Hardening

Nothing is ever fully secure, and the more secure something is, the more restricting or inconvenient it generally is.6 Since it is impossible to protect against every attacker, you focus on the most probable threats. That list of the most probable threats is your threat model.

Privacy and anonymity are not the same. The Hitchhiker's Guide puts it plainly: "Privacy is about people knowing who you are but not knowing what you are doing," and "Anonymity is about people knowing what you are doing but not knowing who you are."7 Total anonymity is for whistleblowers and journalists whose lives depend on it; most people do not need to go that far.3 What you need is a threat model: a short list of the threats most likely to affect you, because you cannot defend against every attacker.6

You rank your adversaries by capability and by risk. Privacy Guides pairs the two: risk is the likelihood a threat "will actually occur," and it "goes hand-in-hand with capability."6 At the bottom are the ones who collect data from everyone by default: advertising networks like Google and Facebook and the data brokers behind them.3 Above them are the ones who target you in particular: a security service that has taken an interest in you, or an attacker on the network you are on.6 At the top sit government agencies, which "might have stronger capabilities"6 than any other adversary but are the least probable threat for most people. This module defends against the middle tier: the adversaries who target you in particular but are not government agencies.

Surveillance reaches you on four distinct layers. The lowest is the carrier layer, the SIM and the cellular baseband, which runs below the operating system and reports your location to the carrier no matter what you change. Above it sits the device layer, the OS and the applications it runs, leaking telemetry, hardware identifiers, and radio broadcasts by default. On the network layer, DNS queries, routing, and IP addresses reveal what you access even when the contents are encrypted. The service layer is everything you hand over to a platform; it sits on the platform's servers, and a court order or a breach hands it to an adversary.

The tool below reads what your browser exposes: your IP address, your location, and your device fingerprint.

Open any page and your browser hands the site a list of details about your device, no login required: the browser and version you run, the size of your screen, the fonts you have installed, and the exact way your graphics chip draws a hidden test image.34 No single detail identifies you, but if that combination is unique it becomes your fingerprint, and a tracker can recognize you on your next visit.34 A cookie is the small file a site saves in your browser to recognize you next time, and you can block it or delete it; a fingerprint leaves no such file, so there is nothing to clear, and changing your IP address with a VPN does not change it.34 Brave blocks fingerprinting scripts by default, though that does not stop all fingerprinting, and Mullvad Browser and Tor Browser go further: they make every user hand over the same answers, the only way to thwart advanced tracking scripts, because you blend into a crowd.35

Your browser can also reveal your real IP address while a VPN is running. WebRTC is a browser feature for real-time voice, video, and data. To open a direct connection between two browsers, it discovers the device's own IP addresses, including the local network address and the public one, and a web page can run this discovery with no permission prompt and no visible call. If the VPN routes only part of the device's traffic, or runs as a browser extension rather than for the whole device, this discovery can report the real public address the VPN is meant to hide. You confirm your own browser does not leak this way with a WebRTC leak test in Unit 07.

Fingerprinting is not limited to what a page's JavaScript reads. The TLS handshake that begins every HTTPS connection follows a pattern specific to the browser and its version, recorded as a value called a JA3 or JA4 fingerprint. The set and order of the HTTP headers, the User-Agent string, and the Client Hints the browser sends each describe the browser and the operating system. The parameters of the TCP/IP packets describe the operating system as well. Blocking JavaScript, clearing cookies, or opening a private window changes none of these. This is the reason Mullvad Browser and Tor Browser make every user identical: they normalize these lower layers too, so you match the crowd at each layer and not only in JavaScript.

Your ISP can still see that you connect to the Tor network, and ISPs and governments may compile lists of Tor users from that visibility, so a lone Tor user on a low-traffic connection stands out.36 Tor Browser ships with bridges for that visibility, and you leave it unmodified, because any non-standard setting pushes you out of the very crowd you are hiding in.36 Bridges carry a limit of their own: they may provide adequate censorship circumvention, but that is a transient benefit. They do not adequately protect you from your ISP discovering you connected to Tor in the past through historical traffic-log analysis, because bridge IPs are discovered and blocked, just not immediately.44

