OpSec for Personal Safety

A Working Checklist

How to use this: This isn't something to complete top to bottom in one sitting. It's a reference to come back to. Items marked 🔧 ADVANCED need more technical comfort - skip them for now if they don't make sense, and ask someone who you think might be able to help. Items marked ⭐ are the highest-impact, lowest-effort changes - start there.

This is general education, not legal advice. Laws on searches, recording, protest, and privacy vary a lot by location - if you have specific legal exposure, talk to a lawyer who knows your situation.

Part 1 - The Mindset (Read This First)

OpSec is a process, not a product. No app or setting makes you "secure" - it's about consistently asking a few questions and adjusting your behavior.

The core questions, in order:

1. What am I actually trying to protect? (Your location, your identity, your associations, specific plans, communications content...)
2. Who am I protecting it from? Be specific - a nosy family member, an employer, a stalker or abuser, local police, a more organized/resourced group, or a state actor are all very different threats requiring different responses.
3. What do they actually want, and what can they actually do? Match your effort to real capability, not worst-case imagination.
4. What happens if it fails? How bad, realistically?
5. What's it going to cost me to protect it? Time, convenience, money, relationships. Perfect security that you abandon after a week protects no one.

• ⭐ Write down, just for yourself, who your realistic "adversary" is and what they want - this shapes everything else on this list
• Accept that perfect OpSec doesn't exist - the goal is raising cost and reducing the avoidable risk, not becoming invisible
• Build small, sustainable habits rather than a huge one-time lockdown you won't maintain
• Review your threat model periodically - it changes as your situation and activities change

Part 2 - Know What's Already Out There (Digital Footprint)

Before locking things down, find out what's already visible. You can't protect what you don't know is exposed.

• ⭐ Search your own name (plus city, employer, known usernames), logged out and in a private/incognito window, to see something closer to a stranger's view
  
  Note: a private window mainly stops the search from being saved to your local browsing history and keeps you logged out so results aren't personalized to you - it does not hide the search from the search engine or your network. It makes the results more representative, not the search invisible.
• Check what old accounts, forum posts, or usernames tie back to your identity
• Look at your social media from a stranger's view (some platforms have a "view as public" option) - what does it reveal about routine, location, relationships?
• Check photo metadata (EXIF data) on images you've posted - many photos embed GPS coordinates automatically
• Notice patterns: do you reuse the same username or profile photo across platforms? That's often how accounts get linked together
• 🔧 ADVANCED: Use a reverse image search on your own profile photos to see where else they appear online

• Reusing a distinctive username across platforms
• Writing style / vocabulary that's identifiable
• Posting at consistent, predictable times
• Photo backgrounds (street signs, license plates, reflections, landmarks)
• Friends and connections who tag or mention them

Part 3 - Communications

• ⭐ Move sensitive conversations to Signal instead of SMS or unencrypted chat apps
• Enable disappearing messages for anything time-sensitive or planning-related
• Think before you write: assume anything in text could eventually be read by someone other than the intended recipient
• Vary communication timing where it matters - perfectly consistent patterns (same time, every day) are themselves a signal
• Use different channels for different purposes - don't mix casual chat, work, and sensitive planning in the same thread
• 🔧 ADVANCED: Set up a separate email address (and consider a separate phone number via a privacy-respecting service) for sensitive organizing, kept apart from your everyday identity
• 🔧 ADVANCED: Use PGP or similar for sensitive email when the recipient supports it

Part 4 - Accounts & Passwords

• ⭐ Use unique passwords per account via a password manager (e.g., Bitwarden)
• ⭐ Turn on two-factor authentication - prefer an authenticator app (e.g., Aegis, Authy) over SMS, since SMS can be intercepted or SIM-swapped
• Separate your identities: a "legal/official" identity (banking, work), a "social" identity (friends, casual), and a "sensitive/organizing" identity, each with their own email and never cross-linked
• Review privacy settings on each platform you use, at least once - defaults are rarely the most private option
• Periodically check for account breaches (haveibeenpwned.com is a common tool for this) and rotate any exposed passwords

Part 5 - Devices

• ⭐ Strong alphanumeric passcode, not just a 4-digit PIN or biometrics alone (biometrics can sometimes be legally compelled where a passcode can't)
• Turn off lock-screen notification previews for messaging apps
• Set a short auto-lock timer (30 sec – 2 min)
• Enable full-device encryption (on by default on most modern phones, but check)
• Review app permissions regularly - location, mic, camera, contacts - and revoke what isn't needed
• Turn off automatic cloud backup for anything sensitive
• Keep your OS and apps updated
• 🔧 ADVANCED: Consider device separation - a dedicated device or profile for sensitive activity, kept apart from your daily-use phone
• 🔧 ADVANCED: For serious risk levels, Tails OS (a live, amnesic operating system that leaves no trace on the host machine) is worth learning

Myth check: isn't a pattern more secure than a PIN? It feels that way, but research says the opposite. Drawing a pattern leaves a visible fingertip smudge trail on the screen - studies have reconstructed patterns from smudges alone up to 68% of the time. Patterns are also easier to memorize at a glance, so shoulder-surfing works better against them: one study found onlookers could reproduce a pattern 64% of the time after watching it entered just once, rising to 80% after two views. And most people pick patterns from a small, predictable set of shapes (letters, simple geometric paths), shrinking the real security margin further. A 6-digit-or-longer PIN, or better, an alphanumeric passcode, beats a pattern. If you're currently using a pattern lock, this is a good moment to switch.

