Dirty Little Machine

from Beatrix Morrigan, Digital Artificer

Resources on Safety & Security

Table of Contents See also: Tactics, Community, Know Your Enemy

Operational

Community Care as a Pillar of Operational Security

Digital

Locking Down What You Have

Passwords, PIN Codes, FaceID, Fingerprints
Mobile Devices
Laptops, Desktops, Flash Drives, and External Hard Drives
  • encrypt all of your USB drives, external hard drives, all of the storage drives in your computers, all of them, before you put anything on them.
  • ensure that all login accounts on your computer have a strong password
  • be very, very careful about where you save any recovery keys or passwords for encrypted machines.
    [Microsoft spokesperson Charles Chamberlayne] said [Microsoft] receives around 20 requests for BitLocker keys per year and in many cases, the user has not stored their key in the cloud making it impossible for Microsoft to assist.

    [...]

    Both [Matt Green, cryptography expert and associate professor at the Johns Hopkins University Information Security Institute,] and [Jennifer Granick, surveillance and cybersecurity counsel at the ACLU,] said Microsoft could have users install a key on a piece of hardware like a thumb drive, which would act as a backup or recovery key. Microsoft does allow for that option, but it’s not the default setting for BitLocker on Windows PCs.

    Without the encryption keys from Microsoft, the FBI would’ve struggled to get any useful data from the computers. BitLocker’s encryption algorithms have proven impenetrable to prior law enforcement attempts to break in, according to a Forbes review of historical cases. In early 2025, a forensic expert with ICE’s Homeland Security Investigations unit wrote in a court document that his agency did “not possess the forensic tools to break into devices encrypted with Microsoft BitLocker, or any other style of encryption.” In one previous case, federal investigators obtained keys by discovering that a suspect had stored them on unencrypted drives.

    Now that the FBI and other agencies know Microsoft will comply with warrants similar to the Guam case, they’ll likely make more demands for encryption keys, Green said. “My experience is, once the U.S. government gets used to having a capability, it's very hard to get rid of it.”

    - from Microsoft Gave FBI Keys To Unlock Encrypted Data, Exposing Major Privacy Flaw by Thomas Brewster for Forbes on January 23 2026
  • How to Encrypt a USB Flash Drive with BitLocker (Windows), Veracrypt (Windows, Linux), or macOS' Disk Utility (Apple).
    • see my warning above about taking care where you store any decryption or recovery keys
  • How To Encrypt Any USB Drive With VeraCrypt
  • How to Encrypt USB Drive with Bitlocker
  • How to Encrypt external USB drives on macOS in 3 minutes
"The Cloud"
  • "the cloud" is just warehouses of computers that someone else owns and operates. the people who operate these warehouses will do different things to try to convince you that your data is actually private and safe with them - you have to judge on a case-by-case basis whether you can rely on those promises, or you have to add some extra protections that allow you not to rely on those promises quite as much.
  • you can add another layer of encryption to the files you store "on the cloud" with the open-source application Cryptomator
  • when you do use "the cloud", make sure you're always aware of your account settings and which devices are synchronizing what data
Metadata
Messages and Emails
  • regular SMS texts and emails are not encrypted. You could, technically, put your texts and emails through the cryptographic algorithms yourself and then send them, then your friend could decrypt them algorithmically - but that sounds horrible to most people. A more practical approach is to use messaging and emailing platforms that build the encryption into the application. when this is done properly, it's called end-to-end encryption
all recommended tools are free and open source unless otherwise noted.
  • Delete Me - a paid service to scrub your personal information from search engines and data brokers.
    Delete Me's business is to do the annoying work for you, to get your information off of data broker sites. You can do this work yourself, as described in the following guides:
  • End-to-End Encrypted Messaging & Calling
  • End-to-End Encrypted Email
  • 1Password - paid closed-source password management service.
    • though 1Password is closed-source, I'm willing to forgive that for a few reasons:
      • 1Password uses, ironically, a 2-key cryptographic system to encrypt your password vault (don't worry, you only have to remember one day-to-day).
      • they publish the results of regular 3rd-party audits and certifications (this is industry-standard practice, but I like what I see of how they do it anyways)
      • they've published a whitepaper explaining the design of 1Password in nerdy detail
    • if you'd still prefer an open-source password management option, try Bitwarden, Proton Pass, or a flavor of KeePass - check the Privacy Guides page about password managers for a more detailed discussion
    • password managers are a hotly debated topic in privacy nerd circles, for plenty of valid reasons. some folks (like this former Google Project Zero researcher) will tell you to use your browser's password manager, while others will balk at anything except a self-hosted password vault. I am recommending services that I think are the best combination of usable by the average person, and well-designed and executed for privacy and security.
  • Malwarebytes - antivirus software for most phones and computers. not open source. paid service upgrades available.
  • TailsOS - portable anonymizing operating system
  • Filesharing
    • CryptPad - encrypted filesharing service. good alternative to Google Drive for collaborative file editing. paid service upgrades available. excellent security options with per-file granularity available.
    • Riseup Pad - ephemeral encrypted filesharing service
    • Proton Drive - Google Drive replacement
  • Web Browsers
  • VPNs

    basic things to look for when choosing a VPN: a no-logs policy confirmed by independent audit, a warrant canary, parent company based in a country where privacy laws favor the consumer, parent company not owned by an advertising or data broker entity

    • Surfshark
    • Mullvad is my foremost VPN recommendation for the privacy-conscious, for a few reasons:
      • neither names, addresses, phone numbers, nor email addresses are required to get a Mullvad VPN subscription. accounts are tied to random 16-digit numbers
      • you can pay for your subscription with cash, Monero, bank wire-transfer, credit card, Bitcoin, Bitcoin Cash, PayPal, Swish, EPS Transfer, Bancontact, iDEAL, Przelewy24, and vouchers sold by resellers. this variety of options tells me that Mullvad understands that privacy isn't something you can achieve with one tool or strategy alone.
      • Mullvad's feature selection is up-to-date with current industry knowledge on privacy-invading practices; for example, they offer DAITA: Defense Against AI-guided Traffic Analysis to combat statistical categorization of your internet activity based on metadata
      • Swedish authorities have tried executing a warrant for customer data on Mullvad's offices in 2023, and had to walk away empty-handed
      • as a policy, Mullvad doesn't do influencer sponsorships
    • Proton VPN
Further Guides to Recommended Apps
Further Digital Security Resources

Medical

Gearing Up

TLDR: All PPE must be well-fitted to be effective. Goggles should be rated ANSI Z87.1. Respirators should be rated for P100 and OV (organic vapors). Get a helmet with a chin strap or other method to keep it from falling off, and know the pros and cons of suspension helmeys vs. crash helmets vs. padded helmets. Wear skater's knee and elbow pads to protect yourself from falls and impacts.