# Home - Operational security for activists

This is a short book that describes how activists can stay safe when using technology or attending protests. Many of the tips in this book were written for people that are being threatened by law enforcement, large corporations, or organized crime.

## Table of contents

{% content-ref url="/pages/-M8xZB6K6fQdiTKG47Vc" %}
[Mobile phone security](/mobile-phone-security)
{% endcontent-ref %}

{% content-ref url="/pages/-M8x7gtQ9DHIs\_ORwo1B" %}
[Secure digital communication](/secure-digital-communication)
{% endcontent-ref %}

{% content-ref url="/pages/-M8x2tV9EqEi3OtRsFkz" %}
[Email, online banking, and social media security](/social-media-security)
{% endcontent-ref %}

{% content-ref url="/pages/-M8z4SDrBSfRZSeeBtAw" %}
[Running a pseudonymous social media account](/running-a-pseudonymous-social-media-account)
{% endcontent-ref %}

{% content-ref url="/pages/-M8ytD8FtpMNHnLLEqVU" %}
[WiFi security](/wifi-security)
{% endcontent-ref %}

{% content-ref url="/pages/-M8xC\_Om2DBc3n43KDcK" %}
[Virtual Private Networks (VPNs) and Tor](/internet-security)
{% endcontent-ref %}

{% content-ref url="/pages/-M8x66AKcMcCGL6bkOJx" %}
[Editing images for security](/editing-images-for-security)
{% endcontent-ref %}

{% content-ref url="/pages/-M8x\_CuHsqsKcLxhB8t1" %}
[Laptop security](/laptop-security)
{% endcontent-ref %}

{% content-ref url="/pages/-M8x7HOhPflm4H2cBxAI" %}
[How the government tracks your location](/how-the-government-tracks-your-location)
{% endcontent-ref %}

{% content-ref url="/pages/-M8x4gKkL3PT4vusQ9If" %}
[Talking to journalists](/talking-to-journalists)
{% endcontent-ref %}

{% content-ref url="/pages/-M9p94Uy\_prUyL8dECHQ" %}
[Glossary](/glossary)
{% endcontent-ref %}

{% content-ref url="/pages/-M9OPEM\_V5dZTdXxEF3b" %}
[Further reading](/further-reading)
{% endcontent-ref %}


# Mobile phone security

These are some basic tips for keeping data on your phone secure.

## Use a strong passcode on your phone with digits and, if possible, letters.

Always have a passcode on your phone made up of numbers and/or letters. Don't tell it to anybody that has access to your phone. You may consider telling your passcode to a friend that lives far away so that they can unlock your phone in the case that something happens to you.

## Do not use biometric authentication like fingerprint detection (Touch ID) or face detection (Face ID).

In the United Staes, law enforcement [cannot compel you](https://techcrunch.com/2019/11/21/court-police-suspects-passwords/#:~:text=Another%20US%20court%20says%20police%20cannot%20force%20suspects%20to%20turn%20over%20their%20passwords,-Zack%20Whittaker%40zackwhittaker\&text=The%20state's%20Supreme%20Court%20said,protects%20suspects%20from%20self%2Dincrimination.) to turn over the passcode to your phone because the Constitution protects you from self-incrimination.

However, law enforcement might be allowed to use your face or fingerprint to unlock your phone. This is an [ongoing debate](https://www.zdnet.com/article/police-cant-force-us-citizens-to-unlock-their-phone-by-face-or-finger/), but the safest thing is to avoid the debate and **always use a numeric or alphanumeric passcode.**

## Take backups or sync to the cloud to avoid losing data.

Phones are easily lost, damaged, or stolen. It is important to back up the information on your phone if you do not lose it.

{% hint style="info" %}
Nearly all modern phones can sync most of their data to a cloud service, but it might make it easier for computer hackers or law enforcement to obtain your phone's data. **Do not connect your phone to a cloud service if you are worried about law enforcement**. It is also possible to back up your phone to your local computer instead.
{% endhint %}

## Beware that the government may be tracking your location with fake cell towers.

Fake cell phone towers go by a few different names:

* Cell-site simulator
* [IMSI-catcher](https://en.wikipedia.org/wiki/IMSI-catcher)
* [StingRay](https://en.wikipedia.org/wiki/Stingray_phone_tracker) (a brand-name IMSI-catcher manufactured by Harris Corporation)

These are all radio devices that send out signals advertising themselves as cell phone towers for your phone to connect to. Often, these devices then note your phone's identity and disconnect, returning you to a real cell phone tower.

There is [research in detecting](https://techcrunch.com/2017/06/02/who-catches-the-imsi-catchers-researchers-demonstrate-stingray-detection-kit/) the presence of fake cell phone towers, and it is harder for fake cell phone towers to intercept connections using the latest protocols. **However, you should assume that the only way to avoid detection from a fake cell phone tower is to turn off your phone's cell radio.**

The Electronic Frontier Foundation [has more information](https://www.eff.org/pages/cell-site-simulatorsimsi-catchers) about how fake cell phone towers work.

## Consider purchasing a second "burner" phone to use for sensitive situations.

It may be safer and more secure to conduct your activist work on a separate cell phone than you use for your personal life.

### Considerations for when purchasing a burner phone.

Many mobile phone stores will require you to show a government ID in order to purchase a phone. When this happens, you should not consider the use of your phone to be untrackable by the government.

Apple iOS devices have a reputation for stronger security when compared to Android or other devices. However, Android phones are often cheaper.

### Avoid putting your burner phone number in your real phone's contact list, and vice-versa.

The information you store in your burner phone and your real phone should not connect to each other. The two phones should not be in the same contact list.

