Protest: A Security Nightmare

We are OSINT-surgency. We compile and analyze data that is public though the eyes of the adversary, for the purpose of helping insurgents analyze, reflect on, and harden their security.

During a recent protest in a small town we have observed terrible security practices that we would like to point out.

In general, we do not think that protests are a good use of comrades' time and energy. We think that engaging in protests exhausts activists by corralling them into prescribed march routes and coaxing them into a sense of having 'accomplished something' while in reality the have only strengthened the state by providing data about the strategies and risk profiles of activists as well as practice responding to them. We do not feel that this increases activists' freedom or political power. We are not necessarily opposed to spur-of-the-moment participation in actions as opportunities arise, but we think there are important factors to take into consideration:

Assessing the Terrain

Differences in the location, population, number of participants, fervor of the moment, political climate, all provide differences in opportunities for actions. Whether or not an action will benefit those involved or increase their freedom and political power depends on the situation and the context. A large and raucous protest in a large urban area such as New York City or Hong Kong provides different opportunities for action than a small protest related to a small demographic group in a small town with a largely-forward-facing activist scene and a large police force. It is crucial to be sensitive to this context when planning and engaging in actions.

The Risk of Metadata

A lot of the risks that activists open themselves up to when participating in actions are not immediately obvious. Law enforcement cares just as much about mapping the social networks of activists as it does about catching individuals directly engaged in illegal activities. This allows them to narrow their attention to a reasonable subset of potential actors when word of an upcoming event surfaces or when responding to an event. When an outsider appears on the scene, it is easy to target this individual specifically and is in fact highly valuable to do so. Capturing an outsider enables law enforcement to map their social networks with the new network. This provides invaluable data to law enforcement and strengthens their knowledge of activist social networks and actions.

The security breaches we've seen include but are not limited to the following:

** Getting arrested
No one plans to get arrested. However, engaging in activities that might lead to arrest are particularly problematic when the terrain involves a small scene with mostly front-facing activists in a small march that was publicly organized. Behaviors such as vandalism may make sense in the middle of a large protest full of rioters setting things on fire. It makes less sense in a small protest organized by identifiable actors. This makes it easy to target individuals engaged in illegal activity and begin mapping their social networks.

In this particular case, the arrest resulted in releasing someone's deadname to the public which was previously unknown even to some who were close to this person. This increases the attack surface of everyone affiliated with the deadnamed person because now everyone has knowledge about the person's identity, their past actions and risk profile, and their past social affiliations and networks. This information will be spread by the public and can even be spread unintentionally by friends, which can intentionally and unintentionally incriminate people.

Continuing to discuss and spread information about the deadnamed person and their history is also harmful. Information about past and future actions should always be on a strict "need-to-know" basis and should not be discussed by anyone who isn't directly and currently involved with an action. The reason for this is that people can *unwittingly* share incriminating information such as social network metadata and current and past affiliation with the person involved.

Do not assume that using disappearing messages provides cover to spread this information. There is no good reason to disseminate information about an individual's past identity, activities, and social affiliations, nor to speculate about whether these actions are good or bad, worthy or unworthy. Spreading this information among social networks increases the information that people might unwittingly share in the future. If it's in your head you can share it. If it's not in your head, you can't.

** Posting photos of the action without obscuring people's faces
Never post photos of people involved in actions without obscuring their identities. This puts everyone at risk in many ways, some of which aren't immediately obvious--For example, providing further facial recognition data on an individual who was previously not connected with their current name and location, and their social affiliations which were previously unconnected with photo evidence that is now available on the internet. In this particular case, even if the person posting the un-censored photos did obscure the faces of the participants in the photos, the social media account used contains clear, unobscured photos of the 'organizers' and their social affiliations. This means that simply knowing the social networks of the organizers is enough to narrow down the participants' identities, which are often forward-facing in other places on the internet.

** Debating the specifics about the event on social media
When someone on social media asks stupid questions about the organizers or participants of an event in which illegal activities occur, responding vaguely with details about the structure of the organization or details about the people involved, or refusals to 'out your friends' can all unwittingly reveal information about the existing social affiliations of yourself and others, such as that (1) 'the organizers' are people in your social network, (2) the organizers are involved in illegal activities, and (3) you are friends with people who are engaged in illegal activities. It is best not to get involved in online debates about the specifics of actions themselves and the people involved, or at least to consider the unintended implications of what you might be spreading on the internet.

** Changing your behavior when 'engaging in radical activity'
Suggestions such as that people should drop out of signal threads, delete threads, or turn off devices before 'engaging in radical activity' are simply bad suggestions. If it is the case that the metadata on your device, such as who you are talking with and when, or your location and your activities and habits, is being used to identify your potential involvement in sensitive actions, then a dramatic change in that activity is just as incriminating as a direct connection with the activity itself. It is better to let your metadata paint a picture that nothing about your behavior is suspicious or has changed, for example by leaving your phone on and at home.

** Choreographing the march on social media
In 2008 during a Pittsburgh G20 protest march, an individual who was similarly choreographing the march via Twitter was [[ by the police]]. Today there is simply no excuse to publicly link a social media account with several uncensored photos of several participating individuals with real-time participation in an event which resulted in allegedly illegal activities.

