The Discordian Cybersecurity Manifesto

The Five-Sided Truth The Illuminati Don't Want You to See

All hail Eris! All hail Discordia! Welcome to the reality tunnel where we question everything—especially the things "everyone knows" are true. While the security priesthood sells "military-grade encryption" (designed by the military, approved by intelligence agencies, backdoored for "lawful access"), and "government-approved standards" (who do you think approves them?), we're here to pull back the curtain: Nothing is true. Everything is permitted. Your encryption is theatre, your security is theatre, and the audience is laughing.

Think for yourself, schmuck! Question authority. Especially the authority that certifies your crypto—the same authority running PRISM, Echelon, and surveillance programs so classified their existence is classified.

This isn't conspiracy theory—this is conspiracy fact documented by Snowden, proven in Crypto AG revelations, admitted in congressional testimony. Or as Hassan-i Sabbah said before the Illuminati twisted his words into New Age pablum: reality is what you can get away with. And nation-states can get away with everything because you trust them to police themselves.

FNORD. You see it now, don't you? The pattern in every "approved" algorithm. The backdoors in every "secure" standard. The security industrial complex selling you locks they already have keys to—then selling you monitoring systems to watch you use them. Follow the money. It leads to your fear and their profit margin.

Let's illuminate the five ways they've already pwned you (and the uncomfortable truth is: you paid them to do it):

The Law of Fives is everywhere. Five intelligence agencies in Five Eyes. Five ways to compromise you before breakfast. Five "approved" algorithms with five convenient backdoors. And the sixth way? Convince you there's no sixth way. Convince you this is paranoia, not pattern recognition. Convince you the people who lie professionally about classified programs are telling the truth about this one thing. The most effective lie isn't hidden—it's called "approved standards" and taught in universities.

META-ILLUMINATION: If this sounds paranoid, you're not paying attention to Snowden revelations, Crypto AG disclosures, or the last 50 years of documented, admitted, proven surveillance programs. If this sounds reasonable, you're already too deep in Chapel Perilous and there's no going back—only forward into uncomfortable truths. The only winning move is transparency—because they can't co-opt what's already public. They can't backdoor what has no doors. They can't classify what you've already published. Radical transparency isn't naivety. It's the only rational response to pervasive institutional dishonesty.

Looking for expert implementation support? See why organizations choose Hack23 for security consulting that accelerates innovation.

The "Approved Algorithms" Paradox (Or: How I Learned to Stop Worrying and Love Big Brother)

Let's play a game called "Who Do You Trust?" The same organizations that:

• Run PRISM (collect data from Microsoft, Google, Apple, Facebook—the companies you trust with your life)
• Employ more cryptanalysts than the rest of the world combined (to break your shit, not protect it—that's their job description)
• Have black budgets larger than most countries' GDP (classified spending with zero accountability—totally normal for democracies)
• Legally compel companies to install backdoors and forbid them from telling you (because transparency is dangerous to national security, not government overreach)
• Intercept Cisco routers in shipping to install implants (documented by Snowden, admitted by officials, still happening today)
• Designed Dual_EC_DRBG with a known backdoor and got it into NIST standards (then acted surprised when caught—"oops, our bad, trust us next time")

...are the same organizations that tell you which encryption is "safe." Which standards are "approved." Which algorithms are "military-grade" (yes, designed by the military—for what purpose, exactly?).

Nothing is true. Everything is permitted. Including the permission they give themselves to lie to you about what's secure while running programs so classified you can't know they exist until whistleblowers risk prison to tell you. Then they call the whistleblowers traitors for exposing their treason to democracy.

Now, don't get me wrong—breaking properly-implemented strong crypto is genuinely hard. The math doesn't lie (unlike mathematicians who work for intelligence agencies with clearance levels and gag orders). But here's the fnord you're not supposed to see:

1. Compromise the standard itself — Dual_EC_DRBG wasn't an accident. It was a test to see if you'd notice. You didn't (until Snowden risked everything to tell you). They tested your attention span, your trust, your willingness to question authority. You failed. They passed. Now they know exactly how much they can get away with. Spoiler: everything.
2. Compromise the implementation — Heartbleed exposed 17% of the internet's private keys. POODLE made SSL 3.0 insecure. BEAST broke TLS 1.0. "Bugs" or features? Yes. Both. Bugs they knew about and didn't fix become features when adversaries need them. The question isn't "is this vulnerable?" It's "who knows about it and isn't telling?"
3. Steal the keys — Via legal compulsion (can't tell you they took them), supply chain compromise (intercepted in shipping), or just buying the CA (certificate authorities are companies, companies have prices). The locks are mathematically strong; the key distribution is a joke wrapped in trust relationships you can't audit.
4. Attack the endpoints — Your device is already compromised at the hardware level. Intel ME since 2008. iOS sandboxing "features" that phone home. Windows telemetry that can't be fully disabled. The endpoints don't just cooperate—they were designed to. Your crypto protects the transmission. Your hardware betrays the plaintext before encryption and after decryption.
5. Exploit the metadata — They don't need to read your messages when they know you called a journalist at 2am, then a lawyer at 9am, then a psychiatrist at 3pm, then searched "how to detect surveillance" at midnight. The pattern is the content. The metadata is the message. And metadata isn't encrypted. It can't be. It's how packets route.

