Overview

This playbook covers the tools and practices for keeping your communications secure from surveillance, data collection, and government or corporate access. It is designed for activists, organizers, journalists, and any citizen who communicates about sensitive matters.

Core principle: Assume all unencrypted communications are potentially accessible to law enforcement and corporate actors. Use encryption as a default, not an exception.

Quick Reference: Secure Communication Tools

Step 1: Understand Why It Matters

Read: Digital Security for Citizens and Activists (Part I: Your Threat Model)

Different activists face different threats. Understanding your threat model determines which security measures are proportionate. A community organizer has different needs than a journalist protecting a source.

Step 2: Encrypted Messaging — Signal

Read: Digital Security for Citizens and Activists (Part III: Encrypted Messaging)

Signal is the foundational tool. Install it, enable disappearing messages, and migrate your most sensitive conversations to it.

Signal setup checklist:

• [ ] Downloaded from official App Store / Google Play
• [ ] Registration Lock enabled (Settings > Account)
• [ ] Screen Security/Lock enabled
• [ ] Default disappearing message timer set (1 week or less for sensitive groups)
• [ ] Note to all organizing contacts: “Let’s move sensitive conversations to Signal”

Step 3: Metadata Stripping

Read: Tutorial — Metadata stripping before sharing

Photos, documents, and files contain hidden metadata (EXIF data) that can reveal:

• GPS coordinates of where a photo was taken
• Device make, model, and serial number
• Creation date and time
• Software used to create a document

Strip metadata before sharing any file that could expose locations or identities.

Tools: ExifTool (free, cross-platform), MAT2 (Linux), Exif Purge (Mac), Metapho (iOS), Photo Metadata Remover (Android).

Step 4: Source Protection (Journalists and Sensitive Cases)

Read: Methodology — Source Protection

For journalists and anyone receiving sensitive information from sources:

• Use SecureDrop (secure submission system) for initial contact
• Use Signal for ongoing communication with sources
• Never contact sources through regular email or phone for sensitive matters
• Train sources on secure communication before they provide information
• Understand your state’s shield law protections

Step 5: Secure Communication Tool Catalog

Read: knowledgebase/investigative-tools/tool-catalog/by-category/secure-comms.md

The full catalog of secure communication tools: encrypted messaging, VPNs, anonymous email, secure file transfer, and source intake platforms. Includes assessment of each tool’s security properties.

Step 6: Operational Security for Organizations

Read: Comprehensive Toolkit for Opposing Autocracy and Authoritarianism (Section 2: Security — Digital, Physical, and Operational)

Organizational security hygiene:

• Compartmentalize information on a need-to-know basis
• Don’t discuss sensitive plans in Signal groups larger than necessary
• Use code names for sensitive operations if helpful
• Regularly audit who has access to what
• Have a plan for compromised devices or compromised members

Step 7: Full Digital Security Guide

Read: Digital Security for Citizens and Activists

Complete guide covering: device security, encrypted messaging, email, VPNs, social media hygiene, location data, browser privacy, and border crossing procedures.

Common Failure Modes

Failure 1: Using Signal for sensitive messages but discussing the same topics on unencrypted channels Signal does not help if you also discuss sensitive matters on regular SMS, email, or social media. Consistency matters.

Failure 2: Using Signal but not enabling disappearing messages Messages stored on devices can be seized. Enable disappearing messages as your default.

Failure 3: Trusting a VPN to provide anonymity VPNs hide your traffic from your ISP but do not make you anonymous. A VPN provider can be subpoenaed.

Failure 4: Assuming encrypted group chats are secure if any member’s device is compromised Encryption protects against network surveillance. If a device is physically compromised or has malware, all messages on that device are accessible.

Related Role-Based Playbooks

• Journalist Playbook
• Political Activist Playbook
• Civil Rights Activist Playbook

Related Use-Case Playbooks

• Organizing a Resistance Group
• Truth and Reconciliation Archiving
• If You Are Arrested or Detained — device seizure