Core OPSEC principles that apply regardless of your threat level — VPNs, metadata, device security, and the failures that matter.
A January 2026 GAO report confirmed US military OPSEC training does not address commercial data brokers. The same brokers were exposed in the Gravy Analytics breach. The soldier who locks down Instagram still has his home address on dozens of databases.
FulcrumSec leaked 3.9 million records and 118 .gov profiles from LexisNexis Legal and Professional after exploiting an unpatched React frontend. The platform every law firm uses just became the database every attacker wants.
Three affiliate programmes. One editorial mention. Each tool passed the same filter: would we use it ourselves if our security depended on it. Everything else got declined.
Every site you visit collects 22 signals from your browser, hardware, and behavior, without consent. Most are unaffected by VPN or private browsing. The operator countermeasures, layer by layer.
Browser fingerprinting identifies you across sessions, VPNs, and incognito. The signals, the tests, and the only browsers that actually break it.
Hankey v. United States: the Supreme Court heard arguments on April 26, 2026 on whether a warrant targeting a geographic area, not a person, is constitutional. Your phone’s location history is the evidence.
Yes, in several documented ways. A VPN masks your IP address from the sites you visit and encrypts traffic between your device and the VPN server.
DNS queries: every domain name your device looks up.
When you open an incognito window, your browser stops saving three things locally: your history, your cookies, your form data.
In 2018, a Missouri sheriff used a carrier-data reseller called Securus to track the location of a judge and a fellow officer without a warrant.