A few days ago, a GitHub repository called MasterDnsVPN racked up over 1,400 bookmarks in a matter of days. It’s a DNS tunnelling VPN — a tool that encodes internet traffic inside DNS queries to bypass censorship in environments where only DNS traffic is permitted. Built by an Iranian developer called Amin Mahmoudi, it’s optimised for filtered networks, unstable connections, and strict MTU limits. It supports multipath routing, packet duplication, and SOCKS5 proxying.
If you don’t understand what that means technically, don’t worry. What matters is what it represents. In 2026, as the EU mandates digital identity wallets and the UK pushes age verification that amounts to digital ID by the back door, someone in Iran built a tool that tunnels through the last protocol governments can’t block without breaking the internet itself. And thousands of people bookmarked it in days.
This isn’t new. This is a pattern. And it’s been running for thirty-five years.
The Manifestos That Started a War
In 1988, Timothy C. May — a retired Intel physicist — wrote The Crypto Anarchist Manifesto. Its opening line borrowed from Marx with deliberate irony: “A specter is haunting the modern world, the specter of crypto anarchy.”
May’s vision was precise and prophetic. He foresaw a world where cryptography would allow two people to “exchange messages, conduct business, and negotiate electronic contracts without ever knowing the True Name, or legal identity, of the other.” He predicted these developments would “alter completely the nature of government regulation, the ability to tax and control economic interactions, the ability to keep information secret, and will even alter the nature of trust and reputation.”
He also predicted the state’s response: “The State will of course try to slow or halt the spread of this technology, citing national security concerns, use of the technology by drug dealers and tax evaders, and fears of societal disintegration.” Then the kicker: “But this will not halt the spread of crypto anarchy.”
Five years later, on 9 March 1993, Eric Hughes published A Cypherpunk’s Manifesto. Where May was strategic, Hughes was philosophical. His opening line became the movement’s creed: “Privacy is necessary for an open society in the electronic age.”
Hughes drew a crucial distinction that most people still don’t grasp: “Privacy is not secrecy. A private matter is something one doesn’t want the whole world to know, but a secret matter is something one doesn’t want anybody to know. Privacy is the power to selectively reveal oneself to the world.”
That distinction matters more now than it did in 1993. Because what the UK and EU are building isn’t about catching criminals. It’s about eliminating the possibility of selective revelation. It’s about making every online action attributable to a verified, state-issued identity. It’s about destroying the space between public and private.
The cypherpunk mailing list that spawned these ideas — launched in 1992 by Hughes, May, and John Gilmore (co-founder of the Electronic Frontier Foundation and Sun Microsystems employee number five) — became one of the most consequential forums in technological history. Its alumni read like a who’s who of digital liberation: Phil Zimmermann, Hal Finney, Julian Assange, Adam Back, Bram Cohen, and many more. Gilmore’s maxim became an internet proverb: “The net interprets censorship as damage and routes around it.” That wasn’t optimism. It was an engineering observation.
The Man Who Armed the Rebels
Phil Zimmermann is not a household name, but he should be. In 1991, he created Pretty Good Privacy (PGP) — a program that gave ordinary people access to military-grade encryption for the first time. He released it as freeware, and it spread across the early internet like wildfire.
The US government was not pleased. They launched a three-year criminal investigation into Zimmermann for “arms export without a licence.” At the time, strong encryption was legally classified as a munition — the same category as missiles and tanks. Sharing PGP internationally was, in the government’s view, no different from shipping weapons to a foreign power.
Zimmermann’s response was one of the great acts of civil disobedience in the digital age. He published the entire PGP source code as a printed book, then exported the book. Books are protected speech under the First Amendment. The government couldn’t prosecute him for publishing a book without simultaneously admitting that code is speech. The investigation was dropped in 1996. The principle won.
His most famous line cuts to the heart of every surveillance debate since: “If privacy is outlawed, only outlaws will have privacy.”
Think about that. Truly think about it. If you make strong encryption illegal, you don’t eliminate it — you just ensure that only criminals and state intelligence agencies have access to it. Everyone else — journalists, activists, businesses, ordinary citizens — gets nothing. The power asymmetry doesn’t shrink. It becomes absolute.
The Chaotic Prophet
John McAfee was not a cypherpunk in the purist sense. He was erratic, contradictory, and frequently his own worst enemy. But he embodied something the movement needed: a visible, unapologetic refusal to submit to state authority over the individual.
McAfee’s war with governments spanned decades and continents — from Belize to the United States to Spain. He was wanted for questioning in a murder case, charged with tax evasion, and spent his final years on the run. His positions were extreme but internally consistent: taxation is theft, privacy is a right, and governments are the primary threat to both.
He was arrested in Spain in October 2020 and held in Barcelona’s Brians 2 prison. On 23 June 2021, hours after a Spanish court approved his extradition to the United States, he was found dead in his cell.
From prison, months earlier, he’d written: “I am content in here. I have friends. The food is good. All is well. Know that if I hang myself, à la Epstein, it will be no fault of mine.”
