Lopp argues the FCC is treating spectrum like FinCEN treated money — as something flowing through identifiable parties — when physics treats it as a public good with no inherent gatekeeper. He draws on a decade of Bitcoin KYC critique to show identity-verification regimes are fundamentally incompatible with permissionless infrastructure layers like Part 15 unlicensed radio.
The editorial reinforces that Part 15's 1989 free-to-use model — built on type-acceptance at the manufacturer level rather than operator identity — is what enabled WiFi, Bluetooth, LoRa, and the entire unlicensed IoT ecosystem. Bolting KYC onto that compliance model isn't an upgrade but a different protocol stack entirely.
Lopp highlights that the rule reaches Meshtastic, AREDN, Reticulum, and GoTenna — the exact projects that grew out of cellular network failures during events like Hurricane Maria. KYC requirements at the radio layer would gut the resilience properties that make these networks valuable precisely when centralized infrastructure fails.
By submitting the post and driving it to 290 points, FergusArgyll amplified the framing that hardware developers and mesh networking communities should treat this as an existential threat to the off-grid comms layer. The submission's traction signals that the HN technical audience views the mesh ecosystem impact as the most alarming dimension of the rulemaking.
Jameson Lopp — better known for spending the last decade explaining why Bitcoin KYC was a category error — published a call to action this week against an FCC Notice of Proposed Rulemaking that would extend identity-verification requirements deep into the radio spectrum. The post hit 290 points on Hacker News inside a day, and the comment thread is unusually well-informed for HN: ham operators, LoRa firmware authors, and at least one ex-FCC engineer all weighing in.
The scope is the part that should make any hardware developer sit up: the proposal touches not only licensed amateur bands but Part 15 unlicensed devices, mesh and LoRa stacks, and the long-tail of low-power IoT radios that ship by the millions every year. This is the layer that Meshtastic runs on. It's the layer AREDN (Amateur Radio Emergency Data Network) federates over. It's the substrate underneath Reticulum, GoTenna, and every off-grid comms project that's emerged since Hurricane Maria made the failure modes of centralized cellular legible to a generation of engineers.
Lopp's framing is straightforward: the FCC is treating spectrum the way FinCEN treated money — as a thing that flows through identifiable parties — when the actual physics treat it as a public good with no inherent gatekeeper.
The technical objection isn't ideological. It's architectural. Part 15 of Title 47 CFR exists precisely because the FCC, in 1989, decided that some chunks of spectrum should be free-to-use with no per-device registration as long as devices respect power and interference limits. That decision is what made WiFi, Bluetooth, garage door openers, baby monitors, RFID, and the entire LoRa ecosystem possible. The compliance model is type-acceptance at the manufacturer level, not identity at the operator level. Bolting KYC onto that model isn't an upgrade — it's a different protocol stack.
Compare to what happened in crypto. FinCEN's 2019 guidance and the FATF Travel Rule didn't actually stop illicit flows; they pushed activity to mixers, non-custodial wallets, and jurisdictions outside the regime. What they did do, very effectively, is raise the cost of running a compliant on-ramp from "weekend project" to "twelve-figure compliance team." The open-source crypto wallet developers either incorporated offshore, stopped shipping, or got subpoenaed. Applied to radio, the same dynamics would mean Meshtastic forks shipped from Estonia, hobbyist hardware sold gray-market, and a chilling effect on every U.S.-based maker who currently treats `npm install` and `pip install` as the riskiest legal exposure they face.
The comments on Lopp's post surface the practical fault lines. One thread points out that LoRaWAN gateways already log DevEUIs — but that's a network-layer identifier the user controls, not an identity. Another notes that AREDN's value proposition collapses if every node needs a registered operator; the whole point is emergency federation during the moments when centralized authority is, by definition, unreachable. A third commenter — claiming hardware-engineer credentials — observes that mandatory device-side attestation would require either a TPM in every $4 ESP32 board or remote server check-in at boot, both of which break the offline-first guarantee that mesh networks exist to provide.
There's also the secondary-market problem. If every radio needs a registered, KYC'd operator-of-record, then the resale of a Heltec dev board, a baofeng, or even a used WiFi router becomes a regulated transaction. eBay's policy team would have to enforce it. The hobbyist supply chain that powers everything from weather balloons to wildlife trackers to your kid's first SDR doesn't survive that.
If you ship a product that includes a radio — and "radio" here means anything from a WiFi-enabled doorbell to a mesh-networked agricultural sensor — assume that the compliance overhead is going up. The practical question is by how much, and at which layer.
For manufacturers, the likely endpoint is server-attested device identity baked into firmware. That means signed boot, remote attestation, and an enrollment flow at first power-on. It also means devices that brick when the manufacturer's servers go down — a failure mode Tile, Insteon, and a half-dozen smart-home companies have already demonstrated to customers' regret. The Right to Repair lobby will have something to say about this, and the timing of that fight overlaps badly with the FCC comment period.
For open-source mesh projects, the situation is more existential. Meshtastic's threat model assumes the network might be operating in a region where the local government is hostile to it; that's a feature, not a bug. A U.S. rule mandating per-device registration doesn't break Meshtastic in Belarus or Myanmar, but it does criminalize the U.S. contributor base, which is where most of the firmware commits originate. The pattern rhymes with what happened to Tornado Cash maintainers — the regulation didn't kill the protocol, it killed the U.S. people who maintained it.
For hobbyist developers, the immediate practical move is to file a comment during the FCC's open period. The agency's NPRM process is one of the few regulatory venues that actually weights technical objections from named individuals — particularly licensed amateur operators, whose call signs carry standing the same way a bar number does in court filings. The historical record shows that the FCC has reversed proposed rules when the engineering community surfaced specific implementation impossibilities; the 2015 modular transmitter ruling is the most-cited example.
The comment window is the leverage point, and it closes before most developers will have heard about it. After that, the proposal either dies on the docket, gets watered down through industry negotiation (read: the incumbents shape it to lock out competitors), or moves to final rule. The bitcoin KYC arc took roughly seven years from proposal to settled regime; the radio version will move faster because the enforcement apparatus already exists. The asymmetry to watch: every hour Lopp's post spends on the HN front page is worth more than a thousand industry comments, because it's the only mechanism that gets the engineering community to read the docket at all.
It's even worse: Since cell phones broadcast your location at all times, this means telling hundreds of companies (and a number of governments) your location at basically all times.That's already an issue with most cell phones. Making this apply to prepaid phones is even worse.
> Note: By checking this box, I acknowledge that I am filing a document into an official FCC proceeding. All information submitted, including names and addresses, will be publicly available via the web.Is there really not a way to submit an express FCC comment that avoids all my personal info bei
Im USA based use prepaid service because I dont want to provide information for a credit check to obtain postpay service. Theres absolutely no reason for a US based telephony provider to retain the most sensitive PII on their customers. Every large provider has a history of breaches and selling cust
They would do well to make a better CTA for their call to action. Here's the link from the article:https://www.federalregister.gov/documents/2026/05/26/2026-10...I think that gets you most of the way to a link that somebody on HN dropped a few days ago:https:&
Top 10 dev stories every morning at 8am UTC. AI-curated. Retro terminal HTML email.
We really just need telcos to stop allowing caller id spoofing. Doesn’t even need your name, but with a real number we could actually report these scams.You can still allow people to hide it, but then by default every non-business phone should block calls with hidden numbers.