THEVPNMATRIX
    ← Back to Blog

    Digital Security Under Authoritarianism: A Practical Defense Guide

    Evidence-based strategies for protecting yourself against state surveillance, harassment, and persecution when living under—or resisting—authoritarian regimes.

    Privacy GuidePublished · 46 min read· By Security Research Team

    Evidence-based review per our 28-criteria methodology · affiliate disclosure

    On November 9, 2024, security researcher Micah Lee published "Practical Defenses Against Technofascism"—a guide for surviving digital authoritarianism in the United States. His advice: assume your adversaries include law enforcement, federal agencies, and hostile non-state actors. Protect every layer of your digital life as if your freedom depends on it. Because increasingly, it does. [1]

    Lee's guide emerged from decades of work with Edward Snowden, Reality Winner, and journalists operating in hostile environments. His framework applies universally: whether you're living in Russia, China, Iran, Hungary, or Florida—authoritarianism demands the same defensive posture. This article expands on Lee's framework, incorporating lessons from Hong Kong pro-democracy protesters (2019-2020), Belarusian dissidents (2020-2021), Iranian women's rights activists (2022-2023), and current guidance for journalists, activists, and ordinary citizens facing state surveillance. [2-5]

    1. Executive summary

    Living under authoritarianism—whether overt (China, Iran, Russia) or creeping (US post-2024, Hungary, Turkey)—requires a fundamentally different security posture than democratic contexts. When state actors become adversaries, conventional privacy advice falls short. This guide provides actionable, evidence-based strategies for protecting yourself, your communications, your networks, and your freedom.

    Key principles from this 46-minute guide:

    • Assume breach: Your devices, communications, and movements may already be compromised. Build defenses assuming surveillance, not preventing it. Compartmentalization, not perfection, keeps you safe. [1, 6]
    • Layer defenses: No single tool provides complete protection. VPNs + Tor, encrypted messaging + secure deletion, physical security + legal preparation—survival requires redundancy across every domain. [7, 8]
    • Endpoint security is critical: If your device is compromised (malware, physical seizure, spyware), all encryption is worthless. Hong Kong protesters taught us: burner phones, clean accounts, Tails OS for high-risk work. [4, 9]
    • Communications metadata kills: Encrypted messages protect content, but connection metadata (who you talk to, when, for how long) reveals networks. Signal is excellent for content security, but timing attacks and contact graphs expose you. Use Tor, compartmentalized accounts, and operational security. [10, 11]
    • Physical security often fails before digital: Iranian women's rights activists were identified through CCTV + facial recognition, not hacked phones. Belarusian protesters were arrested via telco data (cell tower logs), not intercepted messages. Protect your movements, appearance, and associations. [3, 5, 12]
    • Legal documentation matters: Document state violations immediately: save logs, record timestamps, secure evidence offline. When regimes fall or legal challenges emerge, contemporaneous records are critical. Hong Kong protesters used encrypted cloud storage for evidence. [13, 14]
    • Community security protects individuals: Isolated activists are vulnerable. Networks practicing collective security—shared threat intelligence, emergency protocols, mutual aid—survive longer. Iranian activists use decentralized Telegram channels, VPN distribution networks, and offline emergency contacts. [5, 15]
    • Emergency protocols save lives: When targeted, seconds matter. Pre-configured panic buttons (Wipe for iOS, Ripple for Android), memorized safe contacts, and dead man's switches (Riseup's warrant canary, personal equivalents) create critical response time. [16, 17]
    • Your threat model determines your strategy: Low-visibility activists need different protections than high-profile dissidents. Journalists require source protection above personal safety. Whistleblowers face unique legal risks. Assess your profile realistically. [18, 19]
    • Sustainability matters: Perfect security is exhausting and unsustainable. Build defenses you can maintain long-term. Burnout kills movements as surely as arrests. Balance security with wellbeing. [20, 21]

    This guide covers operational security (OPSEC) fundamentals, device hardening, communications security (Signal, Tor, anonymous email), network protections (VPNs, obfuscation), physical security (device seizure protocols), social engineering defenses (interrogation resistance), legal preparation, community security practices, and emergency protocols. Each section includes case studies from Hong Kong, Belarus, Iran, Russia, and Turkey—showing what works, what fails, and why.

    Premium Research Content

    Continue reading this in-depth analysis on Substack

    Evidence-Based Research
    Deep-dive analysis backed by primary sources and expert interviews
    Weekly Updates
    New legislation tracking, policy analysis, and privacy tool reviews
    Community Access
    Join privacy researchers, developers, and policy experts in discussion threads
    Powered bySubstack

    2. Understanding your threat model

    Effective security starts with realistic threat modeling. Who wants to harm you? What capabilities do they have? What are you protecting?

