The Architecture of Overt Surveillance Interaction: Legal, Technical, and Sociological Dimensions of "Signal Tripping"

Full report

On this page

Introduction to Overt Surveillance Engagement

Historically, the relationship between state surveillance apparatuses and the civilian populace has been defined by a paradigm of evasion, encryption, and opacity. The deployment of advanced data collection systems—ranging from network packet interception to facial recognition and metadata aggregation—has traditionally prompted the development of privacy-enhancing technologies designed to encrypt, route, or completely mask digital footprints. However, an alternative paradigm has emerged within cybersecurity, legal theory, and digital activism: the intentional, overt interaction with government monitoring systems. This practice, frequently conceptualized as "signal tripping," involves deliberately triggering cybersecurity tripwires, automated monitors, or signals intelligence (SIGINT) filters. Crucially, in this context, the objective is not malicious exploitation, but rather to transmit a benign signal, a greeting, or a form of socio-political protest, effectively attempting to say a "friendly hello" to the entities managing the surveillance infrastructure.1

The act of sending a friendly communication to a government monitor occupies a highly complex and often perilous intersection of network engineering, criminal jurisprudence, and cyber deception.1 Surveillance networks and cybersecurity perimeters are fundamentally designed to operate deterministically and defensively, capturing specific technical artifacts such as keywords, header data, metadata, and behavioral anomalies.6 Because these automated systems lack inherent human context and emotional intelligence, they cannot easily differentiate between a sophisticated cyber probe preparing for a network intrusion and a civilian executing an overt, non-malicious interaction.9 Consequently, the legal and technical ramifications of signal tripping are profound, transforming seemingly innocuous digital greetings into potential federal crimes.

This comprehensive report provides an exhaustive analysis of the mechanisms through which monitoring systems can be overtly triggered. It examines the governing statutes that criminalize or theoretically protect such interactions, the formalized channels for government-civilian cyber engagement, the physical radio frequency constraints governed by federal authorities, and the artistic interventions that utilize keyword poisoning as a form of electronic free speech and privacy protection.

The Technical Mechanics of Signal Tripping

Interacting with a monitoring system requires manipulating the specific network layers and protocols that the system is configured to observe and log. Because automated surveillance and cybersecurity infrastructure ingest data across the entirety of the Open Systems Interconnection (OSI) model, signal tripping can occur at multiple stages of digital communication, each carrying distinct technical signatures and varying levels of risk.

Network and Transport Layer Manipulation

At the most fundamental routing level, government servers, firewalls, and intrusion detection systems continuously monitor incoming traffic for anomalies. The Internet Control Message Protocol (ICMP) is often utilized to query the reachability of a host, a process commonly known as a "ping".12 While pinging is a universally standard network diagnostic tool used to measure latency and packet loss, it generates an explicit log entry on the target server. Pinging a government IP address intentionally creates a digital record of presence, effectively acting as a basic digital knock on the door.

However, ICMP manipulation carries inherent risks. Altering the packet size or the frequency of the requests can easily trigger Distributed Denial of Service (DDoS) protections. Malformed ICMP packets—such as the historically destructive "Ping of Death," which involves sending fragmented packets that exceed the maximum allowable size upon reassembly—are immediately flagged as hostile attacks rather than benign greetings.12 Furthermore, automated defense systems evaluate ICMP traffic heuristically. While a single echo request might be ignored, repeated or sequential pings are routinely categorized as unauthorized port scanning or reconnaissance, a precursor to an attack.15 Therefore, while technically feasible, the ICMP protocol lacks the semantic capability to convey a "friendly hello," reducing the interaction to a binary alert that is highly likely to be interpreted as hostile.10

Higher up the protocol stack, the Transport Layer Security (TLS) handshake provides another critical vector for overt signaling. When a client initiates a secure HTTPS connection to a government server, the initial ClientHello packet must specify the target domain. This is accomplished via the Server Name Indication (SNI) extension, which was established in 2003 under RFC 3546 to allow multiple secure domains to be hosted on a single IP address without certificate conflicts.16 In standard TLS 1.2 and earlier implementations, the SNI is transmitted in plaintext before the encrypted tunnel is established.13

Because the SNI is unencrypted, network censors, internet service providers, and signals intelligence monitors routinely inspect it to filter, block, or log traffic based on the requested domain.13 A user attempting to leave a highly visible "hello" to a monitor could theoretically manipulate the SNI field in a custom TLS ClientHello packet, inserting a greeting instead of a valid hostname.19 This action forces the middlebox or the terminating server to log the custom string.

The ongoing evolution of internet privacy protocols is actively attempting to close this specific surveillance loophole. The development of Encrypted Client Hello (ECH)—the successor to Encrypted Server Name Indication (ESNI)—aims to encrypt the SNI using public keys fetched via the Domain Name System (DNS).16 By moving the hostname into an encrypted ClientHelloInner section, ECH prevents network operators from observing the requested domain.22

Despite the privacy benefits of ECH, its implementation remains contentious. Various national governments and internet service providers rely heavily on SNI inspection to enforce local regulations and content blocking. The widespread adoption of ECH threatens to eliminate this capability, potentially leading governments to enforce root certificate installations, mandate client-side blocklisting, or block ECH traffic entirely to maintain surveillance capabilities.21 Until ECH achieves universal enforcement, the plaintext SNI remains a primary, highly visible tripwire for deep packet inspection systems.24

Application Layer and Header Injection

The Application Layer offers the most direct and semantically rich methodology for transmitting human-readable greetings to server administrators and automated monitors. When accessing any government website, the user's web browser or command-line utility automatically transmits HTTP headers, which include the User-Agent string.26 The primary function of the User-Agent is to detail the browser version, rendering engine, operating system, and device type, allowing the server to optimize content delivery. However, because this string is entirely client-controlled and easily modified, it can be manually rewritten to contain custom, non-standard text.4

When a modified User-Agent string—such as "Hello\_Government\_Monitor\_This\_Is\_A\_Friendly\_Ping"—is transmitted to a server, it is permanently recorded in the server's access logs alongside the user's IP address and timestamp.26 On the server side, these logs are not merely archived; they are routinely audited using sophisticated machine learning techniques and Security Information and Event Management (SIEM) software to detect abuses, track users, and analyze traffic patterns.28 Because altering a User-Agent does not involve exploiting a software vulnerability, bypassing an authentication mechanism, or causing a denial of service, it serves as a theoretically non-destructive method of leaving a localized message within a government database.4 Historically, users and researchers have utilized the User-Agent field to leave humorous messages, protest statements, or contact information for bug bounty programs, knowing that log analysts will eventually review the anomalies.31

Similarly, the Domain Name System (DNS) can be utilized for signaling, both inbound and outbound. Organizations publish DNS TXT records to prove domain ownership, provide instructions to automated crawlers, or manage email security protocols such as the Sender Policy Framework (SPF) and DomainKeys Identified Mail (DKIM).34 While typically used strictly by domain owners for administrative validation, a civilian configuring their own DNS infrastructure could theoretically populate TXT records with benign messages. Given that government intelligence agencies perform routine, automated infrastructure scanning and reverse-lookups across the internet, these customized TXT records would eventually be ingested by government databases.36

Furthermore, the transition to DNS over HTTPS (DoH) complicates the surveillance of DNS queries. While traditional DNS operates in plaintext, allowing internet service providers and intermediate monitors to log every site a user attempts to visit, DoH encrypts the query between the client and the DoH resolver.36 However, even with DoH, the entity operating the resolver retains full visibility of the queries.37 If a user intentionally routes custom, greeting-laden DNS queries to a government-operated resolver, the queries will be logged internally, creating a localized signal trip without exposing the traffic to intermediate third parties.