### Avoid syncing your burner phone to the cloud.

Syncing your burner phone to the cloud makes it easier for law enforcement or computer hackers to obtain the information on it. If you need to make backups, backup your phone locally to your computer. Apple's iTunes [makes it possible](https://support.apple.com/en-us/HT203977#computer) to create encrypted local backups of an iPhone.

### Avoid connecting your burner phone to the same WiFI networks and Bluetooth devices as your real phone.

Your phone's Wi-Fi and Bluetooth connections can be used to discern a lot of information about who you are and where you have been. For example, if your car offers Bluetooth connections, don't connect both your real phone and your burner phone, because that gives a hint to anyone examining both devices that they owned by the same person.


# Secure digital communication

You should use Signal and ProtonMail to communicate online.

## Tools you should use to communicate.

The following tools have high security standards and are generally trusted by most independent computer security professionals.

### Signal for secure instant messaging and phone calls.

[Signal](https://signal.org/) is an instant messenger available on Android, iOS, Mac OSX, Windows, and Linux. Signal is developed by a non-profit foundation that releases the underlying source code and designs for independent computer security professionals to audit and approve.

[Download Signal for your computer or phone here.](https://signal.org/download/)

### ProtonMail for secure email

[ProtonMail](https://protonmail.com/) is a provider of end-to-end encrypted email. It has one of the strongest reputations for security in the industry.

Many journalists have a public-facing ProtonMail email address for new sources to contact them. If you want to email someone that had a ProtonMail email address, you should email them from another ProtonMail account. [Emails between ProtonMail users are end-to-end encrypted](https://protonmail.com/blog/zero-access-encryption/?utm_source=auto\&utm_medium=email\&utm_campaign=welcome\&utm_content=text) and cannot even be read by ProtonMail employees. Whereas if you send an email to a ProtonMail user from an unencrypted email service like Gmail, then your email provider (and law enforcement) can still read what you sent.

## Tools you should NOT use to communicate.

This below list is incomplete. No matter what, you should stick to communicating with Signal and ProtonMail whenever possible.

### Telephone calls

You should treat phone calls on telephone networks as unencrypted. Assume the government or someone else is listening. Even if you think that nobody is listening to your phone calls, it is entirely possible that the person you are calling is under surveillance.

You should also assume that your adversary will be able to obtain the metadata of your phone call:

* Who you called
* When you called them
* The cell phone towers connecting you, which provide a rough location of where the callers were.

### SMS/text messaging

SMS is an incredibly insecure protocol, and should not be used for communicating. SMS messages are unencrypted and phone numbers are frequently subject to being stolen via [SIM-jacking](https://www.vice.com/en_uk/article/3kx4ej/sim-jacking-mobile-phone-fraud). Popular Mechanics has a [deep dive into the security issues around SMS](https://www.popularmechanics.com/technology/security/a29789903/what-is-sms/).

### Traditional email

Traditional email services like Gmail are not end-to-end encrypted. Your browser may have an encrypted connection to Gmail, and Gmail uses encryption to send the email to your recipient, but **your email exists unencrypted on their mail servers**. Law enforcement can request access to these emails.

It is possible to layer on additional encryption with tools like [Pretty Good Privacy (PGP)](https://en.wikipedia.org/wiki/Pretty_Good_Privacy) or [S/MIME](https://en.wikipedia.org/wiki/S/MIME), but using these tools is typically far more complicated than just using Signal instead.

If you must use email, [ProtonMail](https://protonmail.com/) is an email provider with a reputation for security.

### Social network direct messaging

The messaging tools from Facebook, Twitter, Instagram, Snapchat, and WeChat are typically not end-to-end encrypted. Employees of these social networks and law enforcement may be able to see what you send.

Facebook Messenger's Secret Conversations are an exception. [Secret Conversations are presumably end-to-end encrypted](https://www.facebook.com/help/messenger-app/1084673321594605#:~:text=A%20secret%20conversation%20in%20Messenger%20is%20encrypted%20end%2Dto%2Dend,\(ex%3A%20a%20screenshot\).), but it is difficult for independent security professionals to audit this. You should use Signal instead.

### Snapchat

Snapchat is known for being an easy way to send disappearing messages, but this does not make Snapchat secure for activists.

Snapchat promised that their messages disappear, but [they got in trouble with the US Federal Trade Commission](https://www.ftc.gov/news-events/press-releases/2014/05/snapchat-settles-ftc-charges-promises-disappearing-messages-were) when it came out that they were storing messages after "disappearing." Recently, [Snapchat claims to have added end-to-end encryption](https://www.telegraph.co.uk/technology/2019/01/09/snapchat-adds-end-to-end-encryption-protect-users-messages/), but you should still stick to using Signal.

### Workplace messaging apps

Slack, Discord, Google Meet, Microsoft Teams, and other apps are typically not end-to-end encrypted. Employees that make these apps as well as law enforcement may be able to see what you send.

Slack's enterprise plan [offers encryption key management](https://slack.com/enterprise-key-management), but this system should not be considered resilient to law enforcement. Use Signal instead.

### Zoom

As of June 2020, the Zoom video chat app [does not intend on offering end-to-end encryption for users on Zoom's free tier](https://www.theverge.com/2020/6/3/21279355/zoom-end-encryption-calls-fbi-police-free-users). This is partially to allow law enforcement access to these Zoom calls to cut down on illegal behavior on the Zoom platform.

You should instead make video calls with Signal. However, as of this time of writing, Signal does not support group calling or screen sharing.

### WhatsApp

WhatsApp is significantly more secure than most messengers. Under the hood, [it uses the same security protocols](https://signal.org/blog/whatsapp-complete/) as Signal.

