LunarDAO Manifesto

The Leviathan

Information is power. Privacy and transparency are two antithetical dimensions of information. Transparency must apply to those in power, to lay open their machinations and hold them accountable. This includes any government, supranational entity, corporations and conglomerates. Privacy is for the people, to prevent the agents of power from intruding in the innermost parts of our individual and social existence.

The mouthpieces of the surveillance state claim that our sanctuaries and agoras are enabling criminals to sell drugs, weapons and human beings, and laundering money through cryptocurrencies. They use this as an excuse to block our access to DeFi and privacy tools and limit our autonomy. All the while the crimes we stand accused of are carried out day by day on a massive scale by well-connected and legally protected people, aided by national governments, their courts and law enforcement bodies. While attacking tools that empower people, they commandeer the black market and launder money through esteemed international banks.

So-called democratic nation-states openly make profit by entertaining economic relations with regimes they pretend to reject. Especially when it comes to war industry, these profitable relations are carried out against international conventions these states promoted themselves. Armaments are sold to regimes and used against civilians and liberation movements in the name of profit.

Hegemonic nation-states and their financial institutions have control over our lives. As long as we depend on their money we have no choice but to live under the dominion of empires. Banks track and control the money flow and can freeze assets at any time. They tempt us with the illusion of wealth, making us believe that we are part of the big game, when really we are expropriated. We are the yield.

Sunset

Decades ago, cypherpunks foresaw the rise of censorship and surveillance. They understood that cryptography and economic sovereignity were necessary to ensure freedom. Bitcoin created an economy outside of financial hegemony and made it possible for people to regain agency.

Today that is no longer enough.

Crypto’s resistance to capture makes it a target. And so the surveillance state is on the attack. It has already started to make our software illegal. We are forced to self-regulate to survive. Anyone who falls into this trap has already lost.

Over the years, the voices upholding the cypherpunk mission have become fewer and quieter, drowned out by a flood of easy money. The advocates of crypto's liberatory mission lack unity as well as strategy.

LunarDAO provides such a strategy.

Midnight

There are no institutions in this world that safeguard freedom. Those that try to are being denounced as criminal and terrorist, co-opted, marginalized and violently crushed. The existing establishment only maintains and intensifies our enslavement. We, the people, must create new worlds to live a free life. Many others before us have attempted to do so, and important contributions have been given by freedom fighters. We walk on this path remembering and celebrating this heritage and forging alliances with others struggling for liberation. We recognize the contribution done by the team of Wikileaks, which has stripped the American government of its historical immunity and shed light on the dark affairs of world powers. The United States, eager to deny the right to privacy of their citizens, are now persecuting Julian Assange for unmasking their own crimes.

While trying to regulate their internal markets and imposing strict surveillance over the economic activities of their own citizens, countries like France have developed unregulated markets in former colonies that are crippling local economy. An exemplary case is the French sabotage in Guinea; after the former colony declared its independence, France, led by De Gaulle, counterfeited the new Guinean Franc in order to trigger an economic crisis and cast down the elected leader Touré, as testified by former French secret services agent Maurice Robert. The colonizers didn’t succeed with getting rid of Touré, but managed to damage the Guinean economy enough to ensure dependency on France. Guinean case is particularly symbolic for French policies in the former colonies of West Africa, where economics has been weaponized against local people to keep them enslaved.

This and others crimes are daily committed with impunity by authorities that persecute, torture and imprison people building concrete alternatives of free life.

This is the case of Ross Ulbricht, among others. Creator of Silk Road, an anonymous e-commerce website, Ulbricht has been sentenced to an unjustifiable two life sentences and more, without parole, because some users used the marketplace to sell and buy illegal goods, mostly cannabis. The fact that one of the drug sellers has been condemned to five years makes if crystal clear that Ulbricht has been turned into the scapegoat of the United States’ war against privacy, to spread terror and deter the online community from searching for alternatives to surveillance.

Economy is being weaponized in Iran against women struggling for their freedom, as Iranian government is threatening to freeze the bank accounts of those who refuse to adhere to the law imposing hijab. As economic warfare is a common practice of the nation-states to impose their domain, building tools and platforms to guarantee economic freedom is a crucial struggle.

Organization is the key to self-defense, and self-defense is necessary to live. So believed J-Stark, 3D printing pioneer, who lived by the slogan ‘live free or fucking die’. He did die for freedom – he was murdered by German police, guilty of giving people a 3D technology that deprived the state of its monopoly on weapon production. We celebrate his legacy, and recognize a society’s right to self-defense against exploitation and occupation.

Since the dawn of the oppression of the state, free societies have armed themselves and resisted. Countless have died to protect the free life of humanity, and great victories have been achieved. But we slowly lost ground. State civilization has imposed its own narrative, casting the memory of democratic resistance in the shadows of the past - but our legacy has never disappeared. Although at constant risk of being erased and forgotten, it still continues in the resistance against occupation, fascism, patriarchy and ecocide. It has flourished over the millennia in the uprisings of peasants against landlords, in the knowledge of the witches, in the nomadic tribes refusing the institutions of power. The spirit of freedom that inflamed Tiananmen Square and the people of Falluja is a source of hope in Jenin and Kobane. The great battles of the past are the urban guerrilla of today. Everywhere, David is striking back at Goliath.

Ruling elites have robbed society of its knowledge, its memories and its dimensions. They have monopolized economy, depriving it of its original meaning, rewritten history and deviated the noble purpose of science. The greed of the oppressors is pushing technology, one of the spearheads of humanity’s knowledge, into degeneration. As they weaponize technology to enforce oppression, we are committed to using our skills to promote liberation.

