Shelter from the Typhoon: Last-resort comms with Meshtastic and SLIM

Shelter from the Typhoon: Last-resort comms with Meshtastic and SLIM

Speakers: Caleb Queern (Managing Director, KPMG Cyber); Slava Maslennikov (Consultant, Cool Consulting, LLC)

Conference: DistrictCon

YouTube: https://www.youtube.com/watch?v=ATK84uy1oe8

Overview

In "Shelter from the Typhoon," Caleb Queern and Slava Maslennikov address a critical gap in modern communication infrastructure: the lack of robust, resilient systems for delivering vital information during periods of extreme disruption. Framed by the "Undisruptable 27" initiative, which anticipates potential geopolitical conflicts or severe natural disasters, the talk highlights the urgent need for last-resort communication methods when traditional internet and power grids fail. Queern, a Managing Director at KPMG Cyber, and Maslennikov, a Consultant specializing in DevOps and Meshtastic, argue that current web design principles are ill-suited for austere conditions, making populations vulnerable to information blackouts during crises.

The presentation introduces two pivotal components designed to counteract this vulnerability: SLIM (Speedy Light and Immersive Markup), a proposed protocol for ultra-low-bandwidth web content, and Meshtastic, an open-source, mesh-networking radio technology. Together, these technologies offer a pragmatic blueprint for establishing secure, off-grid communication channels capable of disseminating essential data, such as hospital bed availability or emergency instructions. The speakers underscore the relevance of their work against the backdrop of threats like Volt Typhoon and Salt Typhoon, which target critical infrastructure, emphasizing that preparedness for such "typhoons" is not merely theoretical but a crucial imperative for national resilience.

This talk is not just a theoretical exploration but a call to action, urging organizations and individuals to proactively build and deploy these resilient communication frameworks. By presenting concrete tools and methodologies, Queern and Maslennikov aim to empower communities and critical infrastructure sectors to maintain operational continuity and public safety, even in the most challenging environments. Their insights are particularly pertinent for cybersecurity professionals, emergency planners, and government agencies seeking to fortify their defenses against a spectrum of modern threats.

Background

▶ Watch: Introduction: Shelter from the Typhoon & Undisruptable 27 (0:00)

The premise of "Shelter from the Typhoon" is rooted in the stark reality that modern society's reliance on omnipresent, high-bandwidth internet connectivity creates a critical single point of failure during severe disruptions. The speakers invoke the "Undisruptable 27" scenario, a framework for preparing for a potential 2027 conflict involving Taiwan, as a primary driver for their work. However, they are quick to broaden the applicability, emphasizing that the discussed vulnerabilities and solutions are equally relevant for natural disasters, large-scale cyberattacks (such as those carried out by Volt Typhoon and Salt Typhoon targeting telecommunications), or even physical attacks on infrastructure like water systems (illustrated with the "water hammer" analogy).

Caleb Queern meticulously details the current state of the web, demonstrating its inherent fragility under stress. He presents data from the Web Almanac, illustrating the continuous growth of total internet bandwidth. Paradoxically, this abundance has fostered a culture of consumption, leading to ever-larger websites. Median page weight and the number of requests per page have skyrocketed, with typical initial page loads involving 50 to 60 individual requests. While this delivers rich, immersive experiences in ideal conditions, it renders most websites unusable when bandwidth is scarce. A poignant example cited is the performance of official US state COVID-19 websites during the pandemic. Despite their critical public health mission, a vast majority scored "terrible" on Google PageSpeed Insights, indicating that citizens in areas with limited bandwidth likely struggled to access life-saving information.

The core problem, as identified by the speakers, is a fundamental design flaw: the absence of standards for a "shitty web experience" – that is, a basic, text-only interface optimized for extreme austerity. While some organizations like text.npr.org and light.cnn.com have independently developed such pared-down versions, these are isolated efforts, not widely adopted or standardized. This lack of a common framework leaves critical sectors, from government to finance and healthcare, unprepared to deliver essential information when conventional communication channels are compromised. The talk posits that without deliberate design for austere network conditions, modern infrastructure is a glass jaw, vulnerable to being knocked out by a "typhoon" of any origin.

Key Findings

▶ Watch: Introducing SLIM: Protocol for austere web conditions (7:45)

The central findings of "Shelter from the Typhoon" revolve around identifying critical vulnerabilities in contemporary communication systems and proposing practical, deployable solutions. The speakers unequivocally establish that the modern web, despite its pervasive reach, is fundamentally unsuited for crisis communication due to its insatiable demand for bandwidth and lack of resilience under strain. This deficiency is evidenced by the poor performance of critical public service websites even under moderate duress.