However, Signal is run by a foundation that publicizes the source code and designs for Signal so they can be independently audited by security researchers. WhatsApp uses some of the same technologies, but WhatsApp itself cannot be audited in the same way. Because of this, nearly all security researchers advise people to use Signal instead.

### iMessage

iMessage is a messaging service offered by Apple for users of their devices. Apple has historically had a strong stance on security and they claim that iMessage conversations are end-to-end encrypted, but iMessages has several problems:

* iMessage is not available for non-Apple phones. iMessage falls back to sending an insecure SMS in this case.
* iMessage is a proprietary system that is not easily audited by the security community.

Use Signal instead.


# Email, online banking, and social media security

Here is how to secure your email and social media profiles. But if you want to communicate 1-1 with someone, use Signal instead.

## Only use ProtonMail for email.

'As described in the [Secure digital communication](/secure-digital-communication) page, ProtonMail is a secure email client with encryption features that most other email providers lack. If not ProtonMail, consider using the chat messenger Signal.

## Disable images in your email client.

Many emails contain embedded images in them. When you open an email, these images load from remote servers. Whoever owns these servers can often determine:

* when and how many times you opened the emails containing their images.
* your IP address, which can be used to approximate your physical location when you emailed them.
* some basic information about your email client and computer.

In July 2019, the email client Superhuman was [widely criticized](https://mikeindustries.com/blog/archive/2019/07/superhuman-is-spying-on-you) for sending emails with tracking images that could expose the above information about the recipient. This is a common feature in a lot of email-sending software used by businesses or hackers.

## Avoid opening links that you have been sent in your email client.

If you click on a link in an email to visit a website, the website will learn your IP address--which can reveal your approximate location. The website may also learn basic information about your computer that can be used to recognize you and de-anonymize you later.

If you are being sent an email with a link to a website that you regularly visit--such as your bank--do not click the link. The link may send you to an imposter website. Avoid this by storing your bank's URLs in your browser bookmarks or carefully and correctly typing the URL directly.

## Avoid opening attachments sent to you by email.

Many attachments--such as PDFs and Microsoft Office documents--can store executable code that could install malware on your computer. This is a difficult rule to follow because many activists have to open attachments as part of their jobs, but always recognize the risks.

## Use two-factor authentication (2FA) on your online accounts.

### What is two-factor authentication?

Two-factor authentication is an additional security measure that protects access to an Internet account when your password is stolen.

Your password is the *first factor* that identifies you, and the *second factor* is typically a proof that you own a specific device or account. The second factor is usually a time-limited code:

* sent to you via email or SMS. (Avoid using this. See below.)
* generated from a mobile phone app like [Google Authenticator](https://en.wikipedia.org/wiki/Google_Authenticator) or [Authy](https://authy.com/).
* generated by special hardware devices like the [Yubikey](https://www.yubico.com/).

Two-factor authentication makes it much harder for an attacker to hijack one of your online accounts. It is an important part of staying safe online.

### Avoid text message/SMS based two-factor authentication.

Many of these websites will send you the time-sensitive two-factor authentication code via text message. This is a security risk, because it is [possible for attackers](https://www.cnet.com/how-to/do-you-use-sms-for-two-factor-authentication-heres-why-you-shouldnt/) to gain control over your phone number via SIM-hijacking attacks. Avoid using SMS 2FA unless it is the only type of 2FA offered by the website.

### Do not tell anybody your two-factor authentication over the phone or SMS.

Sometimes an attacker succeeds in obtaining or resetting your password, but they need your time-sensitive two-factor authentication code to log in. Some attackers get this code simply by contacting you while pretending to be someone else (such as your IT department) and asking for the code so they can log in.

To avoid being fooled, never give your two-factor codes to anybody.

### Backup your authentication codes somewhere.

People commonly use an app like Google Authenticator or Authy to generate 2FA codes. If you only have these codes on one device, you risk being locked out of your accounts if something happens to that device. Keep that in mind if you are bringing your phone to protests.

Authy lets you create encrypted backups of your 2FA codes to their servers. The password manager 1Password offers the same.

## Store your passwords in the password manager 1Password.

1Password is a tool that securely stores your passwords so that you do not have to remember all of them. Instead, you only have to remember a master password used to lock your 1Password installation.

{% hint style="info" %}
Do not attempt to memorize all of your passwords for various websites. Only memorize your 1Password master password. Do not write down any of your passwords anywhere else.
{% endhint %}

### Why choose 1Password?

There are many password managers to pick from, but 1Password has a reputation for having some of the strongest security while still being easy to use. [Thomas H. Ptacek](https://sockpuppet.org/me/) is one of the most respected security researchers in the world. As of this time of writing, [he recommends 1Password](https://twitter.com/tqbf/status/867093206328119296).

### How to use 1Password

For ease of use, 1Password can sync your passwords to their cloud website. However, if your threat model includes your government, it may be more prudent to use 1Password without cloud syncing. If you do this, make sure to take backups to avoid losing access to all of your passwords.

1Password can also store your two-factor authentication codes. This makes it a lot easier to use two-factor authentication, but it also means that anybody that can compromise your 1Password vault can get complete control of all of your accounts.

## When filling out account recovery "security questions," do not use any information people know about you.

When registering for an account at an online website, they may ask you for security questions to answer in case you forget your password or are locked out of your account.

Never use security questions based on your real-life biography, such as your birthday, the name of your hometown, your mother's maiden name, and so forth because:

* Biographical information about you may be available on social media or Internet websites.
* Some adversaries, like an abusive partner or family member, may know the answers to these security questions.
* Once people know biographical information about you, it is hard to change it. Everybody can change a password, but nobody can change their birthplace.