While a SIM is in the phone and its radio is on, the phone registers with the cell towers around it, and the carrier records which towers it connects to; that record is your location over time.11 The cellular baseband that does this runs below the operating system, so no app permission or setting on the phone reaches it. Airplane mode is a software command to those radios to stop transmitting; while it is set, the phone no longer registers with towers and, by default, stops actively scanning the Wi-Fi access points and Bluetooth devices around it that Apple and Google map to a location more precise than GPS.7 But it is a setting the operating system asks the closed baseband to honor, not a hardware cut, and a powered-off phone is not necessarily silent: iPhones, recent Samsung phones, and Macs keep broadcasting an identifier over Bluetooth Low Energy so the Find My network can locate them while offline,7 and an iPhone 11 or later on iOS 15 or later holds its Bluetooth chip in an ultra-low-power state that pings the Find My network for up to twenty-four hours after you turn it off.41 Neither airplane mode nor power-off erases the location history already collected, and the only way to be certain a device emits nothing is to seal the device in a Faraday bag, which blocks all radio frequency signals.7

Your laptop, your wireless earbuds, your smartwatch, your fitness tracker, and the key finder clipped to your bag each broadcast a wireless identifier of its own. Your phone does the same, sending out Wi-Fi and Bluetooth probe requests that carry its identifiers even when it connects to nothing.8 A system sold to law enforcement, Leonardo's ELSAG SignalTrace, pairs sensors with license-plate cameras to capture those Bluetooth, Wi-Fi, and RFID signals and bundle them into a single electronic signature.2728 Seventy cars in a hundred may carry an iPhone, but only one carries that iPhone plus an Audi radio, a pair of Bose headphones, a Garmin sports watch, a key finder, and one specific license plate. That combination of devices is the electronic signature that identifies the vehicle.27

Every application, website, and service begins with a DNS lookup: your device asks a name server to translate a hostname to an IP address, and by default that query goes in plaintext to your ISP's resolver before the connection opens. The ISP sees the domain name of every site you visit.9 That record does not stay with the ISP: the FTC found that ISPs in its study use web browsing data to target ads, combine it with app-usage and personal information, and share real-time location data with third parties.49 Leaked NSA documents published by Le Monde show the agency ran MORECOWBELL, a covert program monitoring DNS lookups at scale, with a companion program able to intercept and rewrite DNS answers.10 One detail worth knowing now, because it undoes work you do later: a hardened browser resolves DNS through its own encrypted channel by default, which sends its lookups to a provider the browser chose rather than to any resolver on your network. That is fine until Module 01, where you build your own resolver. At that point you turn the browser's own setting off, or it bypasses the resolver you just stood up.

Your messages raise a separate question: who can read the contents at each hop, not just who you contacted and when. The answer depends on which layer of encryption the service uses.

The interactive below maps each exposure point on the phone, and on what you carry with it, to what closes it, in three categories: red is the exposure no phone setting reaches, amber is the exposure a setting closes, and green is the exposure that only a different operating system closes. The carrier and SIM are red because the baseband that registers your phone with the towers runs on its own processor below the operating system, outside any app permission or toggle. DNS is amber: every connection opens with a name lookup that, by default, leaves the phone unencrypted on UDP port 53 to the resolver your ISP assigned, where it can be surveilled or modified in transit; the fix is to point the phone at an encrypted resolver, over DNS over TLS or HTTPS, now, and to run your own in Module 01.9

Physical access to the phone creates a threat distinct from remote collection. Law enforcement and intelligence agencies use commercial extraction tools that connect through the phone's USB port and image device storage directly. Cellebrite UFED is one of the most widely documented.14 Leaked Cellebrite capability documents from October 2025 show how much the device state matters: per the published reporting, locked stock Pixels yield some information even before first unlock, while every locked Pixel 9 running current GrapheneOS was listed as inaccessible, and older GrapheneOS builds yielded only partial results.45 What those tools can pull depends on the phone's encryption state. A phone that has not been unlocked since it last booted is in the Before First Unlock (BFU) state: the disk encryption keys have not been loaded into memory, and extraction tools find no usable key material. Once you unlock the phone after boot, it enters the After First Unlock (AFU) state: the keys sit in memory and some tools can recover them without knowing your PIN.12 Advanced Protection on Android and Lockdown Mode on iPhone both block USB data transfer while the phone is locked, which closes the extraction path.1516 If you anticipate a stop, search, or seizure, powering the phone off instead of locking the screen restores BFU state. EFF's border guidance says the same for the checkpoint specifically: enable full-disk encryption, not just a screen lock; disable biometric unlocks in favor of a strong passcode; and power down your devices. How far you can refuse depends on status: U.S. citizens must be let back into the country, lawful permanent residents generally must be as well, and other non-citizens who refuse to comply may be denied entry.46

Most account takeovers start with a reused password rather than an elaborate hack. An attacker takes the username-and-password pairs exposed in past breaches and tries each against every other service, a technique called credential stuffing.1819 If your email shares a password with a breached forum, both are compromised at once. A password manager with unique generated passwords removes that attack surface.