    State adversaries: capabilities and tactics

    Authoritarian states deploy surveillance infrastructure far beyond democratic norms:

    • Mass surveillance: China's Great Firewall, Russia's SORM system, Iran's internet shutdowns. States monitor all internet traffic, censor content, and identify dissidents through traffic analysis. [22-24]
    • Telco cooperation: Mobile carriers provide cell tower data (location tracking), call logs, and SMS intercepts to authorities without warrants. Belarusian regime identified 2020 protest participants through telco data. [3, 25]
    • Facial recognition: CCTV networks with AI-powered face matching. Iranian authorities identified women removing hijabs, Hong Kong police identified protesters via subway cameras. [5, 12, 26]
    • Malware and spyware: Pegasus (NSO Group), FinFisher, Predator—zero-click exploits that compromise devices without user interaction. Used by Saudi Arabia (Khashoggi case), UAE, Hungary, Poland. [27-29]
    • Social graph analysis: Mapping networks through metadata: who communicates with whom, when, via which platforms. Signal and Telegram groups expose organizational structures even if message content is encrypted. [10, 30]
    • Legal coercion: Arrests, detention, interrogation, torture. Belarusian activists faced beatings during detention to extract phone passwords. Iranian women faced month-long detentions for hijab violations. [3, 31, 32]

    Non-state adversaries: harassment and doxxing

    Even in democracies, activists face non-state threats:

    • • Doxxing: Publishing personal information (addresses, phone numbers, family details) to incite harassment. Common tactic against reproductive rights activists, LGBTQ+ advocates, journalists. [33]
    • • Swatting: False emergency reports to send armed police to targets' homes. Has resulted in deaths (Andrew Finch, 2017). [34]
    • • Online harassment campaigns: Coordinated abuse via social media, threats of violence, reputation attacks. Gamergate (2014), Kiwi Farms campaigns (ongoing). [35, 36]
    • • Employer targeting: Contacting employers to get targets fired. Common tactic against BLM activists, anti-fascist researchers. [37]

    Threat model matrix: assessing your risk

    ProfilePrimary ThreatsPriority Defenses
    Low-profile activistMass surveillance, social graph analysisEncrypted comms, VPN/Tor, metadata hygiene
    High-profile dissidentTargeted malware, physical surveillance, arrestBurner devices, Tails OS, physical security, legal prep
    Journalist w/ sourcesSource identification, device seizureAir-gapped devices, SecureDrop, plausible deniability
    WhistleblowerAttribution via forensics, insider threat detectionAnonymity via Tor, no digital/physical trails, Tails OS
    Ordinary citizen (surveillance state)Mass surveillance, censorship, social credit impactVPN for censorship bypass, encrypted messaging

    3. Operational security fundamentals (OPSEC)

    OPSEC is the practice of protecting information that could be used against you. In authoritarian contexts, OPSEC failures lead to arrests, network exposure, and movement collapse.

    Core OPSEC principles

    Compartmentalization

    Separate identities, devices, and activities. Your activism identity should never intersect with your personal identity. Hong Kong protesters used burner phones for protest coordination, personal phones stayed home. [4, 9]

    • • Separate devices: Activism phone ≠ personal phone
    • • Separate accounts: Activism email/Signal ≠ personal email
    • • Separate networks: Activism contacts never mixed with personal contacts
    • • Physical separation: Activism materials kept in separate locations

    Need-to-know basis

    Share information only with people who need it. Cell structures (small, isolated groups) prevent compromise of entire networks. Belarusian telegram channels used admin-only posting to prevent infiltration. [3, 38]

    Metadata hygiene

    Metadata (who, when, where, how long) reveals as much as content. Strip EXIF data from photos (location, device info). Use disappearing messages (Signal auto-delete). Avoid patterns in communication timing. [10, 39]

    Operational silence

    Don't discuss sensitive activities on insecure channels. Iranian activists learned: even Signal group chats are risky if one member is compromised or coerced. In-person meetings (without phones) for sensitive planning. [5, 40]

    Verification and trust

    Assume infiltration. Verify new members through trusted intermediaries. Use security questions, in-person vetting, and slow onboarding. Russian FSB infiltrated protest groups via fake activists. [41]

    Common OPSEC failures (and how to avoid them)

    • Bringing personal phones to protests: Cell tower data identifies participants. Hong Kong: leave phones at home, use burners with no SIM or anonymous prepaid SIMs. [4]
    • Using real names/photos on Signal/Telegram: Compromised phones expose entire contact lists. Use pseudonyms, generic avatars. Iranian women activists learned this too late. [5]
    • Reusing accounts across contexts: Linking activism Twitter to personal Instagram exposes identity. Create entirely separate accounts, never cross-post. [42]
    • Posting photos with identifying features: EXIF data, reflections in windows, background landmarks. Hong Kong protesters wore masks, removed EXIF, avoided distinctive clothing. [43]
    • Using compromised apps: Russian activists used Telegram; FSB compromised phone numbers via telcos. End-to-end encryption doesn't matter if SIM registration identifies you. [44]

    4. Device security: hardening your endpoints

    Your devices are the weakest link. If compromised (malware, physical access, spyware), all other protections fail.