This is why lunarpunks gather in the periphery rather than the center. We make our home in moonlit forests of encryption outside the reach of the state. We refuse to leave our protection in the hands of governments and Big Tech. We consider self-defense to be everyone's responsibility.

Rulers maintain authority by keeping people isolated. When we are alone, we cannot build the strength to change our realities. That is why lunarpunks are not content with the modern mirages of individual liberty. We form squads, clans and communities and fight for collective liberation.

Moonrise

Freedom can only be found outside the logic of domination. Self-defense requires a philosophy rooted in liberation and adequate tools. We must bypass the all-pervasive mindset of submission and obedience. Lunarpunk forest is a sanctuary where society can redefine itself, self-administrate and regain its economic, political and moral agency. As our community grows, we witness how society can truly flourish only when free from state. But in order to protect ourselves and our communities from oppression, we need to practice self-defense.

Decentralized, private and anonymous networks are fundamental for communities to defend themselves. Self-defense requires control over information, infrastructure and material resources. Lunarpunks use zero-knowledge cryptography to create a shield of privacy and anonymity that enables communities to operate without persecution by the state.

The aims of LunarDAO are:

• Enable parallel confederated societies that are diverse and autonomous but mutually protect each other against central authority.

• Learn, educate, share knowledge. Education is fundamental in our struggle for free life, autonomy, and community.

• Develop infrastructure for economy and politics beyond the state, that is uncensorable, sovereign and anonymous. Expand the dark forest.

LunarDAO invests in privacy projects and anonymity-oriented tooling for the lunarpunk society. By prioritizing technical excellence, practicality and an uncompromising philosophy of freedom it creates value building towards a self-sustaining antifragile ecosystem. We believe that lunarpunk is not something distant. It is available to anyone who is ready to make a choice: to let nation-states control our lives or to join the fight for freedom.

Anyone can join LunarDAO and start a new investment project or take part in an existing one. Learn how to use free software and privacy tools, extend the reach of infrastructure, exit Big Tech and the surveillance state, learn programming, study economics and build the counter-economy.

Sunset has arrived. The moonlit night is coming.

Moonlight, or the lunarpunk future

In the darkness of the night, the forest of encryption is alive. Many tribes have found a sanctuary under the thick branches of its trees. Societies are regaining their strength, and free life is being built under the gentle light of the moon. Outside of the forest, war is raging. Nation states are in conflict with one another, ecocide is being perpetrated against nature, and repression strikes those who struggle for freedom. The more the agents of the state attack, the more individuals and groups escape the scorching sun of surveillance and seek refuge in the moonlight of anonymity. Societies, finally aware of themselves, defend their forest through cyber-guerrilla and regain territory. A new moon shines on earth.

Abstract

LunarDAO is an investment fund based on lunarpunk philosophy. By allocating funds in privacy projects & anonymity tooling we aim to expand freedom and ensure sovereignty. Squad wealth leverages collective strength and capture value in the ecosystem by building a portfolio of privacy assets. Anyone can exit at any time. Members are anonymous hence can participate in building this vision without fear of frozen funds, legal implications or any kind of repression. We aim to move to a full anon setup and develop infrastructure for a parallel economy outside of control and centralization.

LunarDAO's supports research on privacy technologies, listed in the wiki, and education structures such as Adalan Academy, where people can acquire knowledge and master skills in programming and economy while developing a philosophical frame to generate the future path of lunarpunk ecosystem.

Preface

The moon symbolizes many things, among those transformation and life, strength and power. To develop life means continuous transformation. Life that is stagnant will cease to exist. LunarDAO is one part of the expanding forest against surveillance society. It was created out of necessity, but lunarpunks existed long before this DAO. The regulatory changes incentivize us to organize our defenses with more persistence. We constituted LunarDAO, because we believe in community, decentralization, individual responsibility and contribution to a common mission. LunarDAO is a community directed by Lunar Squad. It is a practical application of lunarpunk narrative.

Decades ago, cypherpunks foresaw the rise of censorship and surveillance. They understood that cryptography and economic sovereignty are necessary to ensure freedom. Bitcoin created an economy outside of financial hegemony and made it possible for people to regain agency. Over the years, the voices upholding the cypherpunk mission have become fewer and quieter, drowned out by a flood of easy money. The KYC regulated crypto diverged from that foundation. The advocates of crypto's liberatory mission lack unity as well as strategy.

LunarDAO provides such a strategy.

The more regulation is imposed on people the bigger is the thirst for anonymity and privacy. The development of anonymity and privacy results in stronger regulation. This loop is inevitable. Instead of closing our eyes to this reality, we choose to expand the forest and build a sanctuary where society can redefine itself, self-administrate and regain its economic, political and moral agency.

Read LunarDAO full manifesto.

Mission

LunarDAO mission is the manifestation of lunarpunk vision which enables the forest to expand. In practice LunarDAO:

• Invest in privacy and anonymity tech and infrastructure.
• Research and share information on privacy projects.
• Support education initiatives aligning with LunarDAO aims.

Investment Thesis

LunarDAO is an INVESTMENT FUND INTO PRIVACY PROJECTS & ANONYMITY TOOLING, a squad wealth based DAO spreading Lunarpunk narrative, philosophy and building infrastructure.

Problem

Anonymity and privacy oriented developers will face an increasing difficulty in finding support among traditional VC's and investment funds, because of regulatory measures. This will lead into a dynamic where the developing teams will be forced to sell their work underpriced to counterparties who don't share the same vision. This scenario portrays privacy as a taboo, developers are under stress and value is extracted from the ecosystem.

