How to Build the Safest Possible Digital Persona in a Repressive Country
-A thread-
-A thread-
This is standard operational hygiene for journalists, activists, and any outspoken citizen who wants to stay safe.
I’ll break it down from basic to advanced.
I’ll break it down from basic to advanced.
1. Separate identities:
Public Persona vs Real Identity
Public persona:
Alias, never your real name
No face photos
No real-time locations
Not linked to phone numbers tied to your legal ID
Voice: analytical, observational, restrained
Public Persona vs Real Identity
Public persona:
Alias, never your real name
No face photos
No real-time locations
Not linked to phone numbers tied to your legal ID
Voice: analytical, observational, restrained
Real Identity:
Used for work, family, banks, legal matters.
Never touches political content.
A repressive state doesn’t need to censor your speech; it only needs to connect your speech to your body.
Used for work, family, banks, legal matters.
Never touches political content.
A repressive state doesn’t need to censor your speech; it only needs to connect your speech to your body.
2. Separate devices
Device A (clean):
Your main phone, used for work, banking, family, official apps.
Never logs into your public persona.
Device B (dirty):
Cheap, separate phone.
Not linked to your real SIM or ID
Used only for public commentary.
Device A (clean):
Your main phone, used for work, banking, family, official apps.
Never logs into your public persona.
Device B (dirty):
Cheap, separate phone.
Not linked to your real SIM or ID
Used only for public commentary.
3. Separate SIM cards or numbers.
Your biggest vulnerability is when:
Work number, Banking number, WhatsApp number, Social media number are all the same.
For a public persona:
Use a SIM card not tied to your national ID.
Never connect it to e-wallets or banking apps.
Your biggest vulnerability is when:
Work number, Banking number, WhatsApp number, Social media number are all the same.
For a public persona:
Use a SIM card not tied to your national ID.
Never connect it to e-wallets or banking apps.
4. Strip metadata
Most people leak identity through metadata, not content:
- GPS tagging
- Photo EXIF data
- Auto-upload to cloud drives
- Real-time sharing
- Device name that contains + real name
- WiFi networks that reveal
home or workplace
Most people leak identity through metadata, not content:
- GPS tagging
- Photo EXIF data
- Auto-upload to cloud drives
- Real-time sharing
- Device name that contains + real name
- WiFi networks that reveal
home or workplace
5. Safe communication style
Avoid:
- Naming officials directly
- Personal insults
- Claims of criminal acts
- Explicit calls for protest
- Emotional ranting
Use:
- Historical parallels
- System level critique
- Methapors
- Dry humor/irony
- Questions instead of statement
Avoid:
- Naming officials directly
- Personal insults
- Claims of criminal acts
- Explicit calls for protest
- Emotional ranting
Use:
- Historical parallels
- System level critique
- Methapors
- Dry humor/irony
- Questions instead of statement
6. Never unify all platforms
Do not use the same persona for:
- Twitter
- Instagram
- TikTok
- YouTube
- Threads
- etc
The more platforms are connected, the easier you are to track.
Do not use the same persona for:
- TikTok
- YouTube
- Threads
- etc
The more platforms are connected, the easier you are to track.
7. Protect your social graph
States don’t chase opinions; they chase networks.
Don't:
- follow coworkers & family
- connect to your LinkedIn
- join political WhatsApp/Telegram groups with real number
Your social connections are fingerprints.
States don’t chase opinions; they chase networks.
Don't:
- follow coworkers & family
- connect to your LinkedIn
- join political WhatsApp/Telegram groups with real number
Your social connections are fingerprints.
8. Prepare for low-level harassment
In semi-authoritarian states, the first attacks are not from police.
They’re from:
- coordinated report brigades
- doxxing attempts
- threatening DMs
- trash burners (buzzer mobs)
In semi-authoritarian states, the first attacks are not from police.
They’re from:
- coordinated report brigades
- doxxing attempts
- threatening DMs
- trash burners (buzzer mobs)
How to handle:
- Don’t reply emotionally
- Use filters for toxic terms
- Keep screenshots but stay silent
- Restrict replies (followers only)
- Turn off DMs
- Protect your email
This often prevents escalation.
- Don’t reply emotionally
- Use filters for toxic terms
- Keep screenshots but stay silent
- Restrict replies (followers only)
- Turn off DMs
- Protect your email
This often prevents escalation.
9. Don’t link your public persona to your workplace
- No workplace hints
- No industry clues
- No meeting complaints
- No photos from the office
- No references to your role
Repressive systems love applying pressure through employers.
Don’t give them the rope.
- No workplace hints
- No industry clues
- No meeting complaints
- No photos from the office
- No references to your role
Repressive systems love applying pressure through employers.
Don’t give them the rope.
10. Create an “airlock” between your online and real life
Whatever you share publicly must never link directly to your offline movement.
Rules:
- Never post where you are
- Never post what you’re doing in real time
- Avoid specific time windows (like daily routines)
Whatever you share publicly must never link directly to your offline movement.
Rules:
- Never post where you are
- Never post what you’re doing in real time
- Avoid specific time windows (like daily routines)
11. Use a consistent VPN identity
Switching locations too much is suspicious. Pick one country (Singapore works well). Stick to it.
12. Separate email identities
Use ProtonMail, Tutanota, or Mailbox. Don’t connect it to any service with billing info and don't back up to cloud
Switching locations too much is suspicious. Pick one country (Singapore works well). Stick to it.
12. Separate email identities
Use ProtonMail, Tutanota, or Mailbox. Don’t connect it to any service with billing info and don't back up to cloud
13. Exit plan for digital emergencies.
If things go bad:
Don’t announce anything
Don’t make a farewell post
Simply vanish
Steps:
- Log out everywhere
- Change passwords
- Delete apps
- Swap devices
- Freeze the persona
- Redirect people to nothing
Silent is safest.
If things go bad:
Don’t announce anything
Don’t make a farewell post
Simply vanish
Steps:
- Log out everywhere
- Change passwords
- Delete apps
- Swap devices
- Freeze the persona
- Redirect people to nothing
Silent is safest.
15. Weaponize ambiguity
Never give the system a clean quote to use against you.
Speak in ways that are:
intelligent
ambiguous
layered
half-joking
interpretative
A repressive state hates things it cannot categorize.
Never give the system a clean quote to use against you.
Speak in ways that are:
intelligent
ambiguous
layered
half-joking
interpretative
A repressive state hates things it cannot categorize.
Closing:
stay unpredictable, untraceable, and un-collapsible into one identity.
A repressive state only needs one thing to shut you down:
a direct line from your voice to your legal identity.
Your job is to break that line in as many places as possible.
stay unpredictable, untraceable, and un-collapsible into one identity.
A repressive state only needs one thing to shut you down:
a direct line from your voice to your legal identity.
Your job is to break that line in as many places as possible.
• • •
Missing some Tweet in this thread? You can try to
force a refresh