SMS two-factor authentication does not add the protection most people assume. SS7, the Signaling System No. 7 that carriers still use to route calls and texts between operators, was built to trust interconnected networks, so a party with SS7 access, a rogue or leased carrier interconnect or a compromised node, can send signaling that reroutes your texts and queries your location, intercepting the texted codes.5 Moving to 4G or 5G does not fix it: 4G's Diameter signaling and 5G's interconnect carry the same interception and location flaws, their optional protections are usually left off, the networks still interwork with SS7 for roaming, and an attacker can downgrade your phone to 2G, where GSM's weak or absent encryption exposes the SMS outright.3239 The weak link is the SMS, not your connection. A SIM-swap attack achieves the same result without any protocol access: the attacker convinces your carrier to move your number to their SIM, and the code goes to them instead. An authenticator app generates codes on the device. A passkey goes further: it is bound to the domain of the real site, so a phishing page that mimics your email login receives nothing when you authenticate.17

Full-disk encryption stops anyone who boots the laptop from a USB stick from reading the drive, but it adds a condition: the encryption keys must not be in memory. When a laptop sleeps, RAM stays powered and the keys remain loaded. A Thunderbolt or USB4 port supports Direct Memory Access, which lets a connected device read system RAM without involving the operating system. Apple Silicon Macs and PCs with Kernel DMA Protection wall kernel memory off from that port; an older laptop without it stays exposed to a few minutes with a DMA device, which can lift the disk encryption keys from a sleeping, previously unlocked machine.20 Cold boot attacks reach the keys by another path on any machine: RAM holds its contents for several seconds after power is cut, and chilling the chips stretches that window long enough to read them.38 Powering the laptop off clears RAM entirely. When you leave a machine unattended where physical access is a real possibility, powered off means the encrypted drive is scrambled data, with no key left in memory to unlock it.

An SSH keypair is two matching files: the private key stays on this laptop, and the public key is the half you hand out, so any server holding it trusts the laptop that holds its match. This is the credential the rest of the series runs on: in Networking you put the public key on your first server, and the laptop logs in with no password to steal. You open a terminal and run:

$ ssh-keygen -t ed25519

The -t ed25519 flag picks the modern key type, introduced in OpenSSH 6.5 in 2014: an elliptic-curve scheme that "offers better security than ECDSA and DSA and good performance."24 You accept the default location and set a passphrase. The passphrase encrypts the private key file, so a copied file is useless without it. Your two files land in ~/.ssh/: id_ed25519 (private) and id_ed25519.pub (public). The file ending in .pub is the only one you ever share.

Verify: ls ~/.ssh lists both files, and you set a passphrase when prompted.

You confirm each item on the checklist across your devices.

• Phone: updated and still supported, strong lockscreen, high-risk mode on, theft and identity protection on, permissions trimmed, advertising ID reset, unused radios off, encrypted DNS set.
• Accounts: a manager with unique passwords, passkeys where offered, app or hardware MFA, aliases per service.
• Browser & network: a fingerprint-resisting browser installed, and a no-logs VPN for the connections you want off your ISP.
• Laptop: disk encrypted with the recovery key on paper, screen auto-locks, firewall on, automatic updates on, daily use on a standard account, telemetry off, a recent encrypted backup made.
• Keys: both files in ~/.ssh/, the passphrase set.

This module does not make you anonymous, and it does not close the carrier layer; unit two covers why. Hardening is not one-time either. Automatic updates stay on because they patch the vulnerabilities attackers use, but a major update can switch settings back on, reset app permissions, or add a feature that collects by default. After one, you check your settings again.33

The next module, Networking, builds on this. You SSH into a server with the keypair you just generated, configure WireGuard, and self-host Matrix and AdGuard Home on a Raspberry Pi. That resolver encrypts your DNS lookups, so your ISP no longer sees them. The private key on this laptop is the only credential that opens the server, and it never leaves this machine.

