Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

One solution (if you really need to communicate using a mobile phone) is to drive (better with public transport or in taxi) with the phone (turned off, no battery) to some random location, with no CCTVs around, turn it on at predefined time, wait for contact, turn it off, remove the battery, go home. The phone must be clean (not used before with other SIM cards that can be linked to you) and the SIM card must be clean (not used with other phones that can be linked to you). And you should change the phone (or at least its IMEI, but better change the phone, changing the IMEIs is illegal in most countries) and the SIM card regularly.

Edit:

Or better use the internet for communications, cryptography and steganography are working.



I think this is what you are looking for. http://grugq.github.io/blog/2013/06/13/ignorance-is-strength...

As for how to use the phone to avoid attracting attention, the typical technique is to use payphones on one end and the regular phone on the other. There are details here: http://grugq.tumblr.com/post/61946725012/hizb-allah-resurrec...

The open codes that get used to avoid detection, at least historically (modern usage seems to be even more restricted) are examined here: http://grugq.tumblr.com/post/60890158036/al-qaedas-codes

And here is an analysis of a modern clandestine organisation that used mobile phones for communication: http://grugq.github.io/blog/2013/10/07/drug-delivery-service...


All invalidated by corroborating the times with the call log where you were not present.

Your edit is a better option in that regard, but as long as online is blended in some way with offline, anonymity is impossible... which is why I don't even bother for the most part.


If you don't have much of a presence (either social or on-line) to begin with, like being a reserved person, there isn't much data to be corroborated with in the first place.


True. But then again, you don't need that much anyway. I doubt they scanned his entire email archive at least first. Just the fact of including his real email and that one post on SO seemed to have been enough to establish probable cause.

His social interactions could have only been directly traced to 2-3 posts outside of Tor at most. What really did him in are the pseudonyms and similarity of preferences picked up from those few instances. So really, any online/social presence is a liability if it's contaminated with something about you offline.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: