessing and its client concealed the known exposure while leaving the wider scope unexplained. The responsible authorities must establish who knew, who had the authority to stop the process, which other disclosures were affected and what was done after notice. Responsibility follows the workflow and the decisions made about it. ## OUR POSITION. A RIGHT IS NOT A CORPORATE FAVOUR. PhishDestroy / public position and call for scrutiny **We are not asking for an account to be restored. We are asking for a process to be examined.** A corporation's budget, a law firm's reputation and a lawyer's academic title do not answer the questions in these documents. ### We did not enter this as a party. We will not walk away as observers. What makes this situation unusual is our independence from the original dispute. We did not arrive to represent Source 1. We arrived at documents whose contents, signatures and handling demanded examination. What we found has made neutrality about the conduct impossible. Our assessment is explicit: **intimidation, delay, arrogance, incompetence and failure to comply with the law.** The letters, the defective redaction, the notifications and the response are the basis of that assessment. We regard the concealment of this exposure, and Dr. Patrick Zurheide's use of the right to be forgotten against reporting about it, as part of the same accountability problem. There is little we can add to the language of the letters themselves. Read them. Compare what they say about the requester, the courts and the firm's diligence with what the delivered PDF contains. > Suspicion is not a licence to cancel someone's data rights. A lawyer's prediction is not a court judgment. A black rectangle is not deletion. A company cannot create a blanket exemption from Article 15 by declaring that the requester is a fraudster, a rule-breaker or a criminal. Access rights are not a reward for being a customer the company approves of. The EDPB's access guidelines address this directly: the controller should not assess the requester's intentions or refuse access merely because the data may be used in a dispute. [EDPB Guidelines 01/2022 · right of access]() ### Three branches. Separate responsibility. 1. **Valve and Steam.** The platform's statements, the data it holds and the material relevant to the parallel Steam investigation. The PDF supplied the evidence needed for that branch. 2. **Taylor Wessing and the signatories.** The letters, the processing of documents, the redactions, the response to notification and the professional conduct of the people whose signatures appear on the documents. Valve cannot answer these questions in their place. 3. **The wider handling of GDPR requests.** The methods used in neighbouring matters, the people affected beyond this account and the systemic questions being developed in our two academic papers. Resolving the account dispute does not resolve the second or third branch. Source 1 cannot settle them on our behalf. We are seeking honesty, examination and accountability. This work cannot be disposed of as a private negotiation over one customer's ban. ### What, exactly, is being taught? Dr. Tobias Schelinski's published teaching appointments make the professional question broader than one letter. What are future practitioners being taught about a corporation's obligations to an individual exercising a statutory right? What does it mean when corporate counsel writes as though the outcome in any court is already known? We ask universities and the legal profession to examine those questions against **Doc. No. 42282474 and Doc. No. 42603633**, not against the prestige of a title. We also ask the public, human-rights advocates and LGBTQ+ readers to examine the first visible report row. Could Dr. Patrick Zurheide fail to notice or understand that slur after the claimed two months of manual processing? Was leaving it visible a failure of review or a deliberate choice? His response found room for allegations and predictions. Where is the complete answer to the request for data? Our historical chapter and the present documents are available for readers to consider together. ### The scope of the review must extend beyond this file. This is not merely one case. In our reading, the correspondence and the choices made in the disclosure fit the historical pattern discussed above with disturbing precision. Compare what was hidden with what was left visible. Our position will not become softer because those comparisons are uncomfortable. This is a question about the practical value of the GDPR when a corporation pays someone else to handle a request. How many requests processed by Taylor Wessing were answered completely and lawfully? How many were returned 94% blacked out, as in the case documented here? How many were prolonged until the requester no longer had the time, resources or energy to continue? Were threats or accusations used in neighbouring matters? **The size of either company is irrelevant to those questions.** In our view, the service revealed here amounts to withholding data under the cover of professional authority. If corporations consider access rights commercially inconvenient, they should say openly that they want the law changed. They do not get to privately replace it with a paid prediction of what a court will do. We call for a review of other PDFs produced through the same process, the handling of related access requests, the instructions given to those preparing the files, and the decisions taken after notification. We advised the firm to examine its PDFs. Whether that review happened, what it found and whom it notified are questions the firm must answer. The boundary of our own evidence is precisely where an authority's power to inspect becomes necessary. Beyond this file / a question for the regulator ### If the same words appear in other files, examine the process. If a regulator finds similarly retained homophobic slurs in neighbouring disclosures, we ask it to establish **who prepared those files, who reviewed them and who authorised their release.