OPSEC Fundamentals: Protecting Yourself in a Digital Surveillance State
Last Updated: March 26, 2026 Category: Digital Protection / Operational Security Difficulty: Beginner to Intermediate Time to Implement: 2-4 hours for basics, ongoing practice
When This Matters
OPSEC (Operational Security) is not just for spies and soldiers. In an era of mass data collection, facial recognition, license plate readers, social media doxxing, and employment consequences for lawful political activity—operational security becomes a life skill for anyone who values privacy, safety, or the ability to organize without interference.
This guide helps you build a defensive privacy posture—not to hide wrongdoing, but to protect your right to live freely.
What is OPSEC?
OPSEC is a systematic process for protecting sensitive information from adversaries. Originally developed by the U.S. military during the Vietnam War, it is now used by journalists, activists, security professionals, and privacy-conscious citizens.
The Five-Step OPSEC Process
Identify Critical Information — What do you need to protect?
Analyze Threats — Who wants this information?
Analyze Vulnerabilities — How could they get it?
Assess Risk — What is the likelihood and impact?
Apply Countermeasures — What will you do about it?
Step 1: Identify Your Critical Information
Personal Information Worth Protecting
Information Type
Why It Matters
Risk Level
Home address
Physical safety, doxxing prevention
HIGH
Phone number
SIM swapping, harassment
HIGH
Real name (if organizing)
Linking online/offline identity
HIGH
Workplace
Employment consequences
MEDIUM
Family members identities
Collateral exposure
HIGH
Financial accounts
Fraud, freezing assets
HIGH
Political/activist affiliations
Targeting, blacklisting
MEDIUM
Daily routines
Predictability, stalking
MEDIUM
Step 2: Understand Your Threats
Common Threat Actors
Actor
Capabilities
Motivation
Data brokers
Aggregate public records, sell to anyone
Profit
Corporations
Track browsing, purchases, location
Advertising, profiling
Malicious individuals
Doxxing, swatting, harassment
Personal grudges, ideology
Local law enforcement
Access to databases, cameras
Investigation, monitoring
Federal agencies
Advanced surveillance, data mining
National security
Hackers/criminals
Technical exploitation
Financial gain
Step 3: Apply Countermeasures
Immediate Actions (Do Today)
1. Password Hygiene
Use a password manager (Bitwarden, 1Password, KeePass)
Generate unique 16+ character passwords for every account
Never reuse passwords between important accounts
2. Two-Factor Authentication (2FA)
Enable 2FA on email, banking, social media, cloud storage
Use authenticator app (Authy, Raivo, Aegis) NOT SMS
Save backup codes in your password manager
3. Email Compartmentalization
Create multiple email addresses:
Primary: Banking, government, important accounts (Proton Mail)
Secondary: Social media, shopping, newsletters (Proton Mail)
Disposable: One-time signups, risky sites
4. Browser Privacy
Install Firefox with uBlock Origin and Privacy Badger
Or use Brave Browser (privacy built-in)
Switch to DuckDuckGo or Brave Search
5. Phone Security
Disable location services except when needed
Turn off advertising ID
Review app permissions monthly
Use Signal for messaging (encrypted)
Short-Term Actions (This Week)
6. Social Media Hardening
Set profiles to private
Remove birth year, hometown, workplace
Disable face recognition
Use alias if possible
7. Data Broker Opt-Out
Opt-out of major data brokers:
Acxiom, Experian, Equifax, TransUnion
Whitepages, Spokeo, BeenVerified
8. Secure Messaging
Use Signal for encrypted messaging
Enable disappearing messages
Verify safety numbers with contacts
Medium-Term Actions (This Month)
9. VPN Selection
Mullvad (anonymous, no email required)
Proton VPN (free tier available)
IVPN (privacy-focused, audited)
10. Financial Privacy
Use credit cards for online purchases (fraud protection)
This guide provides information for educational purposes about protecting your privacy and security. The techniques described are legal when used for legitimate purposes: protecting personal privacy, securing communications, preventing identity theft, and organizing lawful activities.