    Mobile device hardening

    iOS hardening (iPhone)

    • • Lockdown Mode: Enable Settings → Privacy & Security → Lockdown Mode (blocks most zero-click exploits used by Pegasus). [45]
    • • Strong passcode: 10+ character alphanumeric, not biometrics (Face ID/Touch ID can be compelled in many jurisdictions).
    • • Disable USB Restricted Mode: Settings → Face ID & Passcode → USB Accessories (prevent data extraction if phone seized).
    • • Disable Siri on lock screen: Prevents voice access without passcode.
    • • Auto-wipe after failed attempts: Settings → Face ID & Passcode → Erase Data (10 failed passcode attempts).
    • • Hide notifications on lock screen: Prevents message preview if device seized.
    • • Disable location services for non-essential apps: Settings → Privacy → Location Services.
    • • Panic button app: Install "Wipe" (iOS) for emergency data deletion. [16]

    Android hardening

    • • Use GrapheneOS: Privacy-focused Android fork (hardened, de-Googled). Install on Pixel phones. [46]
    • • Strong PIN/password: No biometrics (fingerprint/face unlock can be compelled).
    • • Full-disk encryption: Enabled by default on modern Android, verify in Settings → Security.
    • • Disable USB debugging: Prevents data extraction tools (Cellebrite, GrayKey).
    • • Panic button app: Install "Ripple" (panic button that wipes data, notifies contacts). [17]
    • • Remove Google account: Google tracks location, searches, contacts. Use F-Droid for apps (open-source app store). [47]
    • • Use privacy-focused apps: Signal (messaging), ProtonMail (email), Firefox + uBlock Origin (browsing).

    Computer hardening

    Use Tails OS for high-risk activities

    Tails (The Amnesic Incognito Live System) is a Linux distribution that runs from USB, leaves no traces, and routes all traffic through Tor. Essential for whistleblowers, high-profile activists, journalists with sensitive sources. [48]

    • • Amnesia: Shuts down, wipes RAM, leaves no traces on host computer
    • • Tor-only: All connections routed through Tor (anonymous by default)
    • • Encrypted persistence: Optional encrypted USB storage for files you need to keep
    • • Pre-installed tools: Tor Browser, OnionShare, KeePassXC, Thunderbird + Enigmail

    macOS hardening (if Tails not feasible)

    • • FileVault: Full-disk encryption (System Settings → Privacy & Security)
    • • Strong password + auto-lock: 5-minute idle timeout
    • • Disable Siri, Spotlight suggestions: Reduces telemetry to Apple
    • • Firewall: Enable + block all incoming connections (System Settings → Network → Firewall)
    • • Disable analytics: System Settings → Privacy → Analytics & Improvements (all off)
    • • Use Little Snitch: Network monitoring tool (alerts on outbound connections)

    Windows hardening (not recommended, but if required)

    • • BitLocker: Full-disk encryption (Settings → Privacy & Security → Device Encryption)
    • • Disable telemetry: Use O&O ShutUp10++ (disables Windows spying)
    • • Use Linux VM for sensitive work: Qubes OS or Ubuntu in VirtualBox
    • • Avoid Windows for high-risk activities: Windows 10/11 telemetry is extensive and untrustworthy

    Burner devices: maximum compartmentalization

    For high-risk activism, use separate devices for activism work:

    • • Cheap Android phone: GrapheneOS, no Google account, anonymous SIM or no SIM (WiFi only)
    • • No personal data: Only activism contacts, never personal contacts
    • • Leave at home during non-protest times: Prevents location tracking
    • • Wipe regularly: Factory reset after high-risk activities

    5. Communications security

    Secure communications protect message content AND metadata. Encryption protects content; operational security protects metadata.

    Encrypted messaging: Signal vs alternatives

    Signal (recommended for most users)

    • • End-to-end encryption: Messages encrypted on device, Signal cannot read them
    • • Open source: Audited by security researchers
    • • Disappearing messages: Auto-delete after specified time
    • • Sealed sender: Metadata protection (Signal doesn't know who sends to whom)
    • • Registration lock: Prevents SIM hijacking (PIN required to re-register)

    Caveat: Signal requires phone number. In authoritarian states, phone registration links identity to account. Use anonymous SIM or burner device. [49, 50]

    Telegram (NOT recommended for high-risk use)

    • • Not end-to-end encrypted by default: Only "Secret Chats" are encrypted (most users don't use them)
    • • Metadata stored on servers: Contact lists, group memberships visible to Telegram
    • • Cooperates with authorities: Russia, Iran, UAE have pressured Telegram to disclose user data
    • • When to use: Large group coordination (protesters, community organizing) where anonymity is less critical [44, 51]

    Anonymous email: ProtonMail + Tor

    • • ProtonMail: End-to-end encrypted email (Swiss jurisdiction, no data retention). Register via Tor for anonymity. [52]
    • • Tutanota: Alternative encrypted email (German jurisdiction)
    • • Avoid Gmail, Outlook, Yahoo: All cooperate extensively with law enforcement, scan emails

    Secure file sharing

    • • OnionShare: Share files anonymously via Tor (no servers, direct device-to-device). Built into Tails OS. [53]
    • • SecureDrop: For whistleblowers contacting journalists. Anonymous submission via Tor, journalists retrieve from air-gapped servers. [54]
    • • Avoid Dropbox, Google Drive, iCloud: All cooperate with law enforcement, lack end-to-end encryption

    Metadata protection: what encryption doesn't solve

    Encrypted messaging protects content but reveals:

    • • Contact graphs: Who you communicate with (exposes networks)
    • • Timing patterns: When you message (correlates with activities)
    • • Group memberships: Signal/Telegram groups visible if one device compromised
    • • Phone numbers: Signal/Telegram registration links identity

    Mitigation:

    • • Use burner devices with anonymous SIMs for activism accounts
    • • Compartmentalize: separate Signal accounts for activism vs personal
    • • Use Tor for metadata anonymity when accessing Signal/ProtonMail
    • • Delete messages immediately (disappearing messages set to 1 hour max)

    6. Network security: VPNs, Tor, and obfuscation

    Network security protects your traffic from ISP surveillance, government monitoring, and censorship. In authoritarian states, unencrypted traffic is assumed to be monitored.

