Unlimited Unthrottled Anonymous LTE Access

Protecting privacy and enabling free speech on the Internet is germane to a healthy society and functioning democracy. Unfortunately, we too frequently find ourselves victims of an escalating war against privacy. Whether you're worried about your Government using their powers to snoop in your personal life or are simply tired of the ever-present panopticon tracking every fucking thing you do, you have options to fight back.

This post will walk you through improving your personal privacy by acquiring and using an unlimited, unthrottled, and anonymous* LTE hotspot offered through The Calyx Institute, all for about $40 a month. When The Calyx Institute states their LTE service is unlimited and unthrottled, they absolutely mean it -- I've yet to experience slowdowns after using a metric shit-ton of data.

Note: this is not the first article which describes this invaluable service. However, most of these articles are focusing on saving money through usage of this service as a primary ISP. This is not my intent. Rather, this post will focus the history behind this LTE offering, the very real and ongoing fight to keep this service operational, and some basic OPSEC to keep in mind.

*For some definition of anonymous.

The History Behind Unthrottled LTE

If you're impatient and just want to get a hotspot, skip this next section.

I am personally shocked that unlimited, unthrottled LTE is accessible in the United States in late 2019, especially at the reasonable price of $40 a month.

Given mobile carrier plans are in a race to the bottom with expensive data, surplus charges, and aggressive throttling, this service should not logically exist. Yet it does. I'm going to quickly walk through the history behind this LTE service and how it could quickly disappear given the FCC is hell-bent on commercializing the wireless spectrum and we are seeing massive consolidation of wireless service providers.

The Educational Broadband Service

Our story starts back in the 1960s when the U.S. Government created a reservation for 114 MHz of the 2.5GHz wireless band. Known as the Educational Broadband Service (EBS), this band was only accessible to licensed academic and educational institutions. This ultimately reserved a massive chunk of high-speed, high-capacity spectrum that was inaccessible to the commercial industry.

In 1983, in an effort to encourage further adoption of the spectrum, the FCC allowed for excess capacity sales of the spectrum to commercial entities. As long the EBS licensee maintained good standing and complied with FCC regulations, they could sell most of their unused spectrum capacity to commercial entities. The best part? They could sign an agreement as long as 30 years. This is important as we will see shortly.

Game of Thrones: Mobile Carrier Edition

Fast-forward to 2006 and we find demand for wireless spectrum for high-speed cellular communications is exploding. With protected access to the EBS spectrum, nonprofit, academic, and educational institutions face massive demand from commercial wireless carriers. Using the excess capacity clause ruled by the FCC back in 1983, EBS licensees began collaborating, sharing, and selling portions of their spectrum allocation.

Relevant to our story are 5 EBS licensees, operating under the trade name Voqal, who formed such an agreement with the wireless internet service provider Clearwire Corporation. As part of the 30-year agreement, Voqal would lease a large portion of their EBS spectrum directly to Clearwire in exchange for unlimited, high-speed broadband access for schools, libraries, educational institutions, and nonprofit organizations. This access would be granted in terms of cost-free education accounts (CFEAs) which could be given away or resold at very favorable rates to qualifying educational institutions and nonprofit organizations.

To help qualified organizations gain access to these CFEAs provided under the Clearwire contract, Voqal founded the Mobile Citizen project. Mobile Citizen would act as the CFEA intermediary and broker cost-effective and high-speed Internet access to educational and academic institutions. Partnering with other projects, these CFEA agreements enabled low-income persons, nonprofits, and academic organizations to get unlimited access to the Internet at incredibly reasonable rates. All was well in the world, right?

Well no, all good things come to an end and in 2012, Sprint decided to buy Clearwire. In typical corporate fashion, Sprint tried to immediately shut down the Clearwire WiMAX service, throttle the unlimited data access, and not honor the previous agreement between Mobile Citizen and Clearwire established back in 2006. This led to a variety of lawsuits, court injunctions, bad press, and as far as I know, this lawsuit has still yet to be resolved. At some point, Sprint capitulated and decided to honor the agreement.

Yet the acquisitions weren't done yet. In mid-2018, T-Mobile and Sprint announced a plan to merge with an estimated completion date of 2020. If that weren't enough, the FCC voted 3-2 to auction off the EBS-protected spectrum to commercial entities sometime in 2020. (Editor's note: Ajit Pai is a clown.)

With massive profit margins on per-gigabyte data transfer plans and the death of net neutrality, telecommunication carriers have little incentive to honor previous agreements or advocate for inexpensive, high-data plans. The future of Mobile Citizen services, and EBS operators more broadly, is uncertain.

The Calyx Institute and Unlimited LTE Access

Now that we've walked through the convoluted history of agreements, purchases, acquisitions, and lawsuits, where does the Calyx Institute come into play?

Founded in 2010, The Calyx Institute is a 501(c)(3) nonprofit organization dedicated to raising awareness about surveillance and privacy issues. Most notably, the Founder of The Calyx Institute, Nick Merrill, was hit with a National Security Letter under the USA PATRIOT Act, and successfully fought it in court. There's a good 27c3 talk about his journey through the court system as part of this fight.