** Associating public space with the group who engaged in these activities on social media
Do not post to social media that a locally-known, public-facing activist space has been 'taken over' by the people who organized an action in which allegedly illegal acts occured, especially not immediately after the action has concluded. When you associate the space with people who are allegedly engaged in illegal activities you put the space at risk of greater suspicion and surveillance.

** Recommendations
At a minimum, all documentation of events by those spearheading said events should cease. By doing so, you allow the adversary to connect public and obscured identiies, therefore making their maps of unrest more robust. Should activists continue to adopt the strategy of protest, let public-facing figures and uninvolved bystanders spread visibility of the event. All illegal action is not recommended. The recurrence of the same people at actions combined with small numbers make new people and illegal action stick out to your adversary. Finally, when data on a comrade is released, it is suggested that comrades do not continually rehash it. Doing so increases the attack surface of everyone involved and the probability that this information might be spread accidentally, which increases the chances an adversary will use that information for their own ends.

** Conclusion
We hope that our comrades will continue to build strong security culture as they develop their tactics and increase their capacity for building joy and freedom. We'd like to recommend some readings about security culture for activists:


This report is free to dissect, detourn and distribute.

There are 17 Comments

The idea of kinda crowdsourcing intelligence is cool, but hard to picture.
Very curious about the author's thoughts on the subject.

my only complaint with this article is that it doesn't explain what "deadnaming means", which may be obvious to a lot of woke anarchy people on this site but wouldn't necessarily be clear to someone dipping their toes in to these kind of articles for the first time.

other then that, good read and the thing about leaving your phone on at home instead of off in your pocket/off at home is good and calls back to a great article about that subject posted a year or two back...anyone got the link? It may been European

Great resource, thanks. If you (or anyone) have any other resources that blend street and digital opsec concerns and want to share, please do.

Yeah, but what does deadnaming REALLY mean??

Hey, if you don't know what that means it means you aren't from the same echo chamber therefore you ain't cool!

Yeah, but what does echochamber REALLY mean Huh, without the bias?

Deadnaming means outing someones legal name, esp. related to trans folk who change their names after transitioning.

I didn't know what deadnaming was 5 minutes ago, either. But there's this invention called the Google Machine...

Is disregarding the trans identity of someone now the only problem with snitching? Wtf... still confused about the use of this word.

sheesh, this is a bit dense.

The point is that before getting arrested, no one knew this person's previous legal name that they no longer use (their deadname), which was released by the police. People involved also talked to the media using their new name, thus cementing the association between deadname and new name in the media. Now everyone that knows this person by their new name also knows their old name and thus (through a quick google search), now knows their previous history with actions.

Does that clear it up?

Yes, that clears it up, kinda.

But when using some niche slang terms that might apply to more general contexts of snitching (i.e. protesters or rioters in general, beyond just trans people), you can't except everyone to transliterate that in their heads as precisely as you do, OVER THE INTERNET, and with people who aren't from the same background as you.

It's got more to do with acculturation than being dense.

c o m m u n i c a t i o n !

You seem kinda defensive about something you could've just googled

Well I cannot talk for others as honestly I'm not experiencing the situation of 1312 activity in some US cities, but it appears to me that while all of the analysis and advice above is sound and legit, and connects with my own experience of the protests of the last few years (especially those ridiculously awful XR and BLM nonviolent marches); I'm left with the question of how to communicate these with the activist groups they are aimed at. Even if you find a way to... how will you even get their attention or interest?

Today it's like the normal to be expecting people to film and take pictures of everyone, and there's zero knowing of who these people are and who they work with. It's a fucking joke.

The best way I can see to counter this would be to wear some kind of brown paper bag on your head with stuff written that goes like "my identity's underneath but it belongs to ME, alone. Plz fuck off!". This could become a curiosity to the protest paparazzis, so maybe a counter-trend could start from this.

And that is the kind of engagement anarchists should have with protests, imo, instead of just disappearing among the mass of sheeple or following the herd. There's a way to assert your critique without ending up as the black sheep of the crowd, that is quickly snitched or isolated by the leading group. Especially consider maybe NOT being a black bloc, and explore other avenues of engagement.. like those that have never been tried. A plurality of ever-shifting forms is compliant with the notion of diversity of tactics... where espousing the black bloc as the only way to engage seems pretty much like a single tactic!

Aside from that, here's the major issue that some principles clearly weren't passed across generations, so that at every new one, some people like the author of the text above gotta, once again, do the pedestrian yet necessary work of warning people about their ever more awful lack of security practices.

"In general, we do not think that protests are a good use of comrades' time and energy. We think that engaging in protests exhausts activists by corralling them into prescribed march routes and coaxing them into a sense of having 'accomplished something' while in reality the have only strengthened the state by providing data about the strategies and risk profiles of activists as well as practice responding to them. We do not feel that this increases activists' freedom or political power."

You're saying this is Summer 2020, after a month in which many protests have simultaneously involved megaphones calling for voting and crowds looting a block away. What's your alternative? Go back to gluing an ATM once a year?

there are various other options, many of them posted on this site daily

Jesus just be happy shits kicking off, the protests have accomplished a lot, stop pissing about it and join in

Add new comment