Introduction: One Person’s Story

I have been active in my community for years. Not long ago, far-right trolls found social media accounts of my friends, family, and workplace. They stalked me and used the photos they found of me and my family members to assemble timelines of my life and to map my social networks. Because of my anti-racist beliefs, they used the information they gathered to threaten me, my family, and my friends. In every harassing email and social media comment, they characterize the projects I participate in as “terrorist groups,” describing me as a “leader” and member of an imaginary “shadowy mob of violent leftists” that they want to “do something serious about.” Whether these conclusions are just shoddy investigative work or intentionally dishonest misrepresentations, their behavior should be concerning to anyone who believes in standing up against oppression.

I deactivated my social media when I learned that this was underway—not because I am ashamed of being associated with the struggle for a freer world, but because I want to protect my friends and social networks. Anyone who knows me knows it is no secret that I oppose all forms of bigotry and oppression. They did not target me specifically for anything in particular I have done, but because they are opposed to all anti-racist, feminist, and queer activism and they think that they can isolate and intimidate us one by one. This is why we need to stand by each other.

I want you to know about this in case you ever find yourself in the same situation. You are not alone. I hope this encourages you to think seriously about your personal online security and the security of your family members and friends.

Robert Bowers, the Pittsburgh synagogue shooter, publicly chatted with alt-right trolls who doxxed anti-racists. The stalking campaign against me shows that they are willing to manufacture falsehoods to put people in those crosshairs. The only way to protect ourselves is to keep showing up for each other. We must not let them intimidate us.

What Is Doxxing?

Doxxing means publishing a person’s private information with the intention of exposing and intimidating them. This can result in physical, emotional, and economic harm to the target. It is intended to dissuade the target from action and to shame them for their ideas and values. It is important to take security seriously before you are doxxed—before you even have reason to fear that you could be doxxed. Often a doxxer will wait until they have gathered a lot of information before releasing it. It is possible that you are already being stalked and will not find out until it is too late.

Whether you are a well-known public activist or hardly involved at all, you should protect your social networks and other spheres of your life—even if you don’t think you are doing anything that would warrant attention. Maintaining good practices protects your friends, family, and community. It is common for people to be included in right-wing conspiracy theories about “Antifa members” solely because they are queer or trans, “look like a leftist,” play in bands, attend an event, or hang out in radical spaces. The information does not have to be correct or justified for someone to target you. All a harasser needs is one piece of information to begin to seek more details online.

Being aware of what information trails you leave online can protect you from law enforcement as well as stalkers. Now that state-imposed surveillance is increasingly sophisticated and livestreaming has become normal at protests, just wearing a mask is often not enough. In June 2020 in Philadelphia, investigators identified a woman starting with nothing more than a blurry photo of her. They followed a trail of breadcrumbs including an Etsy purchase, twitter accounts, and her professional work page. Customs and Border Protection have started to trawl public social media. Securing your online presence can make you feel more secure taking action offline.

An Ounce of Prevention Is Worth a Pound of Cure

There’s no better time to start than now. After you have been doxxed, you may not be able to eliminate the information that is out there even if you try to get it taken down.

There are many different ways to approach this. Obviously, the best way to ensure that no one can find any information about you is to have nothing available—but some people can’t eliminate their online presence, whether because of work, family, or other responsibilities. In some cases, there are strategic reasons to maintain some sort of online persona; for example, having a longstanding, believable but innocuous social media account may be helpful for non-citizens crossing the US border. Thankfully, there are ways to firewall distinct spheres of your life, curate a public profile if you need one, and adopt practices that can help you and your friends to feel empowered to continue taking action in your community. This process can be tedious. It will take time and energy. I recommend doing it together with friends, roommates, or family members to help through some of the difficult or boring aspects.

Maintaining Separate Spheres

If you cannot completely delete yourself from the internet, you can still preserve relative privacy by maintaining distinct spheres¹ of online activity and cleaning up forgotten or infrequently used accounts.

You likely have more than one online presence. This could include social networks, message boards, job sites, email accounts—anything you need to log into. Often in doxxing, information is triangulated from many different sources. One way to reduce the amount of information available to doxxers is to partition these spheres so they are not connected to each other. This is a highly individualized process; take some time to consider the following questions and map out your own online spheres.

Do you spend your time on r/politics or the wall of a Facebook acquaintance debating? Do you frequently like or repost statuses from radical Instagram or Twitter accounts? Do you have images or personal information on job boards? Do you buy things on Etsy or eBay? Do any of your friends post pictures of you on their Instagram accounts? Do you have to promote yourself online for the line of work you are in? Do you connect with your co-workers, family members, and activist friends using the same account? Do you use parts of your real name or birthday for usernames or emails?

Each of these may not be a problem in and of itself, but together they can create links between different spheres of your life.

Ask yourself:

• How separate are each of these accounts/identities?
• What is public? What is private?
• What does public and private mean in the context of each site?
• What can be found by searching your legal name?
• Do you use the same username or email for multiple accounts? Do these cross over into distinct spheres of your life?Take a moment to think about the way in which all of these spheres overlap offline.
• Does your job allow you to be open about your politics?
• How public is your activism? Do you speak to reporters? Do you work at an infoshop?
• Do you filter some or all of your social media content from relatives?
• Are there any references to illegal or controversial activities in a given profile?