Electronic mail protocols offer yet another avenue for application-layer signaling. The Simple Mail Transfer Protocol (SMTP), which underpins global email delivery, relies on a series of plaintext commands such as HELO, MAIL FROM, and RCPT TO.38 The SMTP envelope is distinct from the message headers displayed to the end-user, meaning that routing information can be manipulated to interact with mail transfer agents (MTAs) and surveillance filters.39 When emails traverse the internet, particularly across international boundaries, they are frequently subjected to bulk collection and keyword filtering.7 By deliberately stuffing emails with specific keywords, users can reliably guarantee that their communications will trigger automated surveillance flags, a concept that forms the foundation of several digital art interventions discussed later in this report.

Cyber Deception: Honeypots and Canary Tokens

Government agencies and critical infrastructure defenders frequently employ cyber deception technologies to detect unauthorized access at the earliest possible stage of the attack kill chain. These systems, designed explicitly as digital traps, represent a fundamental shift in defensive strategy: relying on deterministic interaction rather than probabilistic heuristic analysis.6 For an individual attempting to signal trip, these deceptive elements present the most immediate and unambiguous method of alerting a defender, but they also carry the highest risk of misinterpretation.

Two primary mechanisms dominate the landscape of cyber deception: honeypots and canary tokens.

1. Honeypots: A honeypot is a deliberately created digital trap—often a simulated server, network service, or database—designed to simulate a legitimate, vulnerable, and high-value target.41 Honeypots exist entirely isolated from production networks. Because they have no legitimate business function, any interaction with a honeypot—whether a port scan, a login attempt, or a payload delivery—is immediately classified as unauthorized.42 The primary purpose of a honeypot is to attract cyber attackers, compelling them to engage with the isolated environment so that defenders can study their techniques, tooling, lateral movement strategies, and ultimate motivations without risking actual data.42
2. Canary Tokens: While honeypots require the maintenance of simulated infrastructure, canary tokens are lightweight, easily deployable deceptive artifacts.6 The concept derives from the historical use of canaries in coal mines to provide early warnings of toxic gases. In the digital realm, a canary token can manifest as a fake AWS API key, an active directory credential, a hidden URL, a macro-enabled Microsoft Word document, or a seemingly valuable configuration file placed within a real network.6

The operational rule governing a canary token is absolute and unambiguous: no legitimate user or automated process should ever encounter, query, or interact with the artifact.6 Therefore, the detection model is strictly deterministic. The token does not attempt to score access attempts against a behavioral threshold or correlate weak signals; the mere act of accessing the token is itself the definitive evidence of an intrusion.6 When a token is triggered, an immediate, high-priority alert is dispatched to the security operations center (SOC), typically containing the interacting user's IP address, the timestamp, the user-agent, and the specific token accessed.44

For an individual attempting to execute a "friendly" signal trip, discovering and interacting with a publicly exposed government canary token or a honeypot guarantees that the signal will be received loudly and clearly.44 However, the fundamental nature of these deceptive technologies eliminates the possibility of benign interpretation. Because defenders deploy these tools specifically to catch advanced persistent threats (APTs) and malicious insiders, any interaction is instantly classified as hostile reconnaissance or active breach.46 An attacker caught in a honeypot or tripping a canary token is subjected to immediate incident response protocols.48 Consequently, triggering these systems to say "hello" is functionally equivalent to breaking a window to wave at a security guard; the intent is overshadowed by the violation of the security perimeter.

The Legal Architecture of Surveillance Interaction

The legality of intentionally triggering a government monitoring system rests on a highly precarious foundation. Overtly interacting with government infrastructure—even when driven by entirely benign intentions, curiosity, or a desire for artistic expression—intersects violently with federal cybercrime statutes, data privacy laws, and regulations governing the interference with state operations.49 The legal framework does not naturally accommodate the concept of a non-malicious digital greeting, often evaluating the action solely on the basis of authorization and operational disruption.

The Computer Fraud and Abuse Act (CFAA)

The primary federal statute governing computer interactions, unauthorized access, and cybercrime in the United States is the Computer Fraud and Abuse Act (CFAA), codified at 18 U.S.C. § 1030\.52 Enacted in the 1980s and repeatedly amended to expand its scope, the CFAA prohibits intentionally accessing a protected computer "without authorization" or "exceeding authorized access," and thereby obtaining information, causing damage, or executing a fraudulent scheme.5

A critical element of the CFAA is its incredibly broad jurisdictional reach. The statute defines a "protected computer" not merely as a government or financial institution asset, but as any computer used in or affecting interstate or foreign commerce or communication.52 In the modern digital era, courts have universally held that any device connected to the internet inherently affects interstate commerce and thus qualifies as a protected computer.52 Therefore, every public-facing government server, API, and monitoring system is shielded by the CFAA.56

The central legal peril of signal tripping lies in the CFAA's complex definitions of "damage" and "loss." To elevate a CFAA violation from a misdemeanor to a felony, or to establish the necessary standing for a civil lawsuit by a network owner, the statute generally requires a showing of a "loss" aggregating to at least $5,000 in value during any one-year period.15 For a civilian sending a friendly "hi" via an altered ICMP packet or a custom HTTP header, this threshold might seem impossibly high, given that no data was stolen and no servers were physically damaged or taken offline.