We don't accept the future to be so grim. The prospect of privacy is ultimately bullish. LunarDAO offers a solution.

Solution

We form a decentralized squad of sovereign individuals and lunarpunks, to allocate resources together and assemble squad wealth. The DAO leverages collective power and becomes an investor. The community discusses which tools are needed to empower the ecosystem, the research committee looks for the solutions, and lists them in the Investment Portal. The Squad members vote on the proposals and invest in the chosen projects.

Gains

• The privacy projects will get support from a decentralized, anonymous organization, aligned with their mission.
• The teams will be provided with the needed resources to develop, grow and deliver.
• LunarDAO Squad is a privacy investor building a treasury (portfolio) of accumulated privacy assets.
• The value is conserved in the ecosystem, both parties profit from the upcoming lunarpunk cycle.
• While leveraging collective power, every individual is protected against majority rule and can exit the DAO any time with 100% of their shares (without any fee).

For the current list of primitives and projects discussed as possible investments, visit our Investment portal.

We believe that the loop of tightening regulations and growing demand for privacy and anonymity is inevitable, these events will happen with or without us. We can strenghten the ecosystem, capture the value and grow squad wealth, or be left out in the desert with regressive regFi.

Nym Exit Gateways

As a part of our mission LunarDAO aims to:

Develop infrastructure for economy and politics beyond the state, that is uncensorable, sovereign and anonymous. Expand the dark forest.

To walk the talk, we lead by an example. Our first milestone to establish such infrastructure in an anonymous and distributed fashion is to run Nym Exit Gateways.

LunarDAO Gateways

LunarDAO currently operates 15 Nym-nodes as Exit Gateways.

Connect to LunarDAO Gateways

Users and devs can channel their Mixnet connections through LunarDAO gateways either via NymVPN or SOCKS5 client.

NymVPN

NymVPN is a client routing all users traffic thorugh Nym mixnet. The CLI version (setup guide here enables users to choose any Gateway providing options --entry-gateway-id [ENTRY_GATEWAY_ID] and --exit-gateway-id [EXIT_GATEWAY_ID]. To get LunarDAO ID keys needed for this setup, choose gateways from the table above and supply the key to your command.

Nym SOCKS5 Client

LunarDAO Nym Gateways have Network Requester (NR) and Internet Packet Router (IPR) embedded and they run according to the new Nym exit policy - a combination of Tornull and Tor reduced policy - a default filter allowing users to connect to any but blacklisted IPs and ports.

To use LunarDAO Nym Exit Gateways, run your own nym-socks5-client and route it through one of our embedded NR's. Here is how:

1. Get nym-socks5-client from Nym release page.
2. Make executable: chmod u+x nym-socks5-client
3. Initialise and configure with one of our NR addresses listed in the table above.

./nym-sockc5-client init --id [ANY_NAME] --provider [USE_ONE_FROM_THE_LIST_ABOVE]

4. Run ./nym-socks5-client run --id [YOUR_ID]

Now the client should be connected to 127.0.0.1 and port 1080, drop these values to any SOCKS5 supporting app to run through the mixnet, like in this example or check out this list of supported applications.

Introduction

The following entries about surveillance programs focuses both on the past and the present. This is a fragment of all information available, and even less if considering the surveillance measures by nation-states and corporations. We are not aiming to present in depth articles on these programs. The intention is to build an understanding for what surveillance measures are existing which can inform us directions in regards to privacy knowledge and tools. Wikileaks have extensive materials on surveillance programs and for anyone interested to learn more, we'd recommend to read the materials shared there.

European union chat surveillance

In 2013, former US intelligence contractor Edward Snowden leaked US's National Security Agency (NSA) mass surveillance programs. NSA was collecting the telephone records of tens of millions of Americans, collected and stored 200 million text messages per day. NSA directly accessed servers of nine internet firms, including Facebook, Google, Microsoft and Yahoo, to track online communication in a surveillance programme known as Prism. They also bugged Eurpean Union offices, and surveilled Japan, South Korea and India, Brazil and Mexico. These are only few examples.

The European union is currently proposing mandatory scanning of every private message, photo, and video in the name of stopping child sexual abuse. Research on this measure makes it clear that widespread scanning produces significant numbers of false accusations and is ineffective for the claimed purpose. It is also criticized fo violating the basic human right to privacy.

Schengen information system (SIS)

Schengen information system is a database composed by entries which are called alerts. 885 000 (or 1.9%) are connected to specific individuals. Every alert includes but is not limited to the following information: name, date of birth, gender, nationality, aliases, arms or history of violence, the reason for the alert and the action to be taken if the person is encountered, requests for extradition, undesirability of presence in particular territory, mental illnesses, requests by a judicial authority, and suspected of crime, lost, stolen and misappropriated firearms and banknotes. In total there are 46 million entries in SIS. All schengen countries have access to the database and have to abide by the information provided there. It is updated in real time.

On March 7, 2023, SIS was been updated; additional tools to prevent irregular migration, working closely with EES (Entry-Exit System, to be launched in November 2023), have emerged, including registering third-nation traveler’s name, the type of travel document, biometric data, and the date of entry and exit from the EU or refusal of entry information. Also, the new features of SIS will include new categories of alerts and biometric data, such as palm prints, fingermarks and DNA records for missing people.

Data rentention initiative

From 2006 EU member states had to store information on all citizens' phone and internet connections for a minimum of six months and at most twenty-four months. If the police in the member states demanded it, the information had to be shared. The court of justice of the European Union declared the directive invalid for violating fundamental rights.