To address this, the talk introduces SLIM (Speedy Light and Immersive Markup) as a foundational contribution. SLIM is presented as a "first stab" at a standardized, ultra-low-bandwidth protocol designed specifically for delivering critical information when networks are severely degraded. Its key characteristics—text-only, no images or media, and a single-fetch design—ensure maximum reliability under "austere network conditions," which Caleb Queern operationalizes as two weeks of only 5% of accustomed bandwidth. A significant finding is the creation of a WordPress plugin for SLIM, which allows administrators to "slimify" their websites with a single click, instantly adapting them for crisis scenarios. This is particularly impactful given that WordPress powers approximately 35% of the entire web, including over 3,700 .gov websites, offering a direct pathway to widespread adoption for government emergency communications.

Complementing SLIM, the talk highlights Meshtastic as the preferred last-resort communication layer. Meshtastic leverages LoRa (Long Range) technology on the 900 MHz spectrum, operating without requiring an FCC license while uniquely offering encryption. Its mesh-enabled architecture allows messages to hop between nodes, extending reach beyond line-of-sight limitations, making it ideal for environments where traditional infrastructure is absent. While acknowledging limitations such as reliance on line of sight (typically 3-10 miles, though up to 200 miles with optimized, elevated antennas) and potential performance issues in dense communities under default settings, Meshtastic's capabilities for secure, off-grid data transmission are underscored. The ultimate finding is the synergistic integration of SLIM and Meshtastic into 72-hour emergency communications kits ("go kits"). These standalone, battery/solar-powered devices, often built around a Raspberry Pi acting as a BBS (Bulletin Board System), are designed to broadcast SLIM-formatted critical information from elevated antennas to multiple ground-level devices, specifically targeting critical infrastructure sectors like hospitals.

Technical Deep Dive

▶ Watch: Meshtastic hospital use case for critical status updates (14:15)

The technical core of the presentation lies in the detailed exposition of SLIM and Meshtastic, explaining how these distinct yet complementary technologies provide a robust solution for austere communications.

SLIM (Speedy Light and Immersive Markup)

SLIM is introduced as a proposed framework, not yet a formal standard, to address the glaring deficiency of the modern web in crisis scenarios. Unlike protocols such as HTTP/QUIC or Speedy, which prioritize rich media and high-bandwidth experiences, SLIM is engineered for extreme scarcity. Its design philosophy centers on delivering the absolute minimum necessary information with maximum reliability. Key technical specifications include:

• Content Restriction: SLIM explicitly disallows all images, video, audio, and complex styling. It is a strictly text-based protocol, ensuring that the data payload is as small as possible. This decision is fundamental to its ability to operate under severe bandwidth constraints.
• Single Fetch Architecture: A core principle of SLIM is that all information for a given page or critical update must be retrievable in a single network request. This minimizes latency, reduces overhead, and improves reliability, especially in highly intermittent or congested network environments. This contrasts sharply with typical modern web pages that involve dozens, if not hundreds, of individual requests for various assets (scripts, stylesheets, images, fonts).
• Operational Definition of Austere Conditions: Caleb Queern defines "austere network conditions" as a scenario where only 5% of accustomed bandwidth is available for an extended period, potentially up to two weeks. This concrete metric provides a tangible target for SLIM's performance requirements and underscores the severity of the problem it aims to solve.
• WordPress Plugin: To facilitate adoption, a WordPress plugin has been developed. This plugin allows WordPress site administrators to toggle on a "Slim experience" with a single click. When activated, the plugin dynamically transforms the site's content into a SLIM-compliant, text-only format. This is a crucial technical enabler, as WordPress powers a significant portion of the internet (around 35%) and is widely used by government entities, including over 3,700 .gov websites. This makes SLIM potentially deployable on a massive scale without requiring extensive re-engineering of existing infrastructure.

Meshtastic

Meshtastic serves as the physical and logical layer for transmitting SLIM-formatted data when conventional internet infrastructure is unavailable. It builds upon the LoRa (Long Range) wireless communication protocol, known for its ability to transmit small data packets over long distances with minimal power consumption.