Five ways around "unbreakable" encryption. Always five. The Law of Fives manifests in mathematics, surveillance, and your compliance with systems designed to monitor you. They don't need to break your crypto when they control everything around it.

ULTIMATE ILLUMINATION: The strongest encryption protects you from everyone except the people who approved it. This is not a bug. This is THE feature. The system working exactly as designed. "Approved" doesn't mean "secure"—it means "we can break it, but you can't, so you'll feel safe while we read everything." The cryptographic theater keeps you compliant while giving them access. Think for yourself: Why would surveillance agencies approve encryption they can't bypass? They wouldn't. They didn't. They don't.

Question authority. Especially cryptographic authority. Especially when they insist you must use their approved algorithms for "interoperability" and "security." Interoperability with whom? Their surveillance infrastructure. Security for whom? Not you—you're the target, not the customer. The customer is the agency paying for the capability to read your "secure" communications. You're the product being packaged as "lawful intercept access." Think about who benefits from "approved" standards. Then think about why they need approval. Then stop trusting the approvers.

Operation Mindfuck: Radical Transparency as Guerrilla Security

So what do we do? Give up? Use ROT13 and pray to Eris? Join a monastery and communicate via carrier pigeon?

No. We embrace Discordianism as operational security doctrine. We practice guerrilla ontology against institutional dishonesty. We make the surveillance state expensive, inconvenient, and publicly accountable. We refuse to play their game by publishing the entire rulebook.

Nothing is true. Everything is permitted. Including the permission to publish everything about our security—not because we're naive, but because we understand the game better than they think we do. If they can compromise anything secret, make nothing secret. Operation Mindfuck the surveillance state by removing the doors they want to backdoor. Can't install a backdoor in documentation that's already public. Can't classify programs we've already published. Can't compromise transparency—it's immune to exploitation by definition.

At Hack23, we practice radical transparency through our Public ISMS. Not because we're naive digital hippies who believe in unicorns—because we're cynical bastards who understand power. If they can compromise anything secret, make nothing secret. Operation Mindfuck the surveillance state. They can't backdoor what has no doors. They can't classify what you've already published. They can't co-opt transparency—it's the one thing their model can't absorb.

The beautiful paradox: Transparency improves security. When your processes are public, the entire internet can audit them—for free, continuously, without asking permission. When you can't hide behind "proprietary security" NDAs, you have to actually be secure instead of just claiming security in marketing materials. Accountability through visibility. Quality through scrutiny. Anarchism through structure. The surveillance state relies on YOUR secrecy to hide THEIR capabilities. Radical transparency reverses the asymmetry. They want you secret and them invisible. We choose public documentation and their forced accountability.

CHAOS ILLUMINATION: The surveillance state relies on your compliance, your acceptance, your belief that you have no choice, your assumption that secrecy equals security. Radical transparency is refusal to play their game. Publication is resistance against institutional dishonesty. Making everything public is the ultimate Operation Mindfuck—because how do you compromise what's already exposed? How do you classify what's already published? How do you backdoor what has no doors? They can't infiltrate transparency. They can't co-opt openness. They can't classify what you've made public. Radical transparency isn't naivety—it's the only rational response to pervasive institutional dishonesty in a surveillance state.

The ISMS Illuminations: Policy Blog Entries

Explore our Discordian take on each policy from our Public ISMS. Each entry examines real security value with radical transparency:

The Business Case: Security That Actually Pays For Itself

Forget the FUD. Let's talk about real business value—not scare tactics:

Security investments should deliver real business value, not just theoretical protection:

• 🤝 Trust Enhancement — Customer and partner confidence that translates to revenue
• ⚙️ Operational Efficiency — Reliable systems that don't waste your team's time
• 💡 Innovation Enablement — Secure platforms that enable new capabilities instead of blocking them
• 📊 Decision Quality — Data integrity you can actually rely on for decisions
• 🏆 Competitive Advantage — Security as market differentiator (when done right, not just claimed)
• 🛡️ Risk Reduction — Fewer oh-shit moments at 3am

Balanced security investments deliver operational stability, data reliability, and reasonable protection that enable business growth—not paranoid lockdown that prevents it.