Echelon

In the 90s Echelon surveillance program was exposed. Echelon was a system used to intercept telecommunications, faxes as well as emails. It was created by USA but used also by the so called western countries.

Facebook selling user data

In 2018 it was revealed that Facebook had previously allowed the political consulting firm Cambridge Analytica to access the personal data of tens of millions of its users - around 87 million people- without their knowledge or consent. This data was then used to target specific groups of users with political ads during the 2016 US presidential election. CA's executives declared in 2018 they had worked in 200 elections around the world.

Google tracking users

In 2018 it became known that Google is tracking the location of users even when they turn off their location history setting, and not only: they pressure phone companies to hide or make it harder to find location settings. This is continuing to this day.

Tik tok selling user data to Chinese government

In 2019 articles surfaced that were written about TikTok collecting extensive data about its users, including their device information and location data, and sharing it with the Chinese government.

In US all federal employees are prohibited to use Tik Tok. Canada and United Kingdom also banned Tik Tok. Many countries decided on some form of ban of TikTok on government-issued devices, here's a list of them. France extended the ban to other "recreational" apps like Twitter and Instagram.

Wikileaks publications

In 2017 Wikileaks published 'Vault 7' about US intelligence measures to spy on users and collect data. One of these projects was 'Scribbles' project, a document-watermarking system for documents that are likely to be copied by Insiders, Whistleblowers, Journalists or others - in order to track those who freely try to share about surveillance programs and attacks on our privacy.

In 2017 Wikileaks also published about CIA surveillance tool 'Weeping Angel', an implant designed for Samsung F Series Smart Televisions, which record audio from the built-in microphone and store the data.

Julian Assange, founder of WikiLeaks, has been imprisoned in Belmarsh High Security Prison for 5 years. The UK government ordered his extradiction to US in June 2022. The extradiction hasn't been executed yet due to appeals although the first was rejected by UK high court. In US Assange will face charges of espionage and even though the US has assured that no death penalty would not be imposed should he be convicted, he would face life imprisonment.

Assange was the target of many focused spying operations. One including UC Global Julian Assange spying case: Judge suggests CIA may have received illicitly recorded conversations, a company hired to secure and protect the Ecuadorian Embassy was used by the CIA to install surveillance devices including cameras and microphones throughout the embassy. This includes putting microphones inside the women's restroom. Julian and every guest that came into the Embassy including his legal defense team were spied on by UC Global for the CIA. The UC Global CEO would routinely meet with CIA officials and hand over surveillance materials.

Wikileaks have extensive materials on surveillance programs. Read more on https://wikileaks.org/.

Pegasus

Pegasus was discovered in 2016. It is developed by Israeli cyber-arms company NSO. Pegasus is targeting smartphones and is capable of reading text messages, tracking calls, collecting passwords, location tracking, accessing the device's microphone and camera, and collecting information from apps. NSO stated that the spyware is intended to be used to combat terror and crime. However, many countries bought it to spy on those critical to the regime in the given location including activists, human rights defenders, journalists and even politicians. Up until 2019, some kind of interaction was needed from the user in order to install Pegasus, like clicking a link or opening a document. The last years have brought the zero-click exploit, meaning that the software can be installed with a missed call or a message; the record of the call can be canceled and there can be no notification for the message, meaning that the user doesn't even realize something is happening. Countries including Hungary, India, and even Saudi Arabia have bought it.

A consortium of 17 media organizations investigated Pegasus and released a list of 50000 phone numbers that could be possible surveillance or interesting targets for NSO since 2016; not everyone of them has been checked for traces but of the 67 examined in 2021, 37 turned out to have traces of Pegasus. The consortium also identified at least 1o governments who where entering numbers into a system: Azarbaijan, Bahrain, Kazakhstan, Mexico, Morocco, Rwanda, Saudi Arabia, Hungary, India and United Arab Emirates.

An article from April 2023 states that an Indian defence agency bought spyware from Cognyte Software Ltd, which is seen as a Pegasus alternative. Cognyte collects information on, among others, journalists and critics of authoritarian regimes without their knowledge.

NSO has faced legal issues and heavy criticism by Microsoft, Meta, Alphabet, Cisco and Apple. Meta is pursuing a spyware lawsuit against Pegasus, accused of expoliting a bug in WhatsApp to install spy software allowing surveillance of 1400 people.

Amnesty International has developed a guide to check for traces of Pegasus on phones and a Mobile Verification Toolkit (MVT) to automatize the process.

Surveillance in China

China surveils the population is a known fact, but maybe not everyone knows to what extent. More than half of the world’s surveillance cameras are in China, nearly one billion. The data from the cameras can tell someone’s race, gender and whether they are wearing glasses or masks. The police (In Fujian Province) estimated that there were 2.5 billion facial images stored at any given time. The aim is “controlling and managing people”. Devices known as WiFi sniffers and IMSI catchers are used by the police to track the movements of a person of interest. It's a way to connect digital footprint, real-life identity and physical whereabouts. All 31 of mainland China’s provinces and regions use phone trackers, for example to detect an Uyghur-to-Chinese dictionary app on phones in order to surveil the Uyghur ethnic minority. The police in China also use sound recorders, to record people's voices within a 300 foot radius. These are attached to their facial recognition cameras. In 2017 in Xinjiang, the Chinese authorities built a database which can hold iris samples from 30 million people and are now extensively expanding iris-scan and DNA databases. Megvii, one of the largest surveillance contractors in China, created a software that collects data like movement patterns, clothing, vehicle, information about their phone and social connections. This tool is used by the Chinese police.