Whether you see McAfee as a martyr or a cautionary tale depends on your priors. But his central insight was correct: “Governments sometimes turn paranoid. And they fear things. And sometimes the thing they fear the most is the populace.”
That fear is what drives digital ID mandates. Not child safety. Not fraud prevention. Fear of ungovernable citizens.
And then there’s Julian Assange — a cypherpunk before he was anything else. Before WikiLeaks, before the embassy, before the headlines, Assange was a teenage hacker in Melbourne operating under the handle “Mendax.” He joined the cypherpunk mailing list in 1993, contributed to the development of the Rubberhose deniable encryption system, and ran one of Australia’s first public internet service providers. His guiding principle — “privacy for the weak, transparency for the powerful” — was pure cypherpunk philosophy. Whether you agree with everything he did afterwards, his starting point was the same as Zimmermann’s, Hughes’s, and May’s: cryptography is a tool of liberation, and those who wield power should fear transparency, not the other way around.
The Evolution of Resistance Tools
Here’s the timeline that matters. Every entry is a response to a tightening of control:
1991 — PGP. Phil Zimmermann gives the world encrypted email. The US government calls it arms trafficking. The code survives.
1995 — SSH. Tatu Ylönen, a Finnish researcher, creates Secure Shell after a password-sniffing attack on his university network. Secure remote access becomes standard.
Mid-1990s — Onion Routing. The US Naval Research Laboratory develops the concept. Yes, the US military invented the foundational technology behind anonymous browsing. The irony writes itself.
2002 — Tor. Roger Dingledine and Nick Mathewson build The Onion Router on the NRL’s research. The EFF funds its development. It goes open source because, as the developers understood, “anonymity loves company” — the more people use it, the harder it is to identify anyone.
2009 — Bitcoin. Satoshi Nakamoto mines the genesis block on 3 January 2009, embedding a message from that day’s Times: “Chancellor on brink of second bailout for banks.” It’s simultaneously a timestamp and a manifesto — a statement that the existing financial system has failed, and a cryptographic alternative now exists. Hal Finney — cypherpunk pioneer, operator of the first anonymous remailer — receives the first-ever Bitcoin transaction.
2014 — Signal. Moxie Marlinspike and Open Whisper Systems launch Signal, making end-to-end encrypted messaging accessible to anyone with a smartphone. The Signal Protocol is later adopted by WhatsApp, Facebook Messenger, and Google Messages. The principle is simple: not even Signal itself can read your messages.
2016 — WireGuard. Jason Donenfeld creates WireGuard — a VPN protocol so elegant that Linus Torvalds called it “a work of art” when merging it into the Linux kernel. At roughly 4,000 lines of code versus the hundreds of thousands in IPsec, it’s auditable by a single person. That matters.
2026 — DNS Tunnelling VPNs. MasterDnsVPN encodes TCP traffic inside DNS queries — the one protocol that can’t be blocked without breaking the internet entirely. It’s designed for Iran, where only DNS traffic is permitted. But the technique is universal.
The pattern is clear. Every time governments tighten control, the tools evolve. The tools have never lost. Not once.
The Current Threat: Digital ID as Internet Access Control
Let’s talk about what’s happening right now.
In the UK, the Online Safety Act came into full enforcement in July 2025. Ofcom mandates “highly effective” age assurance for online services. By February 2026, they’d launched investigations into over 90 online services and issued six fines for non-compliance. In March 2026, the UK government launched a public consultation on a new digital ID system, exploring whether to issue it from age 16 — or even 13.
Think about that. A 13-year-old with a state-issued digital identity required to access the internet. That’s not protecting children. That’s training a generation to accept surveillance as normal.
In Europe, it’s worse. The eIDAS 2.0 regulation came into force on 20 May 2024. By late 2026, every EU member state must offer at least one certified digital identity wallet to its residents. By late 2027, large online platforms, banks, healthcare providers, and telecoms must accept these wallets as authentication. The target: 80% of European citizens carrying a functional digital identity wallet by 2030.
The inversion is total. The presumption has flipped from “innocent until proven guilty” to “unidentified until verified.” Every session. Every click. Every search. Attributable to a verified identity.
The chilling effect on speech, dissent, journalism, and whistleblowing is not a side effect. It’s the point. When every action is traceable, self-censorship becomes automatic. You don’t need to prosecute people for speaking freely if they never speak freely in the first place.
And if you want to see where this road leads, look east. China launched a national online identity authentication system in 2025, issuing “Internet certificates” — unique codes tied to real-name identities. In April 2026, leaked notices from Shaanxi Telecom revealed mandates to block all outbound international connections, including to Hong Kong and Macau. A proposed Cybercrime Prevention and Control Law explicitly criminalises tools that circumvent the Great Firewall. The social credit system integrates it all: financial, social, and legal data fused into a single trustworthiness score.
That’s not a dystopian novel. That’s an operational system. And the EU is building the same infrastructure — just with better branding.
The Moral Case for Privacy and Autonomy
Let’s get philosophical, because this deserves it.
