Hostile environments & source protection
Short answer Six hours is a conservative estimate. With a Cellebrite UFED and an unlocked device, it is faster. What they extract: message history, deleted files, EXIF metadata from photos, browser history, app databases, cloud account access via active sessions. What limits them: a strong alphanumeric passphrase, USB Restricted Mode enabled, Signal with disappearing messages,…
Short answer A personal threat model answers five questions: What are you protecting? From whom? How likely are they to try? What are the consequences if they succeed? How much friction will you actually sustain? Answer these honestly and your tool choices become obvious. Skip them and you will spend effort in the wrong places….
Short answer The airport is too late. By the time you are at the border, every decision that matters has already been made. This checklist works backwards from the border crossing: three weeks before, one week before, 48 hours before, at the border, in-country, returning. Each phase has specific actions. None of them work if…
Short answer The weakest link is almost never the encryption. It is the decision the source made before they knew they were a source by contacting you from a work email, on a work device, from an office network. The channel hierarchy: Signal with disappearing messages first, Proton Mail second, any other encrypted channel third….
Short answer Eleven minutes from seizure to full content access. The laptop was password protected. Seven-character password. The correct response to this is not a better password — it is a travel device that contains nothing sensitive. A device that reveals nothing when searched cannot be used against you. Eleven minutes is how long it…