# Install a minimal Debian-based system
curl -fsSL https://raspi.debian.net/tested/raspi_4_bookworm.img.xz | xz -d | sudo dd of=/dev/sdX bs=4M status=progress

# Disable all network interfaces post-installation
sudo systemctl mask NetworkManager.service
sudo systemctl mask wpa_supplicant.service

# Disable CPU frequency scaling (prevents timing attacks)
sudo echo "performance" | sudo tee /sys/devices/system/cpu/cpu*/cpufreq/scaling_governor

# Disable swap to prevent data written to disk
sudo swapoff -a
sudo sed -i '/swap/d' /etc/fstab

# Install and configure firejail for application sandboxing
sudo apt install firejail
firejail --private --net=none firefox

# Configure system DNS over TLS
echo -e "[Resolve]\nDNSOverTLS=opportunistic" | sudo tee /etc/systemd/resolved.conf.d/dns.conf
sudo systemctl restart systemd-resolved

# Android: Disable location services via ADB
adb shell settings put secure location_mode 0

# iOS: Disable significant Locations
# Settings > Privacy > Location Services > System Services > Significant Locations = Off

# Linux: Prevent WiFi geolocation
sudo systemctl mask geoclue.service
sudo chmod -x /usr/libexec/geoclue-2.0/demo/agent

# Configure curl to use Tor
curl --socks5 localhost:9050 https://check.torproject.org/api/ip

# Configure git to use Tor
git config --global http.proxy socks5h://localhost:9050
git config --global https.proxy socks5h://localhost:9050

# Strip EXIF data using exiftool
exiftool -all= -overwrite_original sensitive_photo.jpg

# Batch process directory
find ./photos -type f -exec exiftool -all= {} \;

# Secure memory wipe demonstration (Linux)
sync
echo 3 | sudo tee /proc/sys/vm/drop_caches
sudo cryptsetup luksClose encrypted_volume

# Device 1: Air-gapped writing device
# - Debian on offline laptop
# - No WiFi/Bluetooth hardware
# - External USB keyboard (no internal input devices)
# - Used only for drafting sensitive documents

# Device 2: Tor communication device
# - Live USB running Tails OS
# - Reboots fresh on each session
# - Pre-loaded with Signal configuration
# - Only connects through Tor + VPN chain

# Device 3: Clean device for public activities
# - Android phone with minimal apps
# - Regular web browsing, email
# - Completely separate identity
# - Never used for sensitive communications

# Device 4: Backup recovery device
# - Encrypted recovery keys for all other devices
# - Stored in physically secure location
# - Accessed only in emergency

# Test device compartmentalization
#!/bin/bash
# Verify devices don't communicate
for device in air-gapped-laptop tor-device android-phone; do
    echo "Testing $device isolation..."
    arp-scan -l | grep -v $device
    # Should find no common networks
done

#!/bin/bash
# Tails OS hardening for CI protection

# 1. Create persistent volume on USB
# This survives reboots and maintains configuration

# 2. Configure automatic bridges for Tor
# Prevents ISP from detecting Tor usage
# Settings > Tor Connection > Automatic Bridges

# 3. Set hostname to maximum entropy
# Instead of "tails-user"
sudo hostnamectl set-hostname $(openssl rand -hex 4)

# 4. Enable firewall with minimal exceptions
sudo systemctl enable ufw
sudo ufw default deny incoming
sudo ufw default allow outgoing

# 5. Disable ICMP to prevent ping detection
sudo iptables -A INPUT -p icmp -j DROP

# 6. Configure AppArmor for application confinement
sudo systemctl enable apparmor
sudo aa-enforce /etc/apparmor.d/*

# 7. Set aggressive swap configuration
echo "vm.swappiness=0" | sudo tee -a /etc/sysctl.conf

# 8. Disable all unnecessary services
sudo systemctl disable bluetooth
sudo systemctl disable cups
sudo systemctl disable avahi-daemon

#!/bin/bash
# Dead drop setup for critical CI communications

# Physical dead drop: Pre-arranged location for message exchange
# 1. Pick obscure but accessible location
# 2. Use signal items (chalk mark, stone placement) to indicate new message
# 3. Messages in sealed envelope, coded if necessary
# 4. Check frequency: Every Sunday 3 PM, or on agreed signal

# Example dead drop signal system
# - White stone on fence: Check location for message
# - Two white stones: Do not approach, area under surveillance
# - Dead drop location: Tree root marker, 10 paces north of telephone pole

# Digital dead drop using compromised accounts
# 1. Create fake email account (no real personal info)
# 2. Exchange drafts without sending
# 3. Both parties access same account, read drafts, delete after reading
# 4. Leaves no transmission records
# 5. Credentials provided out-of-band (spoken, written, memorized)

