Short answer The surveillance does not begin when you publish. It begins when someone decides they want to know what you are working on. By the time you have a reason to suspect something, the access has usually already been established. This is not speculation. It is the pattern across documented cases in different countries,…
Short answer Proton or Mullvad depends entirely on your threat model. If account creation itself is a risk, use Mullvad. No email, no identity, cash by post. If you need a full privacy ecosystem or a VPN that works through active blocking, use Proton. Both have been tested under real adversarial conditions. Both held. This…
Short answer The right answer is not one tool. It is understanding what each tool actually protects, what it exposes, and at which point in a source relationship each one belongs. Most guides to secure communication treat this as a ranking exercise. Best, second best, avoid. The reality is more precise. Each of these tools…
Short answer The image was not intercepted. It was not hacked out of a server. It was handed over voluntarily, as part of a routine document request. The GPS coordinates embedded in the file placed the source at a meeting they had denied attending. The journalist never shared the photo publicly. It was in a…
Short answer The email was not intercepted or hacked. It was handed over by the provider under a legal request the journalist never knew existed. The failure was not technical. It was a misunderstanding of what “secure email” means when the provider is a US company subject to compelled disclosure with non-disclosure orders. The email…
Short answer Six hours is a conservative estimate. With a Cellebrite UFED and an unlocked device, it is faster. What they extract: message history, deleted files, EXIF metadata from photos, browser history, app databases, cloud account access via active sessions. What limits them: a strong alphanumeric passphrase, USB Restricted Mode enabled, Signal with disappearing messages,…
Short answer A personal threat model answers five questions: What are you protecting? From whom? How likely are they to try? What are the consequences if they succeed? How much friction will you actually sustain? Answer these honestly and your tool choices become obvious. Skip them and you will spend effort in the wrong places….
Short answer The airport is too late. By the time you are at the border, every decision that matters has already been made. This checklist works backwards from the border crossing: three weeks before, one week before, 48 hours before, at the border, in-country, returning. Each phase has specific actions. None of them work if…
Short answer The weakest link is almost never the encryption. It is the decision the source made before they knew they were a source by contacting you from a work email, on a work device, from an office network. The channel hierarchy: Signal with disappearing messages first, Proton Mail second, any other encrypted channel third….
Short answer Eleven minutes from seizure to full content access. The laptop was password protected. Seven-character password. The correct response to this is not a better password — it is a travel device that contains nothing sensitive. A device that reveals nothing when searched cannot be used against you. Eleven minutes is how long it…