Activist Online Safety Guide

This guide is for for anyone who wants ensure their online privacy and security. This guide is not meant to be exhaustive but tries to be comprehensive. I hope for it to be a roadmap and starting point for everyone to use to ensure that they can find valid and effective information so that an informed decision about privacy and security issues can be determined based on on each person’s level of risk acceptance. Essentially, what does each person feel safe revealing about themselves. It’s expected that anyone reading this would also do their own research and reading the terms of service of the applications and services they decide to use. Just because everyone else uses a service or app doesn’t mean it’s privacy preserving (cough Facebook cough).

As an activist you want to separate your private life from your activist life. You want to preserve your own personal privacy but also to keep yourself safe from over zealous law enforcement. To do this you need to be vigilant about your operational security (OpSec), be careful about what you post online and say and public, and make it hard to identify you. The best way to do this is to have an activist persona. This is the "person" who is the activist while online.

Digital Persona

A digital persona is “you” represented on the web. However, this “you” can be anything that the real you wants it to be. It is the “person” that is to be seen (and tracked and data mined) when doing something on the web. You might like seafood, your persona might hate it. You can be a liberal, your persona a conservative. You might be from the east coast, your persona from the west. You can have multiple persona’s...maybe the real you, a work persona, and a persona you present to your family. I’d recommend, at a minimum, having at least two personas...your real self and your activist persona. These two should never "meet" online. Your real life persona shouldn’t follow your activist persona on social media. Keeping the personas separate is the first step in ensuring you can have a private life and an activist life. The idea with your persona (or personas if you wish to have more) is to have a minimal back story about them, their likes, where they’re from, age, various preferences, etc. It’s these details that are provided to websites, not your true information. Variations on true things are easier to remember and keeps it simple. When talking with people, giving up a little bit of persona information is fine, but when they probe, tell them you like your privacy...no more details. You also want your persona to live in the same general time zone as you. You don’t want to have your persona live in London and you’re in San Francisco. People will notice when you say good morning and it’s night time in London, supposedly where your persona lives. One thing to be careful about is picking activities or hobbies you know nothing about. It’ll become obvious when someone asks a basic question and you have no clue what they are talking about. You’ll get called out on it. So that boring hobby your ex boyfriend used to drone on about...that might be a good option since you’ll know a bit about it. And yes, if this sounds like you’re becoming a spy. It’s similar.

Yes, we are all fighting for our rights and being active with protests (both real life and digital). The idea is to make is hard (preferably near impossible if you can do it) for law enforcement to link your online activities with your real world activities. This IN NO WAY means you should be saying things online that would bring a significant investigation into you (such as inciting violence), it is SOLELY to be used to help your real life identity from being identified by law enforcement.

Virtual Machine

Separating your activism from your real life only means doing that on your computer. Meta data on your computer can be linked to you while online and during a forensics investigation. Unless you want to buy a new (or used) computer only for your activist activities, a very good (and free) option is using a virtual machine. The application VirtualBox lets you create another install of the operating system on your current computer. I'd highly recommend using Linux Mint. This is a simple to use Linux OS. There are many guides on doing this available. You want to be sure to encrypt the drive when you create the new OS. Then when you want to go online as your persona, you start up this different OS, login, and you have a new OS there ready to use that is separate from your personal OS.

Online Nickname

When picking your online nickname, ensure that it is not able to be linked back to your real identity. For example, if your real name is Julie don’t pick HotJules97 as your nickname (and associated login and email address). Or if you are from Maryland and your persona is from California, having TerpsGal420 as your persona nickname will give you away (the University of Maryland mascot is the Terps - nick name for a Terrapin, a type of turtle). Again, you want to ensure nothing can link your real life persona to your activist persona. You also do not want to re-use old account names, such as from your dead MySpace page.

Phone, Texting, and Email

Almost everybody has a cell phone. It goes with you everywhere and that's the problem. You want to be able to have the ability to make/take calls and send/receive text messages. Many people also use it to live stream when they are out and about. You should never give out your real cell phone number. There are apps that run on your phone that can be used, providing another phone number that can send and receive both texts and calls. Look at MySudo, Burner, IronVest, and TextNow. Though there is a small fee, it’s worth it to keep you safe. The nice (and bad) thing is that a phone number’s area code can reveal where it is. For example the area code 321 is around Kennedy Space Center in Florida (get it? 3..2..1…). With these apps, the location is disassociated with the location to help provide a level of security. Also, if your persona is “from” a certain area, you can possibly get a phone number for that area to help ensure that your persona is airtight and believable.