Here are a few examples of how your online presence can overlap across different sites:

Relatives

• How open is the relationship between you and your blood/legal relatives? If a stranger had information on just one person in this network, what could they discover about the others?

Politics

• Do you discuss or post about your political beliefs online? If so, on which platforms?

Friends and Community

• If you have social media, who are your friends? Your followers? In what ways do your online communities reflect your IRL communities?

Hobbies

• What hobbies do you have? Do you have friends and community through them? Are you a part of any internet communities dedicated to those hobbies?

Legal

• Who are you on paper? What names, phone numbers, and addresses are you tied to? Do any of your accounts include this information? Do any other sites (probably without your permission)?

Career

• Does your job involve an online presence, website, or social media account? Would there be a problem if your politics overlapped with your career? Or is your career in some way tied to your political identity?

Take time to consider where you overlap, what your online goals are, and where you can separate these spheres.

Tactics

Let’s talk about how to discover what information is available about you, how to identify and eliminate trails, and what online resources exist to remove them.

Begin with what is publicly available. Google yourself and make a list of all of your social media accounts. Delete old accounts for things you no longer use. This is also a good time to download a password manager like 1Password or LastPass to assist you in managing unique usernames, emails, and passwords.

Delete off Snoop Sites/Data Brokers

Find out what information people can find out about you simply using a search engine. Search for yourself on DuckDuckGo and Google. Try doing this search in incognito mode. Try different versions of your name, with and with out your middle name and in quotation marks. You could set Google Alerts to send you emails when your name is published on the internet. This will give you a sense of how much data about you is available online to people who are not in your network.

After this initial search, have a look at all of the data broker sites that profit on trading in personal data. I also encourage you to remove your closest family members at the same time. This process can be arduous; these sites try to make it as difficult as possible to delete information about yourself. There are some things you can’t remove yourself from—for example, if you recently registered to vote and still live at that address. (This is another reason some people choose not to vote.)

The most trafficked host sites include: Been-verified, CheckPeople, Instant Checkmate, Intelius, PeekYou, PeopleFinders, PeopleSmart, Pipl, PrivateEye, PublicRecords360, Radaris, Spokeo, USA People Search, TruthFinder.com, Nuwber, and FamilyTreeNow. I recommend starting by searching yourself on OneRep using the free version of their service—it will show you what sites have your information. Then use that information on this website, which has a guide for opting out of virtually every data broker. If you have more money than time, you can pay OneRep or Just Delete Me to have your information removed, but I usually only recommend this service if you have already been doxxed.

I recommend starting with these by searching each one on this website, which has a guide for opting out of virtually every data broker. If you have more money than time, you can pay for a service called Just Delete Me to have your information removed, but I usually only recommend this service if you have already been doxxed.

Delete Old Accounts

When you search yourself in a online search engine, you may also find old accounts. It can be good to do a reverse search using all of the old user names and screen names you can remember. Accounts you have not used in a long time can make you vulnerable because if they are using an older password, they can try that account’s technical support to get more data about you that they can try to use for other accounts. Download any material of sentimental value to you and permanently close all the accounts you no longer use. These can be full of clues about your life.

First, go to this website, which searches over hundreds of platforms for specific usernames, and search all the possible usernames and emails you have used. This will tell you what platforms have accounts using that handle.

Second, go here and type in the website domain. This website archives a huge array of existing websites, categorizes how easy or difficult they make it to delete an account, and provides the link to the “delete profile” page for each respective site.

Haveibeenpwned.com will help you find out if there are any data breaches involving any accounts you hold. If there are, take immediate action to change passwords.

Change Usernames, Email Addresses, and Passwords

The easiest way for someone to find more information about you is to search your name, aliases, and usernames. To keep your spheres of internet activity separate, always use a new username when you create an account. If you have a professional website for work and must use you legal name, make sure the email you use for that account is used solely for that purpose. You may have to have a handful of email accounts and usernames. I have one for all of my medical and governmental accounts, one for my online shopping, one for my political life, and one for my social media, another for dating sites, and so on. I use aliases and false information for all the websites that represent me or display photos of me.

A password manager is a great help for this, as it will store logins for all of your accounts. I recommend LastPass, which you can download for your phone and web browser. It might be tempting to leave yourself permanently signed in, but always make sure to sign out when you are done using it. First, so you don’t forget the master password—and also to ensure that even if someone manages to gain access to your phone or computer, they can’t access all your personal data. Take this time to create new emails and change usernames for all of the accounts you aren’t going to delete. You can easily create new emails using Protonmail. Both 1Password and LastPass can help generate random string passwords, which are the most secure.

Curate What Is Available and Change Your Privacy Settings

Once you have eliminated all your loose ends, take a look at what you chose to retain and what can be found there. If you keep any social media accounts, go through your profile and note what people can find out about you. You can choose from a range of strategies regarding how to approach this, depending on how cautious you want to be and how certain are that it is possible to keep your different spheres of internet activity distinct.

Some of your options include:

• Deleting all photos of yourself, your pets, your car, your mailbox, tattoos, and anything else that includes unnecessary identifying information—especially your public profile picture.
• Eliminating or falsifying any personal details in your profile—give an inaccurate birthday or no birthday at all, choose random answers for your hometown, schools you have attended, and other information.
• Deleting questionable followers and friends. If you change all of your social media settings to private and you feel confident about your followers list, there may be less reason to hide your face. I still recommend keeping details about your location and intimate personal life offline. Remember, you are only as safe as the most open person in your life. If you choose to be more public, keep your friends and family separate, do not post pictures of them or their personal information without their informed consent, and remember that social connections are visible through social networking and data collection websites.

