On Friday, the seniors at my school were filling out 'post-grad' surveys and the QR codes were posted in my room. This was done without warning, but with no protest from me.
As students milled in and out, my coworker – the "survey facilitator," if you will – caught a glimpse of a privacy guide that I was reading, and what ensued was a long conversation about privacy and its importance.
This conversation is a well rehearsed dance for me at this point, I know which arguments to concede and which ones I can win, I've learned people respond best when the conclusion that they come to is not "I have something to hide."
But it takes seniors 4-hours to fill out an 8-question survey, so slowly our conversation drifted into exploring how I find the time to care so much and also develop privacy software full-time.
My background is not what people expect when they hear someone is building privacy infrastructure. I teach high school.
Before teaching I worked in a bioinformatics lab on a project connected to NASA, analyzing gene homologs in cyanobacteria using hidden Markov models. Before that I spent time in Omaha doing community outreach with families dealing with lead contamination in their homes and yards, trying to build trust between people who had every reason to distrust the institutions and the government officials who were supposed to be helping them.
What those things have in common is that they all required me to hold a technical problem and a human problem at the same time and find language that connected them. That is also what 404 requires. The best tool in the world does not matter if the people who need it cannot understand why they need it, cannot trust it, or cannot fit it into their actual life. Privacy is a communication problem and a trust problem and an adoption problem, and those are not any more difficult to address than the engineering, but they are more hidden.
Simply put, no one else is doing it, so I just have to.
Foucault's Biopolitics
"State funded morality class," is a common outburst among sixteen year-olds when you teach them Foucault; from adults you mostly get eye rolls. But for me, at 21 sitting in an economics class, his work showed me something I had been trying to put into words for quite some time.
Foucault's insight wasn't that governments are cruel, though they often are, it was that power doesn't need a villain. Surveillance begets power not because the guard is always watching, but because you can never be sure he isn't. When that's the case, an entire population can be taught to comply – or face the consequences for even thinking about not.
My professor told us, "This is how the state disables bodies. Not just disabled people, but women. Black people. Anyone who can be marked as 'other' gets disabled – made either illegible or too legible to power."
From Institution to the Internet
In 1990, a french-man named Gilles Deleuze wrote on Foucault's ideas and how they were evolving into modern day control societies. These ideas differed from Foucault's definition of control, which required prisons, hospitals, schools – enclosed spaces – to sort bodies into categories that could be controlled.
The control societies that Deleuze identifies do not have a place outside of that control. The institution is not what exerts power over a society, but rather the society that exerts power over itself. This is your credit score, redlining, the poverty line, and all the other labels that are assigned to you by some outside entity and used to make decisions for or about you. This is the internet and the ad-tech tracking apparatus that has been used to turn our attention into capital gain.
Power no longer needs a space to exert itself in. Now, the control is passive and it allows for a consistent grip on a governing body's population.
In his essay, Deleuze makes a call for "new weapons" to break out of this cycle of control. The work that I do is informed by that call to action.
There's No Opt-Out
When talking to a journalist recently, he noted to me that this is not a single point of failure but rather a full-stack issue in which technology is made for the state and not for function.
This 'full-stack' part of the picture became clear to me just before I started building 404. In the months leading up to the initial commit I began doing a digital triage of my life. I was submitting dozens of data removal requests, deleting my social media, moving all of my emails over to Proton, and self-hosting my own cloud and image library.
All of these solutions are future oriented, they say, "you can no longer have access to my data." The true issue arises when you start thinking about the digital footprint you've already left and what the people collecting your data already know. Additionally, data removal requests don't prevent these brokerage companies from collecting more of your data or starting a 'new' profile for you.
Short of automating dozens of emails to send every month or paying for another subscription to manage it for you, there is no way to stop a behavioral data profile from being built on you.
Not to mention, these opt-out signals are a behavioral tell in and of themself – I started getting VPN ads, opt-out service ads, and even identity protection ads. In trying to delete my data, I gave them more hints about who I was and what I cared about.
For most people, persistent cross-session tracking means an increasingly narrow version of the internet. Ads that follow you. An algorithmic feed that reflects your past behavior back at you rather than expanding it. A credit score or insurance model quietly shaped by inferences drawn from your browsing patterns. These harms are real and they are underappreciated, but they are diffuse. Hard to point to. Easy to dismiss.
For others the stakes are more immediate. A journalist researching a target site repeatedly over the course of a weeks-long investigation. An immigration attorney whose research pattern across government portals reveals which clients the firm is representing. A human rights organization whose staff devices are identifiable to the government they are documenting. In these situations, a stable, persistent fingerprint is not an advertising problem; it is a safety problem. It exposes intent. It reveals professional relationships. It tells the subject of an investigation that someone is investigating them, before that someone is ready to be known.
Open Source Software as Speech
404 started as a personal tool that I could use to make my digital self a little less legible and to give myself a bubble of freedom in a world of overarching surveillance.
In my research and development, I identified two key issues with the current suite of privacy tools. The first is that many don't address this full-stack problem. Privacy browsers such as Mullvad rely on another tool (VPN) to cover the rest of your fingerprinting surface. Misconfiguration or misuse of these tools can also lead to your identity or fingerprint being leaked.
The second issue is adopt-ability and the increased scrutiny that an individual can be put under just for using these tools. Even Tor has faced critique for addressing the visibility issues that certain privacy tools introduce.
The Tor Browser's security is weak which makes the privacy protection weak. The need to avoid diversity (fingerprinting) creates a monoculture for the most interesting targets. This needs to change, especially since Tor itself makes people into much more of a target (both locally and by the exit nodes).
- GrapheneOS Team
This is not to say Mullvad or Tor are bad options, on the contrary in-fact. These are tools much more hardened for their use-case than 404 is. They're backed by institutions that have been fighting for privacy for many years and engineers that have been working on the problem for more hours than I've been alive.
Nonetheless, as the technology used to violate user-privacy evolves, so must the technology built to prevent it.
So I built 404.
It is a local proxy, written in Rust, that sits between your browser and the internet rewriting your fingerprint before anything leaves your machine. Paired with a Linux eBPF module that handles the packet-level signals, the TCP/IP values that allow passive OS identification at the network layer. Both components take their values from a single profile: a carefully constructed description of a real, common device. The goal is not to look like nobody. The goal is to look like somebody else, consistently and plausibly, across every layer of the stack at once.
No traffic passes through external servers. There are no external servers. The code is public. The profiles are open source.
404 is not going to dismantle the surveillance economy. I am not under any illusion that a proxy built by a teacher is going to restructure the relationship between commercial data infrastructure and state power.
What I think is possible is narrower than that, and more real. Give the people who need it most a practical tool for one layer of a problem that currently has no practical solution. Make the fingerprint less stable. Make the pattern of your research not reveal your intent to the subject of your research. Make one thing easier than it was yesterday for someone whose work depends on it.
That is the mission. 404 is open source, the code is on GitHub, and the documentation is at un-nf.github.io/404-docs.
If this is a problem you are living with, I would like to hear from you.