The Great firewall of China is blocking peoples access to information through ie. url blocking, and VPN blocking. Cryptocurrencies are forbidden and therefore censored. The main reasons behind the firewall is to crack down on political dissent, control the narrative, and prevent people from accessing content that may go against the country's policies.

Government request of Big tech account data

A study from Surfshark (from 2013 to 2021) shared in an article by Cointelegraph reveals that requests for personal user data from global governments increased by 25% in 2021; 732 773 Google accounts and 716 108 Meta (Facebook) accounts. 60% of the requests came from the United States and Europe. US requests were more than twice as many as Europe. Outside of US; Germany, Singapore, the United Kingdom and France were the main collectors of this data.

Leaked documents showed that the CIA had owned and operated Crypto AG, a Swiss encryption company. Crypto AG had clients from around the world ranging from the Vatican to Iran, including governments officials and private corporations. The hardware allowed the CIA to access the communications via backdoored hardware. Crypto AG was acquired with a partnership between West Germany and the CIA in 1970 and the CIA continued as sole owner until 2018.

Leaked documents from the Snowden revelations uncover the NSA Prism program that was used to spy on users of services including Google, Microsoft, Facebook, Youtube, Apple and many others. The NSA had direct access to the companies' servers. The data that was collected included email, chat (video & voice), photos, VoIP, file transfers, video conferencing, notifications of target activity (logins, etc.), online social networking details, and special requests.

Fingerprinting & Tracking

Device fingerprinting or browser fingerprinting is the systematic collection of information about a remote device, for identification purposes. Princeton University's WebTAP project did a measurement and analysis of online tracking in 2016. Sites that contain news, arts and sports have the most trackers. Google, Facebook, and Twitter are the only third-party entities present on more than 10% of sites.

Analysing information about tracking and fingerprinting cannot be separated when viewed from the angle of Big tech dominance on internet. Parazyd from DarkFi wrote about this in Status Quo. Gary Kovacs, from Mozilla Corporation, shared about the unconsentual tracking in a TED talk.

The information in this post is primarily compiled from Am I Unique, EFF and The Markup. There is extensive research and information on these pages on tracking and fingerprinting as well as proposal on how to improve privacy. This is the TL;DR version.

When you visit a website, your browser makes a request for that site. In the background, invisible trackers makes requests to other hidden third parties. These requests can include (but are not limited to):

• Time zone
• Browser settings
• Versions of software installed
• Broadcast device and browser version
• Browser’s requests is also extracted by third-party ad networks, which are relying on cookie tracking, and browser fingerprinting.
• Screen resolution

Trackers can reveal a detailed behavioral profile of online activity, including:

• Income
• Political affiliation
• Level of education

Digital fingerprint

Browser and hardware setup are unique information to each user - a digital fingerprint. This for example also includes information like computer operating system and screen resolution. In other words characteristics that are more difficult to change.

If the user changes the identifier of the browser to a more common browser, it will not necessarily make the user less identifiable. In combination with other metrics this can stand out, ie. using chrome as identifier but the browser looks like Safari, a combination that is rarely used.

Canvas fingerprinting

Fingerprining can identify a user even with cookies being disables. The canvas fingerprinting technique identifies users by drawing shapes and text on the webpage and the differences in features can distinguish one device from another. The canvas is invisible to the user. Here is a list of more than 15000 sites with canvas fingerprinting scripts.

Cookies

Cookies contains information that the website stores in the browser, such as account login information, items bought at an online store, and location. With this information it's possible to link all user activities. Cookies track users until the cookies are deleted from the browser.

Facebook pixel tracking

Facebook is tracking users, as well as non users, with Facebook Pixel even when they are not logged in. If the user for example makes a purchase, this information is then tied to the user's facebook acount and can reveal the user's real identity.

Google tracking

Google share in their privacy policy the extent of their tracking of anyone using internet.

This information collected and used include the language of the user, the people the user is connected to online, YouTube videos that might be of interest, browser type and settings, device type and settings, operating system, mobile network information including carrier name, phone number, and application version number. Google also collect information about the interaction of apps, browsers, and devices with Google services, including IP address, crash reports, system activity, date and time as well as:

• Terms used for searches.
• Videos watched.
• Views and interactions with content and ads.
• Voice and audio information.
• Purchase activity.
• Activity on third-party sites and apps that use their services.

How to disable cookies

Note: different browsers may have different names than this and some options may not be available. Users are encouraged to learn more about the browser they're using.

To disable cookies, go to the browser Settings then to Privacy and Security where it is possible to select:

• Delete cookies and site data when browser is closed.
• Clear data to remove existing cookies.
• De-select Remember browser and download history.
• Choose Block new requests asking to access your location
• De-select Remember search and form history.

Privacy inspection tools

• Blacklight is a privacy inspection tool. When going to a website it will tell the user how they may be tracked through:

• Ad trackers.

• Third-party cookies.

• Tracking that evades cookie blockers.

• Session recording services (such a mouse click and scrolling, anything typed into a form even if not submitted, including sensitive information such as passwords and credit card numbers). Inspectlet is such a surveillance tool.

• Capturing user keystrokes (ie. logging of entered information such as name, family-name, given-name which matched anon user with postal addresses).

  Here is more information about each of the points above.

• Lightbeam is a browser extension which show the relationships between third parties and the sites you visit.

• Am I Unique

Fingerprint resistant browsers

Browsers such as Tor Browser and Brave are fingerprint resistant and they make the fingerprint less unique. Unique means more identifiable, which is something to avoid if we aim for privacy. Privacy Tools provides a list of browsers which are provacy oriented, including increased protection against tracking and fingerprinting as well as ad-blocking.