However, federal jurisprudence has established a broad interpretation of "loss." Courts have consistently ruled that the financial cost of responding to an offense, conducting a damage assessment, and restoring the system to its prior condition constitutes actionable loss under the statute.58 In cases such as Meta Platforms, Inc. v. BrandTotal Ltd. and Facebook, Inc. v. Power Ventures, Inc., courts affirmed that investigative costs—including the billing hours of internal IT specialists, forensic analysts, and legal counsel required to analyze the anomaly and ensure the network's integrity—are entirely valid components of the $5,000 threshold.57

This interpretation creates a profound hazard for the signal tripper. If a government agency detects an unusual ping, a triggered canary token, or a bizarre string of User-Agent anomalies, standard cybersecurity protocols dictate that the agency must launch a comprehensive incident response investigation to determine if the anomaly is a smokescreen for a sophisticated state-sponsored attack.9 The labor costs of deploying forensic analysts to review server logs, trace IP addresses, and verify the integrity of the network can easily surpass $5,000 within a matter of days.57 As observed in precedent cases, the investigative costs associated with merely interpreting the digital interaction effectively criminalize the interaction itself, regardless of the sender's non-malicious, conversational intent.15

The 2022 and 2024 DOJ Policy Revisions

In May 2022, following significant pushback from the cybersecurity research community and civil liberties organizations regarding the CFAA's chilling effect on vulnerability discovery, the Department of Justice (DOJ) announced a major revision to its internal charging policy.56 This revision sought to clarify how federal prosecutors should apply the CFAA, specifically aiming to protect security researchers who interact with systems in good faith.5

The updated policy explicitly directs federal prosecutors to decline prosecution for conduct that qualifies as "good-faith security research".5 The DOJ strictly defines this safe harbor as accessing a computer solely for the purposes of "testing, investigation, and/or correction of a security flaw or vulnerability".5 To qualify, the activity must be carried out in a manner specifically designed to avoid any harm to individuals or the public, and the information derived from the interaction must be used primarily to promote the security or safety of the devices, machines, or online services involved.56

Conversely, the policy explicitly excludes research conducted for extortionate purposes. Interactions intended to discover security holes so that the researcher can demand payment from the system owners are deemed not to be in good faith and remain subject to aggressive prosecution.5 Furthermore, the policy outlines that prosecutors will evaluate the sensitivity of the affected computer system, the potential risk to national security, critical infrastructure, and public safety, and the deterrent value of a prosecution when deciding whether to pursue charges.61

Despite this seemingly progressive policy shift, an individual sending a friendly "hi" via signal tripping remains trapped in a legal gray area. Because a purely communicative "hello" is not aimed at discovering, testing, or mitigating a specific software vulnerability, it fundamentally fails to satisfy the strict definition of "security research".5 Furthermore, the DOJ policy represents an internal prosecutorial guideline, not binding statutory law.62 It does not provide an affirmative defense in a criminal trial, nor does it shield individuals from civil litigation initiated by network owners seeking to recoup their investigative costs.62 Consequently, unauthorized signal tripping—even under the guise of an overt greeting—leaves the actor entirely vulnerable to broad statutory interpretations of unauthorized access and damage.60

The Third-Party Doctrine and Metadata Collection

From the perspective of the government, the interception and analysis of overt signals are legally insulated by established constitutional interpretations, primarily the Third-Party Doctrine. Originating from Supreme Court precedent, notably the 1979 case Smith v. Maryland, this doctrine establishes that individuals possess no reasonable expectation of privacy under the Fourth Amendment for information they voluntarily surrender to third parties, such as internet service providers, telecommunications companies, or cloud hosting platforms.2

Under the Electronic Communications Privacy Act (ECPA) of 1986, law enforcement and intelligence agencies can obtain non-content data—such as routing information, ping locations, IP addresses, historical cell-site location information (CSLI), and metadata—without needing to secure a probable cause warrant.51 The government merely needs to demonstrate to a court that the records sought are relevant to an ongoing criminal investigation, a significantly lower evidentiary standard.51

Furthermore, within the realm of national security, the Foreign Intelligence Surveillance Act (FISA) utilizes a staggeringly broad definition of "content." Under FISA, the government defines content to encompass any information concerning the identity of the parties to a communication, or the existence, substance, purport, or meaning of that communication.7 When discussing mass surveillance programs, government officials frequently exclude communications records and metadata from the definition of "content," treating them instead as navigational roadmaps.7 However, internal operational manuals indicate that even email subject lines and URLs are swept up in this collection.7

The implications for signal tripping are absolute: when a user deliberately formats an unencrypted packet, an HTTP header, or a DNS query to say "hello," they are voluntarily transmitting that data across public routing infrastructure managed by third-party ISPs. By doing so, they effectively forfeit any Fourth Amendment privacy claims over the transmission, granting the government the legal authority to intercept, log, and analyze the greeting without judicial oversight.2 The government maintains that such lawful access is essential to securing digital spaces and preventing cyber threats from exploiting warrant-proof encryption.66

Interference with Government Operations

Beyond the federal constraints of the CFAA and ECPA, individuals attempting to interact with surveillance systems must navigate a web of state and federal laws regarding the disruption of government services. Numerous jurisdictions have enacted statutes explicitly prohibiting "interference with government operations".49

While these laws were traditionally applied to physical obstruction—such as blocking access to a public building or interfering with a law enforcement officer—the integration of electronic communications into the statutory language poses severe risks for digital actors.50 For example, modern statutes define "means of communication" to include electronic mail, social media posts, text messages, and network data transfers.50

If a signal tripping campaign—such as flooding a government server with thousands of custom User-Agent logs to ensure the "hello" is noticed—requires an agency to divert analytical resources, throttle bandwidth, or take systems offline for maintenance, prosecutors possess the legal tools to frame the benign communication as a reckless disruption of official operations.50 Additionally, repeated and pervasive signaling targeted at specific government employees or SOC analysts could theoretically cross the threshold into workplace harassment, violating civil rights protections and generating liability for creating a hostile digital work environment.70

Sanctioned Channels: Vulnerability Disclosure and Standards

To mitigate the immense legal risks of unauthorized interaction while simultaneously recognizing the value of civilian engagement in securing critical infrastructure, the federal government has formalized specific channels and protocols for digital interaction. These frameworks provide explicit legal safe harbors and highly structured methodologies for interacting with government systems, though they severely limit the scope of acceptable communication.

RFC 9116 and the Implementation of security.txt

One of the most significant architectural developments in overt civilian-government cyber interaction is the widespread adoption of the security.txt standard. Formalized under Internet Engineering Task Force (IETF) RFC 9116 in 2022, a security.txt file is a standardized, machine- and human-readable text document placed in a universally recognized web directory, specifically /.well-known/security.txt.74

The purpose of this file is to provide security researchers with the explicit contact information, preferred communication protocols, encryption keys, and policy links necessary for safely reporting security vulnerabilities to the domain owner.74 By defining the acceptable boundaries of engagement directly on the server, organizations can streamline the reporting process and protect well-intentioned researchers from legal peril.74

In 2019, the Cybersecurity and Infrastructure Security Agency (CISA) issued a Binding Operational Directive mandating that all U.S. federal agencies publish a valid security.txt file on their public-facing web domains.74 The adoption of this standard represents an unprecedented, overt invitation from the federal government to the public to interact with their cybersecurity apparatus. Data analysis indicates a stark contrast in adoption rates across different sectors; while K-12 education and higher education institutions exhibit critically low compliance (often below 1%), federal government websites have aggressively adopted the standard, establishing a direct, sanctioned line of communication for technical researchers.76

Federal Rules of Engagement for Vulnerability Disclosure

Federal agencies manage the influx of civilian interactions and vulnerability reports through formal Vulnerability Disclosure Programs (VDPs). These programs are governed by strict Rules of Engagement (RoE) that dictate exactly how, when, and where a civilian may interact with a government network.77

