OPSEC for Activists and Journalists
OPSEC for Activists and Journalists
Section titled “OPSEC for Activists and Journalists”Journalists, activists, and dissidents face adversaries far more capable than the commercial data brokers most privacy advice targets — police with subpoenas, corporations with lawyers, and sometimes nation-states with interception capability. Good operational security here is not about theoretical perfection; it’s about calibrating defenses to a realistic adversary and being disciplined about the few things that matter.
Model your adversary first
Section titled “Model your adversary first”You can’t defend against everyone equally — decide who you’re actually up against:
| Adversary | Can typically see | Will typically do |
|---|---|---|
| Corporations / data brokers | Tracking, purchased data, public records | Profile, sell, deplatform |
| Local law enforcement | Subpoenas to providers, device seizure, location data | Compel records, search devices |
| Nation-state | Network interception, malware, border control | Targeted compromise, coercion |
Your defenses should match the top adversary you realistically face — overbuilding for a nation-state when your risk is a data broker wastes effort and usability; underbuilding the reverse can be dangerous.
Compartmentalization
Section titled “Compartmentalization”The core discipline: keep identities, devices, accounts, networks, and social graphs separated so a breach of one doesn’t unravel the rest.
- Distinct accounts per role, never sharing recovery addresses or phone numbers.
- A dedicated device or profile for sensitive work — see Burner Devices Guide and Sock Puppet Accounts.
- Reach sensitive accounts only over an anonymized path (Tor/VPN), consistently — see Tor Network Guide.
Device security and seizure resistance
Section titled “Device security and seizure resistance”- Full-disk encryption everywhere (LUKS, FileVault, Android/iOS default) — useless if the device is unlocked when seized, so power down at checkpoints (encryption keys leave RAM when off).
- Strong passphrases over biometrics in high-risk moments — in many jurisdictions a fingerprint/face can be compelled more easily than a memorized passphrase.
- Amnesic systems — Tails boots from USB, routes everything through Tor, and leaves no trace on the host.
- Border crossings — assume devices may be searched or copied; travel with minimal data, or clean devices, and restore afterward.
Minimize your digital footprint
Section titled “Minimize your digital footprint”- Scrub file/photo metadata before publishing — see Metadata Hygiene.
- Reduce location history, ad IDs, and account exposure; audit what’s public about you.
- Resist browser fingerprinting for research personas.
Safe meetings and surveillance awareness
Section titled “Safe meetings and surveillance awareness”For in-person sensitive work: leave phones behind or use a Faraday pouch (a powered phone is a tracker and a microphone), agree on meeting protocols in advance over a secure channel, and learn basic surveillance-awareness. The most secure conversation is one with no electronics in the room.
Source protection for journalists
Section titled “Source protection for journalists”- Use Signal (disappearing messages) or a SecureDrop instance for source intake — purpose-built to protect source anonymity even from the news organization’s own infrastructure.
- Protect source identity in published work too: strip document metadata, paraphrase identifying details, and avoid publishing originals that carry hidden tracking.
- Treat your notes and contacts as seizable; encrypt and compartmentalize them.
Related
Section titled “Related”- Burner Devices Guide — device-level identity separation
- Secure Messaging Comparison — choosing the right channel
- Tor Network Guide — anonymizing the network path
- Metadata Hygiene — not leaking yourself or a source through files