The myth of the anonymous Internet - and it has always been a myth - is slowly fading as the average Internet user watches their protections and rights to be ignored wholly forgotten in the mad rush for capital-building information. While forensics have been able to piece together identifying markers from online activity for decades, the cost of doing that work has gone down substantially in recent totalitarian regimes. In the United States, the fourth amendment has generally held that your privacy, digital or otherwise, cannot be invaded without judicial intervention. Just cause has turned into “just ’cause” overnight with the very public dismantling of checks and balances. Private tech companies no longer worry about rolling over for fascism causing their stock to drop. Humans are no longer their customers. Speculative bubbles are more profitable and if they never have to put the money back into the pot - rather, just hand it back and forth to one another and tip their hats like playground pantomime - they are all the more happy. So why bother saving face when you can get special treatment by playing ball with dictators? That hurdle has classically been the most difficult one to overcome when doing Internet sleuthing and it has eroded entirely.
Palantir and its precursors, along with government programs like PRISM, work their way into boards and halls of tech giants. They use kickbacks, permitting, and all sorts of bribery to make sure that the biggest-named players are all in on the grift of faux security in modern tech. But tech is less secure than it has ever been. It may prevent low-rent script kiddies from scamming your Roblox account, but everything you do on most of your devices can be laid bare in seconds if someone merely decides to look.
Again, this is not new. Logging has been fundamental to computer network interaction since its inception. Things needed for reliable communication over an infrastructure made to carry flustered Trans-Atlantic accents from Pennsylvania-65000 to Klondike-5555 were already being stored so these digital bridges could be created. Endpoints had to be known. Routes had to be known. Owing to this, there was little anonymity in computing from the start. Anonymity was added, intentionally and otherwise. Log files take up space, so anonymity is bolstered simply by not storing this information past the active session. But compression got extremely good, extremely fast. Especially for text. Logs became less and less a storage concern and more one of privacy well before AOL shipped its first disk. For a while, privacy was a top tier feature in online communication. At least, behind the scenes. People love to identify themselves. It’s almost like we are all apes made of existential dread and routine. Because we are. As the net became more ubiquitous, people started realizing the importance of privacy. Not for illicit acts, though certainly those were in the mix. But for every day activities that were becoming more common online. Communication with friends, family, doctors, colleagues. These all needed some protection from prying eyes. Encryption technologies became an arms race against bad actors trying to hijack communications to steal what information they could. At the same time, however, companies began realizing how much of the data flow they controlled and how much that data could be used to create targeting for themselves. Then, they realized people would still pay for services even if ads where part of that service. In some old newsroom storage closet, William Randolph Hearst’s portrait smiled. So began the two-faced deceit of IT security.
All of this is just a long-winded intro to say this: No corporate entity ever has your best interests in mind when making decisions. Only profit. Or reduction of loss. When paramilitary police forces decide to dox you, the ’safe, secure, encrypted’ services you use from publicly traded for-profits mean absolutely nothing. They have your data. They will give it over to the cops. It’s the most financially beneficial stance (on paper), and that’s the only stance they will ever take.
So what is there to do? Break out paper cups and semaphore flags? How can you go to a protest and keep your digital life from becoming Exhibits A-Q should a stormtrooper decide you look enough like his ex or his abusive dad or just that kid he beat up in high school so it’s your day to get zip-tied and paddy-waggoned? Not all is bleak, nor do you have to pull a Full Amish when you head down to the future kettle where the first amendment is “protected” until it’s not. You can do quite a bit to harden your personal security - which in turn makes those around you more secure. It’s work, but what isn’t these days? Work, I guess.
Leave your phone at home
This is one of those pieces of advice that often gets eye-rolled by activists and organizers. But before you dismiss it, hear me out. I’m not saying ‘don’t take a phone.’ I’m saying leave the phone you use as your primary device at home. It is very easy and very cheap to pick up a second phone for recording - one of the most important functions of a phone at any protest - and communication. You can use an anonymous pre-paid carrier phone for emergencies, an old phone you’ve wiped, or grab a cheap used unlocked phone off of any number of marketplaces. Considering the despicable desposability cycle of modern phones, you can probably find a few free ones with some calls to friends and family. A few things to keep in mind:
- Fully factory reset any phone you receive or purchase. If possible, do this offline using tools from the manufacturer.
- If an alternative, hardened OS such as GrapheneOS is available for your device, consider using that instead of stock Android or the manufacturer’s bloatware.