The Coach from Crash Override Network is a helpful step-by-step guide that links you directly to the privacy settings page for many commonly used social networks. Click “Let’s Get Started” and “Strengthen the security of my online accounts so people can’t break into them as easily,” and follow their guides for all the top social media companies. This guide can also help with other aspects of online security, so after you’ve done that, I recommend finishing the Coach helper and checking out what other resources they offer.

When you think you are done, have a friend try to create a profile based on what information they can find about you while pretending to be a “doxxer” to see if anything you didn’t think of slipped through the cracks. It may be important to periodically check in on what can be found by searching your name every few months.

If You Have Been Doxxed

We do not recommend approaching the police when you are doxxed (or ever). The police may use the information you give them about the harassers, but they will also use the information they get about you and other individuals and groups you may have been publicly associated with. Once that is on file, it’s permanently in their hands, and there’s no guarantee they won’t use it to target you or others with state repression.

If you chose to involve the police, please be transparent and do not ask any radical groups to support you. Be sure to inform any groups that you are connected with of your decision. Usually, the police will do nothing or make the situation much worse. The idea of thiis guide is to provide you with alternatives based in community support and empowerment.

Should I Go Public?

Short answer: Do not immediately react publicly. Take time to secure yourself and alert your networks privately before reacting publicly.

Your first impulse may be to alert as many people as you can immediately with a public announcement or to shut everything down. Going public in this way can provide you with immediate support if you have a sympathetic audience, but it carries the risk of increased aggression from harassers. There are good arguments for being cautious with information at the beginning. The most important thing to do first is to take steps to protect yourself and your networks against further harm.

Immediate announcements can complicate your security efforts. Whether or not the information posted about you is accurate, no one is likely to use it to cause you any serious harm without first confirming at least some of it. Posting on a social media account confirming your doxx immediately confirms that the information about you is accurate; it also indicates that you have seen where it was posted and suggests that you are terrified. This furthers the goals of your harassers. They want to intimidate and isolate you. Do not confirm or deny any of the information they have dug up about you, regardless of whether it is false or embarrassing. They are seeking a reaction. If you let them know that what they have posted is incorrect, they may conclude that they are on the right track and they just need to keep digging. Sometimes, one of the most effective initial public responses is no response at all—don’t make any major changes to your posting habits or show any fear. This can send the message that your doxxer missed the mark, and that the attack was a failure.

After you have had time to process your feelings and secure your position, it may be strategic to go public and perhaps to band together with other people who are in a similar situation. You may be able to leverage the public outrage over white supremacists to create a campaign to dissuade further doxxing—for example, make a funding drive with pledges to give money for every harassing email you or others in your community receive! Since your harassers want to isolate you, public support like this may dissuade further intimidation. Try to be creative, resilient, and strategic. Be careful not to endanger anyone else in this process.

When making public statements, if you posture or brag about your abilities, your ability to employ violence, weapons with which you can defend yourself, or overstate your ferociousness, you may bite off more than you can chew. It is generally not a good idea to misrepresent yourself. Talking directly or indirectly to the harassers does not usually improve matters. I recommend making a positive statement asserting your ethics and beliefs, describing how your identity or your ideals have made you a target but maintaining that while these campaigns of harassment are intended to make you cower, you will not do so, because you have no reason to hide your politics. Avoid talking about specific actions or groups, whether or not you are involved with them.

Immediately after Being Doxxed

1. Don’t panic. Call a close friend to come over and help.
2. Create an incident log and keep records for both online and offline provocations. This is crucial to identifying the patterns of the attacks. It can be useful to compare these with other organizers in order to identify larger patterns so as to identify your opponents and their organizations.
3. Alert your friends, family, and sensitive political networks privately. Task a few friends that you trust with your personal information to help report social media and blog posts that doxx you, identifying them as harassment. Do so repeatedly. Some platforms lack policies that will protect you, even if these posts include accurate personal information, even if they put you in danger. Sometimes, doxxers will use your photos and information to make imposter accounts. It is usually easier to report these as fakes; try to do so quickly in order to prevent them from obtaining more information from your networks by posing as you. You, your family, and your employer may begin to receive threatening or harassing phone calls. Let them know what is happening as quickly as you can and instruct them not to engage with the harassers.
4. Shut down the flow of information. If you are reading this section and have not done the preventative care section, begin that process. Download a password manager like 1Password or LastPass and change all of your passwords immediately. You can also pay for a service called Delete Me that will take much of your online footprint off of snoop sites that harvest and display personal information. This service will take care of the information aggregated by the data brokers but not any social media, web accounts, news articles, or arrest records you may have, those will have to be handled on your own. It is important to balance the hemorrhage of information, while also not alerting your harassers that the dox was effective or on target. Try to shore up your social media accounts by making friends lists and information private in order to protect your networks until you are sure that they don’t offer vulnerable personal information to those willing to dig for it. How you react publicly is a very delicate situation and should be handled carefully throughout this process.
5. Set up a safety plan. Recruit friends and family to support you. Let them know what is going on; doxxing can be traumatic and you need to prioritize your mental and physical health so that you can work through these attacks. These conversations can be difficult—especially if they do not understand the nuances of this political moment, if it’s the first time they are hearing about a particular flavor of hate group, or if your relationships are strained due to political or personal differences. If you don’t feel up to it, you could ask a friend who has a good understanding of the situation to have the more difficult conversations for you.

