Security Essentials
Every click, message, and location ping creates a digital trail that can be used against activists and organizers. Law enforcement regularly demands data from tech companies to identify and surveil people working for social change.
This guide helps you minimize your digital trail. These steps won't make you invisible, but they'll make it substantially harder for authorities to:
Track your location and movement patterns
Monitor your communications and political discussions
Map your relationships and networks
Build profiles of your activities and associations
Baseline security
Use Signal for texts and calls, especially your activism and political conversations
Normal calls and texts are insecure and can be turned over to the cops
How to set up Signal
Install Signal on your phone
You can now message your existing contacts using their phone number (they must have Signal installed as well). If you're messaging someone new who you don't yet have trust with, you should exchange usernames instead of phone numbers when possible.
To start a new message: Press the "Create" icon in the top right of Signal, then type in either the person's phone number or username
Follow the Signal Checklist to make sure you have the most security and privacy
When to use Signal
Some examples of when you would especially want to use Signal
Discussing a protest/action that is not public
Organizing a protest/action that is public, but the organizers want to protect their privacy
Criticizing government and power holders
Keep speaking out publicly! We encourage Signal (or just in-person conversations with no tech around) to have secure channels where we can speak more freely to get organized for public engagement. That said, we should encourage one another to continue to speak out publicly about our criticisms of power holders. As Timothy Snyder says, do not obey in advance.
Use privacy-focused browser for everyday browsing (instead of Chrome)
Minimize tracking, so there’s less of a digital trail.
We recommend Brave because it offers the most privacy without any additional configuration, which is our goal on this site.
How to set up Brave Browser
Brave is a privacy-focused browser that allows you to install Google Chrome extensions.
Install Brave on your computer (or phone).
Follow the steps after you launch to import your configuration from Chrome or another browser. (See warning below about how plugins make you more identifiable.)
Configure privacy settings: On the desktop browser, go to Brave > Settings > Shields then select the following: (The mobile app will not have all these settings)
Select Aggressive under "Trackers & ads blocking"
Select Strict under "Upgrade connections to HTTPS"
Uncheck everything under Social media blocking
(Optional) Enable Forget me when I close this site. (On the mobile app, the settings is called "Shred Site Data") The site won't be able to store anything about you after your reset your browser.
This will make it harder for sites to track you across the internet. It's good for privacy, but you'll want to manually override this for specific sites. Visit the site > Click the Brave (lion) logo in the URL bar > Advanced controls > Disable "Forget me when I close this site"
Optional:
Disable the annoying new tab page: Brave > Settings > Get started > New Tab Page > Select "Blank page" from the dropdown
Disable toolbar items: Brave > Settings > Appearance > Toolbar > Disable all the toolbar buttons that you don't want (Brave Rewards, VPN, Wallet, Leo AI, etc)
Plugins warning: Every plugin you install makes your browser stand out from “the crowd” and makes you more identifiable, reducing the effectiveness of the privacy features built-in to Brave.
Bonus Brave configuration tips:
Install Privacy Badger for some added protection.
Other browser options:
Firefox can offer even more privacy if you take the time install the right plugins and configure it properly.
Use Tor Browser for highly sensitive browsing that is truly anonymous
Install the latest software updates for your laptop, phone, and apps
The latest updates for your computer, phone, and apps all contain security fixes that help keep your system safe from attackers.
All software contains bugs, which are errors or flaws that can lead to various issues.
Don't wait to update! We know it's tempting to press "I'll do this later" when prompted for an update. Here's why it's important to do right away: When a new update comes out, it's often because a vulnerability in the system/app is now public. That means attackers are now trying to use that method of attack on anyone who hasn't run the updates. The longer you wait, the more vulnerabilities can be used against you.
How to run updates
iPhone
Verify your device is still supported: Check for iPhone models. Make sure there is a "Yes" in the "Supported" column.
Operating System: Settings → General → Software Update
Apps should already be automatically updated unless you have disabled this option.
Mac
Verify your device is still supported: Make sure your Mac isn't on this "obsolete" list. You can check your Mac model by going to the Apple menu → About This Mac.
Operating System: Apple menu → System Preferences → Software Update
Apps installed via the Mac App Store: These apps should already be automatically updated unless you have disabled this option.