The Department of Homeland Security (DHS) VDP policy, enacted in accordance with the SECURE Technology Act, provides a definitive legal safe harbor for researchers who meticulously abide by its parameters.79 The policy outlines explicit allowances and prohibitions:

Within the specific context of signal tripping to send a friendly "hello," the VDP frameworks present an insurmountable boundary. Because a purely communicative ping, header injection, or custom SNI string is not intended to disclose an actionable software vulnerability, it does not technically align with the stated purpose of the VDP.78

Agencies explicitly instruct researchers not to submit a high volume of low-quality reports or engage in any testing that disrupts operations.78 Furthermore, the rules mandate that researchers must not demand compensation and must respect strict non-disclosure embargoes.78 Therefore, utilizing a VDP channel or interacting with a system merely to flag the presence of a monitoring system could be viewed as an immediate violation of the RoE. Such an action instantly voids the presumption of good faith, stripping the researcher of the legal protections the policy affords and exposing them to CFAA liability.77

Electromagnetic Interactions: Radio Frequencies and FCC Regulations

The desire to interact with government monitoring systems is not restricted solely to digital internet protocols traversing fiber-optic cables; it also encompasses the vast expanse of the electromagnetic spectrum. Government signals intelligence agencies operate massive arrays of passive listening stations, satellite uplinks, and terrestrial antennae designed to intercept radio frequency (RF) communications globally.81 However, the interaction with these systems through RF transmissions is highly regulated by federal authorities, presenting unique, often insurmountable constraints on overt communication.

Amateur Radio and the Prohibition on Broadcasting

In the United States, the Federal Communications Commission (FCC) rigidly regulates civilian radio operations, primarily through Title 47, Part 97 of the Code of Federal Regulations, which governs the Amateur Radio Service.82 The amateur radio spectrum is designated strictly for non-commercial, two-way communication, technical investigation, and emergency disaster response.83

A foundational restriction within Part 97 is the general, overarching prohibition on one-way transmissions. The FCC defines "broadcasting" as any transmission intended for reception by the general public, and broadcasting is strictly forbidden on amateur bands.84 Because government SIGINT stations and automated monitors operate as passive listeners rather than active conversational participants, any attempt by a civilian to transmit a blind "hello NSA" over the airwaves is inherently a one-way transmission. If this transmission is not directed at a specific, licensed amateur operator to facilitate a two-way dialogue, it violates the anti-broadcasting rules and subjects the operator to severe fines and license revocation.83

Furthermore, the FCC mandates strict transparency in amateur operations. Operators are required to identify themselves frequently using their full, FCC-assigned call signs.87 The use of encryption to obscure the meaning of a message is entirely prohibited, ensuring that all communications remain open and auditable.88 The culture of amateur radio also polices itself heavily; operators are expected to remain polite, avoid abusive language, and refrain from utilizing the spectrum for commercial, political, or highly controversial topics, focusing instead on the technical aspects of radio communication.87

Exemptions: Beacons, Telemetry, and Emergency Operations

While the prohibition on one-way transmissions is robust, the FCC does provide explicit, narrowly tailored exceptions under Part 97 that allow for specific types of non-conversational signaling.

1. Beacon Stations: A beacon station is an automatically controlled transmitter used by the amateur community to study radio-wave propagation, reception, and atmospheric conditions.84 Beacons are strictly limited; they must not exceed 100 watts of transmitter power, and they are confined to specific frequency segments (e.g., 28.20-28.30 MHz, 50.06-50.08 MHz, and 144.275-144.300 MHz).91 While a beacon continually transmits a one-way signal, its content is structurally limited to identification and technical data. Utilizing a beacon to transmit conversational messages or political greetings deviates entirely from its authorized experimental purpose. The FCC grants Regional Directors the explicit authority to issue immediate cease-and-desist orders to any beacon operating improperly or causing undue interference.92
2. Telemetry and Space Communications: One-way transmissions are legally permitted for space stations transmitting telemetry data back to Earth, or for the remote telecommand of model craft, such as drones or remote-controlled boats.83
3. Brief Tests and Emergency Communications: Operators are permitted to make brief, one-way transmissions to test equipment, typically limited to stating "Hello test" followed immediately by their full call sign.83 Additionally, in genuine emergencies involving the immediate safety of human life or the protection of property, all standard restrictions on amateur operations are temporarily lifted, allowing operators to use any means necessary to secure assistance.84

Ultimately, while the amateur radio spectrum is continuously monitored by federal intelligence entities, the regulatory environment is decidedly hostile to overt, unsolicited greetings. The strict enforcement of call sign identification, the total ban on cryptographic obfuscation, and the rigid parameters surrounding allowable one-way broadcasts ensure that RF signal tripping remains an unviable, highly illegal avenue for civilian-government interaction.82

Sociological and Artistic Interventions: Privacy Through Visibility

Where rigid technical protocols, criminal statutes, and electromagnetic regulations restrict direct, conversational communication, civil society, digital rights activists, and contemporary artists have engineered novel interventions to force interaction with government surveillance. These projects do not attempt to bypass or hide from monitoring systems; instead, they aggressively engage them, exploiting the deterministic nature of algorithmic surveillance to make profound political statements.

The Paradigm of Algorithmic Poisoning

The traditional, prevailing response to the expansion of mass surveillance and corporate data harvesting has been obfuscation via encryption. Technologies such as Virtual Private Networks (VPNs), end-to-end encrypted messaging applications (like Signal), and anonymization routing networks (like Tor) attempt to hide the user's data from prying eyes.8 However, surveillance capitalism and government data collection possess a distinct asymmetry of power; the mere act of hiding metadata or utilizing heavy encryption often flags a user for deeper, more aggressive scrutiny by intelligence agencies, as the desire for privacy is itself treated as a suspicious anomaly.31

In response to this paradox, scholars, artists, and technologists have developed a counter-strategy often referred to as "privacy through visibility" or algorithmic obfuscation.40 This methodology involves generating massive, automated volumes of synthetic data to poison the well of surveillance analytics. If a system cannot be blinded, it must be overwhelmed. By generating an endless stream of noise that mimics the signal the surveillance system is searching for, the value of the collected data is statistically degraded to zero.8

ScareMail and Keyword Exploitation

The most prominent, effective, and widely analyzed example of overt signal tripping in the artistic domain is ScareMail, a web browser extension created in 2013 by the digital artist and researcher Benjamin Grosser.1 Developed in direct response to the Edward Snowden revelations detailing the sweeping scope of the NSA's PRISM and XKeyscore programs, ScareMail is explicitly engineered to deliberately trip government surveillance filters.3

Government surveillance programs rely heavily on keyword selectors—predetermined, highly classified lists of terms that algorithmically flag communications for human review.8 ScareMail directly exploits this operational dependency. Once installed, the extension utilizes natural language processing (NLP) to generate a unique, highly readable, but ultimately nonsensical narrative that is automatically appended to the signature of every outgoing email.97