If your home address is included in the doxx, find somewhere new you can stay if you are able. If you can’t leave your home, invite friends or a local security group to stay with you. Make a “go bag” with everything you will need if you have to pack up and go with little notice.

Evaluating Threats

If you don’t feel you are at any great risk, especially if your doxx is comprised of freely-available information or is just sent directly to you in an effort to unnerve you, you may feel fine dismissing it as a cheap intimidation tactic, blocking and reporting the harasser, and moving on. It may just be a matter of someone trying to get a rise out of you. However, if your doxx includes sensitive personal information, especially details that are not easy to obtain with simple detective work, or it appears in a public forum where people distribute information in hopes that others will act on it, you may want to take further precautions. This is especially true if you are already part of a targeted group or demographic.

When you learn that you have been doxxed, it’s important to establish which information could translate into credible threats. Often, doxxing is a precursor to more intrusive offline harassment, or is connected with threats to act on the information. This could be anything from threatening phone calls to family or workplaces to pointed death threats or a SWAT call.

It is sometimes difficult to determine what makes a threat “credible.” The most common tactic of ordinary doxxers is to send creepy or intimidating messages wherever they think they can reach you—social media, email, and to family members, and the like. They will often imply that they have more information than they really do; it’s common for them to say that they have provided this information to local law enforcement. Their goal is to intimidate you out of acting; often, whatever information they post publically is all that they have.

Your employer may receive calls demanding that they fire you. Thus far, it is rare that the targets of doxxing have been physically attacked, but it has happened, and it is possible that those who doxx you may make efforts to get your information into the hands of people who are not acting rationally or ethically. It is important to be cautious, but don’t panic or immerse yourself in anxiety.

Ask yourself:

• Is the information accurate? Do they have your home, work, or family address? Do they know places you hang out? Who you are friends with?
• Are you at risk of losing your job if they find out any of this information about you?
• Do you know where the harassers live? Are they close to your physical community or just online trolls on a decentralized forum? Do you have reason to believe law enforcement will be interested in this information? Is the information being shared from local right-wing news sources, putting your face in front of a multitude of hostile strangers who now have your information?
• Do they have embarrassing or private photos of you?
• Is there information tying you to criminal activity that could get you arrested?
  

  

Solutions

Here are some things you can do in response to the dangers that can arise from being doxxed:

• Create a self-defense plan, sign up for self-defense classes, contact a local community defense group.
• Inform the people and groups that are named in the doxx—workplace, comrades, roommates, family.
• Talk through your fears with people you trust.
• Contact people who have been through this before for advice.
• Arrange to have a lawyer available if you are worried that the information about you may be of interest to state actors.
• Connect with a local anti-fascist group—they may be able to help identify the doxxers, if the latter are posting from fake account.

Having Conversations with Jobs and Family

This conversation can be very difficult, especially if your relationship with your family is strained. Have a cool-headed friend on call to help mediate or support you afterwards if necessary.

Think about how often you are willing to be vulnerable with your family and how much opportunity you will have in the future to follow up on the conversation. If it’s necessary to speak to family members but you feel like you will only get one chance, you can rehearse with a friend and prepare for their reactions. If you have an ongoing, conversational, trusting relationship, you can explain the situation to them in a series of smaller conversations, instead of one long sit-down. Evaluate how much time and how much attention you will have.

It has always helped me to frame this as “having a stalker” to people who I do not want to have a political conversation with—that may suffice to explain the severity of the situation and why you need privacy. But it can be worth the effort to be honest about what’s going on. This can help build stronger relationships and demystify this common occurrence, while encouraging others who may not have considered that it could happen to them or someone they know to take online privacy seriously. Most people will respond with fear and sympathy, though sometimes they will suggest or even insist that you call the police.

There is no one-size-fits-all approach. In my case, I had to compel my conservative mother to promise that she would not involve the police. I did so by appealing to my right to personal safety and my autonomy as the victim in the situation, asking her to respect my wishes and reminding her that the police can do very little to respond to targeted harassment like this—and all that calling them would do would be to open me up to their scrutiny, since I was being accused of criminal activity. Such conversations can be very difficult, but they are often necessary. Remind your friends and family not to react or respond to any phone calls, emails, or social media requests.

You can read a guide for how to discuss this with your employer here.

Things to remember when talking to your friends and family:

• The harassers’ goal is to strain your relationships and ruin your life. Do not let them succeed at doing this. Tell your family that the best way to support you is to refuse to give in to their tactics.
• Don’t throw anarchists and anti-fascists under the bus or claim that you are being targeted for no reason. This will not serve you if reasons emerge—and it will only delegitimize and further endanger those who can’t distance themselves from anarchist politics.
• Do not let anyone blame you for what is happening, whether for the politics you adhere to or your perceived irresponsibility for getting yourself “into this situation.” Fighting for a better world involves challenges. If anything, it is to your credit that you have provoked this response by your efforts.
• Suggest concrete ways you can help them understand the situation and protect themselves. Send them this article or a list of resources; offer to help them lock down their social media if they are not tech savvy.
• Talk through what they can prepare for—harassing phone calls, emails, perhaps the neighbors will receive messages about you. Prepare them for worst-case scenario, but emphasize that it is unlikely.
• Be clear about what you need from them.

