This document outlines the operational security (OpSec) standards and data handling protocols observed by the Mallu Cyber Soldiers (MCS) community website (hereinafter referred to as "The Network"). Our commitment is not to standard compliance, but to the absolute operational security and anonymity of every verified node.
We operate under a principle of Data Minimalism. We collect the bare necessity required for network function and member vetting.
Registration Data: We collect the following information required for access and internal vetting:
Username/Handle: (Mandatory for identification within The Network)
Encrypted Contact Signal: (e.g., Secure Email, PGP Key, or encrypted messenger ID)
Cryptographic Key/Identifier: (Used for access control and verification)
Voluntary Profile Data: Any additional information (skills, interests, real-world affiliations) is provided voluntarily and is visible only to vetted, internal members for collaboration and project assignment.
Activity Logs (OpSec Logs): We log access times, source IP addresses (only for temporary threat detection and abuse prevention, not stored long-term), and internal activity (e.g., project contribution, forum posts). These logs are encrypted and purged on a rolling 90-day basis.
The integrity of our members' anonymity is paramount.
Encryption at Rest: All sensitive data (including registration and profile information) is stored using military-grade, state-of-the-art encryption standards.
Pseudonymity by Design: We strongly encourage the use of pseudonyms and dedicated, anonymized contact methods. We do not require or store real names, physical addresses, or national identification data.
No Third-Party Hosting for Sensitive Data: Critical member data is stored on secure, hardened internal infrastructure, not on commercial third-party cloud services.
We enforce a zero-tolerance policy regarding data sharing.
No Commercial Sharing: We never sell, rent, or share member data with advertisers, data brokers, or commercial entities under any circumstances.
Legal/Government Requests: We maintain a strict, adversarial stance toward requests for disclosure from external authorities. Our decentralized structure and encryption protocols are designed to render compliance requests futile. Our policy is to resist all non-binding requests and to maximize legal defense against warrants. Data is only disclosed as a last resort, under absolute legal compulsion, and only after notifying the affected member(s) via their designated secure signal, where feasible.
Encrypted Channels: We mandate the use of end-to-end encrypted communication platforms (e.g., PGP, secure messengers) for all sensitive internal communications.
Forum Data: Information shared on our internal forums or platforms is accessible only to verified MCS members. However, members are reminded that data voluntarily posted is not covered by the same level of anonymity as core registration data.
Joining The Network mandates adherence to strict personal Operational Security.
Secure Access: Members are responsible for securing their access credentials, devices, and communication endpoints.
Anonymity: Members must maintain the anonymity of their peers and any information obtained through The Network.
Vigilance: Any attempt to breach the privacy or OpSec of another member will result in immediate and permanent expulsion from The Network.
This Privacy Protocol may be updated in response to new security threats or changes in operational requirements. Members will be notified of critical updates through secure internal channels.
Effective Protocol Date: November 25, 2025
MCSS: Trust no one. Encrypt everything.