- Try to find a phone that uses a physical SIM card. eSIMs are convenient, but are tied to the device and usually tied to the sales records of the device. A physical SIM lets you swap to another carrier or a prepaid number with ease.
- Keep apps to the bare minimum. When possible, use app stores that do not tie to an account. F-Droid is a good option. Obtainium is very popular as well.
- DISABLE BIOMETRICS. Apart from being way less secure than they purport, biometrics can be used to illegally compel you to unlock your device. Face scans are NOT legally protected. Fingerprint scans can be obtained through force. Set up a complex PIN or password and don’t fall for the false security of biometric login.
- Don’t sync accounts, contact lists, texts, etc. Don’t use e-mail applications. Check e-mail through a private browser session. This is a pain because you have to manually enter security info every single time, but it means that there’s no forensic footprint left on your phone once the session is closed.
- If you need to stream or capture to a cloud service, add a second, anonymized account for doing so. You can always re-share from your primary account later, but there’s no reason to link your activities to verifiable identification.
- Remove data from your phone when you get home. Back it up on a secure drive and remove it from the device. Again, there’s no reason to provide a free map of your whereabouts for potential prosecutors.
- Use a VPN (with manual credentials, not apps). A VPN can help protect you from local scanners, a more and more popular tool for oppressors, as well as provide an extra layer of cover from your carrier snooping on their behalf. Generally, use a VPN from a country with sound data protection laws like the Netherlands if possible.
- Utilize wifi hotspots over cellular data when possible. Many areas have free wifi if you look for it. Combined with a VPN, getting your exact activity trail becomes much, much harder.
- Only give the phone number for the device (if applicable) to a few people you trust. An army willing to use a 5 year old to draw people out of a house will absolutely put pressure on people close to you. People can’t give up your info if they don’t know it, so keep the list as small as you can.
- Use your protest phone for protesting. Keep it on Airplane Mode or turned off. Take it off Airplane Mode AFTER arriving at the protest. Put it in Airplane Mode BEFORE you leave the protest. Cell tower pings can be used to create a very accurate map of your path to and from. Again, don’t give them anything for free.
- If you simply cannot use a dedicated phone and cannot leave your phone at home, consider paring down apps, creating a second profile with very little information and using that when you’re at gatherings, using a VPN, disabling ALL AI tools, turning off tracking metrics (such as “send us data to improve your experience while using the app!” settings), signing out of social media accounts, and following the biometric and VPN suggestions above.
Be comfortable being bored
Excepting a secured phone (if necessary), don’t bring any connected devices with you. No iPad. No Switch. No Steam Deck. No ROG Steam Deck But Worse. If you have one of those handheld retro devices from Anbernic or anything with bluetooth, wifi, or mobile data, just leave it at home. Tablets, smart watches, even many MP3 players - anything that can connect with a wireless service of some type can be scanned and identified and linked to you if found on your person after an arrest. If you’re going to a protest, you’re going to protest. Not to scroll feeds or find epic mounts. Being uncomfortable with being bored is no reason to tag yourself like a migratory whale pod.
Don’t give up your entire identity at home
In your day-to-day life, more and more of your online identity is being added to your digital fingerprint. Platforms can predict, with astounding accuracy, what your next website visit will be. They can pick you out of a haystack of haystacks of users in seconds. Every cookie you accept, every permission you grant…they’ll be watching you.
Use a VPN on your home network. You don’t need to go so far as to tunnel to another country for your day to day use, but just adding one more layer of obfuscation helps. Obscurity is not security, but it’s better than nothing. Use secure communication when available. Set your browser to always use https, in example. Switch off of known problematic messaging apps like Discord to more secure options like Signal. Don’t use AI processing on anything. In fact, turn off AI everywhere you can. If you’re using Windows, [url-”https://www.howtogeek.com/how-to-rip-out-copilot-from-windows-11/” target=”new”]uninstall and prevent CoPilot from reinstalling [/url](note - this can change on a whim and they are pushing CoPilot hard, so your best bet is to leave Windows or go back to Windows 10 and use a debloating tool). Switch your search engine to a non-AI backed search such as DuckDuck Go’s No AI service. Remove AI tools from your browser if you use Chrome or Chromium based browsers or Firefox. (Note, beginning with Firefox 148, a single kill switch will be introduced under Settings -> AI Controls -> Block AI Enhancements, but it has not rolled out globally at the time of this writing).