This guide is part of the Survival & Resistance Content Project. Last updated: March 26, 2026.
OPSEC Fundamentals: Digital Footprint Reduction & Data Broker RemovalDifficulty: Intermediate
Time to Complete: 60-90 minutes—### OverviewYour digital footprint is larger than you think. Data brokers collect and sell your personal information to anyone who pays. This tutorial covers reducing your digital footprint and removing yourself from data broker databases.—### UNDERSTANDING DATA BROKERSWhat They Do:- Collect personal information from public records- Purchase data from apps, websites, loyalty programs- Aggregate and sell to marketers, insurers, employers- Some sell to government agencies and bail bondsmenMajor Data Brokers:- Acxiom (largest, 3000+ data points per person)- Experian, Equifax, TransUnion (credit bureaus)- Whitepages, Spokeo, PeopleFinder- Intelius, BeenVerified, TruthFinder- Epsilon, CoreLogic, LexisNexisInformation They Have:- Name, addresses (current and historical)- Phone numbers, email addresses- Age, date of birth- Family members, relatives- Income estimate, purchasing habits- Political affiliation, religious views- Health conditions (some brokers)—### OPTING OUT: MAJOR BROKERSAcxiom:- Visit: optout.acxiom.com- Enter name, address, email- Select all listings for removal- Processing time: 30 days- Re-opt-out annuallyExperian:- Visit: experian.com/optout- Choose marketing opt-out- Can opt out permanently or for 2 years- Also freeze credit (separate process)Equifax:- Visit: equifax.com/personal/credit-report-services/credit-privacy-lock/- Free credit freeze prevents new accounts- Marketing opt-out separateTransUnion:- Visit: transunion.com/credit-help/privacy-center- Opt out of credit offers: optoutprescreen.com—### PEOPLE SEARCH SITESManual Opt-Out Process:1. Whitepages - whitepages.com/optout - Search your name, select listing - Follow removal instructions - Takes 24-48 hours2. Spokeo - Spokeo | People Search | Opt Out - Enter URL of your listing or search - Confirm email to complete3. Intelius - intelius.com/opt-out - Search and select listing - Complete verification4. BeenVerified - beenverified.com/optout - Search, select, confirm5. TruthFinder - truthfinder.com/optout - Similar processAutomated Services:- DeleteMe (paid, ~$100/year)- Optery (paid, ongoing monitoring)- Kanary (freemium model)- PrivacyDuck (paid service)—### REDUCING FUTURE DATA COLLECTIONBrowser Privacy:- Use privacy-focused browser (Firefox, Brave)- Install uBlock Origin (blocks trackers)- Install Privacy Badger (EFF tracker blocker)- Enable Do Not Track- Clear cookies regularly or use auto-delete- Use private browsing for sensitive searchesSearch Engine:- Switch to DuckDuckGo or StartPage- Google tracks all searches- Bing also tracks extensivelyEmail Privacy:- Use separate emails for different purposes- Don’t use primary email for shopping/social media- Consider ProtonMail for sensitive communications- Use email aliases (SimpleLogin, AnonAddy)Phone Number Protection:- Use Google Voice for public-facing number- Don’t give real number to businesses- Text apps (Signal, Session) for messaging- Remove from reverse lookup databases—### SOCIAL MEDIA PRIVACYFacebook:- Settings > Privacy > Limit Past Posts- Settings > Privacy > Who can see your friends list (Only Me)- Settings > Ads > Ad Preferences (limit data)- Settings > Your Information > Download (see what they have)- Consider deactivating or deletingInstagram:- Set account to private- Remove tagged photos you don’t want- Limit data sharing in settingsLinkedIn:- Settings > Privacy > Profile viewing options (private mode)- Settings > Privacy > Data shared with third parties (off)- Limit visible informationTwitter/X:- Protect your tweets- Disable photo tagging- Limit data sharingGeneral:- Audit followers/friends regularly- Don’t post location in real-time- Remove EXIF data from photos before posting- Think before posting (assume permanent)—### SMARTPHONE DATA