The “nothing to hide” argument is the most intellectually bankrupt position in the entire surveillance debate. Edward Snowden dismantled it in a 2015 Reddit AMA with a single sentence: “Arguing that you don’t care about the right to privacy because you have nothing to hide is no different than saying you don’t care about free speech because you have nothing to say.”
Then he went further: “Nobody needs to justify why they ‘need’ a right: the burden of justification falls on the one seeking to infringe upon the right. But even if they did, you can’t give away the rights of others because they’re not useful to you. More simply, the majority cannot vote away the natural rights of the minority.”
That’s it. That’s the entire argument. Rights don’t require justification. The burden is on those who would take them away.
This isn’t a modern idea. In 1890, Samuel Warren and Louis Brandeis published “The Right to Privacy” in the Harvard Law Review — the first American legal article to argue for a right to privacy. Brandeis later described it as “the most comprehensive of rights and the right most valued by civilised men.” He called it simply “the right to be let alone.”
John Stuart Mill’s harm principle, articulated in On Liberty in 1859, is even more direct: the state has no legitimate business interfering in actions that do not harm others. My reading habits, my browsing history, my private conversations, my financial transactions — these are mine. They harm no one. They are not the state’s concern.
The libertarian position is not complicated. Rights predate government. Privacy is not granted by the state; it exists inherently. A government that demands to verify your identity before you can read a newspaper or send a letter has no legitimate authority to do so, regardless of the technology involved. The medium changes. The principle doesn’t.
The Paradox: Zanzibar vs. Brussels
While the EU constructs its digital panopticon, something remarkable is happening 8,000 kilometres south.
Zanzibar — yes, Zanzibar — is building the world’s first fully automated Special Digital Economic Zone in partnership with ThreeFold. They’ve approved a cryptocurrency-focused cyber city called Dunia, operating under Digital Free Zone legislation with a 10-year tax exemption, no capital gains tax, and blockchain-based administrative systems. They’ve launched a national blockchain sandbox for startups. They’re actively courting digital nomads with crypto-native infrastructure.
This isn’t charity. It’s competition. Zanzibar understands something Brussels doesn’t: capital, talent, and innovation flow toward freedom. They always have. When some jurisdictions choose control and others choose openness, the result is jurisdictional arbitrage on a global scale. The people who build things go where they’re allowed to build them.
The same pattern played out in the 1990s when restrictive US crypto export laws pushed encryption development offshore. It played out in the 2010s when overregulation of fintech pushed innovation to Singapore, Switzerland, and Estonia. It’s playing out again now.
The EU can mandate digital identity wallets. But it can’t mandate that the people who build the future choose to live under that system.
Where This Ends
It doesn’t end. That’s the point.
The arms race between state surveillance and individual privacy has been running since the invention of the sealed envelope. Governments push harder. The tools get better. Cryptography is mathematics, and you can’t legislate mathematics out of existence any more than you can repeal gravity.
Phil Zimmermann proved it in 1991 when he published code as a book. The Tor developers proved it in 2002 when they turned the US military’s own research into a tool for anonymous browsing. Satoshi Nakamoto proved it in 2009 when a pseudonymous figure created an entire financial system that no government has managed to shut down. Amin Mahmoudi is proving it right now, in 2026, by encoding free internet access inside DNS queries in Iran.
The question isn’t whether privacy survives. It will. The question is whether it remains legal or goes underground. Whether governments accept that some freedoms are non-negotiable, or whether they force an entire generation of privacy-conscious citizens into the same legal grey zone that Phil Zimmermann occupied in 1993.
Every surveillance law passed with good intentions creates the infrastructure for abuse by whoever comes next. The database built to verify ages becomes the database that tracks political dissidents. The digital ID system designed for convenience becomes the system that denies services to the non-compliant. This isn’t speculation — it’s the documented history of every surveillance infrastructure ever built. The Five Eyes intelligence alliance, the NSA’s bulk collection programs that Snowden exposed, China’s social credit system — all started with limited, “reasonable” objectives. All expanded. All always do.
Timothy May saw it coming nearly four decades ago: “Just as the technology of printing altered and reduced the power of medieval guilds and the social power structure, so too will cryptologic methods fundamentally alter the nature of corporations and of government interference in economic transactions.”
Eric Hughes said it plainly: “Cypherpunks write code.”
They still do. And the code still wins.
If you care about this — and you should — here’s what you can do. Use Signal for messaging. Use a VPN. Understand what end-to-end encryption means and demand it from every service you use. Support the Electronic Frontier Foundation, the Tor Project, and the open-source developers building the tools that keep the tunnels open. Run a Tor relay. Contribute to open-source privacy software. Teach your children that privacy is not something to be ashamed of — it’s something to be defended.
The walls are going up. But the cypherpunks have been tunnelling for thirty-five years. And they’re not stopping now.
“Arise, you have nothing to lose but your barbed wire fences!”
— Timothy C. May, The Crypto Anarchist Manifesto, 1988