Ad-blockers

Ad blockers are browser extensions that stops advertisers and other third-party trackers.

• Privacy Badger
• Ghostery
• uBlock

SIM card data collection

SIM card providers are centralized entities. The data collected on SIM cards is not controlled by the user. It is transparent and a liability for anyone concerned with privacy. See Privacy setup for android with Graphene OS on private alternatives to android phones which are based on Google services.

• Integrated circuit card identifier (ICCID):
  ICCID is a unique number assigned to a SIM card and internationally a standard way to identify SIM cards. ICCID is the printed on the SIM card. The two first numbers are fixed and differntiated the SIM card from other chips. Next two to three number are country codes. The next one to four numbers are Mobile Network Code which identifies the ussuer of the SIM card. The rest of the numbers are uniwue for each SIM and the last one is based on Luhn algoritm which is used to verify ICCID.

• International mobile subscriber identity (IMSI): The IMSI number includes which country and mobile network and can be used to track the movements of the user. The cell towers’ location is used to triangulate the position.

• Service provider name (SPN): The name of the mobile operator.

• MSISDN - The Mobile Station International Subscriber Directory Number: The phone number for calling and texting.

• Last dialed numbers (LDN): The number and name of the most recently dialed.

• Abbreviated dialing numbers (ADN): Any number and name dialed is saved (and information which can be extracted).

• Short message service (SMS): The information include the SMS text itself as well as the time a message was sent, the sender’s phone number and the status of the entry.

For more information, see:

• https://resources.infosecinstitute.com/topic/sim-card-forensics-introduction/
• https://eforensicsmag.com/understanding-sim-card-forensics/
• https://www.getdroidtips.com/iccid-imsi-imei-numbers/

Opt OUT!

When Edward Snowden was working for NSA he decided to stand against status quo and leak information about global surveillance programs, many which are run by the NSA in cooperation with telecommunication companies and European governments. This is the tip of the iceberg in regards to surveillance measure of governments and Big tech today. Edward Snowden was forced to leave US to avoid imprisonment for sharing this information to people who are the targets of this surveillance.

Julian Assange, who was imprisoned in UK (now released), is one of the founders of Wikileaks. He was initially charged with espionage by US (which concluded with a plea deal where Assange admitted to hacking) for sharing the truth about US war crimes in Iraq and Afghanistan. In regards to surveillance, Wikileaks published extensive materials on CIA projects to intercept SSH credentials, target Linux, Windows and MAC systems, utilize webcams and suspend video recordings and also published research about Amazon's collaboration with the US Department of defense and CIA, and surveillance contractors in Russia to name a few.

Google holds over 70% of the browser market and through IP addresses tracks what we do on internet. Big tech collaborate with governments by handing over information on demand. Even when we are not online, society is digitalized which faciliates enforcing control measures. When we move in society cameras are watching us or the electronic cards we might use for transportation or payment map out our lives.

To develop open source software which aims to bring privacy solutions to users is being criminalized. When Tornado cash developer Alex pertsev was arrested in Amsterdam, US government publicly tagged all Tornado cash users. The current push to regulate crypto including imposing CBDC (Central Bank Digital Currency) is a way for nation-states to co-opt crypto, control people and money flow.

If we want to opt out of the surveillance system, we need to build privacy tools, as well as sharing knowledge and resources on what is already existing.

For further materials concerning state and corporate surveillance, see the Surveillance section in the wiki.

Nokia 8110 "Banana" - Jailbreak

Warning: Changing IMEI number is illegal in multiple jurisdictions. This report is not to promote any activity which can cause users any legal problems! Please research the laws concerning this issue in your region. Treat this report as educational source.

This report speaks about GSM network data monitoring. Do NOT confuse it with internet identifiers (MAC, IP address etc).

Problem: IMEI Number Identification

There are multiple security risks when using a mobile provider (phone or router + sim card) as a hotspot. One security risk is the unique sim card number. However sim cards can be purchased without KYC and changed, the internet or hotspot device - phone or portable router - has a unique IMEI number (International Mobile Equipment Identity). this number remains the same (despite changing MAC or IP address). This makes a device easy to track as IMEI number is communicated to the mobile provider.

Solution: Unlocking IMEI Modification

Nokia 8110 or "Banana phone" (as it's known) is a great hotspot device, separated from the users main internet device (smart phone, tablet or laptop). With a few hacks, the Banana phone allows users to change the IMEI number any time. This setup has several advantages:

• Keeps the SIM away from the actual user's devices. Prevents leakage of the main the main internet device IMEI.
• Hacked Nokia 8110 can appear on GSM network as any other phone since IMEI numbers are unique per device and model.
• If IMEI and SIM card are changed together - the user is very hard to be linked (mind the place of connection and other active devices!).

Tip: An IMEI number on Nokia 8110 can be seen in Menu -> Settings -> Device -> Device Information -> More Information or by dialing *#06#. Validate the setup functionality by running a test check before and after the IMEI change.

Pre-Requisities

• Nokia 8110 4G "Banana"
• USB <-> Micro-USB cable with a capacity to handle data
• Internet
• Android SDK Tools
• WebIDE - Palemoon works well

SDK Tools

To communicate with the phone via computer an adb command & shell are needed. Adb is a part of Android SDK Tools. Install as below.

Linux (Debian based)

sudo apt update && sudo apt install android-sdk

Windows - Follow steps in this manual.