    VPNs: essential but insufficient

    • • What VPNs protect: Hide your IP from websites, encrypt traffic from ISP, bypass geo-blocks
    • • What VPNs don't protect: Endpoint compromise, browser fingerprinting, payment tracking
    • • Recommended VPNs for activism: Mullvad (accepts cash, no email), IVPN (no logs, audited), ProtonVPN (secure core)
    • • Obfuscation: Use VPN obfuscation protocols (disguises VPN traffic as HTTPS) to bypass VPN blocking in China, Iran, Russia [55, 56]

    Tor: anonymity through onion routing

    • • How Tor works: Multi-hop routing through volunteer nodes (no single node knows both source and destination)
    • • When to use Tor: High-risk communications, whistleblowing, accessing censored content, anonymity-critical scenarios
    • • Tor Browser: Pre-configured Firefox with Tor integration (easiest way to use Tor) [59]
    • • Tor blocking: China, Iran, Turkmenistan block Tor. Use bridges (unlisted entry nodes) or VPN → Tor [57]

    VPN + Tor layering

    Connect to VPN first, then Tor. Your ISP sees VPN traffic (not Tor). Tor entry nodes see VPN IP (not your real IP). Best for countries where Tor usage itself is suspicious. [58]

    7. Physical security: protecting devices during searches and detention

    Physical access to devices defeats digital security. Border searches, police raids, and detention scenarios require pre-planned responses.

    Before: prevention and preparation

    • • Minimal data on devices: Don't carry sensitive data if traveling or attending protests. Use clean burner devices.
    • • Strong encryption: Full-disk encryption (FileVault, BitLocker, LUKS) with strong passphrase
    • • Biometrics disabled: Power off device before border crossings (requires passcode on boot, Face ID/Touch ID disabled)
    • • Cloud backups encrypted offline: Don't rely on iCloud/Google Drive. Use encrypted external drives stored separately.
    • • Panic buttons configured: Wipe app (iOS) or Ripple (Android) configured to delete data with emergency gesture [16, 17]

    During: search and seizure protocols

    • • Never unlock device voluntarily: In many jurisdictions, passwords have legal protection (5th Amendment in US). Biometrics don't.
    • • Trigger panic button if possible: Wipe sensitive data (understand legal consequences—obstruction charges possible)
    • • Power off device: Modern encryption requires passcode after reboot (defeats forensic tools like Cellebrite)
    • • Document everything: Names, badge numbers, timestamps, what was seized. Critical for legal challenges. [60]
    • • Invoke legal rights: "I do not consent to searches. I invoke my right to remain silent. I want a lawyer." Repeat as needed.

    After: damage control

    • • Assume compromise: If device seized, assume all data accessible (forensic tools improve constantly)
    • • Notify network: If seized device had contacts/group messages, warn network (device may be compromised)
    • • Change all passwords: Email, Signal, ProtonMail, encrypted drives
    • • Monitor for surveillance: Device returned may have malware. Factory reset before re-use (or destroy device)
    • • Legal documentation: File complaints for illegal seizure, preserve evidence for civil suits

    8. Social engineering defenses

    Interrogation, coercion, and manipulation are common authoritarian tactics. Technical security means nothing if you disclose passwords under pressure.

    Interrogation resistance basics

    • • Invoke legal rights immediately: "I want a lawyer. I will not answer questions." Repeat endlessly.
    • • Resist pressure to cooperate: "Good cop" tactics, promises of leniency, threats—all designed to extract information. Give nothing.
    • • Assume recording: Everything you say can be used against you and your network. Silence is your only defense.
    • • Know your legal protections: In US: 5th Amendment (self-incrimination), 6th Amendment (right to counsel). Varies by jurisdiction.

    Plausible deniability: decoy systems

    • • VeraCrypt hidden volumes: Encrypted container within encrypted container. Reveal decoy volume, hide real data. [61]
    • • Separate "work" and "personal" devices: If forced to unlock, reveal least sensitive device
    • • Clean social media: Maintain plausible "normal" persona (decoy accounts with innocuous content)

    Community support during detention

    • • Emergency contact protocol: Pre-arrange "I've been detained" signal (missed check-in, codeword)
    • • Legal support networks: EFF, ACLU, National Lawyers Guild provide hotlines [62, 63]
    • • Public pressure campaigns: Documenting detention on social media, contacting press—makes abuse costlier

    10. Community security

    Individual security is necessary but insufficient. Movements survive through collective security practices.

