High resistance OpSec guide for activists - check different laptops google “qubes certified computers” not included in post

High‑Resilience OPSEC Guide for Activists

This guide outlines practical operational security (OPSEC) practices for activists focused on reducing attack surfaces, compartmentalisation, and deniability. It assumes a realistic threat model (state surveillance, device seizure, social graph analysis) and prioritises reliable security over exotic tricks.

Table of Contents

• Hardware
• Physical Attack Surface Reduction
• Networking: Tor & Whonix
• Messaging
• Browsing & Research
• VPN Router
• Passwords & Secrets
• Identity Compartmentalisation
• Behavioural OPSEC
• Threat Model Reality Check

1. Hardware: Start by Being Boring

Dumb Phones (Primary Phone)

• Use a dumb phone as your only daily-carry phone.
• Calls + SMS only, no apps.
• No location tracking or social graph harvesting.
• Do not log into activist accounts or pair with laptops.
• Keep contacts minimal and non-descriptive.

Smartphones are tracking devices with a UI. Treat them as such.

Qubes‑Certified Laptop (Primary Computer)

Use Qubes OS on certified hardware only. Official Documentation

Qubes OS is a security-focused operating system based on VM isolation. Each VM (or “qube”) can have a separate purpose and network configuration. This allows you to compartmentalise tasks and reduce risk if one VM is compromised.

• Strong VM isolation
• Limits blast radius of compromise
• Designed for hostile environments

Hardware rules: no Wi‑Fi/Bluetooth required, use Ethernet, avoid webcams.

2. Physical Attack Surface Reduction

• Disable or remove Wi‑Fi, Bluetooth, camera, microphone
• Methods in order of preference: hardware kill switches → BIOS/UEFI disable → physical removal → epoxy tape as last resort

If it has a sensor, assume it can be activated.

3. Networking: Tor & Whonix

Tor Base System

• All networking flows through Tor.
• No clearnet browsing from main OS.
• No exceptions “just this once”.

Whonix Architecture

• Use Whonix inside Qubes.
• VM layout: sys-whonix (gateway), anon-whonix (disposable work VM).
• All browsing in disposable VMs only.

Persistence is memory. Memory is evidence.

Setting Up WebTunnel Bridges in sys-whonix

To bypass network censorship and use Tor in blocked networks:

1. Open a terminal in sys-whonix.
2. Edit Tor configuration:

sudo nano /etc/tor/torrc

3. Add a WebTunnel bridge line, e.g.:

Bridge web 123.45.67.89:443

4. Save and restart Tor:

sudo systemctl restart tor

5. Verify your Tor connection through https://check.torproject.org inside a disposable VM.

4. Messaging: Simple, Metadata‑Resistant

• Use SimpleX Messenger over Tor inside Whonix.
• One identity per purpose.
• Never reuse QR codes, rotate identities regularly.
• Lower metadata leakage than most messengers.

5. Browsing & Research

• All Tor browsing happens in Disposable Whonix Workstations only.
• No bookmarks, no saved logins, no downloads kept across sessions.
• If files must be kept, move to a cold, isolated VM and strip metadata immediately.

6. VPN Router (Not on the Laptop)

• VPN at router level only, protects non-Tor traffic.
• VPN ≠ anonymity; never replaces Tor.
• Infrastructure tool only.

7. Passwords & Secrets

KeePassXC

• Database stored offline
• Open only in dedicated VM
• Strong master password + keyfile

Hidden & Decoy Passwords

• One “normal” database, one hidden database
• Plausible deniability if coerced
• Never autofill across VMs or store passwords in browsers

8. Identity Compartmentalisation

• One VM = one role, one role = one identity
• No crossover between identities
• Examples: Research VM, Messaging VM, Writing VM

If two activities don’t need to know about each other, they shouldn’t.

9. Behavioural OPSEC

• Never reuse usernames or writing styles
• Never mention personal details
• Do not mix activist and personal time patterns
• Vary activity times and assume everything is logged

10. Threat Model Reality Check

This setup is designed to resist mass surveillance, limit damage from device compromise, provide plausible deniability, and reduce metadata leakage.

It will not protect you if:

• You talk too much
• You trust the wrong people
• You break compartmentalisation once

Final Principle: OPSEC is subtraction, not addition. Remove features. Remove convenience. Remove assumptions.