. . . But you don’t wanna spend a shit ton of money learning to write malware.
You’re welcome.
I guess run it through VirusTotal if you’re paranoid. There are things in these files that will show up as malware, though, of course. If you really are worried, just sandbox it.
I cannot stress the importance of remaining as anonymous as possible online as an anarchist enough. Regardless of your level of action, or if you have not taken action at all, the State will take your opposition seriously. So every precaution must be taken to make your identification take as many resources as possible, therefore likely making you not worth the cost.
This post, of course, is not a comprehensive guide on the entirety of digital opsec practices or security culture as a whole. (For more information on all of that, I’d recommend reading these linked posts, as well as AnarSec, NoTrace Project, and these zines from Riot Medicine.) Here, we will focus primarily on the removal of metadata from files and photos.
Most people that submit anonymous communiques for actions are keenly aware of this and take appropriate steps, but the newly radicalized may be completely ignorant to the dangers of metadata. For example, when you snap a photo with your smartphone, it automatically adds GPS information to that photo. Anyone can download a photo from your social media page and view the exif data with easily accessible tools, therefore entirely compromising you in one swift motion.
I’ve written previously that I do not recommend using Windows, as their telemetry practices can be detrimental to privacy if not disabled, even if they did sort of walk back their plans to take screenshots every few minutes. For now.
However, since this is the most commonly used operating system, and switching to Linux may be, as of now, too difficult for some newcomers to all of this, we will start there and then move forward:
I feel as though Linux distros beyond Debian-based are beyond scope of this article as they are less common. For example, the typical Arch Linux user is well-versed enough to know how to install and use a tool like this, considering what it takes to install and maintain it. However, I will add installation instructions if asked to do so.
sudo apt update
sudo apt install exiftool
exiftool -all= /path/to/file
exiftool /path/to/fileUsing a smartphone for pretty much anything is not necessarily recommended. (see: Kill the Cop in Your Pocket.) The recommendation for having a smart phone will always come down to using GrapheneOS, on which exif-eraser also works.
Some time ago, a friend of mine sent me this Digital Safety Tips for Organizers: Online Privacy Checklist to look over.
I think it’s great and brings up a lot of important points regarding maintaining online anonymity for organizers. However, I think it can be touched up a bit with some broader knowledge and application when it comes to infosec practices for activists, especially considering the incoming presidential administration following the 2024 general election; who’s to say what tactics will be employed to defeat “the opposition?” In my opinion, it’s important to be over-prepared for these situations.
Some of these suggestions may seem highly technical for the inexperienced individual, and therefore may present a bit of a learning curve. They may also seem like overkill or inconvenient. But I promise you, when it comes to the many ways an individual can be tracked and subsequently doxxed and/or investigated and arrested, it is worth it to take the time to learn and employ these tactics.
Depending on the actions taken by an organization, even if by a decentralized collective of otherwise anonymous individuals, one misstep can mean the end for you, and potentially your comrades, at the hands of law enforcement or an ultra-right-wing lunatic (if you can even tell the difference between the two). Please note that this is not an attempt at fear-mongering, but rather to prepare you.
Because of various skill levels among individuals, if any of these steps prove to be too difficult for you, consider consulting a trusted and technologically-inclined comrade to assist you. Approach the learning process with an open mind, and you’ll solidify a lot of useful knowledge that can be applied in various ways to maintain your online privacy in several avenues of your online life.
As always, assess your threat model and make decisions based on that.
This document will cover the tech aspects of operational security and won’t go into detail about correlation attacks and stylometry attacks, which is when your usage of anonymous online activities is cross-referenced with your mobile devices and other online activities (like doing something illegal over Tor and immediately shutting down your computer and going to the mall), as well as the analysis of your unique pattern of expression (the way you communicate online). I may make a separate post about those at a later time.
A Concise Online OpSec Guide for Anarchists, Activists and Organizers:
1. Take Stock of Your Online Presence
2. Secure Your Accounts and Communication
3. Secure Your Devices
sudo nano /usr/local/bin/randomize_mac.sh
File:
#!/bin/bash
# Interface name (change this to your network interface)
INTERFACE=”<YOUR WIRELESS INTERFACE>”
# Bring the interface down
sudo ip link set dev $INTERFACE down
# Randomize the MAC address
sudo macchanger -r $INTERFACE
# Bring the interface back up
sudo ip link set dev $INTERFACE up
Make script executable:
sudo chmod +x /usr/locla/bin/randomize_mac.sh
sudo nano /etc/systemd/system/randomize_mac.service
File:
[Unit]
Description=Randomize MAC Address on Boot
After=network.target
[Service]
Type=oneshot
ExecStart=/usr/local/bin/randomize_mac.sh
RemainAfterExit=yes
[Install]
WantedBy=multi-user.target
Enable the service:
sudo systemctl enable randomize_mac.service
4. Additional Resources
PRIVACY
OPSEC
LEARN TO HACK
HACKING OPERATING SYSTEMS
MALWARE DEVELOPMENT
ZINES
ENCRYPTED CHAT APPS
TOR HIDDEN SERVICES FOR ANARCHISTS & HACKERS
This list will change as more resources are discovered and as the digital landscape continues to evolve.
By coming to this site, you agree that you will not use any of the disclosed information for illegal purposes. This site is for educational and entertainment purposes only.