I have spent most of my career making sure cryptographic keys survive. Survive power loss, survive component failure, survive deliberate attack. For the last stretch of that career, we have been building a machine whose proudest feature is that it destroys them.

That machine is CZAssist, and we have just completed the funded six-month project that took it from an idea to working hardware. This post is a retrospective of sorts, but not a technical one. It is an acknowledgement of the problem, an account of what building it taught us, and a marker for what comes next.

The problem nobody designs for

CZAssist is a ruggedised, battery-powered portable secure server for people who work in places where having your equipment taken from you is not a hypothetical. Journalists. Human rights lawyers. NGO field staff. People whose laptops get seized at borders, lifted from hotel rooms, or confiscated by whoever holds power locally that week.

The obvious answer is full-disk encryption, and the obvious answer is wrong. FDE is built on an assumption that the attack arrives over a network. It holds up rather less well when the attack arrives with a uniform and a van. A powered-off disk can be cloned and worked on at leisure. Keys can be pulled from RAM before they decay. A device left in a hotel room can be tampered with and handed back looking untouched. And a device seized while running, with the keys resident in memory, has already lost.

The security industry knows all of this. It is why banks do not protect their signing keys with BitLocker; they buy hardware security modules, tamper-responsive devices that detect physical interference and erase themselves before an attacker reaches the silicon. I know this world well. I spent years at nCipher building exactly that class of hardware for exactly that class of customer.

Here is the part that has bothered me for a long time: the people who most need tamper-responsive hardware are the ones who could never buy it. A bank protecting its keys faces a well-resourced but ultimately commercial adversary. A journalist carrying source material faces an adversary with legal cover, physical custody, and no particular incentive to give the device back. The threat is worse and the budget is zero. The industry built this technology for the customers who could pay, and the people whose lives depend on it were never in the market.

Prefer destruction

The defining design decision in CZAssist inverts the usual priority of a secure system. Everything I was ever taught says: preserve the data. CZAssist says: destroy it.

If the device detects that it is being physically interfered with, it irrecoverably erases its keys. Not “locks”. Erases. There is no recovery procedure and no vendor backdoor. Once the keys are gone, the material needed to produce the plaintext does not exist anywhere, including here.

A false positive costs you your own data, all of it. We decided early on that this is the correct trade, and I would defend it in front of anyone. The cost of a false positive is lost work. The cost of a false negative is a source, a testimony, sometimes a life. Those are not comparable losses, and a design that pretends they are has misunderstood who it is for.

I am not going to describe the internals, partly because proper technical write-ups will come later and partly because some of it deserves to stay vague. The principle is the thing that matters: tamper detection results in irreversible key destruction, and there is no recovery route available to us, and therefore none an adversary can compel us to use. And I will not claim the device is impregnable. Nothing is, and anyone selling hardware in this space who says otherwise should be treated with suspicion.

What six months bought us

We set out to prove that the approach works, and it does. The core of the system exists, it runs, and it demonstrably does what the design says it should: detects interference and responds without mercy. We are equally clear about what it is not yet. It is a proven foundation with working demonstrations, not a product. Getting from here to something you could put in the hands of a journalist heading somewhere dangerous takes manufacturing, certification, and money, and we have never pretended otherwise.

But the more interesting story from those six months is not the box. It is what building the box revealed about how far the ground has shifted under hardware development, and how low the barriers now are for anyone with the right background and sufficient stubbornness.

Start with the design tools. KiCad carried the entire schematic and PCB layout effort, every net and every via of it, and barely put a foot wrong. A free, community-built tool doing work that sat behind five-figure licences for most of my career. The enclosures went from CAD to a desktop 3D printer sitting on the same bench, often the same day. The silicon is its own quiet revolution: functionality that in my HSM days was an entire potted module, with its own board, its own budget, and its own design team, now lives inside a single TQFP-100 package that costs less than lunch. The current generation of secure microcontrollers would have seemed like science fiction to the engineer I was twenty-five years ago.

And then there is AI. Claude Code wrote the majority of the integration firmware, the serial protocols, and the test harnesses more or less from specification, at a pace no team I have ever managed could match. Software simply fell off the critical path. The bottleneck of every embedded project I have ever run was not a bottleneck at all.

Hardware, meanwhile, remains hardware, and it kept its sense of humour. To save time and around a hundred pounds, I ordered express prototype boards without soldermask, which is the kind of decision that sounds shrewd right up until you are three days into hunting solder bridges on bare copper. A false economy of the purest kind, and a lesson I apparently needed to relearn in person. There is no AI for that part either. However good the tooling gets, a board with a short on it somewhere is still found the old way: a magnifier, a multimeter, and language unfit for publication.

The conclusion stands regardless. A serious security device that once demanded a corporate lab and a seven-figure budget is now within reach of a small company with the right skills. The capital barrier has mostly gone. What remains is knowing what to build, and why.

Why this project, why us

I have written before about what happens when the cameras are not allowed in, and I built a memorial to hold the names of journalists who have paid the highest price for bearing witness. A free press is not an abstraction to me; it is the mechanism by which the powerful are made to answer, and the people who operate that mechanism do so at risks most of us never have to contemplate. That is the argument, made in full elsewhere, and it is why this project exists.

What I will say is this. I am South African. I spent my early career building HSMs and cryptographic modules for the military during the apartheid years. The wrong side of history, and I knew it even then. Later I spent five years at Deutsche Bank, building security technology for the same investment banking machine that had crashed the world economy in 2008. Good engineering, well paid, and not much to be proud of on either count.

So when I say this project is personal, I mean it precisely. The skills are the same ones. The tamper protection, the key ceremonies, the threat models I once built for generals and banks work just as well for a photographer at a checkpoint. What changed is who they are pointed at.

There is also an uncomfortable truth about why nobody else does this work. The established high-end hardware vendors have every capability required and no commercial reason to use it. The market is too small to move their numbers and the politics are too awkward for their government customers. That is not a criticism; it is simply how large companies work, and I spent enough years inside them to know it. But it is also precisely our opening. We are small, we are independent, and we answer to nobody whose discomfort matters more than the work. I intend to spend the remainder of my working life being a force for good, and I cannot think of a better place to start.

What comes next

CZAssist is the first of these, not the last. We are building a suite of tools around the same principle: security engineering of the grade normally reserved for banks, aimed at the people who actually stand between the powerful and the truth. The foundations are laid, and there are more directions to take this than we could pursue alone, which is exactly the position we hoped to be in.

So we will not pursue them alone. If you work in this space, if you have carried equipment through a hostile border and know what we got wrong, if you think about the safety of journalists and human rights defenders for a living, we would like to hear from you. The same goes for the funders and organisations backing technology built for public good; this is precisely the kind of thing you exist for.

The machine we built is designed to lose everything it holds. That is not a flaw. The data was always expendable. The people carrying it are not.

---

Dedicated to the journalists killed in conflict zones in pursuit of the truth, the named and the unnamed many. thetoll.memorial