Other apps: Check for updates by going to the top menu bar → Click on the app name → Click either "Check for updates" or "About [APP NAME]" or look inside "Settings...". If you don't see an option to update, it may be set to automatically update in the background.
Android
Verify your device is still supported: Checking Samsung models or Google Pixel models depending on your manufacturer. Make sure there is a "Yes" in the "Security Updates" column.
Operating System: Settings → System → System Update (may vary by manufacturer)
Apps should already be automatically updated unless you have disabled this option.
Windows
Update your system: Start → Settings → Update & Security → Windows Update
Verify your device is still supported: After attempting an update, you should be able to see your current operating system version number. Check that version number against this list of Windows versions that are still receiving security updates.
Microsoft Store apps: Make sure you enable automatic updates (on by default).
Other apps: Look for updates in the menu bar under Help > Check for Updates, or search for "Updates" or "About" in the app's settings.
Ditch Google Search and use a search engine like Brave Search instead
Your search history tells a lot about your interests and political leanings.
Brave Search tends to have better results and we trust them, but some folks don't align with their business model
DuckDuckGo results aren't as reliable but it has a slightly stronger privacy record.
How to set up private search
Brave Search: If you're using Brave browser, it's the default. If you’re using another browser, you can follow these instructions.
DuckDuckGo: Follow these instructions to make DuckDuckGo your default search engine.
Use a privacy-focused map/navigation app (Apple Maps or Magic Earth)
While Google has recently started to make it harder for police to request location data, they have a terrible record on privacy and shouldn’t be trusted.
Apple Maps (iPhone only) goes to surprising lengths to protect your privacy. Apple has a much better privacy track record than Google, but they are a big tech company so we should think of Apple Maps as a “harm reduction” choice that is good for every day use but not for sensitive organizing. We include Apple Maps as a recommendation here because it offers feature that's are missing in other apps: live traffic and public transportation.
How to set up Apple Maps (iPhone only)
Apple Maps is installed by default (you can re-install it if you removed it).
Go to Settings > Privacy & Security > Location Services > System Services, then disable iPhone Analytics, Routing & Traffic, and Improve Maps.
Magic Earth (iPhone or Android; $1/year) is a paid app that offers strong privacy. It does cost $1/year, though. It is much easier to use than our other Android option (CoMaps) and has live traffic data and public transportation routs..
How to set up Organic Maps (iPhone or Android)
Install Magic Earth (Cost $1/year)
It functions mostly like Google Maps or Apple Maps!
CoMaps (iPhone or Android; free) is a less-user friendly than Magic Earth or Apple Maps, but has the strongest privacy promises. You can operate it entirely offline, which is especially helpful for activists. That said, it doesn't have live traffic data or public transit routes, which makes it hard to use as your main mapping solution.
How to set up CoMaps (iPhone or Android)
Install CoMaps
Open the app once in your area and it will automatically prompt you to download the data for offline navigation
Turn off location tracking for most apps
Apps with location access can create a detailed map of your movements, which can be accessed by law enforcement through legal demands or data brokers through purchase.
How to review location permissions on iPhone
Go to Settings > Privacy & Security > Location Services
Review each app and set to one of these options:
Never: Best choice for most apps
Ask Next Time Or When I Share: Good for apps you rarely need location for
While Using the App: Only for essential navigation apps
Always: Almost no app should have this permission
Make sure to set the Camera app to “Never” so you don’t risk revealing your location when you share or upload photos.
Go to the app labeled System Services > Disable Significant Locations
How to review location permissions on Android
Go to Settings > Privacy > Permission manager > Location
Review each app and set to one of these options:
Don't allow: Best choice for most apps
Ask every time: Good for apps you rarely need location for
Allow only while using the app: Only for essential navigation apps
Allow all the time: Almost no app should have this permission
It is especially important to disable location tracking for your camera/photos app
These apps might genuinely need location while in use:
Navigation (Apple Maps, Organic Maps)
Ride-sharing (but only while actively using)
Some apps might need temporary permission:
Food delivery apps only need location when you're actually ordering
Apps that definitely do NOT need location access:
Photo apps
Social media apps
Games
Most shopping apps
Banking apps
News apps
Most productivity apps
Remember: Every app with location access is a potential privacy leak. When in doubt, disable location and only re-enable if you find you actually need it.