Crucially, the extension draws its vocabulary from an officially released Department of Homeland Security (DHS) list of keywords used by the National Operations Center (NOC) to monitor social media and digital communications.1 The algorithm dynamically replaces nouns and verbs from a classic source text—Ray Bradbury's dystopian novel Fahrenheit 451—with highly monitored terms such as "plot," "facility," "wave," "dock," and "Al Qaeda".1

The project's objective is not to hide the user, but to trigger the system overtly. By flooding the NSA's algorithmic search systems with millions of false positives, ScareMail attempts to make keyword tracking statistically useless.1 Grosser’s intervention acts as a direct, algorithmic "hello" to the surveillance state, revealing the inherent, fatal flaw in automated profiling: that vocabulary does not equal intent.1 Because the text is uniquely generated via Markov chains for every single email, it easily bypasses simple spam filters while continuously and successfully tripping national security tripwires.3 Grosser's work has been widely celebrated, winning the 2015 Expanded Media Award for Network Culture, demonstrating that signal tripping can be elevated to a protected form of electronic free speech.1

Physical Camouflage and Counter-Surveillance

The philosophy underlying ScareMail extends to other forms of data obfuscation and physical counter-surveillance. In the digital advertising realm, projects like AdNauseam operate on identical principles against commercial surveillance. By silently clicking on every single targeted ad served to a user in the background, AdNauseam drowns the user's genuine behavioral profile in a sea of randomized noise, making it impossible for data brokers to accurately profile their interests.99

In the physical realm, surveillance interaction is manifested through anti-facial recognition designs. Projects such as Adam Harvey's CV Dazzle utilize jarring, asymmetrical face paint, high-contrast makeup, and unusual hairstyles to deliberately confound the algorithms of facial recognition cameras deployed in public spaces.103 Unlike physical masks or balaclavas that attempt to hide identity—which are often illegal in protest scenarios—these designs are overt, highly visible fashion statements. They signal to the camera that the subject is present, but explicitly reject algorithmic classification.103

These artistic interventions highlight a profound sociological reality: as surveillance becomes entirely mundane and normalized across all facets of daily life—from the workplace to the home via devices like Amazon Ring—resistance increasingly takes the form of visible, performative subversion rather than silent evasion.105

Conclusion

The act of "signal tripping"—intentionally triggering government surveillance and monitoring systems to overt an interaction or send a friendly greeting—represents a highly complex and heavily contested friction point between civilian technological agency and state security apparatuses.

Technologically, the mechanisms to send a digital "hello" are ubiquitous and easily accessible. The manipulation of Application Layer variables, such as HTTP User-Agent strings or DNS TXT records, allows for precise, non-destructive messaging that is guaranteed to be logged by analyzing servers.26 The exploitation of plaintext protocols, such as the TLS Server Name Indication (SNI), provides direct visibility to network monitors before encryption entirely obscures the communication payload.16 Furthermore, interacting with deliberately exposed defensive tripwires, such as canary tokens or honeypots, ensures immediate, deterministic recognition by cybersecurity administrators.6

However, the legal architecture surrounding these technical acts is intensely punitive and structurally blind to non-malicious intent. The Computer Fraud and Abuse Act (CFAA) remains a formidable deterrent.52 Because federal courts permit the classification of routine incident response labor and forensic analysis as actionable "damage," the mere act of a government agency investigating a benign signal can effortlessly elevate a harmless interaction to a felony threshold.58 While the 2022 DOJ policy update offers a vital safe harbor for "good-faith security research," a strictly communicative signal tripping campaign likely falls outside this protection, exposing the actor to severe criminal and civil liabilities.5

Similarly, physical layer communications via radio frequencies are tightly bound by FCC Part 97 regulations, which explicitly forbid unsolicited one-way broadcasting, removing RF as a viable medium for overt surveillance greetings.84 The government's sanctioned avenues for interaction—namely Vulnerability Disclosure Programs (VDPs) and security.txt files—are strictly confined to the reporting of actionable security flaws, actively discouraging any testing, scanning, or signaling that does not serve to patch a critical vulnerability.74

Consequently, the most effective, legally insulated, and culturally impactful method of signal tripping resides in the realm of algorithmic protest. Artistic interventions like ScareMail successfully bypass the restrictive boundaries of the CFAA by manipulating the payload of legally authorized, standard communications.1 By poisoning keyword detection systems with synthetic, algorithmically generated narratives derived from official government watchlists, these projects force surveillance architectures to digest endless streams of false positives, effectively neutralizing the system's analytical power.8

Ultimately, overtly engaging with monitoring systems reveals the inherent vulnerability of mass surveillance: its total reliance on automated, context-blind data processing. While rigid technical frameworks and severe legal barriers prohibit direct, conversational engagement with the state's digital monitors, the strategic, artistic injection of noise into the surveillance stream remains a potent, highly visible, and legally defensible assertion of digital autonomy.