I'd recommend creating and using ONLY for the phone an iCloud account for iPhone and a Google account for Android. This should only be used for updates and to access the app stores.

One issue with these app and services is that some sites won’t accept email or phone numbers from them. One option is to use a burner phone, ie. a completely different physical phone that you’ve bought with cash. TracFone and Mint are common burner phone providers (aka pre-paid plans). Use your persona to register the phone and to active it. They plans can be bought with cash at many convenience stores and places like BestBuy.

Phones HAVE to be activated by connecting to the cellular network when first bought. When you do this, leave all your other cellular linked devices (phone, tablet, watch) at home and drive somewhere not near your house to turn it on and activate it. Once activated, download and install a VPN app (such as Proton or Mullvad) and enable. Adjust the settings so that the VPN is always enabled. Now put the phone into Airplane Mode. When you get home you can now connect to your home's WiFi and use the phone without connecting to the cellular network with your calls looking like they came from a different location (I'd suggest using a US based VPN exit). This only works when connected to a WiFi access point with cellular disabled, not when you’re connected to the cellular network. Even if you use a VPN, if you’re connected to cellular, the phone is still connected to the cellular network and can geo locate you to an area.

Another thing to remember is if you have a personal phone and a burner and bring them to a protest, they BOTH will be seen on cell tower data. When used with other data points this can help to identify you.

Email is another tool that can leak your data so you want to use it wisely. ProtonMail, Tutanota, Disroot, StartMail, and Mailbox.org are providers that are privacy focused. Again, never have your persona account send an email to your real life account. If you just need a temporary email to use (ie, disposable), you can use AnonAddy, SimpleLogin, or IronVest. The idea is that these only work once to prevent your persona email from getting used and tracked.

Then there is Google. They’re a privacy nightmare BUT they have all the right services. As long as you understand the privacy implications (I‘ll talk about that more later) then this can be a good option. The reason a non-private option is good? Because EVERY service will accept the email address AND they have a virtual phone number option that accepts text messaging. It also doesn’t hurt that you get Google Drive to store your content and an Alerts tool. For most people, this is the easiest option.

Use caution with Google.

Banking / Credit

If you want to do almost anything financial you will need to provide your actual identity for anything bank related. I use a separate email account ONLY for banking and financial things. Not a persona, just a separate account to keep all the finances separate. But what happens when you need to pay for something? Prepaid credit cards are the best way to go. For an extra layer of production you can buy them with cash. Another option is to use an app. Ironvest and MySudo can generate one time credit card numbers as well as provide email, phone, and texting abilities. Privacy (thats the app name, Privacy) is another app that generates unique credit card numbers. Another option is to use your own credit cards. Many have the option to generate one time use numbers. Though these are are more easily tied to your real life identity, there are less issues when buying things (some places don’t like the disposable numbers) and is highly protected by banks, it can’t just be found on the internet.

One thing with prepaid cards - they are usually country or region specific. Buying a prepaid card in the US won’t work to buy goods and services in Europe. Depending on the merchant, it's not uncommon for pre-paid cards to not be excepted.

One more recent option that has come up is the use of cryptocurrency. Stay. Away. It is HIGHLY volatile and many are NOT anonymous. There are also lots of fees in transferring/converting between crypto and fiat currency. If that's the only way to pay, Zcash and Monero are the most secure.

Passwords & Management

Passwords - we still need them and you shouldn’t make them. What do I mean? I don’t know ANY of my passwords. I use a tool to autogenerate them and use a password manager to store them. I only know one password, the password to my password manager. I use a passphrase, essentially 4-8 words or a phrase put together that is rememberable. And don’t do something like IHatePasswords or Trump4Prison!. Nothing related to activism or your real identity. The password manager will generate a complex password and remember it along with your login ID. The data is encrypted so that it can not be accessed. BitWarden is my favorite and free, but Proton, Psono, and 1Password are also very good options. KeePassXc can also be used and is only stored locally.

If the site supports it, you should also enable 2FA/MFA (two factor authentication / multi factor authentication). These are actually different things but are used interchangeably by most people. One of three things will be used as a final authentication mechanism after you use your username and password to login. You will either get an email with a code or link, an SMS with a PIN code, or you will use an app to enter the code generated by the app. This last one is the most secure. You will use an app, such as Authy, Ente, , Proton Pass, or Aegis (Google and Microsoft also have options but they aren’t as privacy oriented) and link the app to your account using a QR code. All the apps are free.