COLLECTIONApp Permissions Audit:- Review all app permissions monthly- Revoke unnecessary permissions- Delete apps you don’t use- Use web versions instead of apps when possibleAdvertising ID:- iOS: Settings > Privacy > Advertising > Reset- Android: Settings > Google > Ads > Opt outLocation History:- iOS: Settings > Privacy > Location Services > System Services > Significant Locations (off)- Android: Settings > Google > Location > Location History (off)App Tracking:- iOS: Settings > Privacy > Tracking > Allow Apps to Request to Track (off)- Android: Settings > Privacy > Permission manager—### FINANCIAL PRIVACYCredit Card Offers:- Opt out at optoutprescreen.com- Reduces junk mail with personal infoBanking Privacy:- Use credit unions (often more privacy-focused)- Consider cash for small transactions- Cryptocurrency for online (with proper OPSEC)Shopping:- Pay with cash when possible- Use privacy.com for virtual card numbers- Don’t use loyalty cards (track purchases)- Use burner email for online shopping—### VEHICLE PRIVACYLicense Plate Readers:- Private companies and police track plates- Data stored for years- No opt-out availableCar Modern Features:- Modern cars collect extensive data- Location, driving habits, contacts- Research privacy settings for your vehicle- Disable connectivity features if possible—### MONITORING YOUR FOOTPRINTRegular Self-Searches:- Google yourself quarterly- Check people search sites- Set Google Alerts for your name- Monitor social media mentionsDark Web Monitoring:- HaveIBeenPwned.com (data breach alerts)- Credit monitoring services- Identity theft protection services—### QUICK CHECKLISTImmediate Actions:- Opt out of Acxiom- Opt out of credit bureaus (marketing)- Opt out of 5 major people search sites- Review social media privacy settings- Install tracker blockers on browser- Switch to privacy search engineOngoing Maintenance:- Quarterly self-searches- Annual re-opt-out (some expire)- Monthly app permission review- Monitor for data breaches—OPSEC Fundamentals Series - Vivaed @ endscenar.ioSources: Electronic Privacy Information Center (EPIC), EFF Surveillance Self-Defense, Privacy Rights Clearinghouse, FTC Consumer Information
Time to Complete: 60-90 minutes—### OverviewPhysical surveillance is real and detectable. This tutorial covers recognizing when you’re being followed, basic counter-surveillance techniques, and when to seek professional help.—### UNDERSTANDING SURVEILLANCEWho Conducts Surveillance:- Law enforcement (with or without warrant)- Private investigators- Corporate security- Stalkers and harassers- Foreign intelligence services- Cybercriminals (digital only)Types of Surveillance:| Type | Description | Detection Difficulty ||------|-------------|---------------------|| Static | Fixed position observation | Medium || Mobile | Following on foot/vehicle | Medium || Technical | Cameras, bugs, trackers | Hard || Digital | Online tracking, metadata | Very Hard || Combined | Multiple methods together | Very Hard |—### SURVEILLANCE INDICATORSOn Foot:- Same person seen multiple times in different locations- People appearing to take interest in your activities- Vehicles parked for extended periods- Workers in area that seems unusual- People avoiding eye contact or suddenly looking away- Someone mirroring your movementsWhile Driving:- Same vehicle behind you for multiple turns- Vehicle pulls out when you pull out- Headlights appear in mirrors consistently- Unfamiliar vehicle at your regular destinations- Cars pacing you (one ahead, one behind)At Home:- Unfamiliar vehicles in neighborhood- People walking dogs repeatedly past your house- Workers in area you don’t recognize- Signs of entry when you return home- Items slightly moved from where you left them- Unusual sounds on phone line—### SURVEILLANCE DETECTION ROUTE (SDR)Purpose: Determine if you’re being followedFoot SDR:1. Start from normal location (coffee shop, store)2. Take route with multiple direction