Full Report
Law enforcement has more tools than ever to track your movements and access your communications. Here’s how to protect your privacy if you plan to protest.
Analysis Summary
# Best Practices: Digital Security for Protesters and Activists
## Overview
These practices focus on minimizing digital surveillance risks for individuals attending protests, covering device security, communication interception, location tracking, and data exposure that authorities might leverage against attendees.
## Key Recommendations
### Immediate Actions (Preparation Before Attending)
1. **Assess Device Necessity:** Determine if bringing a smartphone is necessary. If maximum anonymity is the goal, leave the primary smartphone at home.
2. **Prepare a Secondary Device:** If a mobile device is required, use a secondary phone or a dedicated "burner" device that contains minimal private information (no social media, email, or sensitive messaging apps).
3. **Isolate Primary Device:** If bringing a primary smartphone, proactively remove or disable accounts and apps that hold the majority of private data (social media, email, sensitive messaging) to minimize risk upon confiscation.
4. **Use Faraday Protection:** Store necessary mobile devices in a Faraday bag (e.g., Mission Darkness) when not in use to block all radio communications (cellular, Wi-Fi, GPS) and prevent connection to rogue cell towers (IMSI catchers/stingrays).
5. **Pre-arrange Logistics:** Sort out meeting points, contact plans, and emergency procedures with allies beforehand to minimize the need to turn on devices during the event.
### Short-term Improvements (During and Immediately After)
1. **Minimize Device Power-On Time:** Keep necessary phones turned off as much as possible during attendance to reduce tracking via cell tower connections or connection attempts to unauthorized Wi-Fi hotspots.
2. **Control Communications:** Use end-to-end encrypted and ephemeral messaging applications for coordination. Assume standard SMS and non-encrypted communications are monitored.
3. **Be Mindful of Imagery Metadata:** When taking photos or videos, be aware that uploaded files often contain exploitable metadata (timestamps, location data). Before posting, strip this metadata.
4. **Seek Consent for Imagery:** Obtain explicit permission from fellow protesters before photographing or videotaping them, especially if the content might be shared publicly.
5. **Exercise Caution with Livestreaming:** Carefully weigh the necessity of documenting an event via livestream against the risk of inadvertently exposing identifiable faces of other participants who may not consent to being broadcast.
### Long-term Strategy (Ongoing Security Posture)
1. **Review Document Sharing Practices:** Assume that any media (photos/videos) created, even if not posted immediately, could be compelled or seized by law enforcement, impacting future organizing or legal defense.
2. **Develop a Risk Tolerance Profile:** Recognize that personal vulnerabilities and risk tolerances differ; tailor your digital security measures (e.g., device choices) based on your personal risk assessment.
3. **Resist Chilling Effects:** Actively maintain secure digital practices to counter the intended goal of mass surveillance programs, which is often to intimidate dissent.
## Implementation Guidance
### For Small Organizations (e.g., Local activist groups)
- Focus on group consensus regarding secure communication protocols (e.g., agreeing on one specific encrypted chat application).
- Pool resources to acquire a few shared, high-quality Faraday bags or utilize simple, proven hardening steps for personal devices.
### For Medium Organizations (e.g., Mid-sized non-profits)
- Implement mandatory training sessions covering device hygiene (metadata stripping, app permissions) before high-profile events.
- Develop a standardized plan for device handling (which devices to bring, when to turn them on) to ensure consistency across participants.
### For Large Enterprises (Not directly applicable, but relevant for advocacy groups within them)
- Consult with digital security experts to create tailored threat models based on specific jurisdictions and potential responses.
- Establish secure, air-gapped systems for storing sensitive documentation and evidence gathered during protests to protect legal defense materials.
## Configuration Examples
* **Device Hardening:** Minimize the number of accounts (especially high-value ones like primary email or banking) logged into the device taken to a protest.
* **Faraday Bag Usage:** Keep necessary devices completely sealed in the Faraday bag until the exact moment communication is required, and reseal immediately afterward.
## Compliance Alignment
This guidance is largely aligned with proactive security principles found in:
- **NIST SP 800-53 (PR and SC families):** Focusing on protection (PR) and system and communications protection (SC), particularly regarding data segregation and transmission integrity.
- **CIS Critical Security Controls:** Especially controls related to data protection and continuous monitoring, applied here proactively to personal devices used in high-risk scenarios.
## Common Pitfalls to Avoid
- **Assuming "Burner" Anonymity:** Believing a prepaid phone purchased without ID automatically grants anonymity; carriers may still track registration or activation data.
- **Over-reliance on Physical Security:** Believing that physical separation from others negates digital tracking (e.g., relying only on location obfuscation without considering device signals).
- **Ignoring Metadata:** Only focusing on content while uploading images/video that inadvertently reveal precise locations or identities through embedded file data.
- **Constant Device On-Time:** Leaving a smartphone powered on and connected throughout an event ensures maximum data telemetry exposure to local surveillance tools.
## Resources
- Check local organizations for specific, vetted guidance regarding local surveillance tactics.
- Review documentation on privacy settings for common messaging applications to ensure end-to-end encryption is correctly enabled.