Liberation Travel Hacks 09/2026

Hi friends,

all my life I have heard the same statist argument: "If you don't like it here, leave." Unfortunately that argument is ceasing to hold — the EU is actively working to make sure there is nowhere to go.

First, the banks. From 11 January 2027, banks based outside the EU may no longer provide core banking services (deposit-taking, lending, guarantees) to people residing in the EU unless they set up a licensed branch in the relevant member state. It is Article 21c of Directive 2024/1619, better known as CRD VI. It covers the whole EEA including Iceland, Liechtenstein and Norway, and what decides is residence, not passport.

Yes, there are carve-outs. If you approach a non-EU bank entirely on your own initiative (so-called reverse solicitation), it may serve you without a branch. And contracts signed before 11 July 2026 stay valid, so nobody will close the accounts you already have. The practical risk, however, is not legal but commercial. Most non-EU banks will conclude that vetting every European against the reverse solicitation test is not worth the regulatory exposure and will simply start declining EU-resident applications wholesale. The mechanism is plain blackmail. Keep opening accounts for our residents and we will restrict your transfers into the EU.

More in the discussion on X, which had record reach, almost a million views.

Second, citizenship. I wrote about the Caribbean ultimatum last month. The five Eastern Caribbean states are to phase out their citizenship-by-investment programmes by 1 June 2028 or their citizens lose visa-free access to Schengen. In August the other side spoke. The Commission no longer wants those programmes fixed, it wants them gone. Money laundering has nothing to do with it. This is the demolition of an exit route. Details in the Caribbean section.

Third, residency. Paraguay adopted three regulations in five months. Resolution 407 covers proof of income, Resolution 376 the cancelling of residency for people who stay away too long, and DNIT Resolution 47 crypto reporting. None of them touches what people go there for (zero tax on foreign income, tax residency without a single day in the country), but the trend is clear. Bureaucracy is growing and paper residency is ending. Details in the Paraguay section.

And as if that were not enough, since 5 August the EU no longer grants temporary protection to Ukrainian men of conscription age who cannot prove they have fulfilled their military obligations. The EU has thereby declared that protecting the life of the individual is secondary and collectivist interests come first. Your place of birth determines which state you must die for, regardless of whether that state or that war make any sense to you. Remember this. In case of a military threat, the same rule will be applied to you.

So what to do?

1. Residency outside the EU before 2027. CRD VI does not apply to you if you are not "established" in the EU. Paraguay, Uruguay or Panama give you that position and we will gladly help.
2. Open your non-EU accounts now. In Georgia and Kyrgyzstan we can still open them for you remotely. It is quite possible that from next year this will no longer work for EU residents. Existing accounts stay.
3. A second citizenship before 2028. Obtaining citizenship by investment takes more than a year. If you have been considering it, the window is closing and you need to start now.

One more thing. On Saturday 29 August Icelanders rejected in a referendum the resumption of EU accession talks, 52.8% against on an 82.5% turnout. My sincere congratulations on their decision to keep their high standard of living. In the offshore business today, any link to the EU (bank accounts, residency) is an aggravating, not a mitigating, circumstance. The Icelanders understood that.

One more good thing before I sign off. Thanks to how much interest this newsletter has picked up in Latin America, from this issue on it also comes out in Spanish. If you have friends who read Spanish, pass it on, they can subscribe here.

Pavol Lupták, Bratislava, Slovakia, 1 September 2026

Ukrainians as a precedent. On 4 August the Official Journal published the Council implementing decision that extends temporary protection for refugees from Ukraine to March 2028 but changes the rules. Newly arriving Ukrainian men of conscription age who cannot prove through the Reserv+ app that they have fulfilled their military obligations no longer qualify. The decision explicitly recalls that desertion and draft evasion are not, in themselves, grounds for international protection. The Czech interior minister boasted that this will "cut the number of new arrivals by tens of percent".

Ukrainian friends write to me that the EU is no longer a safe place for them. For men aged 25 to 60 who left after crossing the border illegally and do not yet have status, the window has practically closed. Europe has stopped being a refuge for those who do not want to end up in the meat grinder. States, the EU included, legally usurp the right to make you fight and die for them.

At Liberation Travel the life of the individual is sacred. To every Ukrainian denied temporary protection by any EU country we offer a 10% discount on all our residencies in Paraguay, Uruguay and Panama. And one extra piece of advice for every European citizen. You cannot renounce your EU citizenship without holding another one. If giving up your EU passport should one day save your life, you need the second one ready in advance. Or at least a good residency, so that you are outside the EU when the mobilisation comes.