Living Your Life, Moving Forward

Take a deep breath. Do not blame yourself. Emotionally this can be deeply disturbing and disruptive, adding a layer of acute stress to your life. There may be people out there who know what you look like and you will have no idea who they are. Sometimes information from doxxes becomes a permanent part of the internet if you name is googled; this can affect your job prospects. Sometimes nothing comes from the attention—but there is always the possibility that someone will try to pick up where the last doxxer left off.

Until you are sure that your time in the spotlight is over, you may have to alter some aspects of your life. Ask yourself, “What kind of life do I want to live? How can I manage my anxiety? Are there ways I can embrace being a more public figure? How can I feel secure in taking risks and being active again?” Especially as political tensions intensify, it may be important to take more extreme safety measures.

Here are some of the measures you might choose to employ:

• Do not let anyone photograph you unless you trust them to handle the images the way you need them to. This can create some awkward conversations, especially at family events or in professional situations. Be aware of who appears in photos with you; inform them that appearing in a photo with you may attract unwanted attention. It can be helpful to rehearse the conversations you may need to have.
• Install trail cameras at your house.
• Keep logs of all harassment you experience.
• If you move, do not update your address. Do not register to vote, as this makes your address publicly available. Try to hold on to your old driver’s license or ID and receive mail at a post office box. Consider when to use a real address and when to use a fake one or omit your address altogether when you sign up for things online or in person.
• Use pseudonyms online and in person if need be. Don’t use the same one over and over.
• When you go to actions, especially if you don’t mask up, be aware what groups, places, or individuals could be implicated by being seen or photographed in your vicinity.
• Invest time in self-defense classes. This can include weapons training, but should include defensive and disarming training.
• See a therapist to work through any trauma you have experienced.
• Help your friends and family understand the importance of online security.
• Have frank conversations with people outside your circles of political affinity. You may be surprised at how much empathy they express.

No matter how hard the people targeting you try make you feel isolated, you are not in this alone. As a community, we must protect each other and our online networks from harassment, imprisonment, political violence, and intimidation. Together, we can do this.

Citations

• Smiling Face Collective
• Anti-Doxxing Guide for activists facing attacks
• We Are Being Doxxed: What to Do to Keep Each Other Safe
• Guide to Using Signal Securely
• Crash Override Resources: preventing doxxing and post-doxxing resources
• Coach: Crash Override Automated Cybersecurity Helper
• How to Avoid Being Tracked by Facebook
• Communicating Securely Online and via Phones

Get a Password Manager like 1Password or LastPass: You can download it on your phone, computer, and as a browser extension.

Get a VPN: Riseup offers a free VPN, but the one from Nord is more user-friendly.

This podcast presents ideas to help you become digitally invisible, stay secure from cyber threats, and make you a better online investigator.

Imposed version for printing:
doxcare_print_black_and_white

Republished from Crimethinc

A security culture is a set of customs shared by a community whose members may be targeted by the government, designed to minimize risk. Having a security culture in place saves everyone the trouble of having to work out safety measures over and over from scratch, and can help offset paranoia and panic in stressful situations—hell, it might keep you out of prison, too. The difference between protocol and culture is that culture becomes unconscious, instinctive, and thus effortless; once the safest possible behavior has become habitual for everyone in the circles in which you travel, you can spend less time and energy emphasizing the need for it, or suffering the consequences of not having it, or worrying about how much danger you’re in, as you’ll know you’re already doing everything you can to be careful. If you’re in the habit of not giving away anything sensitive about yourself, you can collaborate with strangers without having to agonize about whether or not they are informers; if everyone knows what not to talk about over the telephone, your enemies can tap the line all they want and it won’t get them anywhere. ¹

The central principle of all security culture, the point that cannot be emphasized enough, is that people should never be privy to any sensitive information they do not need to know.

The greater the number of people who know something that can put individuals or projects at risk—whether that something be the identity of a person who committed an illegal act, the location of a private meeting, or a plan for future activity—the more chance there is of the knowledge getting into the wrong hands. Sharing such information with people who do not need it does them a disservice as well as the ones it puts at risk: it places them in the uncomfortable situation of being able to mess up other people’s lives with a single misstep. If they are interrogated, for example, they will have something to hide, rather than being able to honestly claim ignorance.

Don’t ask, don’t tell.

Don’t ask others to share confidential information you don’t need to know. Don’t brag about illegal things you or others have done, or mention things that are going to happen or might happen, or even refer to another person’s interest in being involved in such activities. Stay aware whenever you speak; don’t let chance allusions drop out thoughtlessly.

You can say no at any time to anyone about anything.

Don’t answer any questions you don’t want to—not just with police officers, but also with other activists and even close friends: if there’s something you don’t feel safe sharing, don’t. This also means being comfortable with others not answering questions: if there’s a conversation they want to keep to themselves, or they ask you not to be part of a meeting or project, you shouldn’t take this personally—it’s for everyone’s good that they’re free to do so. Likewise, don’t participate in any projects you don’t feel good about, or collaborate with anyone you feel ill at ease with, or ignore your gut feeling in any situation; if something goes wrong and you get into trouble, you don’t want to have any regrets. You’re responsible for not letting anyone talk you into taking risks you’re not ready for.