Task: Collect what an adversary could obtain about you without a warrant, reduce it, and confirm the reduction.
Condition: Given your own phone, laptop, home network, and online accounts, an internet connection, and a two-week window for mailed and emailed replies. You work only against your own identity, devices, and home.
Standard: Baseline exposure documented across four vectors (data held, identity brokers, home and RF, browser fingerprint) and scored. The listed hardening actions and opt-outs completed and dated. The re-measured score brought below baseline on the fingerprint and the identifiable-device count, and the adversary summary written.

Download the field exercise worksheet (PDF)

Task: Complete the Module 00 test.
Condition: Given ten questions covering units one through seven, without reference to the module units or notes.
Standard: Answer at least eight of ten questions correctly. For each question missed, reread the unit named in the feedback and retake the test until the standard is met.

advertising ID

A resettable identifier the operating system gives apps so trackers can follow you across them. You reset or remove it in the phone's privacy settings.

Advanced Protection / Lockdown Mode

One-switch high-risk modes that shrink the attack surface. Android's Advanced Protection disables 2G, blocks sideloading, and blocks USB data when the phone is locked; iOS Lockdown Mode limits risky message attachments and web features and blocks wired connections when locked.

anonymity

Acting with no persistent identifier that ties activity back to you. Hardening does not provide it.

BFU / AFU

Before First Unlock and After First Unlock: a phone that has not been unlocked since boot holds no usable encryption keys in memory; once unlocked, the keys sit in memory where some extraction tools can reach them. Powering off restores BFU.

baseband

The chip that runs cellular. It runs closed, vendor-supplied firmware below the operating system, and no setting on the phone fully controls it. Airplane mode asks it to stop transmitting rather than cutting its power.

cold boot attack

Reading disk encryption keys out of a machine's RAM by cutting power and cooling the chips, which slows how fast the memory loses its contents. A related attack reads RAM directly over a Thunderbolt port (direct memory access) while the machine sleeps; modern hardware such as Apple Silicon walls that off. Either way, a powered-off machine whose RAM has cleared has no key left to read.

credential stuffing

Trying username-and-password pairs leaked from one breach against many other services, betting that you reused the password. A unique password per service makes a leaked pair useless everywhere else.

data broker

A company that aggregates and resells personal data. Opt-outs reduce, but do not erase, what is held.

DNS

The Domain Name System: the protocol that translates hostnames to IP addresses. By default, DNS queries leave your device in plaintext to your ISP's resolver, exposing every domain name you visit to the ISP and to any program monitoring that resolver.

fingerprint

The combination of traits your browser and device expose (screen, fonts, timezone, and more) that identifies you with no cookie.

full-disk encryption

Encrypts the whole drive at rest, so a powered-off device reads as noise without the passphrase. FileVault, BitLocker, LUKS.

GrapheneOS

A hardened, de-Googled Android for Pixel phones, adding verified boot, sandboxed Google Play, and per-app network and sensor controls.

IMSI-catcher

A device that impersonates a cell tower to collect the subscriber identifier (IMSI) your SIM broadcasts. Sold by a range of commercial manufacturers.

MFA

Multi-factor authentication: a second factor beyond a password. App and hardware-key factors resist phishing; SMS does not.

metadata

Data about data: who communicated with whom, when, for how long, and from where, without the message content. File metadata includes GPS coordinates, author, and edit history.

passkey

A login credential tied to your device, with no password to phish or steal. Phishing-resistant by design.

RFID

Radio-frequency identification, the technology in contactless cards, access badges, transit cards, car keys, and passports. Readers can log tags passing by; the mitigation is carrying fewer tags or shielding them.

SIM swap

Moving your phone number to an attacker's SIM to intercept texted codes. The reason SMS is a weak second factor.

SS7

The legacy signaling protocol that links phone networks. An attacker with access to it can intercept calls and texts, including SMS two-factor codes, and track a phone's location. The reason SMS is a weak second factor.

SSH keypair

Two matching files: a private key that stays on your laptop and a public key you put on a server, so the laptop logs in without a password.

threat model

Your answers to what you protect, from whom, how likely the threat is, how bad the consequences are, and how much effort is justified.

verified boot

The device confirming on every start that its operating system is the signed, unmodified one.