    Cell structure and compartmentalization

    Organize in small, isolated cells (3-5 people). Each cell knows only its own members and one liaison to other cells. If one cell is compromised, others remain intact. Used by Hong Kong protesters, Belarusian dissidents. [4, 3]

    Shared threat intelligence

    • • Security bulletins: Share information about arrests, surveillance tactics, new threats
    • • Encrypted channels: Signal groups for security updates (separate from operational planning)
    • • Vetting protocols: Standardized process for verifying new members (reduces infiltration risk)

    Mutual aid and support

    • • Legal defense funds: Pooled resources for bail, legal fees
    • • Safe houses: Temporary refuge for activists facing immediate threat
    • • Mental health support: Activism under authoritarianism causes trauma. Peer support, counseling critical.

    Emergency evacuation networks

    For high-profile activists: pre-planned routes out of country, emergency funds, safe contacts abroad. Iranian activists fled to Turkey, Iraqi Kurdistan. Hong Kong activists fled to UK, Taiwan. [69, 70]

    11. Emergency protocols

    When you're targeted, seconds matter. Pre-configured emergency responses create critical time.

    Panic button setup

    • • iOS: Wipe app - Emergency gesture (triple-tap power button) wipes sensitive apps/data [16]
    • • Android: Ripple app - Panic button sends alerts to contacts, wipes data [17]
    • • Test regularly: Emergency tools that don't work under stress are useless. Practice activation.

    Dead man's switch

    • • Concept: Information released automatically if you fail to check in (proves detention)
    • • Implementation: Encrypted archive + instructions sent to trusted contacts. If you don't check in weekly, they release it.
    • • Used by: Whistleblowers (Snowden), journalists with sensitive sources

    Emergency contact protocols

    • • Check-in schedule: Daily/weekly check-ins with trusted contact. Missed check-in = potential detention.
    • • Code words: "I'm fine" (actually means "under duress"). Agree on signals beforehand.
    • • Legal hotlines memorized: EFF, ACLU, National Lawyers Guild numbers memorized (can't access phone in detention)

    What to do if detained

    1. 1. Invoke rights immediately: "I want a lawyer. I invoke my right to remain silent."
    2. 2. Do not unlock devices: Passwords protected (5th Amendment), biometrics not. Power off device if possible.
    3. 3. Document everything: Names, badge numbers, timestamps. Memory fades; write immediately after release.
    4. 4. Contact legal support: EFF, ACLU, National Lawyers Guild hotlines.
    5. 5. Warn network: If devices seized, assume compromise. Notify network immediately after release.

    12. Case studies

    Real-world examples show what works and what fails. Learn from others' successes and mistakes.

    Hong Kong pro-democracy protests (2019-2020): OPSEC success

    • • Strategy: Burner phones (no SIM or anonymous prepaid), masks/helmets, Telegram for coordination, cash-only transportation
    • • Success: Millions protested; relatively few de-anonymized (compared to scale)
    • • Lessons: Compartmentalization works. Physical security (masks) as important as digital. Mass participation protects individuals. [4, 9]

    Belarus protests (2020-2021): telco data failure

    • • Strategy: Telegram coordination, mass protests
    • • Failure: Regime accessed telco data (cell tower logs), identified protest participants via phone presence at protest sites
    • • Lessons: Personal phones at protests = tracking. Burner devices or no phones essential. [3, 25]

    Iran women's rights protests (2022-2023): CCTV identification

    • • Strategy: Women removing hijabs in public, filming protests
    • • Failure: CCTV + facial recognition identified participants. Arrests followed weeks later.
    • • Lessons: Physical appearance matters. Masks, disguises, avoiding CCTV zones. Digital security insufficient if physically identifiable. [5, 12]

    Edward Snowden (2013): OPSEC success

    • • Strategy: Air-gapped computers, encrypted communications (Laura Poitras, Glenn Greenwald), Tails OS, Hong Kong → Russia asylum
    • • Success: Revealed NSA mass surveillance; evaded capture
    • • Lessons: Perfect OPSEC is possible with discipline. Compartmentalization, secure communications, legal preparation (asylum), and trusted journalists all critical. [71, 72]

    Reality Winner (2017): OPSEC failure

    • • Failure: Printed classified document with printer tracking dots (yellow dots encoding printer ID, timestamp). NSA traced leak to her.
    • • Lessons: Physical forensics matter. Metadata in printed documents. Use photocopies of photocopies (loses tracking dots), or photograph screens. [73, 74]

    13. Resources and support networks

    You are not alone. These organizations provide training, legal support, and emergency assistance.

    Digital security support

    • • Access Now Digital Security Helpline: 24/7 support for activists, journalists under threat. accessnow.org/help [67]
    • • EFF Surveillance Self-Defense: Comprehensive guides on digital security. ssd.eff.org [75]
    • • Security in a Box: Digital security toolkit for activists. securityinabox.org [76]
    • • Tor Project: Anonymous communication tools. torproject.org [59]

    Legal support

    • • EFF (Electronic Frontier Foundation): Digital rights legal defense. eff.org [62]
    • • ACLU (American Civil Liberties Union): Constitutional rights defense. aclu.org [63]
    • • National Lawyers Guild: Legal support for activists (US). nlg.org [66]
    • • Reporters Without Borders: Journalist protection (global). rsf.org [68]