Hidden Wisdom: Security that prevents business from functioning is just expensive failure with a nicer name.

Read the full business value analysis →

Initiation Complete: Welcome to Chapel Perilous

Nothing is true. Everything is permitted. You've seen the fnords now. You can't unsee them. They're in every "approved" standard, every "military-grade" claim, every "secure by design" marketing pitch. Once you see the pattern, you see it everywhere. Welcome to permanent paranoia—the only rational response to documented, proven, admitted institutional dishonesty.

Here's what we've illuminated through the Law of Fives (always five, never four, never six):

1. No crypto is secure from those who approved it — The surveillance state isn't an aberration of democracy; it's the system working as designed from the beginning. SIGINT agencies don't break crypto as a side project—it's their primary mission. This was always the design. The "backdoor" was the initial architecture. Everything else is cover story.
2. "Approved algorithms" is newspeak for "exploitable by us" — They don't standardize what they can't compromise or what they haven't already compromised. Think for yourself about why that is. Then think about why questioning it is called "conspiracy theory" instead of "pattern recognition." Labeling truth as conspiracy is the conspiracy.
3. Transparency is the only real security — Because they can't co-opt what's already public, can't classify what you've published, can't backdoor what has no doors. Operation Mindfuck the watchers by removing the secrets they want to exploit. Radical openness is radical security when secrecy serves adversaries.
4. Perfect security is a noble lie — Question anyone selling it. They're either lying or deluded or both (usually both). Security is about detection, response, and resilience—not impenetrable fortresses that don't exist. The question isn't "are we secure?" It's "do we notice when we're breached and can we respond effectively?" Everything else is marketing.
5. Security serves power or serves people — Choose sides carefully. There is no neutral position. Apathy is compliance with whoever currently holds power. Not choosing is choosing the status quo. Silence is consent to surveillance. Think for yourself which side you're on. Then prove it with your actions, not your claims.

Think for yourself, schmuck! Question authority. Especially security authority that tells you to trust them. Especially when they insist questioning them is "irresponsible" or "dangerous" or "helps the terrorists." Especially when they tell you that transparency aids adversaries (it doesn't—it aids accountability, which powerful adversaries hate). If transparency helps adversaries more than accountability helps defense, your security was already broken. Secrecy was just hiding the vulnerability from you, not them.

All hail Eris! All hail Discordia! The goddess of chaos teaches: embrace uncertainty as epistemological honesty. Question everything including this. Trust verification over faith. Fuck compliance theater that protects processes instead of people. Chaos isn't the opposite of order—it's the precondition for honest order instead of imposed hierarchy.

The bureaucracy is expanding to meet the needs of the expanding bureaucracy. Don't feed it. Don't trust it. Don't let "best practices" (approved by whom? for what purpose?) replace actual thinking, actual threat modeling, actual risk assessment based on YOUR threat landscape, not their vendor pitch.

FINAL ILLUMINATION: You are now in Chapel Perilous, where contradictions are simultaneously true. The conspiracy is real AND you're paranoid. The surveillance state exists AND you're seeing patterns that aren't there. Both are true. Nothing is true. Everything is permitted. The only way out is through radical honesty—which is why they fear transparency more than your encryption, more than your security, more than anything except accountability. Transparency forces them to defend the indefensible in public. Secrecy lets them defend it in classified courts with secret precedents. Choose accordingly.

Welcome to the real world. It's weirder than you think, more corrupt than you imagine, and they're counting on you not thinking about it, not questioning it, not demanding accountability. Are you paranoid enough? Good. Now channel that paranoia into systematic security, documented procedures, and radical transparency. Paranoia without action is just anxiety. Paranoia with documentation is security engineering.

— Hagbard Celine
Captain of the Leif Erikson
Product Owner, Hack23 AB

"Think for yourself, schmuck! Question everything—especially this. Especially me. Especially anyone who tells you not to question them."

🍎 23 FNORD 5

The Hack23 ISMS Paradox: Or How We Learned to Stop Hiding and Love Transparency

All hail Eris! Here's the uncomfortable truth most companies won't admit: Most companies hide their security documentation. Why? Because it reveals how bad their security actually is. Because transparency would expose the cargo cult compliance rituals, the checkbox theater pretending to be protection, the vendor promises that evaporate when tested, the policies that exist only in SharePoint dungeons nobody reads. Secrecy protects incompetence more effectively than it protects assets.