One newer option supported by all major browsers but not widely used is a FIDO2 complaint physical token. This is a USB or NFC (near field communications) enabled device that is linked with your browser. You will need to purchase one of these. Yubikey is the most common and popular. These are great but you need to make sure you have two - a primary and a back up. There is also another option called Passkeys which are very secure. The issue is they aren't easily ported between devices so switching devices can cause login issues.

Security Tools

There are three things to do to keep your computer safe. Enable the firewall, use anti-virus/anti-malware, and patch both the operating system and applications. Both Windows 10/11 and Macintosh OS X have very good built in firewalls. They should be enabled, the default settings are fine to use. For anti-virus/anti-malware on Windows, using Microsoft’s built in Defender or its upgrade to Advanced Threat Protection (ATP) for home use. Another option is CrowdStrike which is extremely good. There are a few others that are good, Sophos and BitDefender, but they collect a lot of data about the users, especially the free versions.

For Macintosh OS X users Sophos and CrowdStrike work for Mac’s too. There is a belief that Mac’s can’t get malware or viruses. That’s not true but it’s less likely than on Windows. Again, patching and running scans will help prevent a security issue.

Both Windows and Macintosh have built in updaters for the operating system. When it notifies you that there are new patches, install them. Some software, such as Google Chrome, will also notify you that a newer version is out. Be sure to update your apps too. I would recommend setting up a calendar reminder to remind you to run the updaters for the apps you use once a month along with the operating system. After that has completed, run a full anti virus scan.

One setting you should also make is to your DNS settings. You can change them per device, but what’s easier is to change them on your router/wifi access point. You should use 1.1.1.1, 1.0.0.1, and 9.9.9.9 for DNS. These are privacy respecting systems (and usually always better than your ISP’s).

Geo-Location

As I’ve alluded to already, your location needs to be protected and your persona is one way to do just that. You need to be “in” that location and time zone. I even recommend changing the time zone on your virtual machine to where your persona “lives” to help keep you in the right frame of mind. The other issue of geolocation is with your network connection to the services you use. The IP address (the way of addressing things on the internet) can be geolocated. You can go to your favorite search engine (I recommend DuckDuckGo) and search for “what’s my IP address location” and you can easily find your IP address, general location, your ISP, and the browser you are using. A VPN will provide protection from a lot of this. Many vendors will tell you that a VPN will protect you from all kinds of things. Most of it isn’t true. It will only mask your IP address. You never want to use a free VPN service - they make their money by reselling your information. You want to pick a non-free, verifiable non-logging provider. Mullvad, Mozilla, Nord, iVPN, and Proton are all very good options to consider (Proton as a limited free VPN option that is good). Many VPN’s can also be installed on your mobile phone (good for Wifi calling). I do not recommend using proxies or Tor. Most proxies (again, unless paid) aren’t reliable nor safe and can be difficult to set up to ensure ALL the traffic from your computer is going through the proxy. Tor is the gold standard for anonymity but is very slow and streaming is poor. May sites also block Tor traffic.

One place people forget about that can leak their location is their computer’s data/time service. You want to make sure yours is set to the time zone your activist persona “lives” in, NOT the one your real identity lives in.

Personal Details Checklist

One easy thing you should do is to search for yourself. First use your real identity and see what comes up. There are options to remove data about you from data aggregation sites and basic internet searches. Google and Bing (DuckDuckGo uses Bing as the data source) have options to request removal of data about yourself or your persona. If you decide to use Google for email, text, etc. you can set up Google Alerts to run and look for keywords related to you. This allows you to know what’s out there and to be able to request a take down or removal request. There are other tools available that can perform searches and alert you. There are also services to do this automatically for you and to remove the content.

Remember, data is the new oil. It is valuable. You want to leave as little data about yourself laying around the internet as possible. You will pick the level of privacy you are comfortable with but I recommend more privacy sooner that later. Once your data is out, it is impossible to get back. There’s a saying, the internet never forgets.

The following is a list of things to be cautious about sharing/using. Most of them are innocuous on their own but in combination can be compromising. Remember, keep to your activist persona.