Instead, pick arbitrary security questions and give them password-like answers. For example, select "What is your hometown?" as a security question, and type in random words like "correct horse battery staple" as an answer.

The answers to your security questions should be pronounceable over the phone, in case you need to validate your identity to customer support. However, only give these answers when you have made an outgoing call to website's customer support phone number. Do not give these answers when somebody calls you, because you may be speaking to a computer hacker.


# Running a pseudonymous social media account

Here are some tips for running a pseudonymous social media account without being de-anonymized.

{% hint style="info" %}

## Why should you create a pseudonymous social media account?

When you post under your real name, anybody--including law enforcement--can use what you say against you. Not using your real name on the Internet adds a layer of security.

However, you should take the following steps to make sure that your pseudonymous account is not connected to your real identity:
{% endhint %}

## Use a new email address and phone number that you have not shared with anybody else.

If you use share the same email address or phone number between your pseudonymous account and your real-name account, then people that are connected to your real account may be recommended to follow your pseudonymous account--potentially de-anonymizing you.

Sharing email addresses and phone numbers between the two accounts also lets employees at the social network and law enforcement figure out that they are connected.

Other people may be able to figure out that the accounts are connected by requesting password resets for both accounts and seeing if the social network responds with what email address the password reset email went to.

## Do not follow or friend any social media account that you have connected with via your real account.

It is possible for your adversary to use connection information on social networks to guess that your pseudonymous account and real account are related--even if the two accounts are not directly connected.

The safest thing is for your pseudonymous account to completely avoid the network of accounts that your real account interacts with. The two accounts should never be present in the same social circle.

## Fill out security questions with answers that nobody can guess.

Do not share security questions and answers between your pseudonymous account and your real account.

Do not use security questions and answers based on your real personality.

Instead, fill security question fields with random password-like answers--making sure to save the questions and answers in a password manager like [1Password](https://1password.com/) so that you don't forget.

## Make sure none of your posts are tagged with your location.

Many social networks like to annotate your posts with your GPS location. Always check every post to make sure the location is not attached. It may be possible to deny location permissions to the social network's app or website on your phone or laptop for additional security.

## Log into your account using a Virtual Private Network (VPN).

If you log into your pseudonymous account without a VPN, it makes it easier for the social network or law enforcement to de-anonymize you.

Do not use the same VPN provider to connect to your pseudonymous account and your real account. You want to use different VPNs that will show different IP addresses to the social network.

 You can [read more about VPNs here](/internet-security).

## Never open any links or attachments sent to you via Direct Message.

It is possible that an attacker is sending you links or attachments that give away your IP address or other location information when you try to open them. This may be a difficult rule to follow because many activists may have to open attachments to do their job, but beware that any attachment or link can give away your position.

## Do not use your pseudonymous account to log into other websites. Do not use your account to authorize third-party applications.

When you log into a third-party website or app with your social media account, the website or app often gets to download information from your social media account. This can include private information like your Direct Messages.

Facebook [offers guidelines](https://www.facebook.com/help/942196655898243/?helpref=hc_fnav) for how to audit and remove third-party apps you may have already connected. Twitter [offers similar guidelines](https://help.twitter.com/en/managing-your-account/connect-or-revoke-access-to-third-party-apps).


# WiFi security

This describes how to connect to WiFi networks while keeping some semblance of privacy.

## Avoid connecting to unsecured or potentially-untrustworthy WiFi networks.

In addition to [fake cell phone towers](/mobile-phone-security#beware-that-the-government-may-be-tracking-your-location-with-fake-cell-towers), your adversary may have also set up WiFi networks intended on tracking you or eavesdropping on your connection when you use them. To avoid this, only connect to secured WiFi networks run by an operator that you can trust.

### Only connect to unsecured WiFi networks if you have a Virtual Private Network (VPN).

When you connect to a WiFi network without password, you should assume that none of your traffic is private. These unsecured networks are commonly offered at Starbucks and other coffee shops. It is best to avoid them unless you are also using a [Virtual Private Network (VPN)](/internet-security).

## Watch out for WiFi networks with weak security.

WEP and WPA are the names of two WiFi security standards that are considered weak in modern times. WPA2 Personal and WPA2 Enterprise are currently the standards of choice.

## Check the certificate when connecting to an enterprise WiFi network.

Major WiFi networks run by corporations, universities, and governments are typically secured with a certificate. The first time you connect with these networks, you should check the certificate to see if it is legitimate. The IT department that runs WiFi network can provide you with instructions on how to do this.

## Remember that connecting to the Internet might prompt programs on your computer to automatically send data.

Many computer programs periodically make connections to remote servers. These connections may de-anonymize you and reveal your locations. Some programs that do this include:

* Mail clients that periodically check for new mail.
* Proprietary programs that check a central server to make sure that you paid for the program.
* Software that sends a bug report to the developer whenever it crashes.
* Malware that connects to a command-and- control server to receive new instructions and to send your personal information.


# Virtual Private Networks (VPNs) and Tor

VPNs and Tor can help keep your Internet browsing safe and private.

## Browse the Internet through a Virtual Private Network (VPN).

A Virtual Private Network is a tool to help anonymize your Internet connection and secure your communications from being tampered with. There are many VPN providers on the Internet. Some of them are free services, others are paid, and a few more are do-it-yourself software projects that you can install on your own Internet server.

### Which VPNs to buy.

The technology publication CNET [recently rated](https://www.cnet.com/news/best-vpn-service-of-2020/) the following VPNs as being among the best:

* [ExpressVPN](https://www.expressvpn.com/)
* [Surfshark](https://surfshark.com/)
* [NordVPN](https://nordvpn.com/)
* [IPVanish](https://www.ipvanish.com/)

I have never used any of these VPNs personally, so I cannot vouch for them.