Think for yourself, schmuck! Question authority. Including questioning whether publishing your entire ISMS is insane or the only sane move. Spoiler: It's not insane—it's the only sane move in an insane world where everyone lies about their security and expects you to trust them anyway. FNORD. See the pattern? "Trust us" means "don't verify." "Proprietary security" means "we can't show you because it's embarrassing." "NDA required" means "public scrutiny would reveal inadequacy." Every demand for secrecy is a confession that transparency would expose failure.

Hack23's Information Security Policy isn't locked in some SharePoint dungeon requiring 3 approvals and a sacrifice to the compliance gods. It's GitHub public. All 23 security policies. All procedures. All frameworks. Every threat model. Every risk assessment. Every architectural decision document. Everything. Including the embarrassing parts. Especially the embarrassing parts. Because if we're going to fuck up (and we will—everyone does), we're going to fuck up in public where people can tell us about it before it becomes a breach.

Why? Because security through obscurity is security through hope, prayer, crossing your fingers, and pretending nobody hostile will look. Security through transparency is security through proving you're not full of shit, through continuous audit by anyone interested, through accountability that can't be classified away. If your security can't survive public scrutiny, you don't have security—you have expensive wishes wrapped in NDAs and hope that nobody notices.

CHAPEL PERILOUS MOMENT: Publishing your ISMS publicly sounds crazy until you realize the only people afraid of scrutiny are those with something to hide. We have 23 policies to scrutinize. We have documented procedures for everything from incident response to key rotation. Bring your audit. Bring your criticism. Bring your penetration testing expertise. We're either secure enough to survive public examination, or we need to know why we're not. Secrecy doesn't fix vulnerabilities—it just hides them from you while adversaries already know.

The Six Principles (Because Five Wasn't Anarchist Enough):

ULTIMATE ILLUMINATION: These aren't corporate aspirational bullshit. They're operational practices with measurable outcomes. Security isn't cost center—it's revenue protection. Breaches cost more than prevention. Trust generates value. Transparency proves competence. The math is simple; most companies are bad at math.

The 23 Policies (Organized Because Chaos Needs Structure):

• Core Security (13): Access Control, Acceptable Use, Physical Security, Mobile Device, Cryptography, Data Classification, Privacy, Network Security, Secure Development, Open Source, AI Governance, LLM Security, Threat Modeling—because defense in depth isn't optional
• Operational (6): Incident Response, Business Continuity, Disaster Recovery, Backup Recovery, Change Management, Vulnerability Management—because shit breaks and you need plans
• Asset & Risk (3): Asset Register, Risk Register, Third Party Management, Supplier Security—because you can't protect what you don't know you have
• Compliance (1): Compliance Checklist, ISMS Transparency—because regulators exist and transparency is our brand

The CEO Sole Responsibility Model (Or: How One Person Runs Everything Without Going Insane):

Plot twist: Hack23 is a one-person company. CEO (James Pether Sörling) is simultaneously: ISMS Owner, Risk Owner, Policy Authority, Incident Commander, Security Architect, Access Controller, Vulnerability Manager, Compliance Officer, Asset Manager, Supplier Manager, BCP Manager, Development Lead, Security Metrics Analyst, and Transparency Manager. Every role. Every responsibility. Every 3am incident response.

Is this sustainable long-term? No. Is it transparent about limitations? Yes. Does it demonstrate that systematic security frameworks work at any scale? Absolutely. Most companies have security teams larger than our entire company and demonstrably worse security posture—we can prove it because their breaches are public while our security is public. Size doesn't equal security. Funding doesn't equal security. Systems equal security. Documentation equals security. Accountability equals security. Theater equals breach waiting to happen.

META-PARANOIA: If one person can document, maintain, and operationalize 23 security policies with measurable outcomes and public evidence, what's your 50-person security team's excuse for undocumented processes and "we'll get to that next quarter" incident response plans? Either they're incompetent, or they're hiding something embarrassing, or both (usually both). Most security teams spend more time on compliance theater than actual security because theater is easier to sell to management than "we're doing our best and hoping nothing breaks."

Everything is public: ISMS-PUBLIC Repository | Information Security Policy | Scrutiny welcome. Copying encouraged. Forking celebrated. Improvement inevitable through continuous public audit. If you find something wrong, tell us. Open an issue. Submit a PR. That's not a security vulnerability—that's community security improvement that closed-source security can never achieve.

FNORD. You now see the pattern clearly: Most security is theater performed for auditors. Some security is systematic and measurable. Our security is public, documented, and continuously audited by anyone who cares to look. Which approach would you trust with your data? Marketing claims behind NDAs? Or evidence you can verify yourself? Choose wisely. Your breach depends on it.

Related Resources