Your time zone
Events happening locally or major events you’re attending/have attended
Climate; current local weather conditions
Favorite sports teams (if local)
Your alma mater
Landmarks
Past employers/industries
Your vehicle make, model, and year
Using free Spotify (will have local ads, a VPN can help with this)
Reusable shopping bags from local businesses
Local street names or traffic anomalies
Local geographic features/characteristics
Major works of local infrastructure
Local bylaws and regulations
Specifying that you’re from the same place as _____ (celebrity or public figure); identifying local politicians or public figures
Local terminology or slang (do you say pop or soda?)
Local versions of widely available items
Library items visible in the background
Using social media for your personal life
Credentials & certifications where your real name and/or photo will be on a website somewhere
Past or present volunteer roles where your name is listed on the organization’s website

Messaging Apps

You should be very careful with messaging apps as they can leak a LOT of data about you and where you are. SMS/MMS texts have no security or privacy safeguards. Their replacement, RCS (this is mostly used by Android phones) is better but still has some issues. If the phone/carrier of the person you are texting with doesn’t support RCS, it falls back to SMS/MMS. It can provide geolocation data, and it might be set up for client-to-server encryption (the carrier or law enforcement can then read the messages) with optional end-to-end encryption (not the default).

The other popular messaging apps, iMessage and WhatsApp, are both good with security but do have meta data that can be revealing. Telegram chats are by default not encrypted. Other options such as Tox, Signal, and Element are highly secure but do not always have all the features or video features desired. Jitsi and Wire are free, privacy respecting video services that are recommended.

Signal is the gold standard for secure communications. You should not share your address book when you install it unless it's on your burner. You should also use a username instead of your phone number when giving out your contact info. Setting message to disappear after a short time is also a good thing to do.

A note about messaging, even with disappearing messages - if someone takes screenshots or is added to the chat by mistake (aka a Hegseth), then it doesn't matter how good the encryption is.

Sigh Social Media. It’s both a blessing and a curse. A necessary evil. Realize that ALL social media data mines everything you post and anything they can get about you. Some are better than others but use wisely and be smart about what you post. Remove meta data from pictures and video’s BEFORE you post. As a rule I recommend staying away from Facebook and TikTok. Yes, both are very popular but the volume of data they collect about its users is truly staggering.

Twitter / X had is still one of the most popular social media platforms but its increasingly being dropped in favor of BlueSky.

As a final note, Never use the “Login with <FB/Twitter/Google>” options. This is not a good idea and helps to link services to you, even if its only your persona. Also, if for some reason the password to that one site is hacked, the hacker has access to every site that you use that login with.

If you use a social media site with both your activist and real name, if you friend one person in one account, you need to block them seeing the other account to prevent linking your activist persona to your real life persona.

Web Browsers

Mozilla Firefox and the Mullvad browser are the two most trusted browsers for privacy. Brave is a good option if you insist on using a Google Chrome base browser.

Browsers have a lot of issues with data privacy. This is why you want to use a separate virtual machine with a persona, to help prevent any of these tech companies from being able to read your browser data. I HIGHLY recommend clearing your browser cache and cookies after every use or when the browser is closed.

Adding additional plugins might reveal data about you. You’ll want to be careful if you decide you want to use other plugin’s. Only use EFF Privacy Badger, uBlock Origin, Facebook Container, and your password managers browser plugin.

Data Removal

There’s a saying, “the internet never forgets.” This is why you want to be proactive in protecting your personal data. Once it is out there, it is extremely difficult to remove it. Remember to ALWAYS remove meta data from pictures and videos and the use of a persona will help with this. The biggest issue is data brokers constantly pulling data from all over the globe to build profiles on you. They will remove data if you ask and there are services that can help you do this for a fee. There are a LOT of data brokers and trying to do it manually, by your self, is a full time job. Both Google and Bing have portals to request data removal. Even Facebook now has a way to remove data about yourself from your profile.

And the various AI companies are now doing it too.

You should also read through the Anonymous Planet guide - https://anonymousplanet.org/guide/

Links / References

Activist Online Safety Guide

Digital Persona

Virtual Machine

Online Nickname

Phone, Texting, and Email

Banking / Credit

Passwords & Management

Security Tools

Geo-Location

Personal Details Checklist

Messaging Apps

Social Media

Web Browsers

Data Removal

Links / References

Apps

Tools

VPN

Email

Password Managers

Privacy Guides

Data Removal

Meta Data Removal

Regulations

Privacy Protection Services

Warning