1. Microsoft Learn: Configure Windows diagnostic data in your organization
2. FCC report / CNN: Wireless carriers keep your location data for years and provide it to the police (2022)
3. Privacy Guides: Common Threats (CC BY-SA 4.0)
4. EFF Street Level Surveillance: Cell-Site Simulators / IMSI Catchers
5. Puzankov: “Bypassing GSMA Recommendations on SS7 Networks” (Light Fighter Library, Communicate/Cellular-5G): on the SS7 signaling network an attacker can “Track your location” and “Intercept your data, calls and SMS messages,” exposing texted one-time codes even where GSMA protections are deployed; with CISA: Mobile Communications Best Practice Guidance, version 2.0 (2025-11-24) (verified 2026-07-07)
6. Privacy Guides: Threat Modeling (after EFF Surveillance Self-Defense, "Your Security Plan")
7. The Hitchhiker's Guide to Online Anonymity (2022)
8. EFF Surveillance Self-Defense: Mobile Phones: Location Tracking
9. Privacy Guides: DNS Overview
10. C. Grothoff, M. Wachs & M. Ermert: NSA's MORECOWBELL: Knell for DNS; documents published by Le Monde (2015)
11. Carpenter v. United States, 585 U.S. ___ (2018)
12. Privacy Guides: iOS Overview (Before First Unlock; invasive telemetry)
13. Privacy Guides: Android Overview
14. Upturn: Mass Extraction: The Widespread Power of U.S. Law Enforcement to Search Mobile Phones (2020)
15. Google: Advanced Protection on Android 16 (disables 2G, blocks sideloading, blocks USB data while locked)
16. Apple: About Lockdown Mode (wired connections require the device unlocked)
17. Privacy Guides: Multifactor Authentication (TOTP offers no phishing resistance; WebAuthn binds to the origin domain)
18. Privacy Guides: Introduction to Passwords (credential stuffing; unique passwords)
19. Akamai: What Is Credential Stuffing (residential proxies; scale)
20. Privacy Guides: macOS Overview (FileVault on Secure Enclave; Apple Silicon Direct Memory Access protections)
21. Apple Developer Forums: DestroyFVKeyOnStandby and hibernatemode on M1 Macs (the pmset standby tweak has no effect on Apple Silicon)
22. Microsoft: Retrace your steps with Recall (a snapshot of the screen "saved every few seconds"; opt-in, stored locally)
23. Ubuntu: telemetry on Ubuntu Desktop (opt-in; aggregate hardware/usage; never used to build personal profiles)
24. Arch Wiki: SSH keys (Ed25519 introduced in OpenSSH 6.5, January 2014: "offers better security than ECDSA and DSA and good performance"; public/private key roles)
25. Privacy Guides: Data and Metadata Redaction (photos carry Exif and GPS; documents carry metadata)
26. Privacy Guides: Data Removal Services (public-record data on people-search sites; opt-outs are a per-site stop-gap)
27. Leonardo: ELSAG SignalTrace (signal-intelligence system; captures Bluetooth, Wi-Fi, and RFID identifiers into an "electronic signature")
28. Joseph Cox, 404 Media: "This Company Will Add Phone, AirPod, and Smartwatch Trackers to License Plate Readers" (2026-06-08; independent reporting on SignalTrace from Leonardo's product sheet)
29. Privacy Guides: Email Services (encrypted-storage providers with anonymous payment: Proton Mail, Mailbox.org, Tuta)
30. Consumer Reports Security Planner: Prevent SIM-swapping attacks (SIM PIN; carrier port-out lock); with Apple: Use a SIM PIN for your iPhone or iPad (wrong guesses lock the SIM; the PUK code comes from the carrier; verified 2026-07-15)
31. Proton: payment options: cash (USD/EUR/CHF), Bitcoin, and Monero (added July 2025), so a paid account need not be tied to your identity (verified 2026-06-19). Tuta, by contrast, takes card/PayPal directly; crypto only via third-party gift cards.
32. P1 Security: SS7, Diameter, GTP, IMS & 5G signaling risks: 4G Diameter and 5G signaling carry the same interception and location flaws as SS7 (and their optional protections are usually left off); SS7 stays active in roaming and 2G/3G fallback; and an attacker can downgrade a 4G/5G phone to 2G to intercept SMS (verified 2026-06-19)
33. TechRadar: iOS 17 reset some users' privacy settings: a major OS update can re-enable privacy toggles you had turned off (iOS 17 re-enabled Significant Locations and iPhone Analytics; Apple acknowledged it), reset app permissions, or add on-by-default features. Re-check settings after a big update (verified 2026-06-19)
34. EFF: Cover Your Tracks: About: browser fingerprinting is built from "the user agent string," "screen resolution and color depth," "the fonts installed," and "a hash of the image generated by canvas" and WebGL rendering; "if your browser is unique, then it's possible that an online tracker can identify you even without setting tracking cookies" (verified 2026-06-22)
