The router lives on Priya Okonkwo's fire escape, bolted to the rail where a window-unit air conditioner used to drip. It is a Tuesday night in 2036, and she is up on the rusted landing in her socks, holding a flashlight in her teeth, because the node that carries her entire block's traffic has gone quiet again. Below her, the street is dark. Above her, the antenna she pointed at the rooftop two buildings over hums faintly in the cold.
She fixes it. She always fixes it. That is the problem.
Because when the node comes back, the little dashboard on her cracked tablet repopulates, and Priya can see — without meaning to, without wanting to — that someone on the fourth floor has been messaging the same number every night at 2 a.m. She knows whose apartment that is. She knows the marriage in it. She did not ask to know this. She is the one who keeps the network alive, and the price of keeping it alive is that the network has no secrets from her.
This is what we built when we tried to escape being watched. We did not end the watching. We moved it three houses down.
The promise was the opposite of this
For a decade, the pitch was clean and a little thrilling. By the late 2020s, the dominant internet ran on what the Harvard scholar Shoshana Zuboff named surveillance capitalism — "the unilateral claiming of private human experience as free raw material for translation into behavioral data," packaged into predictions and sold.1 The arrangement, she wrote, ran on the logic of a one-way mirror: they could see you; you could not see them.1
Community mesh networks promised to smash the mirror. Instead of routing your life through a distant data center, neighbors would own the hardware themselves — routers on rooftops, antennas pointed at each other, traffic hopping building to building with no corporate ISP in the middle to log it. The model already worked in 2025: NYC Mesh ran more than 2,000 member-owned nodes across the five boroughs, a decentralized network "owned by those who run and use it."2 After the FCC repealed net-neutrality rules, monthly sign-up requests jumped from about 20 to over 400.2 People wanted out.
The logic was sound. Remove the central chokepoint and you remove the place to put the dragnet. There is no server farm to subpoena because there is no server farm.
By the 2030s, mesh had spread from a few activist boroughs to ordinary blocks like Priya's. And that is exactly when the trouble started — not in the cryptography, but in the kitchen.
What the encryption actually did
Here is the part the brochures skipped. A mesh network only works if every node relays its neighbors' packets — that is the whole design. So privacy depends entirely on the encryption holding. And on the most popular community stack, it mostly didn't.
Take Meshtastic, the open LoRa-radio software that ran on a huge share of grassroots meshes. Out of the box, its primary channel is encrypted with a single, publicly known key — base64 "AQ==" — printed in the documentation itself. To get real privacy you "must change this key first."3 Most people never did. The result was what security folks called crypto-theater: a padlock icon over a conversation anyone with the same free app could read.
It went deeper than defaults. Meshtastic's own docs admit the system has no perfect-forward-secrecy, performs no integrity check on channel messages, and offers no authentication — meaning, in their words, it is "trivial to impersonate anyone else if you have access to the channel key."3 Asked plainly whether it is as secure as Signal, the project answers, in bold: "No."3
Then came the proof. In June 2025, researchers disclosed CVE-2025-52464, a flaw rated 9.5 out of 10. Vendors had mass-flashed devices with duplicate key pairs, so an attacker holding a list of those keys could decrypt the "private" direct messages flowing between affected nodes — and hijack remote administration of the radios themselves.4 The fix shipped in firmware 2.6.11.4 But the lesson outlived the patch: the people most confident they were unwatched were often the easiest to read.
The turn
So picture the full reversal. The thing mesh was built to kill was distant, indifferent watching — a corporation that knew your data but not your name, a satellite that saw everything and cared about none of it. What replaced it is the opposite on every axis. The watcher is no longer far away and bored. The watcher is near, and invested, and lives at the end of your hall.
A data center does not have opinions about your affair. Priya does. A corporation will never run into you at the laundromat. Your network administrator will. The corporate mirror was one-way and cold; the mesh mirror is two-way and warm, and somehow that is worse — because you cannot delete your neighbor, and you cannot quit the only network on the block without going dark.
That is the tetrad's cruelest line. A technology built to retrieve the village — the local, the human-scale, the commons we ran our own — did retrieve it. It also retrieved the village's oldest feature: everyone knowing your business, and the impossibility of leaving.
Back on the fire escape
Priya climbs back inside and does not look at the dashboard again. She has a rule about that now — most of the maintainers do, an honor code stitched together after enough blocks learned the hard way. It holds because she is a decent person. It is not enforced by anything but that.
This is where the real question sits, and it is not a cryptographic one. Strong community privacy is genuinely possible; the math exists. But it consistently lands hardest for the people who already had the most — the affluent, technical, tight-knit blocks with the patience to rotate keys and the trust to write rules. The communities most exposed to surveillance often have the least slack to defend themselves with. Privacy, freed from the corporations, did not become universal. It became another thing you have to be lucky enough to afford.
Priya keeps the node alive because the alternative is the cloud, and she knows exactly what the cloud is. She has simply traded a watcher who wanted to sell her for a watcher who wants to judge her — and who will be at the block meeting on Thursday.
We escaped the one-way mirror. We just forgot that the people on the other side of a two-way one can see us hesitate.
Author's Note: This is speculative journalism, written from an imagined 2036. Priya Okonkwo and her block are fictional composites; no real person is depicted. Everything outside the scenes — surveillance capitalism as Zuboff defined it, the structure and scale of community mesh networks like NYC Mesh, Meshtastic's default-key and design limitations, and CVE-2025-52464 — is real and sourced below. The 2036 framing extrapolates today's trade-offs; it does not report future events.