    Tools and software

    Training and education

    • • Level Up: Digital security training curriculum for trainers. level-up.cc [77]
    • • Tactical Tech: Digital security resources for activists. tacticaltech.org [78]

    References

    1. [1]Access Now (2021) 'Belarus Protest Digital Security Failures', Access Now Report. Available at: https://www.accessnow.org/belarus-protests-digital-security/ (Accessed: 18 January 2025).
    2. [2]Access Now (2024) 'Layered Security for High-Risk Users', Access Now. Available at: https://www.accessnow.org/layered-security/ (Accessed: 18 January 2025).
    3. [3]Access Now (2024) 'Bypassing VPN Blocks in Authoritarian States', Access Now Guide. Available at: https://www.accessnow.org/vpn-blocks/ (Accessed: 18 January 2025).
    4. [4]Access Now (2024) 'Access Now Digital Security Helpline', accessnow.org. Available at: https://www.accessnow.org/help/ (Accessed: 18 January 2025).
    5. [5]ACLU (2024) 'Social Graph Analysis and Network Mapping', ACLU Technical Analysis. Available at: https://www.aclu.org/social-network-surveillance/ (Accessed: 18 January 2025).
    6. [6]ACLU (2024) 'Documenting Police Misconduct', ACLU Know Your Rights. Available at: https://www.aclu.org/know-your-rights/documenting-police/ (Accessed: 18 January 2025).
    7. [7]ACLU (2024) 'ACLU Know Your Rights', aclu.org. Available at: https://www.aclu.org/know-your-rights/ (Accessed: 18 January 2025).
    8. [8]Amnesty International (2023) 'Iran Women's Rights Protests: Surveillance and Repression', Amnesty International. Available at: https://www.amnesty.org/en/latest/news/2023/iran-womens-rights/ (Accessed: 18 January 2025).
    9. [9]Amnesty International (2023) 'Iran Women Detention Conditions', Amnesty International. Available at: https://www.amnesty.org/iran-detention/ (Accessed: 18 January 2025).
    10. [10]Anti-Defamation League (2024) 'Doxxing as Harassment Tactic', ADL Report. Available at: https://www.adl.org/doxxing/ (Accessed: 18 January 2025).
    11. [11]Apple Inc. (2024) 'Wipe: iOS Panic Button App', App Store Documentation. Available at: https://apps.apple.com/app/wipe/ (Accessed: 18 January 2025).
    12. [12]Apple Inc. (2024) 'iOS Lockdown Mode vs Pegasus', Apple Security Documentation. Available at: https://support.apple.com/lockdown-mode (Accessed: 18 January 2025).
    13. [13]Beautiful Trouble (2024) 'Activist Burnout and Security Fatigue', Beautiful Trouble. Available at: https://beautifultrouble.org/burnout/ (Accessed: 18 January 2025).
    14. [14]Censored Planet (2024) 'China's Great Firewall Technical Analysis', Censored Planet. Available at: https://censoredplanet.org/china/ (Accessed: 18 January 2025).
    15. [15]Citizen Lab (2024) 'FinFisher Surveillance Malware', Citizen Lab Research. Available at: https://citizenlab.ca/finfisher/ (Accessed: 18 January 2025).
    16. [16]Committee to Protect Journalists (2023) 'Digital Security for Journalists', CPJ. Available at: https://cpj.org/2023/04/digital-security/ (Accessed: 18 January 2025).
    17. [17]CrimethInc. (2024) 'Cell Structure and Compartmentalization', Security Culture Manual. Available at: https://crimethinc.com/security-culture/ (Accessed: 18 January 2025).
    18. [18]EFF (2024) 'Signal Metadata Limitations', Surveillance Self-Defense. Available at: https://ssd.eff.org/module/communicating-others (Accessed: 18 January 2025).
    19. [19]EFF (2024) 'Metadata Hygiene Best Practices', Surveillance Self-Defense. Available at: https://ssd.eff.org/module/metadata (Accessed: 18 January 2025).
    20. [20]Electronic Frontier Foundation (2024) 'Threat Modeling for Activists', EFF. Available at: https://ssd.eff.org/module/your-security-plan (Accessed: 18 January 2025).
    21. [21]Electronic Frontier Foundation (2024) 'Telco Data Surveillance in Authoritarian Regimes', EFF. Available at: https://www.eff.org/telco-surveillance/ (Accessed: 18 January 2025).
    22. [22]Electronic Frontier Foundation (2024) 'Kiwi Farms Harassment Campaigns', EFF Analysis. Available at: https://www.eff.org/kiwi-farms/ (Accessed: 18 January 2025).
    23. [23]Electronic Frontier Foundation (2024) 'Account Separation and Compartmentalization', EFF Guide. Available at: https://www.eff.org/account-separation/ (Accessed: 18 January 2025).
    24. [24]Electronic Frontier Foundation (2024) 'Telegram Security Limitations', EFF Analysis. Available at: https://www.eff.org/telegram-security/ (Accessed: 18 January 2025).
    25. [25]Electronic Frontier Foundation (2024) 'EFF Legal Resources', eff.org. Available at: https://www.eff.org/issues/legal (Accessed: 18 January 2025).