WebIDE - Palemoon

WebIDE is used to sideload (install without the bootloader hacking) the needed apps via GUI. An older version of Palemoon works well. Open terminal in a directory where Palemoon will be downloaded and enter the following commands.

wget http://archive.palemoon.org/palemoon/28.x/28.6.1/palemoon-28.6.1.linux-x86_64.tar.bz2

tar -xf palemoon-28.6.1.linux-x86_64.tar.bz2

Move to Palemoon directory and remove auto-update scripts to keep stay on this version.

cd palemoon

rm -rf update*

Run Palemoon

./palemoon

In case Palemoon still prompts to update, deny!

Installation & Setup

Regardless of the chosen setup, the Banana phone must have updated firmware and activated debugging mode.

Keep the device and desktop connected throughout the entire installation process.

Update Nokia Firmware

The device must be updated to the latest firmware.

Check Firmware Version

Settings -> Device -> Device Information -> Software

Update Firmware Version

Settings -> Device -> Device Information -> Software Update -> Select -> Select

Debugging

Debugging is a mode in which developer changes can be implemented. Dial the code ##33284## (##debug##) with your keypad. A bug icon should appear in the system taskbar above (as already said, on some devices it is necessary to open a menu using the additional code ##0574## and from there enable the USB debugging).

Different Setups

This manual has three options, divided according to the three levels of customization and difficulty of the setup. All three of them include unlocking IMEI customization option.

Three Options

1. Minimal - The necessary steps to allow IMEI & TTL modification *
2. Advanced - Minimal + FOSS alternative enabled, remove Google apps enabled *
3. Expert (not described in this manual yet)- Reinstalling the complete OS to Gerda - IMEI & TTL changing app is included with auto-randomizing script.

Chose option and follow the proceeding described under that option directly (ie if 2. is the choice, don't do 1. before).

Note: The points with * use Wallace Toolbox to change IMEI. User needs to enter the new IMEI manually. LunarDAO listed a database of IMEI numbers at wiki.lunardao.net/imei_tables/imei_table.html.

1. Minimal Setup - Wallace Toolbox Sideload

This setup is the fastest and the least difficult one. The only customization is a sideload of the Wallace Toolbox enabling user to change IMEI, TTL and do few other temporary root actions.

Get Wallace Toolbox

Open terminal in target directory to download and run:

wget https://gitlab.com/suborg/wallace-toolbox/-/archive/master/wallace-toolbox-master.zip
unzip wallace-toolbox-master.zip

Install

1. Open Palemoon WebIDE: Open Palemoon browser (the steps above) and press Shift + F8 or navigate to Tools -> Web Developer -> WebIDE
2. Setup adb to tcp socket 6000. In terminal run:

adb forward tcp:6000 localfilesystem:/data/local/debugger-socket

3. Connect Palemoon WebIDE app to the phone: click on Remote Runtime on the right and make sure it's set to localhost:6000.
4. In Palemoon WebIDE app click on Open Packaged App... On the left
5. Navigate to the wallace-toolbox-master directory and click Open.
6. Click on the play button on top to sideload it.
7. Done. Unmount the device.

Usage

Open the Wallace Toolbox app in the phone menu. Use index numbers to navigate. To edit IMEI1 or IMEI2, the new number must be correct, use wiki.lunardao.net/imei_tables/imei_table.html to get one based on device and model of your choice. Reboot and control the IMEI in the phone settings.

Important: Test it few times without a sim card. After each reboot dial *#06# to confirm the IMEI number was edited. To maintain privacy, remove the phone back cover before the IMEI edit. When the phone turns off to reboot take off the battery and exchange sim cards. Assemble and power on.

2. Advanced Setup - Replacing Google Services with FOSS

WARNING! This process includes factory reset. All data and application will be wiped out!

This setup is probably the best compromise of spent time, needed skills, risk and outcome. The result is a rooted KaiOS (the original OS) enabling user to be in control of all applications and processes. This allows for access to developer menu, removing unwanted apps (Google services), sideloading any new apps and (like in setup #1) editing IMEI & TTL number.

This hack disables navigator.mozApps.mgmt.import method package signature checks, installs OmniSD and allows for app config modification.

Before this process, make sure Palemoon is installed (read Pre-Requsities), the firmware is up to date and the device debug mode is enabled.

Donwload OmniSD

Download OmniSD.zip and extract. Open terminal in the target directory and run the following commands:

mkdir omisd

cd ominsd

wget https://cloud.disroot.org/s/QTC5oM4tZ9rWpAZ/download/OmniSD.zip
unzip OminSD.zip2

Install OmniSD & Run Priviledged Factory Reset

1. Open Palemoon WebIDE: Open Palemoon browser (the steps above) and press Shift + F8 or navigate to Tools -> Web Developer -> WebIDE
2. Setup adb to tcp socket 6000. In terminal run:

adb forward tcp:6000 localfilesystem:/data/local/debugger-socket

3. Connect Palemoon WebIDE app to the phone: click on Remote Runtime on the right and make sure it's set to localhost:6000.
4. In Palemoon WebIDE app click on Open Packaged App... On the left
5. Navigate to the omnisd directory and click Open.
6. Click on the play button on top to sideload it.
7. In OmniSD menu on your device press # and accept privileged reset.
8. Let the device reboot and run the initial setup.
9. Allow debug mode again. Either dial ##33284## or Settings -> Device -> Developer Menu -> Enable debugger in the "ADB and DevTools" mode.
10. Repeat the steps 1 to 6.
11. When the installation is finished, all the applications shall be listed in the left-side bar of the WebIDE.

Keep the phone plugged, WebIDE connected and move through the following points.