Remove your private information from data broker websites
Protect yourself from doxxing and online harassment by removing your personal information
Data brokers collect and publish profiles on all of us including our name, addresses, phone numbers, profile photos, email addresses, and social media accounts.
Doxxing is an increasingly common tactic used against activists where an adversary posts your email/phone/address/etc with an intent to get others to harass you online and sometimes in real life.
There are many steps involved in scrubbing your personal information from the internet (we have a full guide coming soon). The easiest first step is to submit "opt out" requests to data broker websites.
How to opt out of data broker websites
This process can be very time consuming if you do it manually, so we recommend paying to have it automated.
Sign up for EasyOptOuts ($20/year)
Fill out their online form: current and past phone numbers, emails, addresses, housemates, etc.
After 1-2 weeks, you will receive an email with the details of the sites you were removed from
Do separate google searches for your name, email address, phone number, home address to see if there are any locations that still have this information attached to you. See if you can manually remove yourself.
If you want to do this process manually, read Yael's Big Ass Data Broker Opt Out List.
Use a password manager with strong passwords
When you use the same password on multiple sites and one site gets hacked, a hacker can gain access to many other accounts. If you use a weak password, the cops will have an easier time targeting you.
Our main recommendations are:
1Password: Very user friendly. Slightly more secure. Costs $3/month
Bitwarden: Free. Still quite secure.
How to set up 1Password
Download: Download and install 1Password ($3/month)
Master password: Create a strong, random "master password" using a passphrase generator. It should be memorable, but not a password you use anywhere else. Write your master password down on paper rather than storing it digitally. Set a reminder to destroy the paper in a few weeks once you have it memorized.
Import: Import your existing passwords from your computer or browser
Apps: Install the browser extension and mobile app (iPhone, Android) to help you save and auto-fill passwords
Change passwords: If you had been re-using similar passwords, update your most important ones using the random password generator built-in to 1Password.
See 1Password's getting started guide for a video of these steps.
Bonus: Here’s a good introduction on how to get the most out of 1Password.
Alternative options:
Proton Pass: has a free option
KeyPassXC: Open-source and allows you to store passwords only on your machine instead of the cloud, but the user interface is very clunky.
Enable two-factor authentication
If someone steals your password, two-factor authentication keeps them from being able to get in unless they have your phone too.
After entering your password, you'll need to enter a code from your phone to prove it's really you. Think of it like having both a key and an alarm code to get into your house—someone needs both to get in.
Your email is the most important account to have two-factor authentication. If an attacker gets access to your email, they can reset all your other passwords.
How to set up
Install an authenticator app:
Option 1: 1Password: If you're using 1Password, it has an "authenticator" feature built-in (details here).
Option 2: Ente Auth: Install Ente Auth (iPhone, Android)
Optional: You can create an account. Your data is end to end encrypted. Or you can not have an account, but you may lose your one time passwords if your phone is not backed up.
To set up two-factor authentication:
Go to Security/Privacy settings
Look for "2FA" or "two-factor authentication" or "multi-factor authentication"
If an “authenticator app” option is available, select that! (Remember to save the backup codes somewhere secure, like your password manager.)
If “text/SMS verification” is the only option, select that and follow the instructions.
Links to set up 2FA on common sites:
Or look up whether a website/service/app has 2FA on the 2FA Directory.
Note: When a service allows you to choose between an authenticator app and SMS text message verification codes, opting for the authenticator app is always best. It’s possible for an attacker to intercept your SMS texts.
Set your phone passcode to 8 to 10 random digits
It takes years for cops to crack a 8-digit random passcode. They can probably guess your current passcode in less than 5 minutes with automated tools.
How to change your passcode
Generate a random 8 to 10-digit passcode using this random passcode generator. (Don't make one up yourself—humans are bad at choosing randomly!)
Change your passcode:
On iPhone: Settings > Face ID & Passcode > Change Passcode > Passcode Options > Custom Numeric Code
On Android: Settings > Security > Screen Lock > Enter Current Lock > PIN/Password > Enter a Passcode
Practice the new passcode at least 10 times in a row right now so are more likely to remember it. (Disabling biometrics will force a passcode request every time you lock the phone.)
Write your new passcode on paper and keep it somewhere safe at home until you've memorized it. Then destroy it after 2-3 weeks. Setting a remind on your phone can help.
