Operational Security for anybody ================================ by `comotion` ------------- * based on the gruq's stuff * I do deep packet inspection. .. image:: img/engine.jpg Don't get caught ================= Not me ------ * nothing to hide * it wasn't me nothing to hide --------------- * whistleblower * civil disobedience * break forced non-disclosure I didn't do it --------------- * can still end up in jail * or pay $$$ in damages * activity might be legal now exposing -------- * corruption * fraud * corruption * organized crime good guys get taken ------------------- * not a fun place to be * be smart, stay out are you not involved in ------------------------ * filesharing? * anarchist cookbook? * activism? * freedom fighting? might need this later --------------------- if nothing else, raise costs of surveillance Really ======= .. image:: img/invaders.gif OPSEC: cover your ass ===================== * how to think :: methodology * how to act :: techniques * tools to use :: technology Really ======= .. image:: img/notbutter.jpg Don't fuck up ============= * You only get one chance * a little slow, a little late * can't plan for that. it's life Really ====== .. image:: img/energy.jpg In a nutshell ============= * keep your mouth shut * guard secrets * need to know * never give others position of leverage keep your mouth shut ==================== * be careful * be cool * STFU * maintain cautious habits be tidy ======= * don't be explicit * don't use code * one law at a time * camuflage is good Methodology =========== .. image:: img/truck.jpg methodology ============ * cover story * new persona * never pollute your cover 10 commandments of OPSEC ======================== #. dont reveal details #. dont reveal your plans #. dont trust anyone #. dont confuse fun and activism #. dont operate from home 10 commandments of OPSEC ======================== 6. be paranoid, you can't go back in time 7. keep your personal life out of it 8. keep your life contraband free 9. don't talk to the police 10. don't give anyone power over you aha === .. image:: img/destruction.jpg Friends? ======== * Don't spill the beans on Facebook! * Think about it. Your mom will know. Pollution ========= If you steal wearing some gloves, don't do groceries with the same gloves. Contamination -------------- Don't blow the whistle on your employer from your work telephone. Compartmentalize ---------------- Keep your private life separate. Leaving traces -------------- * Same IP address * same browser * same computer * dead easy to trace Surveillance ============= * don't reveal operational details * don't tell how you do it * don't tell when * don't say what * be paranoid dead giveaways --------------- if someone offers you money or benifits for info Techniques ========== * boring * you know it works if nothing happens * put in place first * hard to fix things from jail Personas ======== Spiros ------ He knows my name, but my name is not my name And you.. to them you're only "The Greek." The Greek --------- And, of course, I'm not even Greek. Problem: -------- You are you Solution: --------- Be someone else Personas -------- * Contact between your covers contaminates both * keep cover identities isolated from each other! Defense in layers ----------------- Fail safe technology. * TOR * Back stop: primary cover alias * Secondary cover handles Pitfalls -------- If I know where you are, I know who you are. * Location reveals * Weather * Time * Political events * Profiling data Practice -------- * Amateurs practice until they get it right. Professionals practice until they can't get it wrong. * Practice makes perfect Notes ====== Stringer -------- What you doing? Shamrock -------- Robert's Rules says we got to have minutes of the meeting. These the minutes. Stringer -------- Nigga, you taking notes on a *criminal fucking conspiracy?* No logs. No crime. ================== Staying anonymous ------------------ Personal info is profiling info. * don't include personal info in screen name * don't discuss personal informations in chat * don't mention gender, tattoos or physical capacities Guidelines ---------- * don't mention profession, hobbies or involvement in activist groups * don't use special characters on your keyboard unique to your language * do not post info to the regular internet while you are anonymous * do not use Twitter or Facebook * do not pay with your visa card Guidelines ---------- * Do not post links to Facebook images. These contain your personal ID. * Do not keep regular hours, revealing timezone. * Do not discuss your environment (weather, politics, etc) VPNs vs TOR ----------- * VPN = privacy * TOR = anonymity * confuse the two and go to jail VPNs and TOR ------------ * TOR connection to a VPN => OK * VPN connection to TOR => GOTO JAIL On VPNs ------- * buy with Bitcoins * buy with VISA gift cards * buy over TOR * not all VPNs are good https://torrentfreak.com/vpn-services-that-take-your-anonymity-seriously-2013-edition-130302/ TAILS ------ .. image:: img/bike.jpg TAILS ------ * http://tails.boum.org * TORs all traffic. * LOADED with good tools. Thoughts! ========= If you think, don't speak If you speak, don't write If you write, don't sign If you sign, don't be surprised