** Were the same methods used? Were the same assurances of manual review given? What happened after the problem was reported? 1. **Selection.** Compare the language concealed with the language left visible. 2. **Approval.** Trace the review, the sign-off and the instructions behind them. 3. **Response.** Establish what changed after notification, and in which other matters. We are not asking a German authority to import a binding common-law precedent. We are asking it to compare documented conduct. A comparable case can expose the same self-assurance and passive aggression and identify questions that require answers. **The demand is an examination of the evidence and the process.** Requested scrutiny / three institutional routes - **Data protection supervision:** completeness and timing of access responses, security of the supplied documents, the handling of notifications and the scope of the affected processing. - **Professional oversight:** the conduct of the lawyers, the assertions in their signed correspondence and the supervision of document preparation. - **Prosecutorial review:** examination of the original evidence wherever it gives the competent prosecutor grounds to investigate. If German prosecutors, the bar or the relevant supervisory authorities see no reason to examine the wider process, we will put the systemic question before the **European Data Protection Board and the European Commission**. Our academic work is not an exit from this case. It is the next stage. We are preparing two papers. Once that work is complete, we will pursue the questions they document through the appropriate institutional channels. We will not abandon this matter. ### A direct question for the firm's insurer. The Valve matter warrants examination by Taylor Wessing's professional indemnity insurer. Our position is that the record cannot be reduced to an unknown, isolated mishap. The delivery method, our notifications, the reply and the dated accesses from the client's network belong in that examination. The access records and their preservation limits are set out in [Exhibit PD-VALVE-2026/01](). No break-in was needed to reach the text under the rectangles. The sender supplied the text inside the document. We describe that mechanism as professional negligence: an exposure created during the preparation and delivery of the file itself. The insurer should examine when the risk became known, what was done about it and whether other matters used the same process. ### Germany's data-protection history makes the question sharper. Germany's experience of surveillance under the Gestapo and the Stasi is part of the historical background to its insistence on privacy and limits on institutional power. Hesse adopted the world's first data-protection law in 1970. That history should make an individual's right to obtain their data a serious obligation, not an obstacle to be exhausted through correspondence. [Hessian data protection authority · history]() · [Data protection authority of Baden-Württemberg · historical context]() We once imagined the distinction to be straightforward: lawyers might defend people whose conduct was objectionable while still respecting the limits of their own profession. Here we have doctoral titles, substantial commercial interests, a public history with conspicuous omissions, and documents that require far more scrutiny than their letterheads invite. A title does not close that inquiry. ### To readers, rights advocates and other recipients. Do not let the status of a corporation or its counsel intimidate you out of exercising your lawful rights. If you believe this record merits attention, you can bring it to organisations and authorities you consider appropriate. You may discuss, translate and reuse our work under the [project's published licence and terms](). We are asking for scrutiny of documented professional conduct and institutional practices. Steam users who have experienced account or item theft may have a particular interest in what their access response contains. In the case documented here, a support exchange did not produce the complete disclosure sought, and the supplied material leaves substantial questions about missing data. If you received a complete, useful response from Valve, we also want to hear about it. A wider record needs those experiences too. If you received a redacted PDF from Taylor Wessing, examine whether the black areas actually remove the underlying text. Our [open-source PDF redaction toolkit]() supports local inspection. The Medium articles also describe basic checks using LibreOffice or selecting and copying text into a plain-text editor. Preserve the original file. An opaque rectangle alone does not establish that the concealed data has been removed. Share your experience / PhishDestroy Tell us what you requested, when you requested it and what response you received. [Telegram bot]()[complains@phishdestroy.io]()[PDF inspection toolkit]() ### To the authorities: examine the neighbouring matters. We would prefer not to circulate documents containing other people's information. Publicly, we publish selected screenshots. The complete, unedited originals are reserved for the authorities through a protected channel. They contain personal data and material extending beyond this particular case. We are not asking an authority merely to repeat our examination of one account. We ask it to investigate what we cannot inspect: neighbouring requests, earlier exports, internal instructions, quality-control records and decisions after notice. **Doc. No. 42603633 and Doc. No. 42282474 identify the starting point. They do not define the outer limit of the questions.