Works cited

1. ScareMail — Ben Grosser, accessed May 15, 2026, https://bengrosser.com/projects/scaremail/
2. Surveillance Technology \- DC Justice Lab, accessed May 15, 2026, https://dcjusticelab.org/surveillance-technology/
3. Scaremail \- Electronic Literature Collection, accessed May 15, 2026, https://www.collection.eliterature.org/3/work.html?work=scaremail
4. 100 Days Bug Bounty Challenge — Breaking Psychological Chains | by Batuhan Aydın, accessed May 15, 2026, https://medium.com/@batuhanaydinn/100-days-bug-bounty-challenge-breaking-psychological-chains-3324457d836c
5. Justice Manual | 9-48.000 \- Computer Fraud and Abuse Act | United ..., accessed May 15, 2026, https://www.justice.gov/jm/jm-9-48000-computer-fraud
6. What Is a Canary Token? Enterprise Detection Guide | Acalvio, accessed May 15, 2026, https://www.acalvio.com/resources/glossary/canary-tokens/
7. The Government's Word Games When Talking About NSA Domestic Spying, accessed May 15, 2026, https://www.eff.org/nsa-spying/wordgames
8. ScareMail plugin will flag all your email to the NSA | Gmail | The Guardian, accessed May 15, 2026, https://www.theguardian.com/technology/2013/oct/10/nsa-filter-scaremail-email-blacklist-plugin
9. GCPSG-021 (2025) Fundamentals of Detection Systems in Physical Security, accessed May 15, 2026, https://rcmp.ca/en/lead-security-agency-physical-security/guidance-and-publications/gcpsg-021-2025-fundamentals-detection-systems-physical-security
10. Russian Intelligence Services Target Commercial Messaging Application Accounts, accessed May 15, 2026, https://www.ic3.gov/PSA/2026/PSA260320
11. Experts explain Signal, cybersecurity, and how a journalist was sent high-level military intelligence | Virginia Tech News, accessed May 15, 2026, https://news.vt.edu/articles/2025/03/Signal-intelligence-leak-national-security-cybersecurity-military.html
12. Cyber-Crimes: A Practical Approach to the Application of Federal Computer Crime Laws \- Duane Morris, accessed May 15, 2026, https://www.duanemorris.com/articles/static/CyberCrime.pdf
13. A Survey of Worldwide Censorship Techniques \- IETF, accessed May 15, 2026, https://www.ietf.org/archive/id/draft-irtf-pearg-censorship-09.html
14. International Cyber Incidents \- CCDCOE, accessed May 15, 2026, https://ccdcoe.org/uploads/2018/10/legalconsiderations\_0.pdf
15. Legal Issues | Nmap Network Scanning, accessed May 15, 2026, https://nmap.org/book/legal-issues.html
16. Server Name Indication \- Wikipedia, accessed May 15, 2026, https://en.wikipedia.org/wiki/Server\_Name\_Indication
17. draft-hall-censorship-tech-06 \- A Survey of Worldwide Censorship Techniques \- IETF Datatracker, accessed May 15, 2026, https://datatracker.ietf.org/doc/draft-hall-censorship-tech/06/
18. Jordan: Measuring Facebook live-streaming interference during protests | OONI, accessed May 15, 2026, https://ooni.org/post/jordan-measuring-facebook-interference/
19. ProtoScan Measuring censorship in IPv6 \- arXiv, accessed May 15, 2026, https://arxiv.org/html/2508.07194v1
20. What Is Encrypted Server Name Indication (ESNI)? How Encrypted Client \- Trustico, accessed May 15, 2026, https://shop.trustico.com/blogs/stories/what-is-encrypted-server-name-indication-esni-how-encrypted-client-hello-ech-protects-your-privacy
21. Encrypted Client Hello \- Brian Lovin, accessed May 15, 2026, https://brianlovin.com/hn/37703885
22. Encrypted Client Hello \- Hacker News, accessed May 15, 2026, https://news.ycombinator.com/item?id=37703885
23. Security Now\! \#1027 \- 05-27-25 \- Artificial Intelligence, accessed May 15, 2026, https://www.grc.com/sn/sn-1027-notes.pdf
24. Block or allow ECH TLS connections | FortiGate / FortiOS 8.0.0 \- Fortinet Document Library, accessed May 15, 2026, https://docs.fortinet.com/document/fortigate/8.0.0/administration-guide/447220/block-or-allow-ech-tls-connections
25. A global assessment of third-party connection tampering \- The Cloudflare Blog, accessed May 15, 2026, https://blog.cloudflare.com/connection-tampering/
26. Privacy Policy \- Americans Who Tell The Truth, accessed May 15, 2026, https://americanswhotellthetruth.org/privacy-policy/
27. The COVID-19 Pandemic and the Technology Trust Gap \- Regulations.gov, accessed May 15, 2026, https://downloads.regulations.gov/FTC-2022-0053-1166/attachment\_4.pdf
28. An Architecture for Privacy-Sensitive Ubiquitous Computing By Jason I-An Hong B.S. (Georgia Institute of Technology) 1997 A dis, accessed May 15, 2026, https://www.cs.cmu.edu/\~jasonh/publications/jihdiss.pdf
29. UnGoogled Chromium: Chromium with enhanced privacy, control and transparency | Hacker News, accessed May 15, 2026, https://news.ycombinator.com/item?id=12577787
30. Questions About A Legal Notice Using A Government Website? : r/privacytoolsIO \- Reddit, accessed May 15, 2026, https://www.reddit.com/r/privacytoolsIO/comments/j1e9am/questions\_about\_a\_legal\_notice\_using\_a\_government/
31. NSA permanently targets the privacy-conscious: Merely searching the web for the privacy-enhancing software tools outlined in the XKeyscore rules causes the NSA to mark and track the IP address of the person doing the search. : r/worldnews \- Reddit, accessed May 15, 2026, https://www.reddit.com/r/worldnews/comments/29r9o5/nsa\_permanently\_targets\_the\_privacyconscious/
32. NSA Targets the Privacy-Conscious for Surveillance \- Schneier on Security, accessed May 15, 2026, https://www.schneier.com/blog/archives/2014/07/nsa\_targets\_pri.html
33. Friday Squid Blogging: Book by One Squid-Obsessed Person About Another \- Schneier on Security, accessed May 15, 2026, https://www.schneier.com/blog/archives/2014/09/friday\_squid\_bl\_440.html
34. Use DNS TXT to validate a domain on a pending OV or EV TLS certificate, accessed May 15, 2026, https://docs.digicert.com/en/certcentral/manage-certificates/supported-dcv-methods-for-validating-the-domains-on-ov-ev-tls-ssl-certificate-orders/use-the-dns-txt-validation-method-to-verify-domain-control.html
35. Email domain security guideline | For government | Queensland Government, accessed May 15, 2026, https://www.forgov.qld.gov.au/information-technology/queensland-government-enterprise-architecture-qgea/qgea-directions-and-guidance/qgea-policies-standards-and-guidelines/email-domain-security-guideline
36. Does DNS over HTTPS actually stop ISPs from knowing the sites you are visiting? \- Reddit, accessed May 15, 2026, https://www.reddit.com/r/privacy/comments/17zp7ax/does\_dns\_over\_https\_actually\_stop\_isps\_from/
37. Centralised DoH is bad for privacy, in 2019 and beyond \- PowerDNS Blog, accessed May 15, 2026, https://blog.powerdns.com/2019/09/25/centralised-doh-is-bad-for-privacy-in-2019-and-beyond