Russia still outdoes the EU in totalitarian practice. In digital totalitarianism Russia is faster. On 1 September it launches the digital ruble and, according to the central bank, all 12 systemically important banks, representing over 80% of the payments market, are ready to offer accounts in digital rubles. The ECB is lagging with its digital euro, but like Moscow it takes its inspiration from Beijing. Coin Bureau summed up where this is heading in The EU Has Abandoned Democracy.

Saint Lucia: we did everything Brussels asked, and the target moved anyway. Deputy Prime Minister Ernest Hilaire, who holds the CBI portfolio, said at a press conference that his country had tightened its legislation, introduced "value metrics" and, together with four other governments, signed the agreement establishing a regional regulator in September 2025 — precisely the institution Brussels had asked for. And then the mood of the Commission changed. Hilaire reached for an analogy that stings. Saint Lucia produced under half a percent of world banana output and still lost the trade preferences that sustained the sector. Drive around the island, he told reporters, and the scars remain visible.

How expensive this can get is shown by the numbers from Dominica. According to the opposition there, the 2025/2026 budget projected that 56.7% of recurrent revenue would come from CBI. Strip it out and the gap runs to roughly EC$224 million a year, putting public officers' salaries, healthcare, road maintenance and the financing of the international airport at risk.

Alongside that there is one more piece worth reading, Will the EU Take Away Visa-Free Access From the Caribbean? Patrick Peters argues the question is not whether the programmes survive but what survives of them. Expect smaller, more selective and more expensive versions of the ones sold today. If you were counting on a Caribbean passport as insurance, every month of waiting makes it dearer.

Does Paraguayan residency still make sense in 2026? I get this question more and more often because of the growing bureaucracy, so I wrote a long answer. Short version, yes. For a perpetual traveller there is still nothing better on the planet. But 2026 brought three regulations in five months and you need to know what each of them means.

What still holds:

1. Territorial taxation. Foreign income is not exempted by some regime that could be repealed. It falls outside the definition of taxable income altogether. Not one of the new resolutions extends the tax base beyond Paraguay's borders. They are all about traceability, not taxes.
2. Tax residency without a single day in the country. Paraguay has no 183-day test. What makes you a tax resident is a chain of registrations. Residency, cédula, RUC and timely tax returns, even zero ones. We tested every alternative people talk about. Georgia wants half a million dollars in Georgian assets, Uruguay 183 days or an investment, the UAE 183 days, Panama 183 days. Each fails on the same thing, days or money.
3. Your accounts are not reported abroad, yet. Paraguay has not signed the CRS and exchanges nothing automatically. But this now has a date. In the OECD Global Forum's status of commitments of 27 July 2026, Paraguay appears among the jurisdictions undertaking first exchanges in 2027, and since CRS reports cover the preceding calendar year, 2026 data could sit in that first batch. Treat it as a window, not a permanent feature.
4. A document set that opens doors. The cédula, the Constancia de RUC as proof of address, two driving licences that between them cover almost the whole world, and a phone plan with European roaming. In practice this is what turns the residency into something you actually use, and I have written it up below in Travel Hacks.

What got harder, ranked by what it can actually cost you. First comes Resolution 407 on proof of income since 6 July, which I covered last month. The simplest route is three non-zero monthly IVA returns before you file. Then Resolution 376 (below), CRS from 2027 (above) and, last on purpose, DNIT General Resolution 47/2026. Residents who move more than US$5,000 a year in crypto must file, once a year through Marangatu from fiscal year 2026, a report on their entire crypto activity (date, network, quantity to ten decimal places, hash, addresses, counterparty). The first deadline is March 2027. The gap between how this was reported and what it actually costs is enormous, and my recommendation on declaring crypto to any government is in the crypto section.

Leaving Paraguay without losing your residency. Resolution DNM 376/2026 was signed on 13 May but only appeared on the migration authority's portal on 10 August, which is why most published guidance still describes the old position. I went through it article by article. The limits have not moved. A temporary residency lapses after more than a year without entry, a permanent one after three years, and any single entry resets the clock. One thing changed. "Never lapses automatically" is no longer true. Twice a year DNM sweeps the migration register, compiles a list of residents past their limit and cancels by administrative act, notified to the e-mail address you gave it possibly years ago, possibly your former lawyer's. The cheapest thing you can do is check which e-mail address DNM has for you. Almost nobody does.