Get Wallace Toolbox

Open terminal in target directory to download and run:

wget https://gitlab.com/suborg/wallace-toolbox/-/archive/master/wallace-toolbox-master.zip
unzip wallace-toolbox-master.zip

Install Wallace Toolbox

1. In Palemoon WebIDE app click on Open Packaged App... On the left
2. Navigate to the wallace-toolbox-master directory and click Open.
3. Click on the play button on top to sideload it.

Uninstall Pre-Installed Apps

Pre-installed apps don't show the option Uninstall in the Menu. This quick hack makes them removable.

1. Open Wallace Toolbox App and select 1:ADB root
2. Pull webapps dictionary from the phone, in terminal enter:

adb pull /data/local/webapps/webapps.json

3. Make a backup in case something goes wrong:

cp webapps.json webapps.json.bak

4. Open downloaded webapps.json in a text editor
5. Search every app to be set as removable and edit the dictionary line in the sub-dictionary from "removable": false, to "removable": true,. Save & exit.
6. Push the modified file back to the phone:

adb push webapps.json /data/local/webapps/

7. Reboot:

adb reboot

8. Uninstall Apps in the device menu: move selector to the chosen app -> Options -> Uninstall

Edit IMEI in Wallace Toolbox App

Open the Wallace Toolbox app in the phone menu. Use index numbers to navigate. To edit IMEI1 or IMEI2, the new number must be correct, use wiki.lunardao.net/imei_tables/imei_table.html to get one based on device and model of your choice. Reboot and control the IMEI in the phone settings.

Important: Test it few times without a sim card. After each reboot dial *#06# to confirm the IMEI number was edited. To maintain privacy, remove the phone back cover before the IMEI edit. When the phone turns off to reboot take off the battery and exchange sim cards. Assemble and power on.

3. Expert Setup - Replacing OS

This setup replace the original KaiOS with Gerda OS. Gerda OS by default has no Google services and IMEI randomization is semi-automatized (a user does not have to type the IMEI manually just pushes a button to randomize). However the installation requires good knowledge of Linux and the logic behind phone's backend and bootloader.

To be tested and documented soon.

Additional Security Steps

For maximal security do not use this phone for web browsing or other online applications. Run it as a hotspot and connect to it from another device using MAC spoofing and VPN or Tor!

• Always change both IMEI and sim card at the same time when changing a setup (from hotspot to burner etc)
• Disable Web Tracking: Menu -> Settings -> Privacy & Security -> Do Not Track -> Tick [x] on Tell websites and apps that I do not want to be tracked
• Clear Browsing History, Cookies & Stored Data: Menu -> Settings -> Privacy & Security -> Browsing Privacy
• App Permissions: Menu -> Settings -> Privacy & Security -> App Permissions -> Make sure no app has any permissions without asking.
• Search: Menu -> Settings -> Personalization -> Search -> Change Engine from Google to DuckDuckGo and turn Search Suggestions to No.

Banana phone & Changing IMEI

NOTE: Changing users IMEI number is illegal in multiple jurisdictions. This page is not to promote any activity which can cause users any legal problems! Please research the laws concerning this issue in your region. LunarDAO is not responsible for any decisions done by the users! If you are uncertain, please do not read further and leave this page.

There are multiple security risks when using a mobile provider (phone or router + sim card) as a hotspot. One security risk is the unique sim card and all of identifying information leaked. We will cover this issue later on but there are sources to buy sims without KYC and change them as often as a user needs. Another security issue is that despite changing a simcard often, the internet or hotspot device - phone or portable router - has a unique IMEI number (International Mobile Equipment Identity) which stays the same despite changing MAC or IP address. This makes it easy to track.

Nokia 8110 or Banana phone (as it's known) is a great hotspot device, separated from the users main internet device (smart phone, tablet or laptop). With a few hacks, the Banana phone allows a user to change its IMEI. Such a setup has several advantages:

1. Keeps the sim away from the actual user's devices - does not leak the main internet device IMEI
2. Nokia 8110 can appear on the GSM network as any other phone since IMEI numbers are unique per device.
3. If IMEI and simcard are changed together - the user is very hard to be traced (mind the place of connection and other active devices!)

Note: If not changed regularly, the risk of compromise is higher. Both sim and IMEI need to be changed at the same time!

Hacking a Banana Phone

The Banana phone has many different ways to be hacked for IMEI randomization. The most simple way is to install Wallace Toolbox. Here is Banana hackers guide on how to install Wallace Toolbox.

Installing Gerda OS improves usability, but is not needed to change IMEI. It's even possible to install Debian, called Bananian on this phone! LunarDAO Squad plans to make comprehensive manuals on all the IMEI randomizing devices and the installation steps.

IMEI numbers

If you succesfully hacked a Banana phone or already have one, it can be pain in the ass to find correct IMEI numbers, or even worse to make one up. Thanks to our fellow hackers, there is a generated IMEI table with several thousands IMEI numbers.

DISCLAIMER: The table was not created by LunarDAO Squad neither fully tested. All the data are accessible online, LunarDAO only provides a more accessible format.

IMEI Numbers

NOTE: Changing users IMEI number is illegal in multiple jurisdictions. This page is not to promote any activity which can cause users any legal problems! Please research the laws concerning this issue in your region. LunarDAO is not responsible for any decisions done by the users! If you are uncertain, please do not read further and leave this page.

International Mobile Equipment Identity (IMEI) number identifies mobile and satelite phones. The following table lists devices and randomly generated IMEI numbers.

DISCLAIMER: The table was not created by LunarDAO Squad neither fully tested. All the data are accessible online, LunarDAO only provides a more accessible format.

The table has over 16k rows, use search function to find a particular brad or model