Obfuscating your identity - actsecure/resources GitHub Wiki

tl;dr:

The principles section applies to everyone.

Pick and choose new habits according to the first principle: convenience, as well as your risk level.

This guide is a work in progress.

Principles

Make it convenient for yourself

Make it easy for yourself. Using false data requires some discipline and you should absolutely build in safeguards and assume you will mess up from time to time.

Build better habits over time

Disappearing from the system all at once is extremely difficult, not to mention a huge hassle to maintain. Start small and work on being more mindful of your personal information.

Maintain consistent false data

To get false data to look plausible and get it to propagate through data brokers, it's best to maintain two or three consistent profiles of false data. Prepare a few plausible profiles in advance and use them consistently.

New habits

There are things you can do to improve your day-to-day trackability. These are foundational habits to get into that will help you if you decide you want to compartmentalize your identity more thoroughly.

Use a password manager

Password managers remember things for you, which means you can use harder to remember usernames / passwords, which means they will also be harder to track.

Use an ad-blocker

A lot of tracking happens via ads. Using an ad blocker like Privacy Badger will make it harder for companies to create and sell profiles of your data.

Don't use your legal name

Your legal name unlocks a whole world of data brokers, public records, and internet history. If you can avoid using it, it will make it more difficult to dox you or hack into your personal life.

Don't post your birth date publicly

Choose one or two birth dates that give you approximately the same age (but a few years off is actually helpful if you can look the part) and use them consistently. Using them as part of a false profile will help ensure that the data appears valid and gets propagated through online data aggregators. Many data brokers will bin people by age group (i.e. 20's, 30's) so if you can straddle a boundary and get yourself in more than one bin (I'm 28 and 34!) that's a plus. Keep in mind that when people are attempting to identify activists, they will be guessing your age from photos or seeing you in person, so if you look older or younger than your true age, lean into it!

Change up your usernames

Definitely don't use the same username for everything, in particular for your banking. For websites like banking that aren't social media accounts, use a random username. A password manager can generate them for you.

"Slow burner" email accounts

Set up a couple of long-term google accounts as "burner" accounts (i.e. not linked to your true identity and location). Think of these like your spam email, just a little more of a hassle to set up. Use these accounts for services where you need an email to log in, but you don't need to use your primary email address.

Use a Google Voice number

Google Voice is a VOIP / call forwarding service that is free to use. If you register a google voice number using a false name, that name will propagate to data brokers. This is a convenient and very legitimate-looking way to get false data into data brokers. This layer of obfuscation is critical for activists who need to be able to give out their phone numbers for organizing purposes.

Get a PO Box / away from home delivery location

Getting a PO box or using services like Amazon Locker will allow you to receive mail without disclosing your home address.

Compartmentalizing your life

If you are doing high risk work and you know you're in it for the long haul, compartmentalizing your identity can give you a lot of peace of mind and freedom to do rad shit. Here's how to really get serious.

Use multiple profiles

Create different profiles based on what's convenient to you. Here are some templates:

  • Online shopping - Real address, fake name. If you're ordering things online you may need to have them delivered to your real address. You can avoid using your real name by using paypal or a credit card with a fake name (see below for more info).
  • Social media - Real name, fake address. For services where you want to be identifiable to, say, colleagues and family, but you don't need anything delivered to you, use your real name but don't use your real address.
  • Online services - Fake name, fake address / phone. For things like paid online services or anything where delivering things to your house is never an issue, there's no reason to enter real information ever.

Choosing a fake address

Consider your risk level. If you are a low-profile activist, choosing real addresses at random is probably fine. If you are high risk and think you may be swatted, choose a plausible but false address such as a large apartment building but with no apartment number. Map the address and make sure it looks real. Providing a fake address is also a great way for privileged folks with not a lot of free time to contribute to movement work. Find a friend who lives near you.

Making purchases

You can get credit cards in a fake name using privacy.com. Get one for each identity you will use consistently. You can also use PayPal to hide your identity when making purchases. Keep in mind though, that neither of these services will protect you from the state. The best way to hide purchase trails from the state is using cash.

Making the transition

Once you've decided to compartmentalize, here are some tips for transitioning cleanly and effectively.

Keep track of your identities

Plan out the identities you want to use, write down what they are for and all of their basic information. If you use a password manager, many have a "form fill" option that you can use to essentially manage identities. The form fill feature will make it an easy, one-click process. You can create profiles in LastPass or 1Password.

Propagating false data

Most data brokers don't take submissions, but if you sign up for a CVS card that data will definitely find its way into a data broker. Sign up for discount clubs, edit your profile in the services you use. Register some cheap domain names and don't use whois protection (if you have any domain names already registered with your real name, make sure you use whois protection).

Delete your Facebook

We know, it's rough. But your facebook account has a unique ID that will allow data brokers (and creeps) to track you. Changing your name on Facebook is not enough.