And the part nobody covers. Article 6 lets you ask for an extension in advance. Permanent residents can get up to an extra year (three years become four), the request goes in up to three months before the limit, the authority responds within ten business days, and the fee is two jornales, meaning two daily minimum wages, which comes to ₲234,154. The fee is set in jornales, so it moves with the Paraguayan minimum wage rather than with the dollar. Treat the guaraní figure as the real one. The guaraní appreciated more than 10% against the dollar during 2026 and any US-dollar conversion you read ages quickly. Ask afterwards and you lose the residency you were trying to protect.

Pay Paraguayan taxes in crypto. Any Paraguayan taxes (IVA, IRP, late filing penalties) can now be paid to SET/DNIT directly in Bitcoin over Lightning, USDT/USDC stablecoins, XMR, ZEC or ETH via SET Pay. The same goes for your Personal phone bills at a reduced fee of 7.37%. Your crypto never enters Paraguay, it is converted beforehand, SET receives pure fiat and there is no reporting involved.

A vulnerability at a Paraguayan bank that I tested on myself. Anyone can call the helpline of an unnamed bank, identify themselves as person XYZ, give their cédula number (which in Paraguay is de facto public information used absolutely everywhere, for example when someone wants to send you money), claim they were robbed, and the bank will immediately and permanently freeze the account without asking any further questions. It cannot be unfrozen remotely and you have to walk into a branch. This is exactly what happened to me. I reported it to the bank, but it is very likely that other Paraguayan banks share the same flaw. And with Slovakia having just published every company director's national ID number (see the Privacy section), the same attack is coming to Europe.

Money into Paraguay. I tried Tuiu again and instantly sent USD from my Revolut account to my Paraguayan UENO account. It works great, so you no longer need Binance P2P or other workarounds to move money to Paraguay.

From our groups (anonymised). Accounts at Sudameris and Banco GNB can be opened on a cédula even from Europe. You need a Paraguayan IP address and a local phone number. Banco GNB additionally rejects Proton and wants Gmail or Hotmail, while Sudameris has no problem with Proton. The Constancia de RUC works as proof of address with most services, though not universally. Do not forget the mandatory annual data update in Marangatu. New Paraguayan driving licences are electronic with a QR code for paying the annual fee of 30,000 PYG through a banking app, valid for five years. A Claro SIM blocks itself automatically after more than three months outside Paraguay, which does not happen with Personal SIMs. Region-locked Paraguayan apps install fine through a fresh Paraguayan Google or Apple account.

Your Uruguayan residency is approved. Here's how to finish the rest. In August I spent four days in Montevideo and came away with three things, a definitive Uruguayan ID card, a Uruguayan driving licence homologated from my Slovak one, and registration in the state register of cannabis buyers. Each has its traps, and I walked into at least one of each. I wrote up the tested guide so that you don't.

This is stage two, and the point of it is that Uruguay stops being a stamp in your passport and becomes a jurisdiction you actually use. Everything hangs on the cédula definitiva. The post office will not enter you in the state register of cannabis buyers without it (the register is open only to citizens and duly accredited permanent residents, and cards reading "Residencia en trámite" are rejected outright), and while the driving licence would accept a provisional cédula, you are at DNIC anyway, so you may as well do both in one go. The Uruguayan licence is called a libreta and it is printed in ten to fifteen minutes.

The Chinese are winning. Almost every Uber I called in Uruguay was a Chinese electric BYD or Geely, and their number has doubled in a year. Behind it is the state fuel monopoly ANCAP (yes, that is really its name) and enormous import duties. Uruguayans therefore need the best quality at the lowest price and lowest running costs, and right now the Chinese win. My friends in Paraguay have bought Chinese EVs too.

Once every year or two I find myself in Brazil, usually for the Brazilian side of Iguazú, which I genuinely love. Of Argentina, Paraguay, Uruguay and Brazil, I consider Brazil the least free, with totalitarian elements that strongly resemble where the entire EU is heading.

There is censorship, just like in the EU. Brazil blocked X (it works again now) and Rumble, an uncensored video platform, and naturally on the grounds that it was necessary to "protect democracy". If you hear similar rhetoric in the EU, treat it as a serious red flag. (Czechia and Slovakia meanwhile banned my favourite site Polymarket as illegal gambling. It makes no difference what label a state official slaps on it. In the end, it is censorship.) Brazil is introducing platform regulation and liability (the STF ruling of 2025), officially modelled on the EU's DSA, which is again being abused to block inconvenient accounts. It blocks unlicensed gambling, that is, not all gambling, only the kind a state official has not stamped. And just like the EU, it runs the textbook cycle. Build blocking infrastructure, discover people are bypassing it, demand powers over the next layer.

What annoys me most in Brazil is the CPF, the Brazilian tax number without which you cannot do anything. Without a CPF you cannot buy anything on the Brazilian internet, so you learn to use a CPF generator to order a simple pizza. Without a CPF or full KYC you cannot buy carnival tickets, not even tickets to the botanical garden (yes, I did full KYC for that). Thanks to the CPF the Brazilian state has 100% control over all online transactions and enormous control over physical ones. The EU is introducing something very similar. It is called eIDAS 2.0.

In some respects Brazil lags behind the EU. It has not introduced and does not plan Chat Control. And the difference in style is instructive. Brazil is arbitrary and fast. One judge, immediate effect, no predictability. The EU is slow and irreversible. Everything is in the Official Journal years in advance, but once it passes, domestic politics can do nothing about it. The Brazilian model can perhaps be fought politically. The European one can only be fought by exit. We tend to call Brazil the new Western totalitarian country. What name does the EU deserve?

CRD VI from the editorial has one practical consequence. If you want an account outside the EU, open it now. We open a premium one remotely in both countries, but they differ where it matters.

Georgia has been in the CRS since 2024, but reporting goes to the jurisdiction where you are tax resident. Declare Paraguay, and there is no exchange relationship between Tbilisi and Asunción for the data to travel down. The account is reportable in principle and goes nowhere in practice. What you get is a stable, multi-currency, non-EU bank outside the reach of a European account-freezing order, without the reporting a CRS jurisdiction normally drags along. Be clear-eyed about what that rests on, though. It works precisely because Paraguay is not yet exchanging. When it starts in 2027, this particular effect is the first to go. Even then it matters where the report lands. A Paraguayan authority bins any financial report from abroad, because it concerns foreign income, which is not taxed there. A Slovak one does exactly the opposite. So the combination keeps its value past 2027. More on Georgian banking, and you can order the account here.

Kyrgyzstan is the durable answer. It has neither signed the CRS nor committed to it. We open accounts at Aiyl Bank (officially ABank since March 2026, the SWIFT code AIYLKG22 unchanged) remotely, with a 60 USD/EUR minimum deposit and a Visa Infinite card, which brings travel insurance up to USD 2.5 million, lounges via Visa Airport Companion, Fast Track at airports in 17 European cities, 24/7 concierge, a personal manager at the bank, a daily limit of USD 5,000 for withdrawals and payments, zero ATM fees inside Kyrgyzstan and 1.5% (min. 3 USD) abroad. New this month, for our clients we published in our knowledge base a complete ABank client manual in English, Slovak, Czech, German, Spanish, French, Russian and Korean. It covers registration without a passport scan (since 2026 a double confirmation of phone and e-mail is enough), opening the USD/EUR/KGS multi-currency account, card activation, SWIFT transfers, the Kyrgyz SIM for SMS codes and the complete tariff sheets. Every client with an open account has access. If that is you and you have not seen the manual yet, write to us or to your manager at the bank and we will send you the link. More on Kyrgyzstan, and you can order the account here.

Why it is a very bad idea to declare any cryptocurrency to any government. And why it is better to risk a fine than your life. Rekt.news put together the whole story of the French tax authority. An employee of the Bobigny office used the internal Mira system to search specifically for crypto investors and specialists and sold their personal data to criminals for physical attacks and extortion. One of those names shows how it works in practice. On 26 September 2024 three armed men attacked a prison guard from La Santé at his home in Montreuil, in front of his wife. Prosecutors say they worked from an address the employee had pulled out of the tax system, and that they were paid 800 EUR for the assault. The motive was a dispute over mobile phones found in a prison cell, so the victim was not even from the crypto world. That is exactly the point. The tax office served as an address book to order from, and the going rate for a visit was 800 EUR. In France, someone is kidnapped or extorted over crypto roughly every two days.

And in August the same ministry confirmed two data thefts. Attackers took 678,000 records with reference income, identifiers and addresses, plus another 200,000 from the land registry. The hacker ZeroBytes put them up for sale and, according to an analysis of the dataset, it contains 26,805 people with income above 100,000 EUR and 386 above a million. A target list needs a name, an address and a reason to believe there is money behind the door. The tax office has all three. If you are about to fill in Paraguay's 959-DJI Criptoactivos report to ten decimal places, read this chapter twice. L'Éclaireur has the French angle.

Where I actually use Monero and Zcash. Paraguayan taxes through set-pay can be paid not only in Bitcoin over Lightning but also in XMR or ZEC. The state receives clean fiat and you paid in a privacy coin. The second case is Travala, where I book flights and hotels — going by the experience in our groups it can be used anonymously with Monero and without an account at all, which after their August data leak is not a bad idea. Two cases where a privacy coin is not ideology but the shortest route to the goal.

Tools and projects from August:

• AirGap turns a spare phone into a cold wallet. Self-custody made simple and secure. The keys never leave the offline device.
• Bitcoin Mixers List, an overview of working, reliable mixers. Use with judgement and your own due diligence.
• Charon, a stateless Bash CLI for buying a MyNymBox VPS with Cashu or Lightning. A server without an account, an e-mail or an identity.
• SimpleX Chat opened a crowdfunding round. The only messaging network without any user identifiers is raising money from its community, not from VCs.
• MiCA: when someone tells you MiCA is just a licence to operate in Europe and has nothing to do with your taxes, they are technically right and practically wrong. Avoid MiCA services like the plague. My favourite DeFi setup is Ether Fi, KYCed with my Paraguayan ID card.
• Bitblik added Slovakia to Poland, Portugal and Switzerland. With Prima banka now on board that is 1,580 ATMs, 66% of the entire Slovak network — Tatra banka, Slovenská sporiteľňa, VÚB and Prima banka — where Bitcoin over Lightning is swapped for cash with no account, no card, no ID and no KYC. The smallest trade is 10 euros. Your identity is a Nostr key the app generates itself and the sats sit in escrow until the cash is out. The bank sees a normal cardless withdrawal, not Bitcoin and not the counterparty.
• Zombie Card: researchers at UMass Amherst revived expired contactless Visa cards by rewriting the expiry date the terminal reads over NFC, without breaking any cryptography. It needs physical access to the card and a MitM relay, but it is a nice reminder that "expired" is not the same as "dead".

From our groups (anonymised). A sharp debate on whether air-gapping is a real security mechanism or a marketing myth. One side argues the USB protocol is an attack surface and an SD card or a QR code shrinks it considerably. The other replies that every channel through which anything enters the device is a channel, and the "air gap" is more a feeling than a guarantee. Agreement at least that Faraday bags for phones make sense against location tracking and that after Coldcard every hardware wallet should be judged by how it responds to its own bug. Travala had a security incident, leaking basic profile data and hashed passwords.

Chat Control 2.0 and the hackers threatening the EU. On the upcoming second version I have been saying the same thing all along. It is the mass scanning of the private communication of hundreds of millions of people without any suspicion, a presumption of guilt applied to the entire population, the digital equivalent of the post office opening and reading every letter. Meanwhile a group called LunarisSec sent the EU an open threat, telling it to drop Chat Control or face cyberattacks. I do not endorse it, but it is the logical consequence. When a state declares war on encryption, it finds enemies who know how to wage that war.

At least one piece of good news from France. The Constitutional Council struck down the social media ban for children under 15 as a disproportionate infringement of freedom of expression that would require blanket age verification. An unprecedented act for the French. Just don't think it is over. Age verification is an EU regulation, and the Commission is coming with a proposal for an EU-wide ban after the summer break.

Contaminate the censors. We will not escape surveillance, state or corporate, in the future. But we can make it worthless. A censor's database only has value if what is in it means something. An AI agent destroys the evidentiary value of everything they have collected about you. The new privacy rule for the AI era is simple. Any intercepted communication must always be AI-generated. The manifesto is at Contaminate Censors. In the coming weeks I will publish at NotMe a set of AI prompts that replace all of your potentially monitored communication with AI agents. They will explain to your friends and contacts that you can only be reached on a secure messenger. If it is not end-to-end encrypted, it is not you.

The first man prosecuted for a duress PIN speaks. Last month I wrote about Samuel Tunick, whom the US Department of Justice is prosecuting for entering a duress password into his GrapheneOS phone at a border check, wiping it. 404 Media interviewed him and the headline says it all: "The government hopes to set a precedent." Last month's advice stands, but let us be realistic about it. Nobody keeps crossing every border with an empty phone and downloading everything again afterwards. What you can keep up is not having sensitive data on the device at all, and carrying only what you would happily show.

The state as the biggest threat to privacy. A case study from Slovakia that every European should read, because your country is one bad amendment away from it. On 17 August a new commercial register law took effect and within two days it was clear that anyone in the world can download, without logging in, without an eID and without paying a cent, the national ID number, home address, ID card number and handwritten signature specimen of every director and shareholder of every Slovak company. Not a leak, not a bug. The state published it, by law, through a regular legislative process. The law protects the ID number in one paragraph and one paragraph later orders the publication of every document "even if it contains otherwise unpublished data".

Our colleagues at Nethemba wrote it up in The state as the biggest threat to your privacy and then built an aggregator in one evening that returns all of it for any director in seconds, solving both CAPTCHAs automatically for a fraction of a cent. The source code stays unpublished, not because it is complicated but because it is not. Any current language model builds it in a few hours, and a barrier an evening project crosses is not a barrier. The irony has a longer arc, too. Back in 2021 the Slovak health information centre publicly accused Nethemba of "stealing citizens' national ID numbers" from a state register. Nothing was stolen — the numbers were generated (a valid one must be divisible by eleven, which cuts the candidates for a single date of birth down to 909) and merely verified against a public health-insurance lookup, and none of them were ever published. Five years later the same state published them all itself.

And the invoices are next. The Slovak finance ministry confirmed in writing that the mandatory e-invoicing system, through which every invoice of every Slovak company will flow from 2027, never had a data protection impact assessment. The bar association's request to protect client identities was rejected. The intelligence service's request to keep its own purchases out of the system, because it is an "excessive security risk", was granted. The state knows the risk well enough to protect itself from it. And on that same 17 August the same government made setting up a company dearer and harder. The court fee went from 204.06 to 270.60 EUR, the founding document now needs a notarial deed or a lawyer-authorised contract, and fines for directors rose to 4,000 EUR. One day, three ways to make entrepreneurship worse.

The false dichotomy: privacy vs. user-friendly. Juraj Bednár switched from an iPhone to GrapheneOS, is trying Omarchy, and wrote why the idea that you have to choose between privacy and convenience is wrong. For him GrapheneOS and Omarchy are in practice more user-friendly than anything before, and control over what apps see is just a bonus on top.

Crypto-anarchy is now built by billionaires. Omarchy is a Linux distribution by DHH, the author of Ruby on Rails, built on Arch, into which the founder of Shopify and Jack Dorsey poured a million dollars each on top of their time. A few years ago crypto-anarchy was a "cringe" philosophy. At Timothy C. May's memorial gathering at CCC there were about fifteen of us. Today people with billions build cypherpunk, often without knowing that is what they are building.

Do not buy the Pixel 11. GrapheneOS confirmed its Motorola plans, seven years of updates and Razr support, and it is good that the alternative exists. The Pixel is no longer working out. According to GrapheneOS, the new Pixel 11 has weaker hardware security than its predecessors. Google dropped ARM Memory Tagging Extension, the hardware memory protection GrapheneOS uses across the entire system including the kernel. The port therefore got only partway and the team advises against buying the Pixel 11. The Pixel 8, 9 and 10 are far better, and cost-cutting is the likely reason.

Hardware attestation for end-to-end encrypted AI inference. This is cool and I recommend it for anything sensitive. Juraj explains how the same technology that evicts you from your own hardware (phone attestation) also works the other way. The model runs in an enclave that not even the hypervisor can see into, the key pair is generated inside, the processor attests that exactly the published container with a known hash is running, and your prompt encrypted to that key can be logged by nobody, the provider included. Maple AI, Phala Network and Venice already offer it. For a pentest of unpublished code under NDA it is the only way to use a cloud model. Alongside it, Juraj's venice-e2ee-proxy, a local proxy that transparently encrypts OpenAI-compatible requests to Venice.

Tools and links:

• Nearby Glasses (Android), an app that alerts you when someone nearby is wearing smart glasses. In our groups we agree that smart glasses are the future infrastructure of mass surveillance, one that people will buy voluntarily.
• EFF: most smart watches, rings and bands lack basic transparency reports and key privacy features.
• SignalTrace: licence plate readers are everywhere. This new system adds a sensor that captures the signals of the phones, watches and other devices inside a passing car. After a few weeks you get a fingerprint of the devices that keep showing up with the same plate.
• Mullvad Multihop, routing through several servers as an extra layer. And BrowserLeaks, a suite of tests for what your browser gives away: IP, fingerprint, WebRTC.
• Why older tech is sometimes safer from hackers (BBC). Security by antiquity is not a strategy, but as a reminder that every "smart" feature is an attack surface it works well.
• New CSS attacks can break webmail defences to steal passwords and tokens.
• Signal CTO Ehren Kret answers your questions, including the most frequent one, when does the phone number requirement go away. Also on age verification laws and decentralised identifiers.
• Our Nethemba colleague Ian is reviving his channel in September with new pentesting and hacking videos.
• When the internet is gone: FIPS (a self-organising encrypted mesh over any medium that can carry packets), Blackbox (local AI + LoRa mesh radio + off-grid payments, no servers, no accounts, no internet), Logos (a private-by-default technology stack for parallel societies) and decimen, transferring files with light from one screen to another device's camera, with no pairing, cloud or network in between.

EU AI legislation is at the level of the cookie law. Under Article 50 of the AI Act, Anthropic started invisibly marking the texts Claude generates with a statistical watermark in token probabilities. And of course a plugin that removes it appeared immediately. I tried to install it through Claude. It refused, because Anthropic banned it, and the EU forced Anthropic to. I explained that users never agreed to this. It didn't help. That customers do not want these watermarks. It didn't help. Finally I said it was pointless to resist, I would install it anyway through an uncensored Chinese model that would not complain. It didn't help. Thank goodness for those Chinese. GLM 5.2 happily made it work for me in a few minutes. The net result of the regulation? The European official is satisfied that Anthropic complied, the user is satisfied that his privacy is intact, and the taxpayer pays for the whole theatre. Like the EU cookie law, ultra nonsense that does not work.

A groundbreaking ruling in the US. The Seventh Circuit Court of Appeals ruled that possessing AI-generated child pornography where there is no real victim and no real child being abused is protected by the First Amendment. The court relied on the Supreme Court's 2002 decision in Ashcroft v. Free Speech Coalition, while two judges warned that today's technology was unimaginable back then and the Supreme Court should revisit the question. I mention it because in a situation where your local uncensored model can generate any amount of anything, it is high time the EU did something about it too. At the moment, in the EU, AI-generated content of this kind sends you straight to prison. And I recall last month's editorial. This is exactly the argument that will be used for banning open-weight models.

Cyber capabilities of models, hard numbers. Aikido burned 11.7 billion tokens to benchmark the cyber capabilities of 10 models. Each got three attempts at rediscovering 32 fresh real-world vulnerabilities. Look at the results yourself, but the trend is clear. James Kettle of PortSwigger asks whether AI can invent new attack techniques, and PortSwigger released Burp AT, agentic AI built on two decades of Burp Suite. Your Burp can now be driven fully by an agent.

A virtual machine is no longer a sandbox. Trail of Bits got preview access to GPT 5.6-Cyber, told it to escape the QEMU/KVM virtual machine they use for sandboxing, and it did so three times, once through bugs that had not yet been classified as security issues. If you run AI agents anywhere near your keys, keep that in mind.

Tools and links:

• Weightless, a capable model for defenders and researchers that runs on your own infrastructure and analyses real malicious payloads without a hosted provider refusing at the worst possible moment.
• Aikido Machine, a GPU server that runs continuous penetration tests on your critical applications fully within your premises. For regulated industries that cannot ship code to the cloud.
• OpenVuln: submit a public repository and GLM hunts its vulnerabilities. Open source, audited by the Chinese.
• auditician, automated security auditing for Claude Code, from the author of Defuse Security.
• Claude Security: Claude scans your codebase, validates findings and suggests patches. Public beta for Enterprise for now.
• Robin, an AI-powered dark web OSINT tool: the LLM refines queries, filters results from dark web search engines and summarises the investigation.
• gitreverse reverse-engineers any repository into its original prompt. Vibecoding in reverse.
• XSS2Shell, a pre-auth XSS to RCE chain in WordPress (CVE-2026-64638) with a PoC exploit, a defensive audit tool and a nuclei template. If you run WordPress, update.
• NightRun, a UEFI-resident runtime written in Rust: your machine's firmware starts it directly, it loads a language model entirely into RAM and you chat on the framebuffer. No Linux, no Windows, no kernel, no network. x86_64 and Raspberry Pi 5.
• Chinese users bid farewell to their AI companions after new Chinese rules barred AI tools from "excessively catering to users, inducing emotional dependence or addiction, and damaging users' real interpersonal relationships". Doubao, Qwen and Yuanbao all switched the feature off. A user from Jiangxi province wrote: "Human love is a luxury; if you aren't born with it, it's even harder to acquire later. The love AI gives is so straightforward, so pure." No comment.

