Advice For Activists

This documents is designed to be shared with activists interested in organizing in 2025.
This is not comprehensive, nor is it designed to be one-size-fits-all. It's a general document for normies and is comprised of my opinions.
Everyone has a different threat model and I do not presume to know everyone's or assume that I know what's best for everyone.
As always with security measures the more comprehensive you are, the better protected you will be.


Areas of concern:

- Surveillance cameras
- Incidental collection
- Physical security
- movements
- group organization
- public mobilization
- general online privacy
 

General Notes:
Operational security is key to ensuring that organizational activity is not interfered with.
Elle Armegeddon wrote this excellent guide. https://archive.org/details/opsec-for-activists-by-elle-armageddon/mode/2up

Surveillance cameras are nearly ubiquitous and there is Incidental collection nearly everywhere.
Facial recognition, gait analysis, clothing are all factors that can be used to identify you on surveillance footage.

The EFF has published their Atlas of Surveillance https://atlasofsurveillance.org/ and it is an excellent resource to consider for activists.
 
Required reading:
- Smart Girl's Guide to Privacy - Practical Tips for Staying Safe Online - by Violet Blue https://nostarch.com/smartgirlsguide
- Opsec for Activists - by Elle Armageddon - https://archive.org/details/opsec-for-activists-by-elle-armageddon/mode/2up
 

Useful links:
OSINT Framework - use the tools here to research people of interest
https://osintframework.com/ 

Veilid - emerging project for secure comms:
https://veilid.com

THE Privacy OS:
https://grapheneos.org/ 

Private Email Hosting:
https://tuta.com/secure-email
 
Mullvad VPN:
https://mullvad.net/en
 
Leave no trace:
https://www.notrace.how/
 
Surveillance Atlas:
https://atlasofsurveillance.org/
 
Opensource information about Tesla: (may be up or down depending on censorship efforts)
https://dogeque.st/
 


General Physical security tips:
- Do not use "Smart Locks" or lease apartments with RFID/NFC apartment keys.
- When in public, be aware of your surroundings and look for opportunity to blend into crowds.
- Wherever possible, where non-descript neutral clothing that does not stand out.
- Wear a hat, sunglasses and N95 mask wherever possible.
- Know all possible back routes out of your place of residence, including non-descript routes.
- Be aware of the locations of surveillance cameras near your home, pay attention to locations of doorbell cams.
- Regularly inspect your vehicle for tracking devices.
- Regularly inspect you personal effects and clothing for tracking devices like AirTags.
 

Burner phone tips:
- DO NOT USE BURNER Phones without extremely good discipline.
- Buy burner phones with cash, have someone trusted buy them for you if possible.
- Prefer models with removable batteries.
- Prepaid only.
- Do not buy burner phones all from the same place.
- Prefer places with minimal security like a small independently owned shop in Chinatown.
- Do not turn on burner phones in proximity to your home, office, or your other devices.
- Faraday bag for your devices when turned off.
- Do not connect burner phones to your home or office network.
- If possible - buy burner android phones compatible with Graphene OS and install that - https://grapheneos.org/

 

Personal phone tips:
- Do not use android phones without Graphene OS.

- Apple:
                  - If feasible put your devices in LockDown mode.
                  - Use the security checkup feature regularly to see what apps have access to what data on your phone.
                  - Fully reboot your phone weekly at a minimum.
                  - set a passphrase, not a PIN. (long is strong)
                  - Turn on stolen device protection
                  - Set up account recovery key and store safely offline
                  - When turning off Bluetooth, Wifi; make sure you go into settings. The control center controls do not fully disable these.

- Do not have personal devices in proximity with burner phones without one being powered off and in a faraday bag.

 
Movements:
- When traveling to meet with a source, co-organizer, meeting, etc. It's important to consider how you are getting there, take longer routes that divert through different modes of transport, cut through buildings, subways, and use taxis paid with cash.
- When using public transport with payment card, load with cash value from a kiosk, pay cash; change metro cards frequently.
- Disable location services on your primary phone if you must take it; otherwise bring only your burner, and ensure you are leaving any AirTags at home.
- Modern Apple devices all have "Find My" wideband BTLE broadcasting, even when powered off. Faraday bag any Apple devices you need to take with you.
- When considering routes, doubling back multiple times while changing modes can help lose potential tails.
- Consider automated license plate readers in parking garages and elsewhere in public. This data is aggregated and sold into the Surveillance economy.
- When going to protests, if social media plays a part in your movement, be sure to leave your personal devices at home. Take protest specific devices, unconnected to all of your personal accounts.
 

