Compartmentation is the OPSEC discipline of architecting separate identities, devices, accounts, networks, and physical contexts so that compromise of one does not propagate to the others. Identical concept to compartmentalisation; the shorter form is the term used in the US intelligence community and in operational tradecraft documents.
What it means in practice
The principle is structural, not behavioral. A behavioral rule (“be careful with what you post”) fails on the worst day of your year. A structural rule (“the source-contact phone never connects to home Wi-Fi, ever, no exceptions”) survives because the network does not auto-join. Three tiers of compartmentation in increasing rigor. Account level: separate browser profiles, separate email aliases, separate password vaults per operation. Device level: physically separate phone, laptop, and storage for the operation, never charged on the same circuit as personal devices. Identity level: distinct personas with their own payment methods, social presences, addresses of record, kept separate over years. Each tier costs more in money and friction than the previous. Each tier defends against a higher class of adversary.
Where it shows up
Journalists running source-contact tradecraft compartment the source identity from the byline identity. Lawyers under privilege compartment client matters from each other and from personal life. NGO staff in adversarial jurisdictions compartment local identity from international identity. Activists compartment organizing identity from civilian identity. Divorce clients compartment post-separation identity from the former-shared digital household. Travelers crossing hostile borders compartment the trip identity from the home identity. Same principle, different threat model, different price point. The recurring failure is compartmentation that is real on Tuesday but breaks on Sunday because a notification, a tagged photo, or an autocomplete suggestion crossed the wall.
What you can change today
Pick one operation in your current life that needs a wall. Build the minimum compartment for it: a separate browser profile (Firefox containers or a fresh user profile), a separate email alias (Proton alias or SimpleLogin), a separate Signal registration if relevant. Set explicit rules for what goes through the compartment and what does not. Write the rules down. The discipline is not perfection, it is consistency: one slip and the wall leaks. The cost-benefit shifts the moment the operation matters; the wall must already be standing on the day it matters, not built that morning.
Related articles
- Digital security for journalists in 2026: the complete operational guide.
- A journalist was arrested in Kuwait for reposting a CNN video. The law used to charge him didn’t exist yet when he posted it.
- The US government now requires visa applicants to make their social media public.
- The FBI seized a Washington Post reporter’s phone. It contained 1,200 Signal sources.