### Never use a free VPN provider.

Many companies on the Internet offer VPN service for free. It may be tempting to use these, but [they may be harmful to your security](https://www.cnet.com/how-to/best-free-vpns-5-reasons-why-they-dont-exist/).

Keep in mind that it is possible for the VPN provider to see what you are doing. Some VPN providers insert their own ads or sell your traffic data. Famously, Facebook purchased  a free VPN provider called Onavo. This allowed [Facebook to observe Onavo users' traffic data](https://www.howtogeek.com/342731/dont-use-facebooks-onavo-vpn-its-designed-to-spy-on-you/), which Facebook used to estimate the marketshare of their competitors.

### VPNs do not protect against all ways to determine your identity.

Many websites will ask you for location information or place small pieces of information called "cookies" in your browser which sometimes allow them to follow your path through the Internet. VPNs hide the origin of your network traffic, but VPNs alone do not fight all the ways you can be de-anonymized.

### Remember that you are not anonymous to your VPN provider.

A VPN is a decent way to obscure the origin of your Internet traffic from the websites you visit, but your VPN provider always knows the origin of your Internet traffic, and they also have your billing information.

This means that when you use a VPN provider, you are implicitly trusting them with who you are--even if you do not think you have told them.  The Tor network is a free and secure alternative to VPN providers that do a better job at hiding who you are. Read more below.

## Use Tor to hide your identity online when you cannot trust any VPN provider.

VPNs are great for obscuring to websites where you are connecting from. But one problem is that your VPN provider knows who you are and what traffic you are sending. If this is an unacceptable security risk, you can use the Tor network instead.

Tor is a computer network that encrypts routes your Internet connections through multiple servers--such that no server knows **both** where your connection is coming from and where it is going. This offers much higher anonymity than VPNs.

Tor is free to use. The Tor Project runs on people donating their money or computer network bandwidth. However, this means that Tor can be much slower than many VPNs. Because Tor capacity is granted on a volunteer basis, Tor is not appropriate for high-definition video streaming, BitTorrent usage, or running bulk email servers.

### Use the Tor Browser Bundle.

Tor is a low-level computer network that can route traffic from many different computer programs. However, those programs ma have high-level behaviors that can de-anonymize you.

The [Tor Browser Bundle](https://www.torproject.org/download/) is a web browser designed to include all of the best practices involved in for using Tor. Use it when you want to browser the World Wide Web without leaking information.

### Use Tor Bridge relays when you need to hide your Tor connection from your ISP.

Certain ISPs restrict or monitor access to the Tor network, making it difficult to connect. The entry and exit nodes are publicly-known on the Internet, which makes them easy to block.

To avoid restrictions or surveillance that your ISP may have placed on the official Tor network, you can connect to Tor [through a bridge address](https://tb-manual.torproject.org/bridges/).

### Use Tor *hidden services* (".onion" services) whenever possible.

Tor is largely a tool to anonymize your connection to the public Internet. But for additional security, many people run hidden services--websites and other servers that are only accessible from within Tor.

Tor Hidden Services have the following advantages:

#### The location of the hidden service is anonymized on the Internet.

When hosting a website on the regular Internet, it is possible for ISPs and law enforcement to determine the physical location of the website's servers. It is much harder to determine the location of a hidden service, which makes hidden services a great way to conduct business that must be hidden.

#### Neither you nor the Hidden Service have to trust a Tor exit node.

When you access the regular Internet through Tor, an exit node makes the connection between the Tor network and your destination on the Internet. Exit nodes can observe unencrypted connections from the Tor network to your destination on the regular Internet, but they do not know the origin of the connections.

When accessing a hidden service, your connection is is encrypted in a way that the exit node cannot observe the content of your communications.

### Be aware of Tor's limitations.

Tor is vulnerable to a series of attacks, ranging from the theoretical to the practical. If your adversary is a powerful government, it is possible that control a significant number of the nodes on the Tor network and can use the information they collect to de-anonymize traffic.

#### Using Tor may attract the attention of law enforcement.

Tor is commonly used by people to access child pornography, online marketplaces for drugs, or discussion forums for those that want to conduct illegal behavior.

Because of this, using Tor might earn you the attention of law enforcement, even if they are unable to decrypt your traffic. The FBI successfully identified Eldo Kim as being responsible for sending a bomb threat to Harvard University [because of his usage of Tor](https://www.theverge.com/2013/12/18/5224130/fbi-agents-tracked-harvard-bomb-threats-across-tor). They likely couldn't decrypt his traffic, but using Tor put him at the top of the suspect list.

#### Tor cannot protect against JavaScript-based trackers. Try to disable JavaScript when using Tor.

JavaScript is a programming language used on many websites to offer interactive features, dynamic advertising, and user tracking. It is possible for a website using JavaScript to track you even though Tor obscures the origin of your Internet connection.

However, many interactive websites require JavaScript to function, and it is not possible to use these websites without JavaScript.

#### Tor hidden services are often used to share highly-illegal content like child pornography. This content is illegal to possess, so do everything you can to avoid it.

Do not use Tor to visit websites that contain child pornography, even by accident. Even given Tor's security features, downloading this type of content is a fast trip to prison.  In the past, law enforcement have been able to use [security vulnerabilities to attack and de-anonymize Tor users](https://www.vice.com/en_us/article/qkj8vv/the-fbis-unprecedented-hacking-campaign-targeted-over-a-thousand-computers) downloading child pornography. They [may also be in control of child pornography sites](https://www.wired.com/2013/09/freedom-hosting-fbi/), using them to deliver malware to de-anonymize visitors.


# Editing images for security

Learn to edit images to preserve anonymity.

## Strip EXIF information, including GPS location information.

EXIF stands for *Exchangeable Image File Format*, and often refers to the metadata that is stored in many image files.

EXIF data may include information like:

* The camera used to take an image.
* Various camera settings, like shutter speed, aperture, and ISO speed.
* The names and versions of any photo editing tools.
* The GPS location the picture was taken--as mentioned above.

Some image-sharing sites, like Flickr, proudly show EXIF information for images by default. Other sites, like Twitter and Facebook, strip the EXIF information from images that are uploaded, making them unavailable to other users that see these images. However, if you rely on these sites to strip EXIF information, you are trusting them with it. It is better for security to remove EXIF information before sharing or uploading pictures.

Here are various resources for removing EXIF information by platform:

* [iOS](https://thenextweb.com/syndication/2020/06/03/the-asteroid-that-killed-dinosaurs-hit-at-worst-possible-angle-study-finds/)
* [Android](https://gadgets.ndtv.com/apps/features/remove-location-data-from-photos-view-edit-exif-android-windows-mac-iphone-1821872)
* [Mac OSX](https://imageoptim.com/mac)
* [Windows](https://us.norton.com/internetsecurity-how-to-how-to-remove-gps-and-other-metadata-locations-from-photos.html)
* [Linux](https://www.linux-magazine.com/Online/Blogs/Productivity-Sauce/Remove-EXIF-Metadata-from-Photos-with-exiftool)

## Do not use blurring tools to censor images. Censor images with a solid color brush.

The encrypted messaging app Signal [also offers a tool for automatically blurring faces](https://signal.org/blog/blur-tools/). Note that it will not automatically blur other identifying marks like tattoos and logos with clothing.

## Censor faces, including ears and hair.

It is possible for machine learning models to reconstruct faces based on [images of ears](https://arxiv.org/abs/2006.01943) or potentially other body parts. In order to defeat such models, it is important to censor as much of a person's face and uniquely identifying features as possible.

## Censor detailed images of hands and fingerprints.

Images of fingerprints can [reveal the identity](https://darknetlive.com/post/dream-vendor-canna-bars-sentenced-to-prison/) of who owns the hands. Alternatively, photos of your hands can be used to [duplicate your fingerprints](https://www.bbc.com/news/technology-30623611)--potentially using those duplicates to trick fingerprint scanners.

## Censor revealing reflections, including reflections inside people's eye pupils.

If you are taking a picture of a scene with reflections--mirrors, windows, ponds, etcl--you may end up appearing in the image even though you are behind the camera. Always make sure to censor any reflections that could reveal something you intend to hide.

When you are taking a picture of a person's face, check the pupils of their eyes for revealing reflections. A man stalking a pop star [managed to find her home](https://www.theverge.com/2019/10/11/20910551/stalker-attacked-pop-idol-reflection-pupils-selfies-videos-photos-google-street-view-japan) based on images containing pupil reflections.

## Censor identifying marks such as tattoos and clothing.

Tattoos, piercings, and clothing may be another way that a photo of someone can be de-anonymized. Before you share a photo of someone whose identity you want to conceal, make sure that all such identifying marks are censored.


# Laptop security

These are tips on securing your files on a laptop or desktop.

## Make sure your laptop has full-disk encryption enabled.

Full-disk encryption makes it nearly-impossible for someone to inspect the contents of your laptop (or desktop) while it is turned off.

{% hint style="info" %}
Most full-disk encryption solutions do not protect your laptop while it is turned on. Make sure that your laptop is turned off when going through airport security or a border crossing.
{% endhint %}

Below are some full-disk encryption solutions for different types of laptops:

### VeraCrypt for Windows laptops

[VeraCrypt](https://www.veracrypt.fr/en/Introduction.html) is one of the most powerful encryption tools on the market. It is free to use and the project is developed in the open, allowing independent security researchers to audit it. If you read below, VeraCrypt also has a powerful feature  to hide the existence of an operating system from computer forensics experts.

Another option for Windows laptops is [BitLocker](https://docs.microsoft.com/en-us/windows/security/information-protection/bitlocker/bitlocker-overview), a proprietary solution from Microsoft. Because BitLocker is proprietary, its source code cannot be audited for backdoors that might allow governments to decrypt your laptop without your password. If this concerns you, stick to using VeraCrypt. BitLocker is typically not available for the "Home" editions of Windows--instead requiring the "Pro" or "Enterprise" editions.

### FileVault for Mac OS X laptops

[FileVault](https://support.apple.com/guide/mac-help/encrypt-mac-data-with-filevault-mh11785/mac) is a full disk encryption solution from Apple for their Mac OS X laptops.

When you set up FileVault encryption on a Mac laptop, it asks if you want to back up your encryption key to iCloud. This may prove useful if you lose your encryption key, but backing up the key to iCloud gives law enforcement or another adversary a way to unlock your laptop.

### Linux Unified Key Setup (LUKS) for Linux laptops

LUKS is a tool to encrypt hard drive partitions used by Linux computers. It is easiest to set up when you are installing a Linux desktop distribution for the first time. Like VeraCrypt, LUKS is a free and open-source tool that computer security experts can audit.

## Avoid leaving your (encrypted) laptop turned on when crossing airport or border security.

Remember, if your laptop is turned on, the contents of the disk can be read--even if you have enabled encryption and a password. To benefit from the advantages of full-disk encryption, you must have turn off your laptop before you encounter authorities.

Computer security expert Bruce Schneier has detailed a process for crossing airport or border security [while deliberately forgetting the encryption password](https://www.schneier.com/blog/archives/2009/07/laptop_security.html).

