General Rules of Guarding Against Attacks

Robert Mungai

1. Atomicity is the default.Keep your actions discrete and self-contained.
2. Everything is a secret, without exception, unless necessity dictates otherwise.Maintain utmost secrecy unless there's a compelling reason to disclose information.
3. Everything leaves a trace.Be aware that all actions can be traced, so act accordingly.
4. Someone or something is always watching or collecting.Assume constant surveillance and data collection.
5. Need to know, need to be there, need to be known.Only share information, attend events, or make yourself known when it's necessary.
6. Do not talk.Minimize verbal communication to reduce the risk of information leaks.
7. Outflow and inflow are both problematic.Be cautious about information leaving or entering your domain.
8. Operational Security (OpSec) should expose opponent actions (Detection and Accounting).Your security measures should reveal your opponents' actions while keeping yours hidden.
9. Reduce perception by the opponent.Minimize the information your opponents can gather about your activities.
10. Don't expose your social network, drop names, or share contact details.Keep your social connections and personal information confidential.
11. Beware of traces, taps, trackers, storage, and hidden information.Stay vigilant against potential surveillance and data breaches.
12. Less data and fewer actions mean more security.Limit the amount of data you generate and actions you take to enhance your security.
13. Perform reconnaissance before taking action.Gather intelligence before engaging in any activities.
14. Choose to cooperate or conceal as needed.Decide whether to collaborate or remain hidden based on the situation.
15. Sharing is a threat.Sharing information can pose risks to your security.
16. Keeping unnecessary information can lead to trouble. Delete or destroy what you don't need.Regularly clean up and discard information you no longer require.
17. Beware of garbage or pocket-litter. Maintain conscious control over your surroundings.Be mindful of leaving behind any physical or digital traces.
18. Embrace variation and randomization.Introduce variability into your actions and routines to avoid predictability.
19. Prioritize higher security over efficiency. Efficiency can lead to repetition and sharing.Focus on security even if it sacrifices some efficiency.
20. Change your operational footprint and signature.Alter your patterns and behaviors to avoid detection.
21. Create cover activities and habits to blend into the baseline.Develop routines and behaviors that make you inconspicuous.
22. Reduce linkability by using many names and creating multiple legends.Diversify your identities and stories to prevent easy linkage.
23. Beware of identifiers, such as social media, phones, numbers, addresses, photos, number plates, names, brands, etc.Be cautious of information that can be used to identify you.
24. Learn about opponent resources, methods, tactics, and be aware of manipulation and the unknown when relying on outside information.Understand your adversaries and exercise caution when using external information.
25. Connect everything, but keep security as high as the highest risk.Ensure that your security measures match the level of risk in your operations.
26. Stay away from surveillance, including cameras, crowds, automatic number plate recognition, cellphones, wifi hotspots, etc.Avoid places and technologies that enhance surveillance.
27. Use imprecise/fuzzy information where information sharing cannot be avoided but is not necessary for operational success, especially in social situations.Share vague or ambiguous information in situations where complete secrecy isn't possible.
28. Synchronize fuzzy information to create a legend.Align ambiguous details to build a believable backstory.
29. Embrace legends and covers, giving reasons and satisfying wants.Create compelling narratives and personas that explain your actions and motivations.
30. Use your imagination.Be creative and adapt to changing circumstances.
31. Remember, surveillance and Operational Security (OpSec) is a lifestyle. Retain your operational capabilities in an age of mass data production and retention, surveillance states, corporate manipulators, intelligence competition, and noisy "transparent" societies.Make OpSec an integral part of your life to maintain your capabilities in a world filled with data, surveillance, and information warfare.