Slide Deck QR Code

Setting expectations

Things are bleak
I will do my best to be entertaining

My understanding of the problem

• We are living in an occupied country where:
• The occupying force is hostile towards us
• The occupying force has access to the best intelligence gathering aparatus in the world
• This includes previously unavailable sources of information
• The occupying force is re-defining the rules

Reasons for hope

• An absurd amount of prior art for resistance
• We have a strong history of civil disobedience
• The history of folly within the intelligence community is long and hilarious
• They are reliant on us in ways they don't understand
• The maker's movement

Who the hell is this guy?

Alex McGeorge

• Charming, handsome
• Previously worked at Immunity Inc as a Senior Security Researcher
• Exclusively did offense oriented work
• Occasionally a talking head for TV
• Currently a Senior Security Engineer for a cloud computing provider

Who is this class for?

Non-IT professionals
Though they may get something out of it

How will we proceed

We have an enormous amount of content to cover I would prefer not to get into a technical dick measuring competition

What problems will we be tackling?

• Enough technology background to understand the advice
• Attending political actions
• Attending medical appointments
• Abortions
• Gender affirming healthcare
• Crossing borders
• Using your computer in 2025

What I cannot teach you in 90m (or at all)

• Enough cyber opsec to be completely safe
• Counter-intel or Counter-Surveillance
• Clowning on law enforcement

A brief introduction to threat modeling

Click here to use the graph

Introduction to Relevant Technology

Multi Factor Authentication

• Combines something you have
• With something you know
• Simply knowing your password is no longer enough to sink you
• Enable it on: your email, your financial institutions, health care
• Boot keys for your laptop / desktop

Password Managers

• No specific product recommendations
• Different password for each site you use (no derivatives)

Anti-virus

• A mixed bag, choose one that annoys you the least and is within your budget

Virtual Private Networks

• A technology that establishes an encrypted connection between your computer and another
• Traffic that would normally go out to the internet will now go through this connection or 'tunnel' BEFORE going to its final destination
• Additional reading

A simplistic overview of how the internet works

Now with a VPN

How does law enforcement see this problem?

Thoughts on VPNs

• Can be very useful for local threats
• Understand that VPN providers may or may not keep logs (assume they do)
• Understand that "offshore VPNs" may not be out of reach by the US or allied legal systems
• I like CryptoStorm

TOR

• What is Tor and why you should use it
• Should I use the Tor browser bundle?
• That's complicated
• You still need to be cautious about how you use it

A combination that works

Use Tor (anonymity) to connect to your anonymous VPN (privacy)

It will be extremely slow though

Encryption for data at rest

• Full Disk Encryption for Windows
• FDE for MacOS
• Encrypting external drives

Cellphones and messaging apps

Understanding the environment

• Turn off your phone's backups
• Set a task to reboot your phone every day
• If your friend's phone is snatched assume all conversations it saw are now compromised

Are Twitter DMs safe?

No, read the Twitter Legal FAQ

Is Facebook Messenger Safe?

Lol No

• Facebook adds end-to-end encryption for messages
• Facebook hires a bunch of people good at extracting data from encrypted messages

Is Telegram Safe?

Nope, read some of the privacy concerns here

Is WhatsApp Safe?

Also no, they have moderators to look through messages

What about Signal?

This is the only and best answer to secure messaging and calling on mobile devices

But WHY signal?

• List of third party audits of Signal
• Active measures against tools like Cellebrite

Ok how do I use Signal the right way?

• Configure disappearing messages
• Set up sensitive notification options
• Require a PIN to use the app

But Alex my friend told me about this new messaging app...

USE SIGNAL

Alex how do Cops get on my phone?

• What's a vulnerability? What's an exploit?
• Physical access vs Over the Air
• Commercial products/companies like
• https://www.grayshift.com/
• https://cellebrite.com/en/home/
• https://en.wikipedia.org/wiki/NSO_Group
• https://en.wikipedia.org/wiki/Stingray_phone_tracker

What is the zero day market and what does it look like?

Non-mobile price list from 2017

Metadata

• Data about your data which when used or correlated allows us to deduce other things
• Types of files
• Pictures: EXIFtool
• Video: MediaInfo
• Remember: if you upload something to a site which will 'clean your metadata' now the site has a copy of the original version of the thing you uploaded

A brief note on pictures

• Unblurring is very effective: paper
• Some image formats have layers
• Searching for similar images can link images based on background

Introduction to Good Privacy Habits

You are the weakest link

This doesn't work retroactively

No one will go to jail for you

...

The best thing you can do

Compartmentalization

• Where possible separate devices for compartments
• Always separate accounts for different compartments

Common Scenarios

Don't talk to the fucking cops

Helpful videos on why not to talk to the cops

• Why you shouldn't talk to the police
• Why you STILL shouldn't talk to the police
• It's shut the fuck up Friday friends

But what if I have to?

• Look for ACLU chapters in your state, see what advice they have
• ACLU of Washington DC
• ACLU of Maryland
• ACLU of Virginia
• ACLU of New Jersey
• ACLU of New York

Attending a Political Action

Organizing a Political Action

Too complicated for this talk but start here (audio)

This talk is also good and relevant

Obtaining medical care

As of writing it is unclear how individual jurisdictions will enforce healthcare restrictions

Obtaining medical care (Plan Ahead)

Obtaining medical care (Day Of)

Crossing a Border in 2025

I dont want to be associated with a place I go

• Leave your phone at home
• Take public transit
• Have a dedicated transit pass
• Pay for it with cash
• Get a new one when it runs out of money
• Only pay with cash for anything at the location

Things you can do

Become a student of the game

• Read relevant indictments
• example (context)
• Learn how to locate and request access to court documents
• What can your local library do for you?
• What technology companies supply local, state and federal law enforcement
• Interesting exercise: what is the corpus of all LEO specific software used by a given jurisdiction?

Become well read on various topics

• Intelligence gathering (especially while under occupation)
• How do intelligence operations work in other countries?
• Ex: Germany, Israel, UK, Russia, etc
• Counter-Intel
• Surveillance
• The prepper community
• The grugq's list is a good starting point

Shopping Lists

• Faraday bags (acquire or learn to make)
• Cheap and disposable computing
• Think Craiglist or other local marketplaces
• Pay cash, completely wipe all drives or replace them entirely
• What's in your go bag?

Computery skills to acquire

• Learn how to wipe a computer: DBAN is great
• Learn how identify the internal components of a computer and how to physically destroy them
• Get comfortable with Linux and virtualization:
• Qubes OS
• Whonix
• Tails
• OSINT
• Customizing and compiling software