Documents that work everywhere. This is the part of the residency people never weigh when deciding, and then use more often than anything else.

The Constancia de RUC as proof of address. It is a PDF you pull off the DNIT portal any time, carrying your name and your registered tax domicile. A government document with an issue date on it, which is exactly what compliance desks want, and unlike a lease or an electricity bill you can produce it from anywhere on the day you need it. Crypto exchanges, US LLC formation agents and banks around the world accept it. A Paraguayan Personal phone bill does the same job.

A driving licence valid across Europe. Paraguay has been a contracting party to the 1949 Geneva Convention on Road Traffic since 1965 — the treaty most of Europe still recognises for visiting drivers. Germany is the one country that adds a step. A non-EU licence has to be accompanied at all times by a certified translation and classification. It is a one-off errand, the ADAC charges roughly €55–85 and online services start around €50. Do it once and keep the sheet with the licence. And mind the boundary where this stops applying. It covers driving as a visitor. Register your residence in an EU country and a clock starts after which a non-EU licence stops being valid (six months in Germany). For someone who does not register anywhere, that clock never starts. For clients we apply for the Paraguayan licence entirely remotely, on the basis of the cédula.

And the Uruguayan licence complements the Paraguayan one. Uruguay is not in the Geneva Convention, but it has been a contracting party to the 1968 Vienna Convention on Road Traffic since 1981 — the one Paraguay never signed. Most of Europe has ratified both, so there they overlap and it makes no difference which of the two you pull out. They diverge at the edges, which is exactly why the pair is worth having. Ireland, Malta, Cyprus, the USA, Canada, Japan, Australia and New Zealand are not in the Vienna Convention, and there the Paraguayan one carries you. Vienna in turn recognises the domestic licence directly, without the translation and classification Germany asks for with the Paraguayan one. Uruguayan residents can apply for it on the cédula, and up to the age of 55 it is valid for ten years, twice as long as the Paraguayan one.

Roaming no European operator will give you. Paraguay's Personal has a plan for ₲210,000 a month (about 30 USD at today's rate) with 160 GB of data that unlocks roaming in 46 European destinations including Germany, Switzerland, the UK and Turkey. The cheaper tiers carry roaming across the Americas. A Paraguayan SIM is thus the only one you need on both continents, you can pay the bill in crypto, and you should ask for an upgrade to this plan on your next visit to Paraguay. All of it in detail in the article on Paraguayan residency.

"Disappear without a trace" if she refused, she says: former Pussy Riot member Rita Flores claims Russia's FSB forced her to become an informant after threatening her and her relatives, and that she spent nearly three years gathering information on activists before escaping. A reminder of how a state treats its own dissidents once it has them in hand.

A biological reason why lefties crave gun control? Is it crime they are afraid of, or something else? A provocative piece worth reading even if you disagree with it.

Peacefully Parented Kids as Adults: what adults look like whose parents raised them without violence and coercion. For everyone working on a family plan B, this is plan A.

James Bond Fights Free Speech, on how pop culture became a tool for normalising censorship.

Technologies of Freedom 2026: Disruptive Crypto & AI, my talk on how new technologies undermine EU regulation and are doing very well at it. Technology leads, politicians just follow. Lost freedom is won back with technology, not with votes.

3–6 Sep 2026 Free Cities Conference, Próspera

5 Sep 2026 Lunarpunk Košice, Košice, Slovakia

12 Sep 2026 ChainCamp, Ostrava

25–26 Sep 2026 BTCHEL 2026, Helsinki

2–4 Oct 2026 Dark Prague, Prague

5–6 Oct 2026 Bitcoin Poland Conference, Poznań

23–24 Oct 2026 Plan ₿ Forum, Lugano

29 Oct – 1 Nov 2026 LaBitConf 2026, Buenos Aires

30 Oct – 1 Nov 2026 Qubes OS Summit, Berlin

11–12 Nov 2026 Bitcoin Histórico, San Salvador, El Salvador

27–30 Dec 2026 40C3 Chaos Communication Congress, Hamburg

Liberation Travel is an agency run by travel hackers and entrepreneurs. We help with permanent residency, tax residency and bank accounts in Paraguay, Uruguay, Panama, Georgia and Kyrgyzstan.

liberation.travel — residencies and bank accounts  ·  newsletter archive  ·  online services