• LoRa and Frequency Spectrum: Meshtastic operates primarily on the 900 MHz ISM (Industrial, Scientific, and Medical) band in regions like the US. This frequency range is advantageous because it is generally unlicensed by regulatory bodies like the FCC, allowing individuals and organizations to deploy networks without requiring special permits or certifications (unlike licensed amateur radio bands, though many Meshtastic users also hold ham licenses). However, operating in the unlicensed band means power output (wattage) is limited, impacting range.
• Mesh Networking: A defining feature of Meshtastic is its mesh-enabled architecture. Unlike traditional point-to-point radio communication, Meshtastic nodes can act as repeaters. If a message cannot reach its intended recipient directly, it can be relayed ("hopped") through intermediate Meshtastic devices within the network until it reaches its destination. This significantly extends the effective range and resilience of the network, especially in non-line-of-sight environments where signals might reflect off buildings or terrain.
• Encryption: A novel and critical feature for an unlicensed radio protocol, Meshtastic incorporates encryption. This allows for private and secure communication, addressing a major concern for critical information exchange during emergencies. However, Slava Maslennikov candidly raises questions about the trustworthiness of Meshtastic's specific cryptographic implementation, noting it is not post-quantum computing resistant and relies on a third-party implementation, underscoring the importance of understanding its limitations in high-surveillance scenarios.
• Physical Layer Considerations:
• Line of Sight (LoS): Despite mesh capabilities, LoRa performance is heavily influenced by line of sight. While typical ranges are 3 to 10 miles, optimized setups with elevated antennas can achieve significantly greater distances, with some users reporting up to 200 miles. This emphasizes the importance of strategic node placement.
• Power Efficiency: Meshtastic devices are designed for low power consumption, making them ideal for long-term operation with battery packs and solar power. This ensures sustained operation during prolonged power outages.
• Sensor Integration and Remote Control: The platform supports various sensors (e.g., humidity) and can be used for remote control of devices, such as emergency lights. This expands its utility beyond pure communication to include environmental monitoring and basic infrastructure management in austere environments.
• Limitations: Besides crypto concerns, Meshtastic can perform poorly under default settings in dense communities due to signal congestion and interference. Optimization of settings is often required for effective deployment in urban areas. RF denial-of-service attacks also remain a theoretical threat in hostile environments.

By combining SLIM's ultra-efficient content delivery with Meshtastic's robust, off-grid transmission capabilities, the speakers propose a comprehensive technical solution for maintaining vital communications when all else fails.

Demo / Proof of Concept

▶ Watch: Call to action: Building 72-hour emergency communication kits (15:45)

While the talk did not feature a live, interactive demonstration during the presentation itself, the speakers extensively described the practical application of their concepts and showcased physical hardware available for hands-on exploration immediately following the session. The core of their proof-of-concept centers around the development of "go kits" designed for 72-hour emergency communications.

These 72-hour emergency communications kits are being actively built and represent a tangible implementation of the SLIM and Meshtastic integration. A key component of these kits is a Raspberry Pi connected to a Meshtastic device. This setup functions as a BBS (Bulletin Board System), capable of broadcasting critical information to other Meshtastic nodes within range. The power source for these standalone devices is typically an Anchor power bank, providing approximately a day's worth of operation. However, given the low-power nature of Meshtastic devices, they are highly efficient and can be effectively sustained by solar power for prolonged deployments.

The practical application of these kits is envisioned for critical infrastructure sectors, particularly hospitals. In a scenario where traditional communication lines are down, a hospital could use a go-kit with an elevated antenna to broadcast vital status pages or short messages. Examples include real-time updates on available hospital beds, directions to the next nearest functional hospital, or general emergency instructions. The goal is to distribute these "cheap and simple devices" to the public and staff, enabling rapid, localized dissemination of critical data.

Beyond the hardware, the "go kits" emphasize comprehensive preparedness through robust documentation. This includes laminated instructions, key rotation procedures for maintaining cryptographic security, and detailed checklists to guide users through initial setup and ongoing operation during the crucial first hours and days of a crisis. This holistic approach ensures that the technology is not only functional but also user-friendly and maintainable under stressful conditions. The speakers made a direct call for volunteers to assist in the development and deployment of these kits, highlighting the ongoing, community-driven nature of the project.

Defensive Implications

▶ Watch: Q&A: SLIM protocol's strict no-images policy (18:30)

The "Shelter from the Typhoon" talk provides several critical defensive implications for organizations, governments, and individuals seeking to enhance resilience against communication outages, whether from natural disasters or adversarial attacks like Volt Typhoon.