38. RFC 3865: A No Soliciting Simple Mail Transfer Protocol (SMTP) Service Extension, accessed May 15, 2026, https://www.rfc-editor.org/rfc/rfc3865.html
39. it's too complicated: how the internet upends katz, smith, and electronic surveillance \- Harvard Journal of Law & Technology, accessed May 15, 2026, https://jolt.law.harvard.edu/assets/articlePDFs/v30/30HarvJLTech1.pdf
40. Privacy Through Visibility: ScareMail as an Exploit in Computational Surveillance, accessed May 15, 2026, http://median.newmediacaucus.org/art-infrastructures-information/privacy-through-visibility-scaremail-as-an-exploit-in-computational-surveillance/
41. Cyber Deception \- Deception/Canaries/Honey X \- croninity, accessed May 15, 2026, https://www.croninity.com/post/cyber-deception-canaries-honey-x
42. Spying \- Dr Rajiv Desai, accessed May 15, 2026, https://drrajivdesaimd.com/2025/07/20/spying/
43. Catching Flies: A Guide to the Various Flavors of Honeypots | GIAC, accessed May 15, 2026, https://www.giac.org/paper/gcia/11078/catching-flies-guide-flavors-honeypots/144919
44. What is Canary in Cybersecurity? \- Fortinet, accessed May 15, 2026, https://www.fortinet.com/resources/cyberglossary/what-is-canary-in-cybersecurity
45. What are Canarytokens? \- Thinkst Canary, accessed May 15, 2026, https://help.canary.tools/hc/en-gb/articles/4701687447325-What-are-Canarytokens
46. Canary Tokens in Deception: A Smart Way to Detect Threats Early| Fidelis Security, accessed May 15, 2026, https://fidelissecurity.com/cybersecurity-101/deception/canary-tokens/
47. How to Use Canary Tokens for Threat Hunting | by Tahir \- Medium, accessed May 15, 2026, https://medium.com/@tahirbalarabe2/how-to-use-canary-tokens-for-threat-hunting-0d0508544d96
48. Toward a Multi-Echelon Cyber Warfare Theory: A Meta-Game-Theoretic Paradigm for Defense and Dominance \- arXiv, accessed May 15, 2026, https://arxiv.org/html/2509.08976v1
49. 1971 Annual Report of the Attorney General of the United States \- GovInfo, accessed May 15, 2026, https://www.govinfo.gov/content/pkg/GOVPUB-J-a081c87693ec0420a74d0988094f9e4d/html/GOVPUB-J-a081c87693ec0420a74d0988094f9e4d.htm
50. the tennessee law institute, accessed May 15, 2026, https://www.tncourts.gov/sites/default/files/docs/2021tli\_book.pdf
51. No Warrant, No Problem: How the Government Can Get Your Digital Data \- ProPublica, accessed May 15, 2026, https://www.propublica.org/article/no-warrant-no-problem-how-the-government-can-still-get-your-digital-data
52. The Computer Fraud and Abuse Act: Protecting the United States from Cyber-Attacks, Fake Dating Profiles, and Employees Who, accessed May 15, 2026, https://repository.law.miami.edu/cgi/viewcontent.cgi?article=1078\&context=umnsac
53. Governing Private Sector Self-Help in Cyberspace: Analogies From the Physical World, accessed May 15, 2026, https://carnegieendowment.org/research/2018/12/governing-private-sector-self-help-in-cyberspace-analogies-from-the-physical-world
54. When Broader Is Better: Interpreting the Computer Fraud and Abuse Act When Employees Exceed Authorization to Access Data \- LARC @ Cardozo Law, accessed May 15, 2026, https://larc.cardozo.yu.edu/cgi/viewcontent.cgi?article=1935\&context=cardozoaelj
55. CHALLENGING GOVERNMENT HACKING IN CRIMINAL CASES \- ACLU, accessed May 15, 2026, https://www.aclu.org/wp-content/uploads/publications/malware\_guide\_3-30-17-v2.pdf
56. DOJ Clarifies Policy for Prosecutions Under Computer Fraud & Abuse Act, accessed May 15, 2026, https://www.pietragallo.com/business-blog/doj-clarifies-policy-for-prosecutions-under-the-computer-fraud-and-abuse-act/
57. Alhathloul v. DarkMatter Group et al, No. 3:2021cv01787 \- Document 151 (D. Or. 2025), accessed May 15, 2026, https://law.justia.com/cases/federal/district-courts/oregon/ordce/3:2021cv01787/164325/151/
58. Case 5:25-cv-01673-GTS-CBF Document 9 Filed 01/23/26 Page 1 of 133 \- GovInfo, accessed May 15, 2026, https://www.govinfo.gov/content/pkg/USCOURTS-nynd-5\_25-cv-01673/pdf/USCOURTS-nynd-5\_25-cv-01673-0.pdf
59. Riana Pfefferkorn, Shooting the Messenger: Remediation of Disclosed Vulnerabilities as CFAA “Loss,” 29 RICH. JL & TECH. 89 (2022)., accessed May 15, 2026, https://jolt.richmond.edu/files/2022/11/Pfefferkorn-Manuscript-Final.pdf
60. DOJ Enforcement \- Search Results | Cybersecurity Law Report, accessed May 15, 2026, https://www.cslawreport.com/search/?tagType=topics\&tagName=DOJ+Enforcement\&tagID=20481
61. DOJ Announces It Will Not Charge CFAA Violations for Good-Faith Security Research, accessed May 15, 2026, https://www.tradesecretslaw.com/2022/06/articles/computer-fraud-and-abuse-act/doj-announces-it-will-not-charge-cfaa-violations-for-good-faith-security-research/
62. Patching the CFAA so Researchers No Longer Pay, accessed May 15, 2026, https://open.mitchellhamline.edu/cgi/viewcontent.cgi?article=1141\&context=cybaris
63. No Warrant, No Problem: How The Government Can Still Get Your Digital Data, accessed May 15, 2026, https://www.lvcriminaldefense.com/no-warrant-no-problem-how-the-government-can-still-get-your-digital-data/
64. Ending Privacy's Gremlin: Stopping the Data-Broker Loophole to the Fourth Amendment's Search Warrant Requirement \- Scirp.org., accessed May 15, 2026, https://www.scirp.org/journal/paperinformation?paperid=136925
65. Federal Court Finally Sets Some Limits On Cell Phone Ping Warrants \- Techdirt., accessed May 15, 2026, https://www.techdirt.com/2024/10/31/federal-court-finally-sets-some-limits-on-cell-phone-ping-warrants/
66. Warrant-Proof Encryption and Lawful Access \- FBI, accessed May 15, 2026, https://www.fbi.gov/how-we-investigate/lawful-access
67. Lawful Access: Myths vs. Reality \- FBI, accessed May 15, 2026, https://www.fbi.gov/how-we-investigate/lawful-access/lawful-access-myths-vs-reality
68. 39-17-308. Harassment; exclusions for electronic communications service | WomensLaw.org, accessed May 15, 2026, https://www.womenslaw.org/laws/tn/statutes/39-17-308-harassment-exclusions-electronic-communications-service
69. Tennessee Department of Education | November 2024 \- TN.gov, accessed May 15, 2026, https://www.tn.gov/content/dam/tn/education/documents/Tennessee\_School\_Health\_Laws\_2024.pdf
70. Hostile Work Environment In California: What Counts As “Severe Or Pervasive” Harassment, accessed May 15, 2026, https://www.hr.law/blog/hostile-work-environment-in-california-what-counts-as-severe-or-pervasive-harassment/
71. workplace violence \- OPM, accessed May 15, 2026, https://www.opm.gov/policy-data-oversight/worklife/reference-materials/workplaceviolence.pdf