changes3. Include at least 4 turns (right, left, right, left)4. Pass by reflective surfaces (store windows)5. Stop unexpectedly, observe who stops6. Enter crowded area, observe who enters7. Use public transit (get on/off quickly)8. End at secure locationVehicle SDR:1. Drive normal route initially2. Make 4+ turns in residential area3. Include at least one right turn followed by left4. Use multiple lanes, observe mirrors5. Stop at 4-way stops (observe who stops)6. Drive slightly below speed limit7. Take route unfamiliar to most drivers8. End at secure location (not your home)Timing:- Should take 15-30 minutes- Long enough to reveal pattern- Short enough to be practical—### COUNTER-SURVEILLANCE TECHNIQUESNatural Behaviors:- Act normally (surveillance expects nervous behavior)- Don’t constantly check mirrors- Maintain regular speed and patterns- Use peripheral vision for observationObservation Points:- Shop windows (reflective surfaces)- Elevated positions (parking garages)- Intersections with good visibility- Public places with multiple exitsAmpush Technique:1. Turn corner, immediately stop2. Observe who appears in next few seconds3. Anyone turning same corner = suspectPublic Transit:- Get on just before doors close- Get off at unexpected stop- Change cars mid-route- Use stations with multiple exits—### TECHNICAL SURVEILLANCE DETECTIONVehicle Trackers:****Common Locations:- Wheel wells (magnetic)- Under bumpers- Inside bumpers- Under hood (wired)- OBD-II port (wired)- Inside vehicle (bluetooth)Detection:- Visual inspection weekly- Run hand along wheel wells- Check OBD-II port (under dash)- Look for new scratches on exterior- Use RF detector for active trackersRemoval:- Photograph before removing- Wear gloves (preserve evidence)- Bag and document- Consider reporting to authoritiesBugs/Listening Devices:****Signs:- Phone battery draining faster- Unusual sounds on calls- Electronics interfering with each other- Finding unfamiliar devicesDetection:- Sweep with RF detector- Check for new objects in room- Look for moved items- Professional TSCM sweep for high-risk—### DIGITAL SURVEILLANCE INDICATORSPhone:- Battery draining unusually fast- Phone warm when not in use- Background noise on calls- Delayed shutdown- Apps you don’t recognize- Increased data usageComputer:- Webcam light turning on unexpectedly- Cursor moving on its own- Programs opening/closing- Slow performance- Unusual network activity- Antivirus disabledResponse:- Don’t use compromised device- Factory reset or replace- Change passwords from clean device- Enable 2FA on all accounts—### IF YOU CONFIRM SURVEILLANCEImmediate Actions:1. Don’t confront - Confirms you’ve noticed2. Go to safe location - Police station, crowded area3. Document everything - Photos, descriptions, times4. Change patterns - Different routes, times5. Inform trusted contacts - Let someone know6. Consider legal options - Restraining order, police reportWhen to Seek Help:- Surveillance continues for days- You feel physically threatened- Home has been entered- Devices are compromised- You’re a high-value targetProfessional Resources:- Private security firms (TSCM sweeps)- Digital forensics experts- Legal counsel- Law enforcement (if appropriate)—### SAFE MEETING PRACTICESLocation Selection:- Public places with multiple exits- Moderate crowd (not empty, not packed)- Good lighting- Away from surveillance cameras if possible- Not your regular locations- Not near your home or workTiming:- Vary meeting times- Don’t establish patterns- Arrive separately, leave separately- Have cover story if neededCommunication:- Use encrypted messaging- Confirm meeting day-of- Have backup location- Establish check-in protocol—### LEGAL CONSIDERATIONSWhat’s Legal:- Walking/driving normal routes- Observing your surroundings- Photographing public spaces- Installing cameras on YOUR property- Recording conversations (one-party consent states)What’s NOT Legal:- Trespassing on private property- Wiretapping