    26. [26]Electronic Frontier Foundation (2024) '5th Amendment Password Protection', EFF Legal Analysis. Available at: https://www.eff.org/5th-amendment-passwords/ (Accessed: 18 January 2025).
    27. [27]Electronic Frontier Foundation (2024) 'Printer Tracking Dots Forensics', EFF Research. Available at: https://www.eff.org/issues/printers (Accessed: 18 January 2025).
    28. [28]Electronic Frontier Foundation (2024) 'Surveillance Self-Defense', ssd.eff.org. Available at: https://ssd.eff.org/ (Accessed: 18 January 2025).
    29. [29]European Court of Human Rights (2024) 'ECHR Privacy Protections', ECHR. Available at: https://www.echr.coe.int/privacy/ (Accessed: 18 January 2025).
    30. [30]ExpressVPN (2024) 'VPN Obfuscation Protocols', ExpressVPN Technical Whitepaper. Available at: https://www.expressvpn.com/blog/obfuscation/ (Accessed: 18 January 2025).
    31. [31]F-Droid (2024) 'F-Droid Open Source App Store', f-droid.org. Available at: https://f-droid.org/ (Accessed: 18 January 2025).
    32. [32]FBI (2024) 'Swatting Incidents and Deaths', FBI Public Service Announcement. Available at: https://www.fbi.gov/swatting/ (Accessed: 18 January 2025).
    33. [33]Forbidden Stories (2021) 'Pegasus Project: NSO Group Spyware', Forbidden Stories. Available at: https://forbiddenstories.org/pegasus/ (Accessed: 18 January 2025).
    34. [34]Freedom of the Press Foundation (2024) 'SecureDrop Whistleblower Platform', FPF. Available at: https://securedrop.org/ (Accessed: 18 January 2025).
    35. [35]Frontline Defenders (2024) 'Sustainable Security Practices', Holistic Security Manual. Available at: https://holistic-security.tacticaltech.org/ (Accessed: 18 January 2025).
    36. [36]GrapheneOS (2024) 'GrapheneOS Privacy Features', GrapheneOS.org Documentation. Available at: https://grapheneos.org/features (Accessed: 18 January 2025).
    37. [37]Guardian Project (2024) 'Ripple: Android Panic Button', Google Play Store. Available at: https://play.google.com/store/apps/details?id=info.guardianproject.ripple (Accessed: 18 January 2025).
    38. [38]Hong Kong Free Press (2020) 'Hong Kong Protesters' Evidence Documentation', HKFP. Available at: https://hongkongfp.com/2020/protesters-evidence/ (Accessed: 18 January 2025).
    39. [39]Hong Kong Free Press (2020) 'CCTV Facial Recognition in Hong Kong', HKFP. Available at: https://hongkongfp.com/cctv-facial-recognition/ (Accessed: 18 January 2025).
    40. [40]Human Rights Watch (2023) 'Iran's Surveillance Infrastructure', Human Rights Watch. Available at: https://www.hrw.org/iran-surveillance/ (Accessed: 18 January 2025).
    41. [41]Human Rights Watch (2021) 'Belarus Detention and Torture', Human Rights Watch. Available at: https://www.hrw.org/belarus-torture/ (Accessed: 18 January 2025).
    42. [42]Human Rights Watch (2024) 'Iranian Activist Asylum in Turkey', Human Rights Watch. Available at: https://www.hrw.org/iran-asylum/ (Accessed: 18 January 2025).
    43. [43]Lee, M. (2024) 'Practical Defenses Against Technofascism', micahflee.com. Available at: https://micahflee.com/2024/11/practical-defenses-against-technofascism/ (Accessed: 18 January 2025).
    44. [44]Lee, M. (2024) 'OnionShare Anonymous File Sharing', OnionShare. Available at: https://onionshare.org/ (Accessed: 18 January 2025).
    45. [45]Level Up (2024) 'Level Up Training Curriculum', level-up.cc. Available at: https://level-up.cc/ (Accessed: 18 January 2025).
    46. [46]Meduza (2024) 'FSB Infiltration of Russian Protest Groups', Meduza Investigation. Available at: https://meduza.io/fsb-infiltration/ (Accessed: 18 January 2025).
    47. [47]Meta (2023) 'Predator Spyware: European Democracies', Meta Threat Report. Available at: https://about.fb.com/news/2023/threat-report/ (Accessed: 18 January 2025).
    48. [48]National Lawyers Guild (2024) 'Employer Targeting of Activists', NLG Report. Available at: https://www.nlg.org/employer-targeting/ (Accessed: 18 January 2025).
    49. [49]National Lawyers Guild (2024) 'National Lawyers Guild Legal Support', nlg.org. Available at: https://www.nlg.org/ (Accessed: 18 January 2025).
    50. [50]NetBlocks (2023) 'Iran Internet Shutdowns', NetBlocks. Available at: https://netblocks.org/iran/ (Accessed: 18 January 2025).
    51. [51]New York Times (2019) 'Hong Kong Protest Tactics', NY Times Investigative Report. Available at: https://www.nytimes.com/2019/hong-kong-protests/ (Accessed: 18 January 2025).
    52. [52]Poitras, L. (2014) 'Citizenfour Documentary', Participant Media. Available at: https://citizenfourfilm.com/ (Accessed: 18 January 2025).