How long does it take to crack a passcode?
Type
| Time it takes to crack (average)
| Example
|
|---|---|---|
6-digit easy-to-guess pattern
| Less than 24 hours to crack
| 333666 (common pattern) 110585 (date pattern for Nov 5, 1982) |
6-digit random code
| 200 days to crack
| 238253
|
8-digit random code
| 40+ years to crack
| 34780026
|
Note: These times only apply to phones. Computers can be cracked much more quickly, and need much stronger passwords.
Sources: The estimates in the table above assume real-world observed attempts/second from police forensic hacking tools. If you need more security, use a 10-digit passcode, which will protect you even under the highest-possible cracking scenarios. See the sources linked in the passcode FAQ here.
Don't use email for secure communications
Email wasn't designed to be private or secure.
Email wasn't designed to be private or secure. For sensitive communications, use Signal instead.
Anonymity vs secure communications: It’s very hard to have truly secure email communication, but if you are looking to protect your message contents, then you can use a service like Proton Mail.
What to use Proton Mail for
Creating accounts on websites, signing up for newsletters
Public-facing communications that don't need to be secure, but do need to be anonymous
Organizing work that isn't sensitive
What NOT to use email for (even encrypted):
Truly sensitive or private communications (example: when planning a direct action)
Concerns about Proton's CEO
See our note about why we still recommend Proton's products even though they made a concerning move in early 2025.
Proton Mail is not end-to-end encrypted in most cases
Contrary to popular belief, Proton Mail does not end-to-end encrypt all of your emails. If you send email to someone using a regular email service, your messages will not be end-to-end encrypted. Only your emails to other Proton Mail users (or other people using an encrypted email service) are encrypted. That said, getting off Gmail still makes it harder for your emails to be accessed by the government through backdoors, etc.
How to use Proton Mail
Creating a Proton Mail account
Sign up for a free ProtonMail account
Choose a random username that isn't connected to your identity or preferences
When asked to verify if you are a human, choose the “CAPTCHA” option rather than the “email” option.
When asked to set your phone number / email as a recovery method, choose Maybe later. (Note: This means you must save your password somewhere secure like a password manager.)
Sending emails securely
Messages between Proton Mail users are automatically end-to-end encrypted.
Messages to people using a different email provider will not be encrypted, but you can send a password-protected email.
Bonus resources:
If you want to send end-to-end encrypted emails from Gmail, check out the FlowCrypt extension.
addy.io also offers simple email forwarding to your normal account. It doesn't offer your protection if your normal email account is seized as evidence. But it does prevent the service you signed up with from knowing your main identity.
Enhanced security
If you're taking higher risk actions or are more likely to be a target of government surveillance, follow these steps will help you add additional layers of protection
Remove smart home speakers from your home (Alexa, Google Home, etc)
If you're in a higher risk category, you should be conscious anytime you're talking about political activity around a microphone. This includes laptops, phones, smart watches, and smart speakers.
Risks: These devices have speakers that are always listening.
Protecting yourself: Removing smart speakers from your home is one easy step to take to reduce the likelihood of surveillance.
Most of us are not being actively surveilled most of the time, but it is safer to get into the habit of assuming you might be. Once you're used to it, it doesn't take much work.
How to remove smart speakers
Just get rid of the smart speakers and anything that has a microphone and is internet-connected. Look for phrases like "voice control," "works with Alexa/Google Assistant," or "built-in assistant". This includes:
Amazon Alexa (Echo, Dot, etc)
Google Nest Speaker, Google Home
Sonos and other home speakers
Smart thermostats (some newer models have microphones and voice assistants built-in)
Smart TVs or streaming devices (Look into whether yours has a microphone built-in or not. If so, try to replace it.)
If you need a speaker for music, search for something that doesn't include a microphone at all. Or a simple bluetooth portable speaker that might have a microphone, but isn't internet connected (and gets turned off when not in use).
If you're replacing a product, try to buy used to reduce e-waste and resource extraction.
Background:
In 2017 we learned of the CIA developing a hack for some smart TV to be always listening even when they appeared to be off.
Amazon also frequently receives legal requests for smart speaker recordings from law enforcement.
Install a trusted VPN (IVPN or Mullvad)
A VPN makes it harder for websites to track you and prevents your internet provider from logging your traffic.
A VPN (Virtual Private Network) encrypts your internet traffic and masks your location. This means your Internet Service Provider can't see what sites you visit - they only see you connecting to a VPN. Websites you visit will see the VPN's location and IP address instead of yours. This makes it harder for authorities to build a record of your political activities.
A VPN does NOT make you fully anonymous online. If you need higher anonymity for highly sensitive web browsing, you'll want to look into using Tor Browser. You can always use multiple browsers: one for everyday private browsing and one for tasks that require more anonymity.
Options: All of these are very trustworthy options.
IVPN (our top recommendation) is easier to use. Cheapest if you have 2 devices.
Mullvad VPN enhances privacy by not allowing recurring subscriptions, so they can't store payment info about you. However, you have to remember to pay each cycle. It's also cheaper for users with 3+ devices.
Proton VPN has a solid free plan, but it is only for 1 device. See our note regarding concerns about the Proton CEO and why we still offer Proton options.
How to set up IVPN
Go to IVPN and click Generate IVPN Account ($6/month or $60/year)
Under "Standard Plan" click Select. You can do the Pro Plan if you have more than 2 devices.
Write down your Account ID somewhere safe, like where you store passwords. You cannot recover it with "forgot password." If lost, no one can help you recover it. Keep it somewhere secure (ex: password manager).
Select monthly/yearly and enter your credit card or payment details.
Check the Automatic renewal box then click Make Payment.
Follow the instructions to install the app.
Find the app in your toolbar > Show IVPN > Click the gear icon to open settings > General. Enable the following: Launch at login, Autoconnect on launch, and Allow background daemon to manage autoconnect
Follow the same instructions to enter your Account ID and configure the same settings. (iPhones don't offer the "auto-connect" setting, but it does auto-connect by default).
We recommend keeping your VPN on at all times unless you're having trouble connecting to a site (see below).
Downsides to using a VPN
You will encounter more CAPTCHAs on websites
Some websites may block VPN access
Some streaming services might not work
If you experience odd behavior on websites, always try turning off the VPN temporarily to see if it will load. (IVPN offers a "pause for 5 minutes" option, which helps you not have to have to remember to turn it back on later.)
Note: You must use a trusted VPN that doesn't keep logs of your internet traffic and will push back on government requests. We've vetted our top recommendations
Enable Lockdown Mode (iPhone) or Advanced Protection (Google & Android)
Mercenary spyware is an extremely advanced attack, exploiting sophisticated vulnerabilities on our devices. In response, Apple and Google have introduced an advanced security mode that offers enhanced protection against spyware.
On iPhones, it's called Lockdown Mode and on Android, it's called Advanced Protection Program. (You can also enabled Advanced Protection Program on just your Google Account even if you don't have an Android phone.)
We have no reports of anyone getting infected with spyware who had Apple's Lockdown Mode enabled. Android's Advanced Protection is more recent and its effectiveness has yet to be tested.
Usability trade-offs: There are some usability sacrifices you make for this additional protection. See the lists below.
How to enable Lockdown Mode for iPhones
iPhone: Settings → Privacy & Security → Lockdown Mode → Enable
Enabling Lockdown Mode introduces some usability tradeoffs on your phone. See list below.
This feature is available for iOS version 16 and above.
How to enable Advanced Protection on Android
Android: Settings → Security & Privacy → under "Other Settings" tap Advanced Protection.
Note: The location of this setting may vary between Android devices, so we recommend searching for 'Advanced Protection' in the Settings search bar.
This feature is available for Android 16 and above.
Usability trade-offs
For anyone worried about targeted attacks, these usability trade-offs will likely be worth the big increase in security.
iPhone Lockdown Mode: Features that will be harder to use
No clickable links in messages (mainly within iMessage) - Links show as raw URLs and don't work (i.e. are not instantly clickable). You have to copy-paste them manually to a browser. This encourages you to make sure they are safe before doing so, since spyware often arrives through a text which includes a link custom-designed to be impossible-to-ignore for you in particular.
Most message attachments blocked (also mainly within iMessage) - When receiving PDFs, documents, Office files, contacts, location over iMessage, you might not be able to view them normally and iMessage will indicate "1 attachment." This is because some spyware can be delivered through malicious attachments.