without consent- Installing trackers on vehicles you don’t own- Harassment or stalking- Breaking and enteringYour Rights:- Right to photograph in public- Right to refuse consent to search- Right to remain silent- Right to attorney- Right to ask if you’re free to leave—### QUICK REFERENCE: Surveillance ChecklistDaily Habits:- Vary your routes and times- Check vehicle for trackers weekly- Monitor phone/computer for anomalies- Be aware of surroundings- Note recurring faces/vehiclesIf Suspicious:- Document observations (time, location, description)- Conduct surveillance detection route- Change your patterns- Inform trusted contact- Consider professional helpHigh-Risk Situations:- Use secure communication only- Meet in public locations- Vary all routines- Consider relocation temporarily- Seek professional security advice—OPSEC Fundamentals Series - Vivaed @ endscenar.ioSources: Former Intelligence Community Professionals, Private Security Industry Standards, Electronic Frontier Foundation, ACLU Know Your Rights
Time to Complete: 60-90 minutes—### OverviewStarting with a clean, secure device setup is crucial for maintaining operational security. This guide covers secure installation and configuration of phones and computers.—### COMPUTER SECURE SETUPBefore Installation:- Download OS from official source only- Verify checksums/hash values- Create bootable USB from trusted computer- Backup important data (encrypted)- Have network ready (preferably privacy-focused)Operating System Choices:| OS | Security | Privacy | Ease of Use | Best For ||----|----------|---------|-------------|----------|| Linux (Qubes) | Excellent | Excellent | Hard | Maximum security || Linux (Mint) | Very Good | Very Good | Easy | Daily driver || Linux (Tails) | Excellent | Excellent | Medium | Temporary/anonymous || Windows 10/11 | Good | Poor | Easy | Compatibility || macOS | Good | Medium | Easy | Apple ecosystem |Installation Steps:1. Boot from USB installer2. Wipe entire drive (secure erase)3. Install OS with full disk encryption4. Create non-admin user for daily use5. Install only essential software6. Configure firewall immediately7. Disable unnecessary servicesPost-Installation Hardening:****Linux:- Enable automatic security updates- Configure UFW firewall (deny incoming)- Install privacy extensions on browser- Disable telemetry and analytics- Use encrypted DNS (DNS-over-HTTPS)- Set up automatic screen lockWindows:- Disable Cortana completely- Turn off all telemetry in Settings- Disable advertising ID- Configure Windows Firewall- Install local account (no Microsoft account)- Disable cloud sync featuresmacOS:- Disable Siri and Spotlight suggestions- Turn off analytics sharing- Limit ad tracking in Privacy settings- Enable FileVault encryption- Configure firewall in Security settings- Disable iCloud if not needed—### PHONE SECURE SETUPAndroid (Privacy-Focused):****Option 1: GrapheneOS (Pixel devices)- Best security and privacy- Regular security updates- Google Play Services optional- Hardened memory allocatorOption 2: CalyxOS (Pixel, some Xiaomi)- Good balance of privacy/usability- Includes microG for app compatibility- Privacy-focused defaultsOption 3: Stock Android (de-Googled)- Disable all Google services- Use F-Droid for apps- Minimal Google account useInstallation Process:1. Unlock bootloader (wipes device)2. Install custom recovery3. Flash new OS4. Verify installation5. Configure privacy settingsiOS (Locked Down):While iOS is less privacy-friendly, you can minimize tracking:1. During Setup: - Don’t sign into iCloud initially - Disable all analytics - Turn off location services - Skip Apple ID if possible2. Privacy Settings: - Settings > Privacy > Analytics > Disable all - Settings > Privacy > Location > Disable system services - Settings > Safari > Block all cookies - Settings > Siri > Disable all Siri features3. App Store: - Only install essential apps - Review app permissions before installing - Use App Tracking