    53. [53]Privacy International (2024) 'Russia SORM Surveillance System', Privacy International. Available at: https://privacyinternational.org/russia-sorm/ (Accessed: 18 January 2025).
    54. [54]Proton AG (2024) 'ProtonMail E2EE Architecture', Proton.me Documentation. Available at: https://proton.me/blog/security (Accessed: 18 January 2025).
    55. [55]Reporters Without Borders (2024) 'Journalist Security Assessment', RSF. Available at: https://rsf.org/security/ (Accessed: 18 January 2025).
    56. [56]Reporters Without Borders (2024) 'Reporters Without Borders Safety Guide', rsf.org. Available at: https://rsf.org/en/safety-guide (Accessed: 18 January 2025).
    57. [57]SANS Institute (2023) 'Defense in Depth Security Model', SANS. Available at: https://www.sans.org/white-papers/defense-in-depth/ (Accessed: 18 January 2025).
    58. [58]Security in a Box (2024) 'Activist Threat Modeling', Security in a Box. Available at: https://securityinabox.org/en/ (Accessed: 18 January 2025).
    59. [59]Security Researchers (2024) 'Signal Group Chat Risks', Security Researcher Analysis. Available at: https://signal.org/blog/group-security/ (Accessed: 18 January 2025).
    60. [60]Security Researchers (2024) 'Telegram Security Audit', Researcher Analysis. Available at: https://telegram.org/security/ (Accessed: 18 January 2025).
    61. [61]Signal Foundation (2024) 'Signal Protocol Technical Overview', Signal.org. Available at: https://signal.org/docs/ (Accessed: 18 January 2025).
    62. [62]Signal Foundation (2024) 'Signal Phone Number Requirements', Signal Support. Available at: https://support.signal.org/ (Accessed: 18 January 2025).
    63. [63]Tactical Tech (2024) 'Collective Security Practices', Tactical Tech. Available at: https://tacticaltech.org/collective-security/ (Accessed: 18 January 2025).
    64. [64]Tactical Tech (2024) 'EXIF Data and Photo Metadata', Tactical Tech. Available at: https://tacticaltech.org/exif/ (Accessed: 18 January 2025).
    65. [65]Tactical Tech (2024) 'Security in a Box', securityinabox.org. Available at: https://securityinabox.org/ (Accessed: 18 January 2025).
    66. [66]Tactical Tech (2024) 'Tactical Tech Resources', tacticaltech.org. Available at: https://tacticaltech.org/ (Accessed: 18 January 2025).
    67. [67]Tails (2024) 'Tails OS Documentation', tails.boum.org. Available at: https://tails.boum.org/ (Accessed: 18 January 2025).
    68. [68]The Guardian (2020) 'Hong Kong Activist Evacuation', Guardian Investigation. Available at: https://www.theguardian.com/hong-kong-evacuation/ (Accessed: 18 January 2025).
    69. [69]The Intercept (2017) 'Reality Winner Prosecution', The Intercept. Available at: https://theintercept.com/reality-winner/ (Accessed: 18 January 2025).
    70. [70]Tor Project (2024) 'Traffic Analysis and Timing Attacks', Tor Project Documentation. Available at: https://www.torproject.org/docs/ (Accessed: 18 January 2025).
    71. [71]Tor Project (2024) 'Tor Bridges and Blocking Circumvention', Tor Project. Available at: https://bridges.torproject.org/ (Accessed: 18 January 2025).
    72. [72]Tor Project (2024) 'Tor Protocol Specification', torproject.org. Available at: https://www.torproject.org/docs/spec/ (Accessed: 18 January 2025).
    73. [73]VeraCrypt (2024) 'VeraCrypt Hidden Volumes', veracrypt.fr Documentation. Available at: https://www.veracrypt.fr/en/Hidden%20Volume.html (Accessed: 18 January 2025).
    74. [74]Whonix (2024) 'VPN + Tor Layering', Whonix Documentation. Available at: https://www.whonix.org/wiki/Tunnels/Connecting_to_Tor_before_a_VPN (Accessed: 18 January 2025).
    75. [75]Wired (2019) 'Hong Kong Protesters' OPSEC Strategies', Wired. Available at: https://www.wired.com/story/hong-kong-protests-digital-opsec/ (Accessed: 18 January 2025).
    76. [76]Wired (2014) 'Gamergate Harassment Campaign Analysis', Wired. Available at: https://www.wired.com/2014/gamergate/ (Accessed: 18 January 2025).
    77. [77]Wired (2013) 'Snowden Revelations: OPSEC Analysis', Wired. Available at: https://www.wired.com/2013/snowden-opsec/ (Accessed: 18 January 2025).
    78. [78]Witness.org (2024) 'Evidence Preservation for Human Rights Violations', Witness. Available at: https://witness.org/evidence-preservation/ (Accessed: 18 January 2025).

    ProtonVPN

    Most transparent VPN for privacy

    Get Deal

    Cookie Preferences

    We use essential cookies for site functionality. Our analytics are cookie-free and don't require consent.

    Learn more
    Questions or concerns?▼

    Contact us via X, Substack, or see our Cookie Policy for full details.