# SENTINEL — Track-Back Defense Platform

**Track-back, never hack-back.** A lawful cyber-deception, forensics, vault, and
data-sovereignty platform that lures attackers into decoys, records everything,
analyzes what they leave behind, follows the public money trail, and hands a
court-ready evidence package to law enforcement — protecting everyone from a
single family to a national government.

This platform **only ever operates on infrastructure the operator owns.** It never
reaches into, damages, or steals from anyone else's systems, never executes
captured malware, and uses only synthetic, clearly-labelled demo data. That is what
keeps it entirely on the legal side of the Computer Fraud and Abuse Act
(18 U.S.C. §1030) — and therefore sellable to businesses and government.

---

## Documents (`docs/`)

| File | What it is |
|------|-----------|
| `SENTINEL_Business_Plan.pdf` | The product & business plan: problem, legal bedrock, the four modules, how track-back works, market tiers, go-to-market, roadmap. |
| `SENTINEL_Technical_Architecture.pdf` | The engineering blueprint: four modules, the tiered vault, predictive threat modeling, the chain-of-crime-scenes evidence model, the Sovereign Packet Layer, and the security/legal guardrails. |
| `SENTINEL_Sovereign_Vision.pdf` | The unified vision: how SENTINEL (defend + document) and the Sovereign Control Tower (govern where data may go) form one "national cyber-lockdown" doctrine at three scales. |

The `docs/` folder also contains the Python generators (`build_*.py`, `pdf_common.py`)
and the embedded fonts, so the PDFs can be regenerated at any time.

---

## Working prototypes

Each is a self-contained, local-first Python service. All were built and verified
end-to-end. **Nothing binds to the public network by default; all data is synthetic.**

### `honeypot/` — Honeypot & Deception Grid + Forensics Lab + Track-Back
Decoy Flask server, watermarked canary bait files, beacon-home track-back, a
simulated forensics microscope (never executes samples), evidence chain-of-custody
packaging, plus the upgrades: **auto-cloning decoys**, a **quarantine "glovebox"**
(inert containment), and a growing **fragment/threat-signature catalog**.

```bash
pip install flask
cd honeypot && python demo_seed.py && python honeypot_server.py
# dashboard: http://127.0.0.1:8080/dashboard
```

### `vault/` — Air-Gapped Encrypted Vault
AES-256-GCM authenticated encryption, tiered key derivation (PBKDF2 → scrypt),
tokenized references so even the listing reveals nothing. Family → Business →
Government tiers. Self-test suite passes 23/23.

```bash
cd vault && pip install -r requirements.txt && python demo_seed.py && python app.py
# demo passphrase: demo-pass-123
```

### `gateway/` + `trainer/` — Filter & Track-Back Gateway
Link/attachment detonation in a simulated sandbox with tokenized link sanitizing
(port 5001), plus a consent-gated phishing-simulation trainer with no real payloads
(port 5002).

### `ransom_trace/` — On-Chain Ransom Tracing ("trace, not touch")
Read-only taint tracer over a **simulated** ledger — the lawful "follow the money"
technique used by blockchain-analytics firms. Never injects tokens, never moves or
seizes funds. Produces a law-enforcement referral report with an integrity hash.

```bash
cd ransom_trace && pip install -r requirements.txt && python demo_seed.py && python app.py
# dashboard: http://127.0.0.1:5057
```

### `packet_layer/` — Sovereign Packet Layer
Jurisdiction-aware tokenized egress gateway. Classifies flows DOMESTIC vs
INTERNATIONAL, mints HMAC-signed tokens, and applies ALLOW / INSPECT / BLOCK policy
with cross-tenant cryptographic isolation ("lease to other countries"). An honest
sovereign **overlay** — it does not re-plumb the physical internet.

```bash
cd packet_layer && pip install -r requirements.txt && python demo_seed.py && python packet_gateway.py
# dashboard: http://127.0.0.1:5055
```

---

## Legal & ethical guardrails (enforced throughout)

- **No hack-back.** Nothing touches a system we don't own.
- **No live malware execution.** Captured samples are read as inert bytes only.
- **Synthetic data only.** Demo data, documentation-range IPs, demo passphrases.
- **Local-first.** Services bind to `127.0.0.1`; no cloud dependency, no telemetry.
- **Trace, not touch.** On-chain analysis reads the public ledger; it never moves funds.

### Sources
- Congressional Research Service, *Cybercrime and the Law: Primer on the CFAA* — https://www.congress.gov/crs-product/R47557
- Bloomberg Law, on the DOJ computer-crime manual — https://news.bloomberglaw.com/tech-and-telecom-law/debate-brewing-over-whether-companies-should-strike-back-at-their-cyber-attackers
- GovTrack, Active Cyber Defense Certainty Act (H.R. 3270, 2019) — https://www.govtrack.us/congress/bills/116/hr3270
- Security Today, *Hacking Back: Revenge is Sweet, But is it Legal?* — https://securitytoday.com/articles/2019/01/07/hacking-back.aspx

---

*Prepared for the founder · Brandon, Florida · Confidential*