72. Section 12: Religious Discrimination | U.S. Equal Employment Opportunity Commission, accessed May 15, 2026, https://www.eeoc.gov/laws/guidance/section-12-religious-discrimination
73. Preventing and Addressing Workplace Harassment, accessed May 15, 2026, https://www.uscg.mil/Portals/0/Headquarters/civilrights/Workplace\_Training/PAWH\_Facilitator\_Guide.pdf
74. Security.txt \- Wikipedia, accessed May 15, 2026, https://en.wikipedia.org/wiki/Security.txt
75. Cybersecurity Performance Goals 2.0 (CPG 2.0) \- CISA, accessed May 15, 2026, https://www.cisa.gov/cybersecurity-performance-goals-2-0-cpg-2-0
76. A Critical Line of Defense-The Security.txt File's Potential to Mitigate School Cybersecurity Attacks \- The Future of Privacy Forum, accessed May 15, 2026, https://fpf.org/blog/a-critical-line-of-defense-the-security-txt-files-potential-to-mitigate-school-cybersecurity-attacks/
77. Vulnerability Disclosure Policy | U.S. Department of Education, accessed May 15, 2026, https://www.ed.gov/about/ed-overview/required-notices/vulnerability-disclosure-policy
78. Vulnerability Disclosure Policy \- National Indian Gaming Commission, accessed May 15, 2026, https://www.nigc.gov/utility/vulnerability-disclosure-policy/
79. Vulnerability Disclosure Program (VDP) Policy and Rules of ..., accessed May 15, 2026, https://www.dhs.gov/sites/default/files/2023-05/22\_1222\_vdp-policy-roe-approved.pdf
80. Vulnerability Disclosure Policy \- HHS.gov, accessed May 15, 2026, https://www.hhs.gov/vulnerability-disclosure-policy/index.html
81. Before the Federal Communications Commission Washington, D.C. 20554 In the Matter of Amendment of Parts 2 and 25 of the Commissi, accessed May 15, 2026, https://docs.fcc.gov/public/attachments/FCC-98-310A1.pdf
82. Part 97 Text \- ARRL, accessed May 15, 2026, https://www.arrl.org/part-97-text
83. FCC Rules, descriptions and definitions for the Amateur Radio Service, operator and station license responsibi, accessed May 15, 2026, http://www.w9mks.org/wp-content/uploads/2016/01/2014-2018-Tech-Pool.pdf
84. Section 8.6: Authorized and Prohibited Transmissions | The HamStudy Technician License HamBook (2022, accessed May 15, 2026, https://hambook.org/tech2022/pt2/chpt8/section-86-authorized-and-prohibited-transmissions/
85. Amateur Communications & Operations FAQ, accessed May 15, 2026, https://www.fcc.gov/wireless/bureau-divisions/mobility-division/amateur-radio-service/amateur-communications-operations
86. FCC RULES PART 97 \- QSL.net, accessed May 15, 2026, https://www.qsl.net/k/k6eag//rdf-sf/library/KN6FW%20Tech%20Class/Tech%20AM%202%202014--7-9-15.pdf
87. ethics and operating procedures for the radio amateurr \- ARRL, accessed May 15, 2026, https://www.arrl.org/files/file/DXCC/Eth-operating-EN-ARRL-CORR-JAN-2011.pdf
88. Communications Act of 1934, accessed May 15, 2026, https://www.fcc.gov/sites/default/files/communications-act-1934.pdf
89. Using HAM like walkie talkie : r/amateurradio \- Reddit, accessed May 15, 2026, https://www.reddit.com/r/amateurradio/comments/1f6dh82/using\_ham\_like\_walkie\_talkie/
90. General consensus regarding emergency communications : r/amateurradio \- Reddit, accessed May 15, 2026, https://www.reddit.com/r/amateurradio/comments/p3hf3p/general\_consensus\_regarding\_emergency/
91. ARRL Amateur Radio Education & Technology Program \- Unit 8—FCC Rules and Regulations Radios, accessed May 15, 2026, https://www.arrl.org/files/file/LabHandbook/RLH%20Unit%208.pdf
92. 47 CFR 97.203 \-- Beacon station. \- eCFR, accessed May 15, 2026, https://www.ecfr.gov/current/title-47/chapter-I/subchapter-D/part-97/subpart-C/section-97.203
93. purpose and permissible use of the Amateur Radio Service, operator/primary station license grant \- HamStudy.org, accessed May 15, 2026, https://hamstudy.org/browse/E2\_2018/T1A
94. Is encrypted messaging pointless when surrounded by surveillance-capable devices? : r/privacy \- Reddit, accessed May 15, 2026, https://www.reddit.com/r/privacy/comments/1n3g4fl/is\_encrypted\_messaging\_pointless\_when\_surrounded/
95. Does HTTPS encryption on a site prevent the NSA from knowing you visited its domain / the URL?, accessed May 15, 2026, https://security.stackexchange.com/questions/78682/does-https-encryption-on-a-site-prevent-the-nsa-from-knowing-you-visited-its-dom
96. NSA files decoded: Edward Snowden's surveillance revelations explained | US news | theguardian.com, accessed May 15, 2026, https://www.theguardian.com/world/interactive/2013/nov/01/snowden-nsa-files-surveillance-revelations-decoded
97. ScareMail – Benjamin Grosser, attractive email for NSA | Neural, accessed May 15, 2026, https://neural.it/2014/02/scaremail-benjamin-grosser/
98. Colliding ideas: Artistic explorations of data surveillance and data protection, accessed May 15, 2026, https://policyreview.info/articles/analysis/artistic-explorations-data-surveillance-data-protection
99. \[The Eleventh HOPE\] Schedule, accessed May 15, 2026, https://xi.hope.net/schedule.html
100. Engineering Privacy and Protest: a Case Study of AdNauseam \- CEUR-WS.org, accessed May 15, 2026, https://ceur-ws.org/Vol-1873/IWPE17\_paper\_23.pdf
101. ScareMail Tries To Disrupt NSA Email Surveillance \- Hackaday, accessed May 15, 2026, https://hackaday.com/2013/11/28/scaremail-tries-to-disrupt-nsa-email-surveillance/
102. Uncertain Archives: Critical Keywords for Big Data 9780262539883, 0262539888 \- DOKUMEN.PUB, accessed May 15, 2026, https://dokumen.pub/uncertain-archives-critical-keywords-for-big-data-9780262539883-0262539888.html
103. Resisting Surveillance Through Art \- National Communication Association, accessed May 15, 2026, https://www.natcom.org/publications-library/resisting-surveillance-through-art/
104. (PDF) Call Me BIG PAPA: An Extension of Mason's Information Ethics Framework to Big Data \- ResearchGate, accessed May 15, 2026, https://www.researchgate.net/publication/344323939\_Call\_Me\_BIG\_PAPA\_An\_Extension\_of\_Mason's\_Information\_Ethics\_Framework\_to\_Big\_Data
105. Your Guide to Watching the Watchers \- Belfer Center, accessed May 15, 2026, https://www.belfercenter.org/publication/your-guide-watching-watchers
106. The Fourth Amendment in the Digital Age \- Brennan Center for Justice, accessed May 15, 2026, https://www.brennancenter.org/media/7399/download
107. Privacy Nicks: How the Law Normalizes Surveillance \- Washington University Law Review, accessed May 15, 2026, https://wustllawreview.org/2024/03/18/privacy-nicks-how-the-law-normalizes-surveillance/
108. Rethinking the State of Surveillance through Art | Fusing Art & Science \- YouTube, accessed May 15, 2026, https://www.youtube.com/watch?v=wZfQOKI\_R70