** ### The Medium series: our earlier, informal reporting. The four articles below use sarcasm and an informal voice in response to the correspondence. They do not contain the full account assembled in this dossier. They remain part of the publication record; the academic work develops the methods and evidence further. 1. [My Dog vs. Elite GDPR Lawyers — The Valve Data Breach Nobody Is Talking About]() 2. [My Dog vs. Elite Lawyers — Part 2 — The 5-Year PDF Vulnerability Exposing Global Corporations]() 3. [My Dog vs. Elite Lawyers — Part 3 — Valve, GDPR and the Cover-Up]() 4. [My Dog vs. Elite Lawyers — Part 4 — Dr. Patrick, Your Own Document Just Destroyed Your Client]() **A right that survives only until a corporation hires a lawyer is not being enforced. That is the question we intend to keep before the public and the institutions responsible for answering it.** ## EPILOGUE. THE RECORD WILL REMAIN AVAILABLE. **Taylor Wessing must answer the record.** **Public case materials are limited to screenshots. On October 14, the complete package — including the original letters, raw uncensored logs and supporting documents — is being handed directly to the regulators, without editing.** The originals contain personal data and evidence extending beyond this case, and are therefore not attached to the public page. The dossier and its copy on IPFS preserve the public account of the findings despite attempts to remove it from search. Every correction proposed through [our Wikipedia initiative]() must remain linked to the record that supports it. ### PhishDestroy knows how to wait Our preservation horizon extends beyond a firm's correspondence strategy. Archival funding models already use a **200-year storage horizon**: Arweave's protocol documentation describes upfront funding for replicated storage on that timescale. [Arweave protocol overview — storage endowment]() Removal from search changes discoverability; it does not change what the documents contain. We will continue to contest the use of personal-data protections to suppress examination of signed professional work performed for a corporate client. **The authors, dates, signatures and contents remain part of the record. We will preserve them, submit them and continue to demand answers.** ## SOURCES **The Nazi Past of the Founder (Archives and Reliable Sources):** 1. [Rüdiger Graf von der Goltz (lawyer) — Wikipedia EN]() 2. [Rüdiger von der Goltz (Jurist) — Wikipedia DE]() 3. [Taylor Wessing — Geschichte — Wikipedia DE]() 4. Reichstags-Handbuch 1938, Bavarian State Library, biographical entry for Rüdiger Graf von der Goltz. [Printed page 223 · digital scan 224]() [View the document in this dossier]() 5. Lilla, Doring, Schulz, *"Statisten in Uniform: Die Mitglieder des Reichstags 1933–1945"*, Droste, ISBN 3-7700-5254-4 6. [Blomberg–Fritsch affair — Wikipedia]() [Blomberg-Fritsch-Krise — Wikipedia DE]() **Scandals and PR:** 7. Disciplinary decision of the SDT on Daniel Hutchings (£30,000 fine; covered by Law.com International and Legal Cheek), incident at the Mahiki club, London. [SDT · Judgment 12393-2022 (PDF)]() 8. RollOnFriday — rumors about a "Head of Department" at Taylor Wessing and a trainee. [RollOnFriday · 16 October 2014]() · [Legal Cheek · 15 October 2014]() 9. Official LGBT publications of Taylor Wessing: Stonewall Top 100, myGwork, IDAHOBIT (taylorwessing.com). [Taylor Wessing · Stonewall Top 100]() · [myGwork interview · Attitude]() · [Taylor Wessing · LGBT+ impact report]() 10. Notice on the Taylor Wessing website regarding the exit of the UK, Dubai, Netherlands, Ireland, and Belgium offices from the Taylor Wessing Verein (Winston Taylor brand from June 1, 2026); [Taylor Wessing — Wikipedia EN](). [Taylor Wessing · official 2026 timeline]() **Case Materials (Full versions — with regulators):** 11. Letter from Dr. Schelinski, Taylor Wessing, 15.08.2025, Doc. No. 42282474. [Screenshot location · E01]() 12. Letter from Dr. Zurheide, Taylor Wessing, 01.10.2025, Doc. No. 42603633, Anlagen 1–2. [Screenshot locations · E02 / E04 / E09]() 13. *Exhibit B: Quantitative Forensic Audit of GDPR Disclosure Data*, AR-2025-BAN-FORENSICS (Shannon entropy 3.48 vs 2.14; Jaccard index 1.000; chronological paradox; "pidor", page 444). [Screenshot location · Exhibit B]() 14. *Exhibit PD-VALVE-2026/01*: access logs from Valve Corporation gateways (AS32590) — 21.10.2025, 16–17.02.2026, 31.08.2026; SHA-256 checksums attached. [Full exhibit · records, method and SHA-256]() **Additional historical documents and the firm split:** 15. Hamburgischer Correspondent, Nr. 551, 25.11.1933: „15 Mitglieder der Strafrechtskommission“. [Open source]() · [PDF · front page]() 16. Regge / Schubert (1988), Protokolle der Strafrechtskommission des Reichsjustizministeriums, Teil 1, S. XVI–XVII, XXVII. ISBN 3-11-011694-4. [Open source]() 17. Gesetz über die Akademie für Deutsches Recht, 11.07.1934; RGBl. I, Nr. 78, S. 605 (§2). [Open source]() 18. Gesetz zur Änderung des Strafgesetzbuchs, 28.06.1935; RGBl. I, Nr. 70, S. 839–843, insbesondere Artikel 1 und 6. [Open source]() 19. United States Holocaust Memorial Museum: Gay Men under the Nazi Regime; Paragraph 175 and the Nazi Campaign against Homosexuality. [Open source]() · [§175 · USHMM]() 20. Hans Frank / Rüdiger Graf von der Goltz: Nationalsozialistischer Ehrenschutz. Wien: Deutscher Rechts-Verlag, 1938. CiNii Books, BB17180010. [Open source]() 21. Winston Taylor International LLP, letter of 2 June 2026, filed with the SEC as Exhibit 5.1: merger effective 1 June 2026. [Open source]() 22. Bundesarchiv: Digitalisierte Bestände — R 61, Akademie für Deutsches Recht. [Open source]() Compiled under the pseudonym **Agent Ellis**. [Agent protocol]().