FaceTime calls from unknown contacts blocked - Lockdown Mode will block call attempts from unknown contacts or people you have not been in touch with in the last 30 days. You will be notified if this user attempts to FaceTime you and you can decide to call back if the call attempt is genuine.
Web fonts don't load - Websites appear with system fonts only, often looks weird.
Images may not display - Some images show as missing image icons.
Interactive webpage elements fail - Complex web features, animations, dynamic content often broken.
iCloud Shared Albums don't work as expected - When you share photos in a shared album, location information is excluded. Shared Album invitations might be blocked too.
Device won't connect to any WiFi automatically - On Lockdown Mode your phone won't connect to insecure WiFi's automatically and you will need to manually connect to the chosen network and accept the security risk.
2G or 3G support is turned off - If you find yourself in a location with 2G or 3G cellular network with Lockdown Mode, your phone will simply not connect (as 2G / 3G is more insecure than 4G / 5G).
Learn more about Apple's Lockdown Mode.
Google/Android Advanced Protection Program:
Security key required - Must use security key/passkey for every new device sign-in to Google Account, which can take some getting used to
JavaScript optimizer disabled (Chrome) - Some complex websites may not work properly.
No sideloading - Can't install apps from outside Play Store or verified stores.
USB locked when device locked - Must unlock device before connecting USB accessories.
Insecure Wi-Fi blocked - Won't auto-connect to open/WEP Wi-Fi networks.
Enhanced Safe Browsing warnings - More download warnings and potential blocks.
Fast charging might not work as expected - You might need to unlock the phone in order to
Learn more about Android Advanced Protection Program.
Follow our phone security checklist
How to secure your phone
For added privacy and security on your phone, follow as many of the steps in our Prepare for a Protest guide as you are able to in your daily life, even if you’re not at a protest/action.
Don't click suspicious links
You can protect yourself against spyware by being cautious about what you click on
Spyware often arrives through a text or email with a link custom-designed to feel impossible-to-ignore specifically for you. These aren't random spam - they're personalized attacks that exploit what matters most to you.
How to catch and respond to suspicious links
When in doubt: Do not click the link!
Instead, Contact the sender (whether a business or a friend) through a different method (call them, use a different app) to verify they actually sent it. Taking 2 minutes to verify is always better than clicking and compromising your device.
If it is a shortened URL like bit.ly or tinyurl.com, you can use ExpandURL.net to view the destination page, but this provides no guarantee that the page isn't Spyware. It just helps you view the true URL so you can make a better assessment of whether you trust it.
Red flags to watch for:
Messages from numbers you don't recognize: We all get messages from services that aren't in our contact book often, so it can take work to discern whether this is a legitimate message or not. If it's someone not in your contact book, approach it with more caution.
Urgency or fear: "Your account will be locked," "Urgent security alert," "Family emergency"
Unfamiliar domain name: Spyware texts often come from weird domains like
adsmetrics[.]coorToo personal: References your activism, recent events you attended, or people you know - designed to bypass your critical thinking
Unexpected messages: A contact sends a link with no context, unusual phrasing, or at a strange time (their account may be compromised)
Shortened URLs:
bit.ly,tinyurl.com, or other link shorteners that hide the real destinationSlight misspellings in the URL:
goog1e.cominstead ofgoogle.com
Spyware messages can be highly targeted. Here are some real-world examples of how Pegasus Spyware has been deployed:
"Dear Carmen my brother died in an accident, I’m devastated, I send you the information about the funeral, I hope you can come: [spyware link]" (source)
USEMBASSY.GOV/ WE DETECTED A PROBLEM WITH YOUR VISA PLEASE GO PROMPTLY TO THE EMBASSY. SEE DETAILS [spyware link] (source)
LX 1955 BCN-ZRH 26Jun2020 - Click on the link to receive your mobile boarding pass [spyware link] (source)
Be aware: Some spyware is deployed using exploits that don't require you clicking a link at all ("zero click exploits"). These might show up as missed calls on WhatsApp, for example.
Avoid using “Sign in with [Google, Facebook, etc]”
Every time you use "Sign in with Google" (or similar options) you're letting Google track which services you use and connect them to your real identity. Creating separate accounts with unique passwords (using your password manager) makes it harder for corporations and authorities to build a complete picture of your online activities.
Have Questions?
We want to hear your questions/feedback so we can make these guides useful to folks working for change.