## Use VeraCrypt to encrypt flash drives containing secret information.

VeraCrypt's full disk encryption is only for Windows machines, but VeraCrypt can create encrypted files or drives that are accessible across multiple operating systems.

VeraCrypt's [documentation offers instructions](https://www.veracrypt.fr/en/VeraCrypt%20Volume.html) on creating encrypted filesystems. If you want to make your volumes accessible across Windows, Mac OS X, and Linux, choose one of the following filesystems:

* **FAT32**. This filesystem can be read by almost any operating system on Earth, but it cannot store files larger than four gigabytes.
* **exFAT**. This is a filesystem developed by Microsoft as a successor to FAT32. It is supported in the latest versions of Windows, Max OS X, and most desktop Linux distributions. However, exFAT support may not be available on older operating systems.

VeraCrypt can also create [Hidden Volumes](https://www.veracrypt.fr/en/Hidden%20Volume.html), where you have an encrypted file or drive with two passwords--a decoy password you can give away if you are being coerced, and a real password that gives access to the hidden volume. VeraCrypt hides these volumes in such a way that a computer forensics expert can detect the decoy volume, but not the hidden volume contained within.

## If you have highly-sensitive files, use Veracrypt's Hidden Operating System feature.

If you encrypt your hard drive with traditional encryption, your adversary might simply coerce you into giving them the password. VeraCrypt Hidden Volumes (mentioned above) are a solution, but you might accidentally leave evidence of your hidden volume on your operating system when accessing it.

To solve this, VeraCrypt can encrypt your entire operating system with hidden volumes. The feature, called [Hidden Operating System](https://www.veracrypt.fr/en/VeraCrypt%20Hidden%20Operating%20System.html), works by creating two operating systems on your computer:

* **The decoy operating system**. This operating system is detectable under forensic analysis, but the contents are encrypted and only readable to someone with the password.
* **The hidden operating system**. This operating system is hidden within an encrypted area of the hard drive. A forensic analyst cannot distinguish the existence of this operating system from the encrypted data of the decoy operating system. The hidden operating system has its own encryption password. Typing in this password when the laptop boots up is the only way to identify the hidden operating system's existence.

Your adversary may know that VeraCrypt has the ability to create hidden operating systems, but you can credibly state that you use VeraCrypt without this feature--and that the decoy operating system password is the only password you have to give.

## Do not plug untrusted USB flash drives into your laptop.

Flash drives can contain malware, which might immediately execute when plugged into a laptop.

Computer hackers commonly drop interesting-looking flash drives where targets might find them and plug them into a computer. This tactic is highly effective because it doesn't use the Internet and thus bypasses the network security controls in place at major corporate and government computer networks.

If you need to load files from someone else into your computer, you have several options:

* If the other person is far away, try email or a file-sharing app like Dropbox. However, this requires you to be connected to the Internet, which could help de-anonymize you.
* If the other person is nearby, try Bluetooth File Sharing or a proprietary protocol like Apple's AirDrop. You can do this without either the source or destination computer or phone being connected to the Internet, but having your Bluetooth or Wi-Fi radio turned on still represents a security risk.

## Only connect to the Internet when you are comfortable revealing your location.

Even if you are not actively browsing the Internet, many computer programs periodically "phone home" to remote servers to collect updates:

* Email clients may phone home to automatically fetch new emails.
* Various computer programs may phone home to check if you are using the program with a valid license key.
* Various computer programs send information about your computer when they crash or experience an error.
* Malware may phone home in order to reveal your location or send your files to computer hackers.

Even if you are using Tor or another proxy, many of these programs connect directly to the Internet and reveal your location to whoever is on the other end.


# How the government tracks your location

This page describes some of the tools that law enforcement use to track the locations of people they are interested in.

## Automated vehicle license plate readers.

Many governments operate license plate scanners to identify cars committing traffic violations, often automatically sending a traffic ticket to vehicle registrations's home address.

Police squad cars also have license plate scanners, allowing officers to quickly look up if passing drivers are legal interest. If you are driving past a police car, assume that you have been scanned.

The Electronic Frontier Foundation [has more information on how governments use automated license plate readers.](https://www.eff.org/pages/automated-license-plate-readers-alpr)

## Fake cell phone towers.

Law enforcement often deploy networks of fake cell phone towers that are capable of tracking the cell phones they connect with. You can read more about fake cell phone towers [here](/mobile-phone-security#beware-that-the-government-may-be-tracking-your-location-with-fake-cell-towers).

## Computer vision on security camera footage.

The company Clearview AI [sells a tool to law enforcement](https://www.nytimes.com/2020/01/18/technology/clearview-privacy-facial-recognition.html), allowing them to search for matching faces from billions of images scraped off of social media. If you or anybody else has posted a picture of your face on the Internet, you should assume that Clearview and similar companies already have a copy, and that law enforcement can find your Internet presence based on photos of you taken from security cameras.

There are many other companies that sell or offer the ability to build computer vision models capable of facial recognition, such as [Matroid](https://www.matroid.com/).

## Requesting data from private companies that track your location.

Law enforcement often request information from major social media, mapping, or ridesharing companies. They may make these requests with or without a warrant from a judge. It is common for companies to notify a user when law enforcement is requesting that user's data, but companies are often barred by law from contacting users.


# Talking to journalists

Talking to journalists may be a great way to bring attention to the movement, but be careful when it comes to relying on them to keep your secrets.

## Know the difference between *on the record*, *off the record*, and *on background*.

Before you begin giving information to a journalist, decide whether you want to be on the record, off the record, or on background.

Note that many bloggers and less-formal journalists on the Internet may not honor this distinction. Many journalists do not consider agreements to go off the record to be legally-binding.

