I made a discovery while digging into GSM signaling architecture. When you forward a call cross-carrier, each carrier in the chain only sees adjacent hops. That's just how GSM works. But that means cross-carrier forwarding behaves like a proxy chain. This is a fundamental property of the protocol, not something engineered on top of it. That realization is what CAMO is built on. If cross-carrier forwarding produces partial visibility at each node by default, you can compose that property deliberately. Add M2M private APNs for jurisdictional breaks, rotating eSIM pools so no stable SIM identity persists, WireGuard tunnels between nodes, a signed gossip protocol for node discovery and what you get is onion routing at the cellular radio layer. No single node sees both origin and destination. Chains rotate every 10 minutes. eSIM pools rotate on independent non-synchronized timers. Anyone can run a node. No registration, no fee, no central authority.

The components are all decades-old standards: GSM forwarding, GTP-U, private APNs, GSMA SGP.02, WireGuard. CAMO is the recognition that they compose into something that didn't formally exist before. The enforcement-resistance is structural, not designed. Disabling CAMO requires disabling private APNs and eSIM provisioning which collapses enterprise IoT globally. Tor protects the IP layer. CAMO protects the radio layer. They're complementary.

Spec, threat model, reference deployment: https://github.com/pablo-chacon/camo

CC BY 4.0.