Don’t ever turn your friends over to your enemies.

If captured, never, ever give up any information that could endanger anyone else. Some recommend an explicit oath be sworn by all participants in a direct action group: that way, in a worst-case scenario, when pressure might make it hard to distinguish between giving up a few harmless details and totally selling out, everyone will know exactly what commitments they made to each other.

Don’t make it too easy for your enemies to figure out what you’re up to.

Don’t be too predictable in the methods you employ, or the targets you choose, or the times and places you meet to discuss things. Don’t be too visible in the public aspects of the struggle in which you do your most serious direct action: keep your name off mailing lists and out of the media, perhaps avoid association with aboveground organizations and campaigns entirely. If you’re involved in really serious clandestine activities with a few comrades, you may want to limit your interactions in public, if not avoid each other altogether. Federal agents can easily get access to the phone numbers dialed from your phone, and will use such lists to establish connections between individuals; the same goes for your email, and the books you check out from libraries, and especially social networking sites like Myspace.

Don’t leave a trail: credit card use, gas cards, cell phone calls all leave a record of your motions, purchases, and contacts. Have a cover story, supported by verifiable facts, if you might need one. Be careful about what your trash could reveal about you—dropouts aren’t the only ones who go dumpstering! Keep track of every written document and incriminating photocopy—keep them all in one place, so you can’t accidentally forget one—and destroy them as soon as you don’t need them. The fewer there are in the first place, the better; get used to using your memory. Make sure there aren’t any ghosts of such writing left behind in impressions on the surfaces you were writing on, whether these be wooden desks or pads of paper. Assume that every use of computers leaves a trail, too.

Don’t throw any direct action ideas around in public that you think you might want to try at some point.

Wait to propose an idea until you can gather a group of individuals that you expect will all be interested in trying it; the exception is the bosom companion with whom you brainstorm and hash out details in advance—safely outside your home and away from mixed company, of course. Don’t propose your idea until you think the time is right for it to be tried. Invite only those you are pretty certain will want to join in—everyone you invite who doesn’t end up participating is a needless security risk, and this can be doubly problematic if it turns out they feel your proposed activity is laughably dumb or morally wrong. Only invite people who can keep secrets—this is critical whether or not they decide to participate.

Develop a private shorthand for communicating with your comrades in public.

It’s important to work out a way to communicate surreptitiously with your trusted friends about security issues and comfort levels while in public situations, such as at a meeting called to discuss possible direct action. Knowing how to gauge each other’s feelings without others being able to tell that you are sending messages back and forth will save you the headache of trying to guess each other’s thoughts about a situation or individual, and help you avoid acting strangely when you can’t take your friend aside in the middle of things to compare notes. By the time you have convened a larger group to propose an action plan, you and your friends should be clear on what each other’s intentions, willingness to run risks, levels of commitment, and opinions of others are, to save time and avoid unnecessary ambiguity. If you haven’t been part of a direct action planning circle before, you’ll be surprised how complicated and convoluted things can get even when everyone does arrive prepared.

Develop methods to establish the security level of a group or situation.

One quick procedure you can run at the beginning of a larger meeting at which not everyone is acquainted is the “vouched for” game: as each person introduces himself, all who can vouch for him raise their hands. Only vouch for those you are confident are worthy of your trust. Hopefully, each person is connected to the others by some link in the chain; either way, at least everybody knows how things stand. An activist who understands the importance of good security will not feel insulted in such a situation if there is no one present who can vouch for him and the others ask him to leave.

Meeting location is an important factor in security.

You don’t want a place that can be monitored (no private residences), you don’t want a place where you can be observed all together (not the park across from the site of the next day’s actions), you don’t want a place where you can be seen entering and leaving or that someone could enter unexpectedly—post scouts, lock the door once things get started, watch out for anything suspicious.² Small groups can take walks and chat; larger groups can meet in quiet outdoor settings—go hiking or camping, if there’s time—or in private rooms in public buildings, such as library study rooms or empty classrooms. Best-case scenario: though he has no idea you’re involved in direct action, you’re close with the old guy who runs the café across town, and he doesn’t mind letting you have the back room one afternoon for a private party, no questions asked.

Be aware of the reliability of those around you, especially those with whom you might collaborate in underground activities.

Be conscious of how long you’ve known people, how far back their involvement in your community and their lives outside of it can be traced, and what others’ experiences with them have been. The friends you grew up with, if you still have any of them in your life, may be the best companions for direct action, as you are familiar with their strengths and weaknesses and the ways they handle pressure—and you know for a fact they are who they say they are. Make sure only to trust your safety and the safety of your projects to level-headed folks who share the same priorities and commitments and have nothing to prove. In the long term, strive to build up a community of people with long-standing friendships and experience acting together, with ties to other such communities.

Don’t get too distracted worrying about whether people are infiltrators or not; if your security measures are effective, it shouldn’t even matter.