Transparency (deny all)—### BROWSER CONFIGURATIONFirefox (Recommended):****Essential Settings:- about:config enhancements: - privacy.resistFingerprinting = true - privacy.trackingprotection.enabled = true - network.http.referer.default_policy = 2 - browser.send_pings = falseExtensions:- uBlock Origin (ad/tracker blocking)- Privacy Badger (EFF tracker blocker)- HTTPS Everywhere (force encryption)- ClearURLs (remove tracking from URLs)- CanvasBlocker (anti-fingerprinting)- Multi-Account Containers (isolate sites)Chrome/Edge Alternatives:- Brave (privacy-focused, blocks trackers)- Chromium (open source, less tracking)- Avoid standard Chrome for privacy—### ESSENTIAL SOFTWARESecurity Essentials:- Password manager (Bitwarden, KeePassXC)- 2FA authenticator (Raivo, 2FAS)- Encrypted messaging (Signal, Session)- VPN (Mullvad, ProtonVPN)- Encrypted email (ProtonMail, Tutanota)Productivity:- LibreOffice (Microsoft Office alternative)- Thunderbird (email client)- VLC (media player)- GIMP (image editing)- Obsidian or Joplin (notes)Avoid:- Adobe products (telemetry-heavy)- Google Chrome (tracking)- Microsoft Office 365 (cloud dependency)- Skype (Microsoft-owned, metadata)- Any software requiring constant internet—### NETWORK SECURITYRouter Configuration:- Change default admin password- Disable WPS (vulnerable)- Use WPA3 encryption (or WPA2)- Disable remote administration- Update firmware regularly- Disable UPnP if not neededDNS Configuration:- Use privacy-focused DNS: - Quad9: 9.9.9.9 (blocks malware) - Cloudflare: 1.1.1.1 (fast, privacy) - NextDNS (configurable filtering)- Configure DNS-over-HTTPS in browser- Consider running local DNS (Pi-hole)WiFi Security:- Separate guest network for visitors- Separate IoT network for smart devices- Disable WiFi when not in use- Use VPN on public WiFi always—### ACCOUNT SECURITYEmail Accounts:- Use different emails for different purposes: - Personal (close friends/family) - Financial (banks, investments) - Shopping (online purchases) - Public (forums, social media)- ProtonMail for sensitive communications- Enable 2FA on all accountsOnline Services:- Use password manager for all passwords- Enable 2FA everywhere possible- Use aliases for non-critical services- Review connected apps regularly- Delete unused accounts—### MAINTENANCE ROUTINEDaily:- Lock screen when stepping away- Check for security alerts- Review browser for tracking attemptsWeekly:- Install pending updates- Review installed applications- Clear browser data- Check account activity logsMonthly:- Full system backup (encrypted)- Review firewall logs- Audit app permissions- Update threat modelsQuarterly:- Password audit and rotation- Security setting review- Software inventory- Training/skill development—### RED FLAGSSigns of Compromise:- Unexpected software installations- Browser homepage changed- New toolbars or extensions- Slow performance- Unusual network activity- Popups and ads increasing- Antivirus disabled- Files encrypted or missingResponse:- Disconnect from network- Backup important data (carefully)- Full system wipe and reinstall- Change all passwords from clean device- Monitor accounts for suspicious activity—### QUICK REFERENCE: Secure Setup ChecklistComputer:- Install from verified source- Full disk encryption enabled- Firewall configured- Automatic updates enabled- Telemetry disabled- Privacy-focused browser installed- Essential security software installed- Non-admin user for daily usePhone:- Privacy-focused OS (or locked down)- Minimal apps installed- Location services restricted- Analytics disabled- Encrypted messaging installed- 2FA authenticator configured- Biometric + passcode enabledNetwork:- Router password changed- WPA3/WPA2 encryption enabled- Guest network configured- Privacy DNS configured- VPN subscription active—OPSEC Fundamentals Series - Vivaed @ endscenar.ioSources: EFF Surveillance Self-Defense, NIST Security Guidelines, Privacy International, Electronic Privacy Information Center