As a nonprofit organization, The Calyx Institute operates a variety of awesome services to help keep the Internet private. These services include a free and end-to-end encrypted jabber (chat) server, Tor exit nodes, and Mobile Citizen LTE access. That's right. As they are a nonprofit organization, they can take advantage of that CFEA agreement between Mobile Citizen and Clearwire/Sprint back in 2006. The best part is: if you choose to join The Calyx Institute as a member, you are eligible for access to this LTE service. Neat, huh?

Joining the Calyx Institute

In order to be eligible for the LTE hotspot, you need to be a contributing member of The Calyx Institute. Dues start at $500 a year for the Contributor level, or $600 a year for the Contributor Plus level. After the first year, the dues drop $100 since you already have hotspot hardware.

If you spring for the Contributor level ($500/year), you'll be given a Coolpad Surf hotspot with 12 months of unlimited LTE access via Sprint. This comes out to about $42 a month for unlimited LTE access.

If you spring for the Contributor Plus level ($600/year), you'll be given an Inseego MiFi 8000 hotspot with 12 months of unlimited LTE access via Sprint. This comes out to about $50 a month for unlimited LTE access.

Between the two, the Inseego MiFi 8000 is the superior choice. With two TS9 ports for external antennas, a substantially larger battery, and USB-C charging, it's one of the best 4G LTE hotspots you can get today.

Considering most hotspot deals are NOT unlimited, aggressively throttle, and are expensive, this deal is a no-brainer. Additionally, you can sign up for this service without giving any identifying information to the ISP.

Getting a Privacy-Friendly Hotspot

As stated at the beginning of this post, Mobile Citizen LTE access can be a very privacy-friendly option. While you can sign up with a credit card via their website (note: since they're a nonprofit, this is tax deductible), there are other options available.

As noted on The Calyx Institute website, they will provide the following information to their mobile operator when a new user registers for service:

• Name
• Addresss
• Hardware information (e.g. SIM card, device ID, etc.)

The important part here is that, at no point whatsoever, does it require your name or address need to be yours - or valid at all. As such, you have two primary ways of getting an LTE hotspot without attributing it directly to yourself:

Option 1: Pay in person with cash.

Did you know that The Calyx Institute shows up to DEF CON in person? Yup, they sure do. If you go to everyone's favorite hacker summer camp, you're in luck.

Simply show up to their vendor booth, give them a name (may I recommend Ajit Pai?), hand them a wad of cash, and walk away with your new hotspot.

Need to renew your membership? Simply show up with more cash next year and get a new SIM card.

Option 2: Pay with Bitcoin.

The Calyx Institute accepts payment via Bitcoin on their website. Simply give a name, give an address, and pay with Bitcoin.

Don't want to use your real name? Put whatever you want on the package and have it delivered to your house.

Don't want it delivered to your house? Use a remailer, a friend, or another service for receiving the package.

Either way, your hotspot will arrive activated and present with 12 months of unlimited, unthrottled Internet service.

Hotspot OPSEC

Important note: no matter how you get your hotspot, you're agreeing to abide by the terms of service for LTE access.. Don't be a jerk and use this for illegal, immoral, or unethical purposes.

Having a hotspot unassociated with your real name can be a major boon to privacy and enable freedom of speech. That said, there are some operational security (OPSEC) considerations you need to be mindful of:

1. Your hotspot is tied to your physical location. As an active LTE client with a static mobile device identifier, your location and usage of the hotspot can and will be tracked. The primary benefit of this service is that your mobile carrier (e.g. Sprint) simply does not know who you are but will only know where you are. For the maximally paranoid, you may consider using a mobile carrier other than Sprint, which will ensure your devices aren't all beaconing to the same towers as the same time.
2. Your ISP can still see everything you do. All this hotspot provides is Internet access, not guarantees of privacy or confidentiality. You should assume that all your traffic will be inspected, dissected, logged, and recorded in perpetuity. As such, you will need to employ VPNs, encrypt DNS traffic, use TLS, and control metadata leakage yourself.
3. This hotspot still provides advantages over Wi-Fi access points. While not private, the hotspot has clear advantages over traditional public access points. Public Wi-Fi access points may be metered, unencrypted, require registration (e.g. an e-mail address, name, room number, device MAC address), or use privacy-hostile services (e.g. Google Wi-Fi).
4. Never forget that OPSEC is a mindset and a process, not a silver bullet. When this access is used intelligently, you can bolster your privacy. When used poorly, it may erode it. Be vigilant, be paranoid, and fight for your right to privacy (and party).

Paired well with a travel router, your Mobile Citizen LTE hotspot will grant you enjoyable and fully unlimited, unshaped Internet access, no matter where you go. *

(*As long as it's within the United States and has Sprint service.)

Further Reading and Acknowledgements

• Thanks for The Calyx Foundation and Mobile Citizen for enabling affordable access to the Internet, facilitating freedom of speech, and fighting for our privacy rights.