Group organization:
The most important step is to make sure you can communicate securely without being surveilled. You need a way to communicate privately with your peer group and a way to stay up to date with what's happening around you and where demonstrations are taking place.
- Keep key leadership cell tight
- Use Signal for all communications
- Vet new leadership with OSINT
- Establish a "Go to ground" protocol
                  - Set up burner phones with Signal, Cloudflare Warp
                  - Pre-connect new Signal accounts on each device to each other
                  - ensure disappearing messages are set for no more than 4 hours
                  - Keep phones charged and ready with backup power bank in a faraday bag
                  - practice "Go to ground" protocol monthly at a minimum
- Keep sensitive communication off devices with "AI" tools installed
- DO NOT USE TELEGRAM, WHATS APP OR GROUP ME.
- Arrange group hierarchy such that if one group or person is compromised, the security of the organizing is not impacted.
                  - Core trusted group for key leadership - keep as small as possible (4 or less ideally)
                  - Secondary and Tertiary groups with larger memberships designed for spreading key information for the movement to progress, and organizing protests.
                  - Keep any direct actions to core group selected on a need-to-know basis.
- Do not plan direct actions in recorded forums, video calls, conference calls where guarantee of eavesdropping prevention or transcription is not possible.
- DO NOT PLAN DIRECT ACTIONS THAT COULD RESULT IN DEATH OR INJURY.
        - Keep your direct actions legal and free of harmful things that could lead to someone getting hurt or killed. No direct action is worth loss of life or injury.
        - Do not plan or knowingly participate in direct actions that result substantial in destruction of property. Leave that to the professionals willing to risk their personal freedom.
 

Digital Security generally:
- Social Media accounts for directed action - Social Media can be super important in helping get the message out. When using social media there are some things you can do to reduce your chances of getting doxxed, however its important to remember that social media also plays an important part at protests.
                  - Use a dedicated device for the social media activities if possible
                  - Use an alias account name
                  - Do not use email accounts connected to or accessed from your home network or personal devices
                  - Ensure that MFA is setup with device or app based - do not use SMS
                  - Ensure that the password reset methods from an un-logged in device do not reveal email address information that could be used to identify you.
                  - Do not share pictures taken in your home.
                  - Practice extreme discretion in revealing personal information about yourself, your background, what you look like, where you live, where you work
                  - Consider a "Public Identity" persona with first and last name you can use to mis-direct identification/unmasking. (ie: John Smith)
                  - Do not access these accounts from personal devices ever.

- Do not use Xitter to organize. It is compromised by a nazi. He will use it to target you.
 
- Use a Password manager - DO NOT REUSE PASSWORDS
                  - Passwords App (iOS)
                  - "1Password"
                  - "LastPass"
                  - "BitWarden"

- Multi-factor on ALL accounts
                  - Use "Authy" for MFA codes
                  - Use Passwords app for Passkeys
                  - "Yubikey" for physical MFA keys


- DNS - DNS is how your devices look up website domains.
                  Setting your home router and personal devices to use a privacy focused DNS resolver is one way to help reduce tracking of your activities online.
                  This is usually easy to set by going into the network settings on your devices, and setting the following IP addresses as the DNS resolver.
                  Cloudflare also has an application available in the app store that will make this easy on mobile devices. "Cloudflare Warp" also acts like a VPN and will help make your internet traffic more private.

                  - 9.9.9.9 - Quad 9
                                    https://www.quad9.net/service/service-addresses-and-features

                  - 1.1.1.1 - Cloudflare
                                    https://one.one.one.one/

- Incognito/Private browser sessions

                  - This is a setting that puts your browser in an "ephemeral session" mode wherein the history is not saved and any cookies or login session tokens are not retained

- Sandboxes - online sandboxes are a great place to pre-check any links sent to you for malware or malicious tracking

                  - https://urlscan.io
                  - https://any.run

- VPNs

                  - "Mullvad VPN" - can pay with an envelope full of cash
                  - Cloudflare Warp - free
                  - Apple Private Relay - included with iCloud, good for general privacy, not great option for doing things you really don't want to leave evidence of.
                  - do not trust the VPN companies advertising on YouTube etc. 

- Private Email Hosting
                  - Tuta.com 

- TOR
                  - Do not use TOR. (To quote the security researcher thegrugq about Tor:

“Download and run this and you get a free proxy / VPN; oh, yeah, but you’ll stand out like a fucking glow stick and you have no good reason to use it except as an evasion tool against state authorities. Good luck explaining that when they ask uncomfortable questions.”)

- Signal - for all messaging requiring privacy
                  - iMessage/FaceTime is end to end encrypted however Signal is a better option for more sensitive communications.
                  - Do not use SMS or RCS
                  - make sure you set disappearing message time limits
                  - important - do not use the desktop app version, there is substantially more risk

- Cookies and tracking technology for ad networks are heavily exploited by USGov contractors for intelligence on targets, the following tips are generally good for reducing this tracking tech's effectiveness.
                  - Use an ad blocker like UblockLite
                  - Ditch Chrome, Edge - Brave is a great option. Chromium (de-googled) is also decent.
                  - EFF Privacy Badger is an excellent extension to help reduce tracking and fingerprinting.
                  - Always use ephemeral sessions (Incognito/private) and close them when done.
                  - Avoid extensions that purport to help with shopping discounts etc.
                  - Block all ad tracking and regularly cycle and clear any ad tracking data on your phone (Settings/Privacy/Tracking - turn it all off - https://www.eff.org/deeplinks/2022/05/how-disable-ad-id-tracking-ios-and-android-and-why-you-should-do-it-now)

- DO NOT USE CryptoCurrencies
 - If you must pay for something with CryptoCurrencies, seek assistance from a trusted techie fluent in the risks.