Part 6 - Browsing & Network

• ⭐ Switch default search engine to something that doesn't build a profile of you (DuckDuckGo, Startpage)
• Use a hardened Firefox (tracking protection on, telemetry off) - genuinely non-Chromium, open-source, non-profit-backed
• Install uBlock Origin - verify the publisher is Raymond Hill, install only from addons.mozilla.org; impostor versions using similar names exist elsewhere
• Add Decentraleyes to stop sites quietly leaking your IP to Google/Cloudflare CDNs for common web libraries
• Avoid logging into personal accounts while using Tor or a VPN for something sensitive - mixing identities defeats the point
• Be cautious on public/open Wi-Fi for anything sensitive; use your own mobile data instead when possible
• 🔧 ADVANCED: NoScript for granular script blocking - powerful, but blocks JS by default and will break sites until you whitelist what you trust; not for casual daily browsing
• 🔧 ADVANCED: Learn Tor Browser for genuinely sensitive research - it's Firefox-based, understand it's slower and some sites block it, but it provides real anonymity properties a VPN doesn't
• 🔧 ADVANCED: If you use a VPN, understand it shifts trust from your ISP to the VPN provider - it is not a magic anonymity switch, and provider choice/jurisdiction matters

Part 7 - In Public, at Events & Protests

Higher-risk situations call for extra care. Surveillance tools like facial recognition, license plate readers, and cell-site simulators exist and are in real use in many places - plan with that in mind rather than being caught off guard.

• ⭐ Don't post real-time location or "I'm here now" - post after the fact, if at all
• Decide in advance, individually, your comfort level with having your phone present: bring it as normal, use airplane mode, use a Faraday bag, or leave it at home entirely - these offer increasing levels of protection in that order
• If photographing others, get consent before naming or tagging them
• Be mindful of backgrounds in photos - faces, plates, signage that could place someone somewhere they didn't want documented
• Agree with people you're with on what's okay to discuss in a group chat vs. only in person
• 🔧 ADVANCED: Know your local rules around ID requirements, recording, and device searches before you're in a stressful moment trying to remember them

Part 8 - Group & Social OpSec

This is the part most guides skip - and usually the actual point of failure. Most real-world OpSec breakdowns aren't a hacked phone; they're a person sharing something with someone who didn't need to know it.

• Practice need-to-know: not everyone requires every detail, especially names, addresses, and specific plans
• If something's said in confidence, keep it there - don't relay it "just to one more person"
• Don't assume default trust with new or unfamiliar people; a low-pressure way of getting to know someone beats an awkward assumption later
• Agree as a group, in advance, what (if anything) gets shared publicly afterward, including photos - and get consent from anyone who'd be identifiable
• Normalize asking "should this go in writing?" before sensitive topics come up - it's not paranoia, it's just a habit worth having

Part 9 - When Things Go Wrong

• Know who your point of contact is for security concerns in your group/organization
• If you notice something that feels like surveillance or a compromised device, say something rather than sitting on it alone
• Keep a few key phone numbers memorized or written down (not just stored digitally) - a lawyer, a trusted contact - in case your device isn't available
• Learn from mistakes without spiraling on them - OpSec is iterative, and adjusting after a slip-up is the actual practice, not a failure of it

Quick Reference

Further Learning

• EFF Surveillance Self-Defense - comprehensive, regularly updated guide
• Access Now Digital Security Helpline - free support for activists and journalists facing digital threats
• Local digital rights organizations in your area, if any exist

No tool provides perfect protection on its own. The goal is raising the cost and reducing avoidable risk - not achieving invisibility.

OpSec For Personal Signal Security:

For a Full Comprehensive Activist Checklist and Guide on Proper Signal Security: Click Here or type in this link https://activistchecklist.org/signal/#identity

Hiding Your Identity On Signal:

• Don't use your real name or photo on your Signal profile
• Helps protect you from cops or attackers who want to de-anonymize you. Especially useful if you are in unvetted Signal groups.
• Enable username and hide phone number
• If you want to have the option to be anonymous on Signal, protecting your phone number helps protect your identity.
• Disable link previews
• Can protect you against your approximate location being revealed
• Enable "Always Relay Calls"

Protecting Your Messages and Calls:

• **Important** Change your default settings so all new Signal threads have disappearing messages enabled
• This keeps everyone safer if someone's phone is ever confiscated or breached.
• **Important** Disable face/fingerprint unlock (biometric)!
• You have stronger legal standing with a passcode than with biometric unlock. Cops can try to force you to unlock with biometrics.
• **Important** Enable Lockdown Mode (iPhone) or Advanced Protection (Google & Android)
• Hide message preview and sender name for Signal notifications
• If your phone is confiscated, the cops can no longer get access to your notification history.
• Enable "Screen Lock" and "Hide in App Switcher"
• If you hand your phone to someone, Screen Lock is an extra layer of security.
• Disable "Show Calls in Recents" (iPhone-only)
• Leave Signal groups that might put others at risk
• This helps protect your network if your phone is confiscated.
• Enable Signal PIN and Registration lock
• Protects you from advanced attacks where someone "steals" your phone number and registers it on Signal
• Enable a private keyboard for Signal (Android-only)
• Disable AI notification summaries!
• Be alert for fake messages from "Signal Support" trying to get your Signal PIN or verification code
• Protect your account by being attentive not to turn over your verification code or PIN