Security training: Targeted Activists versus The State

Wiki ▸ Security culture ▸ Persona-based training matrix ▸ Security training: Targeted Activists versus The State

How to use this persona-based threat modeling matrix:

1. You are a "defender" (a given row). Find yourself there.
2. Your concern(s) map to a given "attacker" (a given column). Find your attacker.
3. Find the cell at which these two personas intersect. Everything listed in the cells above and to the left of your cell applies to you, too.
4. Start at the top-left cell and read the advice from left-to-right, top-to-bottom, until you reach your cell. Then stop worrying. :)

		Attackers
		Random Assholes	Assholes with Resources	The State
Defenders	Individuals	Individuals vs Random Assholes	Individuals vs Assholes with Resources	Individuals vs The State
	Organizers and Journalists	Organizers & Journalists vs Random Assholes	Organizers & Journalists vs Assholes with Resources	Organizers & Journalists vs The State
	Targeted Activists	Targeted Activists vs Random Assholes	Targeted Activists vs Assholes with Resources	Targeted Activists vs The State

Targeted Activists versus The State

Prerequisites

Before you dive too deeply into this practice material, you should first explore the following lower-hanging fruit in the following order:

1. Security training: Individuals versus Random Assholes
2. Security training: Individuals versus Assholes with Resources
3. Security training: Individuals versus The State
4. Security training: Organizers and Journalists versus Random Assholes
5. Security training: Organizers and Journalists versus Assholes with Resources
6. Security training: Organizers and Journalists versus The State
7. Security training: Targeted Activists versus Random Assholes
8. Security training: Targeted Activists versus Assholes with Resources

Practices

• Don't maintain long-term OpenPGP keys, try following the suggestions in Operational PGP instead
• Use only hardware you trust:
  • Replace any commercial firmware on your devices with LibreBoot.
  • If you can't use LibreBoot, at least patch your Intel-based logic boards against CVE-2017-5689 (see Wikipedia). (See this HowToGeek article for more on the legitimate use of Intel ME.)
• "Use encrypted email." (OpenPGP/GPG/PGP)
  • GPGTools.org for macOS, optionally without a paid license via Libmacgpg-free
• Use Qubes, a hardened and security compartmentalized operating system generally
• Use Tails for handling specific, extremely sensitive material
• Create an anonymous Signal phone number with Android
• Completely disable the Intel ME subsystem in your hardware:
  • Step-by-step guide to disabling the Intel Management Engine (Gentoo Wiki)
  • me_cleaner
• Enable the Speculative store bypass disable (SSBD) bit in your BIOS/UFI/firmware/hardware systems.