Don’t waste your energy and make yourself paranoid and unsociable suspecting everybody you meet. If you keep all sensitive information inside the circle of people it concerns, only collaborate with reliable and experienced friends whose history you can verify, and never give away anything about your private activities, agents and police informers will be powerless to gather evidence to use against you. A good security culture should make it practically irrelevant whether these vermin are active in your community or not. The important thing is not whether or not a person is involved with the cops, but whether or not he constitutes a security risk; if he is deemed insecure (double meaning intended), he should never be permitted to end up in a situation in which anyone’s safety depends on him.

Learn and abide by the security expectations of each person you interact with, and respect differences in style.

To collaborate with others, you have to make sure they feel at home with you; even if you’re not collaborating with them, you don’t want to make them uncomfortable or disregard a danger they understand better than you. When it comes to planning direct action, not abiding by the security culture accepted in a given community can wreck not only your chances to cooperate with others on a project, but the possibility of the project happening at all—for example, if you bring up an idea others were planning to try in a setting they deem insecure, they may be forced to abandon the plan as it may now be associated with them. Ask people to outline for you their specific security needs before you even broach the subject of direct action.

Let others know exactly what your needs are when it comes to security.

The corollary of abiding by others’ expectations is that you must make it easy for others to abide by yours. At the beginning of any relationship in which your private political life may become an issue, emphasize that there are details of your activities that you need to keep to yourself. This can save you a lot of drama in situations that are already stressful enough; the last thing you need on returning from a secret mission gone awry is to end up in a fight with your lover: “But if you trusted me, you would tell me about this! How do I know you’re not out there sleeping with…” It’s not a matter of trust—sensitive information isn’t a reward to be earned or deserved.

Look out for other people.

Make explicit to those around you what risks you may pose to them with your presence ³ or with actions you have planned, at least as much as you’re able to without violating other precepts of security culture. Let them know to the extent you’re able what risks you run yourself: for example, whether you can afford to be arrested (if there are outstanding warrants for you, if you are an undocumented migrant, etc.), what responsibilities you have to keep up with, whether you have any allergies. Don’t imperil others with your decisions, especially if you’re not able to provide concrete support should they somehow get arrested and charged on account of your behavior. If someone else drops a banner in an area immediately adjacent to a fire you set, the police might charge them with arson; even if the charges can’t stick, you don’t want to risk their ill will, or accidentally block their planned escape route. If you help initiate a breakaway march that leaves the permitted zone, try to make sure you keep your body between the police and others who have come along but don’t necessarily understand the risks involved; if you escalate a spontaneous parade by engaging in property destruction, make sure others who were unprepared for this are not still standing around in confusion when the police show up. Whatever risky projects you undertake, make sure you’re prepared to go about them intelligently, so no one else will have to run unexpected risks to help you out when you make mistakes.

Security culture is a form of etiquette, a way to avoid needless misunderstandings and potentially disastrous conflicts.

Security concerns should never be an excuse for making others feel left out or inferior—though it can take some finesse to avoid that!—just as no one should feel they have a “right” to be in on anything others prefer to keep to themselves. Those who violate the security culture of their communities should not be rebuked too harshly the first time—this isn’t a question of being hip enough to activist decorum to join the in-group, but of establishing group expectations and gently helping people understand their importance; besides, people are least able to absorb constructive criticism when they’re put on the defensive. Nevertheless, such people should always be told immediately how they’re putting others at risk, and what the consequences will be should they continue to. Those who can’t grasp this must be tactfully but effectively shut out of all sensitive situations.

Security culture is not paranoia institutionalized, but a way to avoid unhealthy paranoia by minimizing risks ahead of time.

It is counterproductive to spend more energy worrying about how much surveillance you are under than is useful for decreasing the danger it poses, just as it is debilitating to be constantly second-guessing your precautions and doubting the authenticity of potential comrades. A good security culture should make everyone feel more relaxed and confident, not less. At the same time, it’s equally unproductive to accuse those who adhere to security measures stricter than yours of being paranoid—remember, our enemies are out to get us.

Don’t let suspicion be used against you.

If your foes can’t learn your secrets, they will settle for turning you against each other. Undercover agents can spread rumors or throw around accusations to create dissension, mistrust, and resentment inside of or between groups. They may falsify letters or take similar steps to frame activists. The mainstream media can participate in this by reporting that there is an informant in a group when there is not one, or misrepresenting the politics or history of an individual or group in order to alienate potential allies, or emphasizing over and over that there is a conflict between two branches of a movement until they really do mistrust one another. Again, a shrewd security culture that fosters an appropriately high level of trust and confidence should make such provocations nearly impossible on the personal level; when it comes to relations between proponents of different tactics and organizations of different stripes, remember the importance of solidarity and diversity of tactics, and trust that others do, too, even if media accounts suggest otherwise. Don’t accept rumors or reports as fact: go to the source for confirmation every time, and be diplomatic about it.

Don’t be intimidated by bluffing.

Police attention and surveillance is not necessarily an indication that they know anything specific about your plans or activities: often it indicates that they do not and are trying to frighten you out of continuing with them. Develop an instinct with which to sense when your cover has actually been blown and when your enemies are just trying to distress you into doing their work for them.

Always be prepared for the possibility that you are under observation, but don’t mistake attracting surveillance for being effective.

Even if everything you are doing is perfectly legal, you may still receive attention and harassment from intelligence organizations if they feel you pose an inconvenience to their masters. In some regards, this can be for the best; the more they have to monitor, the more thinly spread their energies are, and the harder it is for them to pinpoint and neutralize subversives. At the same time, don’t get caught up in the excitement of being under surveillance and begin to assume that the more the authorities pay attention to you, the more dangerous to them you must be—they’re not that smart. They tend to be preoccupied with the resistance organizations whose approaches most resemble their own; take advantage of this. The best tactics are the ones that reach people, make points, and exert leverage while not showing up on the radar of the powers that be, at least not until it is too late. Ideally, your activities should be well known to everyone except the authorities.

Security culture involves a code of silence, but it is not a code of voicelessness.

The stories of our daring exploits in the struggle against capitalism must be told somehow, so everyone will know resistance is a real possibility put into action by real people; open incitements to insurrection must be made, so would-be revolutionaries can find each other and the revolutionary sentiments buried in the hearts of the masses find their way to the surface. A good security culture should preserve as much secrecy as is necessary for individuals to be safe in their underground activities, while still providing visibility for radical perspectives. Most of the security tradition in the activist milieu today is derived from the past thirty years of animal rights and earth liberation activities; as such, it’s perfectly suited for the needs of small groups carrying out isolated illegal acts, but isn’t always appropriate for more aboveground campaigns aimed at encouraging generalized insubordination. In some cases it can make sense to break the law openly, in order to provoke the participation of a large mass that can then provide safety in numbers.

Balance the need to escape detection by your enemies against the need to be accessible to potential friends.

In the long run, secrecy alone cannot protect us—sooner or later they are going to find all of us, and if no one else understands what we’re doing and what we want, they’ll be able to liquidate us with impunity. Only the power of an informed and sympathetic (and hopefully similarly equipped) public can help us then. There should always be entryways into communities in which direct action is practiced, so more and more people can join in. Those doing really serious stuff should keep it to themselves, of course, but every community should also have a person or two who vocally advocates and educates about direct action, and who can discreetly help trustworthy novices link up with others getting started.

When you’re planning an action, begin by establishing the security level appropriate to it, and act accordingly from there on.

Learning to gauge the risks posed by an activity or situation and how to deal with them appropriately is not just a crucial part of staying out of jail; it also helps to know what you’re not worried about, so you don’t waste energy on unwarranted, cumbersome security measures. Keep in mind that a given action may have different aspects that demand different degrees of security; make sure to keep these distinct. Here’s an example of a possible rating system for security levels:

1. Only those who are directly involved in the action know of its existence.
2. Trusted support persons also know about the action, but everyone in the group decides together who these will be.
3. It is acceptable for the group to invite people to participate who might choose not to—that is, some outside the group may know about the action, but are still expected to keep it a secret.
4. The group does not set a strict list of who is invited; participants are free to invite others and encourage them to do the same, while emphasizing that knowledge of the action is to be kept within the circles of those who can be trusted with secrets.
5. “Rumors” of the action can be spread far and wide through the community, but the identities of those at the center of the organizing are to be kept a secret.
6. The action is announced openly, but with at least some degree of discretion, so as not to tip off the sleepier of the authorities.
7. The action is totally announced and aboveground in all ways.

To give examples, security level #1 would be appropriate for a group planning to firebomb an SUV dealership, while level #2 would be acceptable for those planning more minor acts of property destruction, such as spraypainting. Level #3 or #4 would be appropriate for calling a spokescouncil preceding a black bloc at a large demonstration or for a group planning to do a newspaper wrap, depending on the ratio of risk versus need for numbers. Level #5 would be perfect for a project such as initiating a surprise unpermitted march: for example, everyone hears in advance that the Ani DiFranco performance is going to end in a “spontaneous” antiwar march, so people can prepare accordingly, but as no one knows whose idea it is, no one can be targeted as an organizer. Level #6 would be appropriate for announcing a Critical Mass bicycle ride: fliers are wrapped around the handlebars of every civilian bicycle, but no announcements are sent to the papers, so the cops won’t be there at the beginning while the mass is still vulnerable. Level #7 is appropriate for a permitted antiwar march or independent media video screening, unless you’re so dysfunctionally paranoid you even want to keep community outreach projects a secret.

It also makes sense to choose the means of communication you will use according to the level of security demanded. Here’s an example of different levels of communications security, corresponding to the system just outlined above:

1. No communication about the action except in person, outside the homes of those involved, in surveillance-free environments (e.g. the group goes camping to discuss plans); no discussion of the action except when it is absolutely necessary.
2. Outside group meetings, involved individuals are free to discuss the action in surveillance-free spaces.
3. Discussions are permitted in homes not definitely under surveillance.
4. Communication by encrypted email or on neutral telephone lines is acceptable.
5. People can speak about the action over telephones, email, etc. provided they’re careful not to give away certain details—who, what, when, where.
6. Telephones, email, etc. are all fair game; email listservs, fliering in public spaces, announcements to newspapers, etc. may or may not be acceptable, on a case-by-case basis.
7. Communication and proclamation by every possible medium are encouraged.

If you keep hazardous information out of circulation and you follow suitable security measures in every project you undertake, you’ll be well on your way to fulfilling what early CrimethInc. agent Abbie Hoffman described as the first duty of the revolutionary: not getting caught. All the best in your adventures and misadventures, and remember—you didn’t hear it from us!

Further Reading

• Security Culture: The Puppet Show
• Anonymity: Dressing for Success