# Example Gmail dead drop
# Username: observer.field.report@gmail.com
# Use: Settings > Forwarding and POP/IMAP > Disable forwarding
# Creates draft messages
# CI handler and CI both access same account from secure networks
# Review drafts, delete after reading

#!/bin/bash
# Counter-surveillance checklist

# Physical security
- [ ] Vary routes to communication locations
- [ ] Check for surveillance vehicles (repeated license plates)
- [ ] Avoid fixed schedule patterns
- [ ] Conduct counter-surveillance of your own patterns
- [ ] Use public transportation (harder to follow than personal vehicle)
- [ ] Identify escape routes from meeting locations

# Digital security
- [ ] Assume all wireless networks are monitored
- [ ] Never use personal identifying information in emergency accounts
- [ ] Rotate devices regularly (if possible)
- [ ] Check device for physical tampering (micro-cameras, etc.)
- [ ] Monitor device battery drain (indicator of malware)

# Communication security
- [ ] Verify handler identity before sharing sensitive info
- [ ] Use predetermined challenge-response phrases
- [ ] Abort communication if anything feels wrong
- [ ] Never discuss methods in recorded communications
- [ ] Assume voice communications are recorded

# Financial security
- [ ] Pay cash for SIM cards, not credit card
- [ ] Use separate payment method for each distinct identity
- [ ] Be alert to unusual financial scrutiny
- [ ] Maintain separate bank account for handler payments (if applicable)

#!/bin/bash
# Security practice documentation

cat > ~/ci-security-practices.txt <<'EOF'
Date Documented: $(date)

SECURITY PRACTICES IMPLEMENTED:
1. Device isolation
   - Air-gapped writing device for sensitive materials
   - Tor-only communication device
   - Public identity device completely separate

2. Encryption standards
   - All data encrypted with AES-256
   - All communications end-to-end encrypted
   - Disk full-disk encrypted

3. Key management
   - Keys not stored on networked devices
   - Key escrow with trusted party for emergency access
   - Regular key rotation

4. Communication verification
   - Out-of-band key verification performed
   - Safety numbers verified in person
   - Challenge-response authentication used

5. Operational discipline
   - No metadata cross-contamination
   - Regular device replacement
   - Physical counter-surveillance awareness

This document establishes that security practices met
industry standards for information protection.
EOF

# Encrypt and secure this document
gpg --symmetric --cipher-algo AES256 ~/ci-security-practices.txt
shred -vfz -n 10 ~/ci-security-practices.txt
chmod 600 ~/ci-security-practices.txt.gpg

# Monitor for common CI compromise indicators

# 1. File system changes
cd ~/Documents
find . -type f -mtime -1  # Modified in last 24 hours
# Unexpected changes suggest malware

# 2. Process monitoring
ps auxww | grep -E "ssh|nc|curl|wget|telnet"
# Verify all processes are user-initiated

# 3. Network connections
netstat -tupln | grep -E ":[0-9]+.*ESTABLISHED"
# Check for unexpected outbound connections

# 4. Port monitoring
netstat -tulpn | grep LISTEN
# Look for unexpected listening ports

# 5. Cron job verification
crontab -l
for user in $(cut -f1 -d: /etc/passwd); do
  crontab -u $user -l 2>/dev/null
done
# Malware often installs cron persistence

# 6. Sudoers verification
sudo cat /etc/sudoers
sudo cat /etc/sudoers.d/*
# Check for unauthorized sudo entries

# 7. If compromise suspected:
# - Immediately shutdown (hard shutdown, don't sync)
# - Do not use system for further communications
# - Recover with fresh operating system
# - Notify handler through alternative channel

# Emergency continuity procedures

# 1. Device compromise recovery
# - Have pre-positioned backup CI device ready to activate
# - Encrypted credentials stored separately
# - Activation procedure: Decrypt credentials, establish Tor connection

# 2. Communication re-establishment
# - Secondary handler contact method pre-arranged
# - Agreed signal to indicate compromise
# - Alternative meeting locations pre-scouted

# 3. Legal support activation
# - Attorney contact information memorized (not written)
# - Legal funds in protected account
# - Instructions for attorney to follow if you're detained

# 4. Physical safety
# - Safe house location known to trusted contact
# - Bug-out bag maintained at secure location
# - Travel documents (if applicable) stored separately

# 5. Post-compromise review
# - All devices assumed compromised
# - All previous contacts potentially exposed
# - Full threat re-assessment necessary
# - New operational security posture required