Many journalists and editors may only let sources go off the record or on background if they have a specific reason to avoid publicity. They may not grant your request.

The below definitions are summarized from the following sources: [The Associated Press](https://www.ap.org/about/news-values-and-principles/telling-the-story/anonymous-sources), [The Oxford University Press](https://global.oup.com/us/companion.websites/9780190200886/student/chapter10/gline/level/), and [The New York Times](https://www.nytimes.com/2018/08/02/reader-center/off-the-record-meaning.html).

### On the record

{% hint style="info" %}
When you speak to a reporter, **you are *****on the record***** by default until both of you agree otherwise**. Be careful what you say to a reporter at the start of a conversation.
{% endhint %}

When you are on the record with a journalist, everything you can say can be quoted directly and attributed to you by name and job title. However, when you are on the record, the journalist may choose to paraphrase your words instead.

When you are on the record, the journalist may also report aspects of your demeanor during the conversation--like facial expressions, eye rolls, and tone of voice.

### Off the record

When you and a journalist have agreed to speak *off the record*, they generally will use the information you give them to corroborate other sources. However, some journalists will still use paraphrased off the record information, but without attributing the source at all.

Keep in mind that journalists have a strong incentive to pursue on the record comments, and they may decline your request to go off the record.

### On background

When you and a journalist agree to speak *on background*, the journalist can summarize the information you give them, but without attributing you by name.

A related term is "not for attribution" or "no fingerprints" which means the journalist can quote you word-for-word, but describing you as a source in vague terms, e.g. "a senior executive"--as opposed to using your exact name or job title.

Another related term is "deep background" where the information can be used, but without any type of attribution. Many journalists have slightly inconsistent definitions of deep background, so make sure that you are on the same page with any journalist that you are speaking with.

## Be careful what you say to a journalist. A careless comment may end up being a news headline.

Journalists do not have a mandate to make you look good or likable--even if you believe you are fighting the good fight and are on the right side of history. You must make sure that you do not say anything to them that you will regret--even if you believe that you are off the record.

## Insist in communicating over Signal as opposed to email or social media direct messages.

Many journalists are unfamiliar with the security standards on this website. Do not let their unfamiliarity cause you to use insecure communications technology. Instead, in your first message to a journalist over an insecure channel, make sure to give them your Signal phone number or your ProtonMail email address.

## If you are offering information that cannot be released immediately, agree with the journalist on a news embargo.

A [news embargo](https://en.wikipedia.org/wiki/News_embargo) is an agreement between you and a publication that the information you give them will only be released after a certain date or when certain conditions are true.

{% hint style="info" %}
You must agree with the journalist and their publication on an embargo before giving them any of the information you want to embargo. Journalists will not automatically sit on information you give them without negotiating and agreeing to the embargo first.
{% endhint %}

Keep in mind that many journalists and publications do not agree to embargoes. Publications may also ask for something in exchange for an embargo--such as not giving the same information to other publications.

Sometimes embargoes are not obeyed by accident, such as when they enter the wrong embargo date into their publication's content management system. If you are talking to a journalist, you should be prepared for the information you give to be released immediately, even by accident.

## Avoid being photographed if you do not want to be identified.

It is increasingly common for activists to censor people's faces and identifying marks when taking pictures of other activists at protests. This is to help avoid adversaries de-anonymizing or identifying activists in the pictures.

However, journalists typically will not edit their photos in this way. They have a commitment to delivering an uncensored take of what they see. Journalists often have big platforms, and anybody they photograph may be easily-identified.


# Glossary

A list of technical terms used in this website and their simple English explanations.

## IP address

An IP address is a location on where to find a computer on the Internet. When you visit a website, the domain name like **`google.com`** is translated into an IPv4 address like **`142.250.31.101`**. There is a newer standard called IPv6 that offers much longer addresses that look like **`2607:f8b0:4004:815::200e`**. The website also sees the IP address assigned to you from your Internet Service Provider (ISP).

A computer's IP address is loosely correlated with the location of the computer on the Internet. If an attacker finds your home computer's IP address, they might be able to guess roughly where you are connecting from. Your ISP and law enforcement may also be able to find who you are from your IP address.

You can mash your computer's true IP address by using either a [Virtual Private Network (VPN) or the Tor network](/internet-security).


# Further reading

These are additional resources that inform activists' strategy.

## [A Practical Security Handbook for Activists and Campaigns (v 2.7)](https://mtlcontreinfo.org/wp-content/uploads/2017/01/booklet-2.7final.pdf)

This is a 71 page handbook with detailed operational security advice for activists.

## [Simple Sabotage Field Manual](https://www.cia.gov/news-information/featured-story-archive/2012-featured-story-archive/CleanedUOSSSimpleSabotage_sm.pdf)

This is a very old guide from the Office of Strategic Services (OSS)--America's World War II-era predecessor to the modern Central Intelligence Agency (CIA). The manual describes how activists in occupied countries can sabotage the enemy war effort.

It is also important to learn these methods to make sure that they are not being used against you.

## [Tactics and methods surrounding the 2019–20 Hong Kong protests](https://en.wikipedia.org/wiki/Tactics_and_methods_surrounding_the_2019%E2%80%9320_Hong_Kong_protests)

This is a Wikipedia page that explains the methods use by protesters in Hong Kong to oppose their local police force and Chinese influence.

## [Twitter Activist Security](https://medium.com/@thegrugq/twitter-activist-security-7c806bae9cb0)

This is a blog post by the well-known security expert [@thegrugq](https://twitter.com/thegrugq). In the post, he details a strategy for running a completely pseudonymous Twitter account.

He recommends the use of a now-defunct email service called SIGAINT. Today's activists should use [ProtonMail](https://protonmail.com/) instead.