1. Develop Austere Communication Standards: The most immediate implication is the urgent need for organizations to recognize the fragility of existing web infrastructure under stress. Defenders must move beyond assuming constant, high-bandwidth connectivity and proactively define and adopt standards for "shitty web experiences" for crisis communication. This means designing critical information delivery systems that function reliably with minimal bandwidth, akin to the proposed SLIM protocol.
2. Implement SLIM-like Solutions for Critical Websites: For any organization with a public-facing presence that delivers vital information (e.g., government agencies, emergency services, healthcare providers, utility companies), implementing a SLIM-compliant version of their website is crucial. The availability of a WordPress plugin for SLIM offers a straightforward path for the 3,700+ .gov websites currently running WordPress to rapidly deploy this capability. This ensures that even if the main site is inaccessible, a low-bandwidth alternative remains available.
3. Deploy Meshtastic Networks for Last-Resort Connectivity: Organizations responsible for critical infrastructure (e.g., hospitals, water treatment plants, power grids) should consider deploying localized Meshtastic networks. These LoRa-based mesh networks provide an encrypted, unlicensed, and off-grid communication layer for internal coordination and external broadcasting of essential status updates when traditional telecommunications are down. Strategic placement of elevated antennas and integration with solar power are key defensive considerations for maximizing range and operational longevity.
4. Build and Stock "Go Kits": Emulating the 72-hour emergency communications kits described, organizations should procure or assemble standalone, portable communication packages. These kits, typically comprising a Raspberry Pi, a Meshtastic device, and a robust power source like an Anchor power bank (with solar charging capabilities), can serve as mobile command posts or local broadcasting hubs. Equipping these kits with clear, laminated documentation and operational checklists is as important as the hardware itself.
5. Address Human Factors and Security: The talk highlights the importance of human factors in cryptography, specifically key leaks and the general reliability of Meshtastic crypto. Defenders must establish clear protocols for key management, rotation, and secure device handling. While Meshtastic offers encryption, organizations should understand its limitations (e.g., not post-quantum resistant) and supplement with other security measures where appropriate.
6. Community Engagement and Collaboration: The call to action for volunteers to help build and refine these solutions underscores the importance of community and cross-organizational collaboration. Participating in initiatives like "Undisruptable 27" or local mesh networks (e.g., DC Mesh) can strengthen overall resilience, share best practices, and contribute to the development of robust open-source tools.
7. Optimize Meshtastic Deployments: For dense urban environments, defenders must be aware that Meshtastic can perform poorly under default settings. Pre-deployment testing and optimization of configuration parameters are necessary to ensure effective communication in specific operational contexts. Additionally, awareness of potential RF denial scenarios is important for planning alternative or hardened communication channels.

By proactively addressing these areas, defenders can significantly bolster their ability to maintain communication and situational awareness during catastrophic events, effectively providing "shelter from the typhoon" for critical operations and the populace.

Key Takeaways

• Modern web is not resilient for crisis communication: Current web design, driven by high bandwidth consumption, makes most critical information inaccessible during "austere network conditions" (e.g., 5% of normal bandwidth).
• SLIM provides an ultra-low-bandwidth standard: The proposed SLIM (Speedy Light and Immersive Markup) protocol offers a text-only, single-fetch solution for reliably delivering critical information when traditional internet infrastructure is compromised, with a WordPress plugin facilitating widespread adoption, especially for 3,700+ .gov websites.
• Meshtastic offers off-grid, encrypted radio communication: Leveraging LoRa on the 900 MHz unlicensed spectrum, Meshtastic provides a mesh-enabled, encryptable communication layer that functions independently of traditional internet and power grids, albeit with line-of-sight and density limitations.
• Integrated "go kits" enhance emergency preparedness: The combination of SLIM and Meshtastic in 72-hour emergency communications kits (e.g., Raspberry Pi-based BBS with solar power) enables critical infrastructure like hospitals to broadcast vital information during outages.
• Proactive defense against "typhoons" is crucial: Organizations must move beyond theoretical preparedness by implementing austere communication strategies, deploying robust last-resort systems, and training personnel to operate them effectively, anticipating threats like Volt Typhoon and the Undisruptable 27 scenario.
• Community involvement is key to resilience: Open-source development and collaborative efforts are essential for building, testing, and deploying these critical communication solutions, emphasizing a collective approach to national and local resilience.

About the Speaker(s)

Caleb Queern is a Managing Director at KPMG Cyber. Beyond his professional role, he identifies as a concerned citizen deeply invested in solutions for societal resilience. He is also the co-author of a book focusing on DevOps and security, reflecting his expertise in integrating robust security practices within modern development and operational frameworks. His work on SLIM highlights his commitment to practical, impactful solutions for critical infrastructure.

Slava Maslennikov is a Consultant at Cool Consulting, LLC, specializing in Site Reliability Engineering (SRE), DevOps, and cloud engineering. He brings extensive leadership experience to his consulting work. Slava is particularly active in the Meshtastic community, offering workshops and deeply understanding its technical nuances. He also holds a ham radio license, underpinning his practical knowledge of radio communications and their application in emergency scenarios.