Air-Gap Verification Guide: Packet Captures & Network Socket Audits

Auditor Assurance: In infosec and compliance audits, claims of "privacy" must be substantiated with verifiable runtime evidence. This guide provides exact commands and filters to audit HushWrite's runtime network behavior.

Why Software Architecture Must Be Verifiable

Many cloud dictation tools claim in their marketing materials that they "respect your privacy" or "do not train on your voice." However, an application that streams audio over the internet is inherently vulnerable to:

The only true guarantee against data leaks is physical data isolation: ensuring that the software process never opens a network socket in the first place.

Audit Recipe 1: Windows 10/11 Network Packet Monitor (pktmon)

Windows includes a built-in kernel-level packet monitor (pktmon.exe) that captures all network traffic passing through the Windows network driver interface specification (NDIS):

# Step 1: Open an elevated Administrator PowerShell prompt
# Step 2: Add a filter targeting the HushWrite process or outbound TLS ports
pktmon filter remove
pktmon filter add HushWriteFilter -p 443 -p 80

# Step 3: Start real-time event tracing
pktmon start --etw -p 0

# Step 4: Perform a 60-second voice dictation session in HushWrite
# Dictate 100+ words into any text editor.

# Step 5: Stop tracing and format the log file
pktmon stop
pktmon format PktMon.etl -o hushwrite_audit.txt

# Step 6: Verify total packets transmitted
Get-Content hushwrite_audit.txt | Select-String "HushWrite"

Expected Audit Result: Zero outbound packets matching the HushWrite.exe process ID.

Audit Recipe 2: Live Socket Inspection with Sysinternals TCPView

Audit Recipe 3: macOS Packet Inspection with Little Snitch / LuLu

For Apple Silicon Mac users:

Air-Gap Mode: Physical Hard-Kill of Network Sockets

In enterprise environments with classified or strict regulatory requirements:

This physical test conclusively proves that speech recognition, punctuation inference, and text injection operate 100% locally on your machine.