Don’t use social media to discuss your activities at protests. You can obviously be loud and proud about your views, but any insight into the inner workings of direct action will be use to subvert it. There is no virtue signalling in protest. There’s no reason to share intel with the enemy during an active war. Save your mementos in a safe, encrypted location. Once everyone swears they were always against all of this, which they will, feel free to make a wall of dissent. But during active operations, no need to identify locations, organization, or the faces of others for internet points.
Keep your systems secure. Self-hosting can be a great way to withdraw from the onslaught of platform rot, but it can also open you up to attacks. Automated attacks are becoming more sophisticated, or in the case of AI based attacks, more frequent to the point of overwhelming systems. Not smarter, just more waves crashing against the beach. Protect yourself by understanding edge security. Make sure your router is not compromised and is up to date on its firmware. Make sure to keep an eye on security bulletins for software you host and quickly update it if a confirmed security hole is disclosed. This is obviously for more technical folks, but anyone can learn how to lock down their home network in a couple of days worth of YouTube videos and old forum posts.
Stop using Spyware as a Service
The Superbowl ad for Ring really shook the tree in terms of the general public’s understanding of just how perverse and pervasive private spying has become. Convenience has, for at least the last two decades, come at the cost of security. We hand over our details willingly to save a few steps while logging in or to scream into our personal void and have it play back our favorite comfort songs. Ditching digital servants is a minor inconvenience that feels like oppression to so many who are now used to the ease of it all. I promise, it’s really not that hard to pick a playlist by hand. Drop digital assistants from your phone. Doubly so if they’re AI-backed. Get rid of Echos and Smart Speakers and cloud-connected doorbell cameras and app-based light managers and all that BS. You can find replacements that leave all of your data in your personal network for nearly everything. So if you really need the convenience or are in a position where you need these things for accessibility, there are options. Home Assistant is a robust, multi-protocol service which can be locked down, but still control your existing closed-source hardware, in example.
Don’t use sign-in aggregators when you can avoid it. “Sign in with Google” sure feels like a convenient wonder. But what it really is is a single point of access for anyone who is able to get your Google device from you. Like the cops or TSA (cops) or ICE (somehow even more cop cops). Instead, consider an encrypted password manager with a strong master password (not biometric!) and individual site password. Avoid saving the password manager backups on cloud storage and instead, sync them to a folder on your network or an external endpoint you control. Again, passwords are protected by the 4th amendment. Your fingerprint is not.
Stop sharing videos with tracking data. YouTube, TikTok (dear god, stop using this garbage), and many other video hosting sites have a share button that tracks you and then tracks further shares by others who are NOT you. Strip your URLs before sharing them. Use only the required query string data (example - on YouTube, shares usually include an si=(code) element. When you share, remove everything except for the required video ID. When using the fully qualified www.youtube.com, this usually means deleting everything after and including the first ampersand. When using a shortened youtu.be link, this usually means deleting everything after and including the first question mark.
Example:
https://www.youtube.com/watch?v=EOxERcvYE9g&si=XXXXXXXXXXXXXX or https://youtu.be/EOxERcvYE9g?si=XXXXXXXXXXXXXX Become https://www.youtube.com/watch?v=EOxERcvYE9g or https://youtu.be/EOxERcvYE9g respectively.
Don’t use photo filter apps, AI enhancement apps, or anything that requires personal data to produce some social token. “It’s fun, everyone’s doing it and I want to see mine!” Nobody is going to care about this shit in a week. Remember BitStrip avatars? Garbage, prepackaged flash art that was reassembled after you handed over the keys to your personal profile? Nobody actually liked anyone else’s but their own. Which means nobody actually liked them. You’d give them enough info to fake a MasterCard support call and get the most dated, ugly garbage to hang on your digital sash. Stop.
The future of capitalism and the future of humanity cannot coexist. We’re living in that tumultuous between-time, when neither side has laid full claim to the next stage of development and both sides are still under the illusion of a false pact. The average person still thinks technology is a service, not a siphon. The average CEO still thinks that there is more wealth to be pumped from a dry populace. One side will crack and separating your affairs now will do nothing but benefit you, regardless of how the whole thing shakes out. Services are built to incubate product. YOU are the product. Your data. Your eyes. Your time. They sell your own atrophied ability back to you in a neatly packaged, completely standardized, wholly unowned-by-you way. Put up as many roadblocks to them getting all of you for nothing as you can.
Some other videos and resources I’ve enjoyed (GDPR protected. Click Play Video to view):

