35. Privacy Guides: Desktop Browsers: Brave blocks "fingerprinting scripts (note that this does not protect you from all fingerprinting)"; Mullvad Browser and Tor Browser prevent fingerprinting "by making your browser fingerprint identical to all other… users," a "'crowd' to blend in with… the only way to thwart advanced tracking scripts" (verified 2026-06-22)
36. Privacy Guides: Tor Browser: a casual user must weigh "your ISP collecting evidence" of Tor use, and everyday use "lowers the quality of 'lists of Tor users' that ISPs and governments may compile"; Tor Browser provides access to "the Tor network and bridges"; "browser extensions and non-standard settings make you stand out from others on the Tor network" (verified 2026-06-22)
37. Privacy Guides: Email Aliasing: a service that generates "a new email address for every website you register for," hiding your main address; true aliasing beats plus-addressing because "websites, advertisers, and tracking networks can trivially remove anything after the + sign" to correlate you (verified 2026-06-22)
38. Halderman, Schoen, Heninger et al., “Lest We Remember: Cold Boot Attacks on Encryption Keys” (USENIX Security 2008 / CACM 2009): DRAM "retain[s] their contents for seconds to minutes after power is lost, even at operating temperatures and even if removed from a motherboard," and "cooling the memory chips prior to cutting power dramatically prolongs data retention" (verified 2026-06-22)
39. Shaik, Borgaonkar, Asokan, Niemi & Seifert: “Practical Attacks Against Privacy and Availability in 4G/LTE Mobile Communication Systems” (NDSS 2016; Light Fighter Library, Communicate/Cellular-5G): "fake base stations were used as 'IMSI catchers' to harvest" subscriber identities; "a semi-passive attacker can locate an LTE device within a 2 km² area in a city whereas an active attacker can precisely locate an LTE device using GPS co-ordinates"; the attacks can "silently and persistently downgrade LTE devices… (limiting them to less secure 2G/3G)" (verified 2026-06-22)
40. Digital Exhaust Opt-Out Guide for Law Enforcement Partners and Their Families, version 2.0 (Light Fighter Library, Intelligence/OSINT): an operational-security playbook to "reduce… data aggregated about the American public," cataloguing the primary data brokers and people-search sites you must opt out of one site at a time (verified 2026-06-22)
41. Apple: Locate a device in Find My (iPhone User Guide): on iPhone 11 and later running iOS 15 or later, the Bluetooth chip stays in an ultra-low-power state after the phone is turned off and pings the Find My network, so a powered-off iPhone can still be located for up to 24 hours (verified 2026-06-25)
42. Brave: “Fingerprinting Defenses 2.0”: Brave randomizes the values fingerprinting scripts read from canvas, WebGL, and Web Audio, "deterministically generated using a per-session, per-eTLD+1 seed," and states these defenses "could be circumvented by motivated, targeted attacks," recommending Tor Browser against that threat (verified 2026-07-04)
43. Microsoft: Turn on device encryption: "Unlike BitLocker Drive Encryption, which is available on Windows Pro, Enterprise, or Education editions, Device Encryption is available on a wider range of devices, including those running Windows Home"; it requires a TPM, Secure Boot, and a Microsoft or work account to store the recovery key (verified 2026-07-04)
44. Privacy Guides: Tor Overview — Protections provided by bridges: "while bridges may provide adequate censorship circumvention, this is only a transient benefit. They do not adequately protect you from your ISP discovering you connected to Tor in the past with historical traffic log analysis… This is a very common occurrence with bridges; they are discovered and blocked relatively frequently, just not immediately" (verified 2026-07-07)
45. Joseph Cox, 404 Media: leaked Cellebrite briefing (2025-10-30), with Android Authority's report on the same leak: the capability matrix covers Pixel 6–9; locked stock Pixels listed as giving "some information" before first unlock (passcodes not brute-forceable for full control); "every locked Pixel 9 running GrapheneOS was listed as inaccessible," with older GrapheneOS devices yielding "partial results up to 2022/2023 patch levels" (verified 2026-07-07; the primary leaked slides are paywalled/forum-hosted — figures here follow the published reporting)
46. EFF: Digital Privacy at the U.S. Border, one-pager revised 2025-08-01: "Enable full-disk encryption, not just a screen lock… Disable biometric unlocks (face/thumb)… Power down your devices"; U.S. citizens "must be let back into the country," lawful permanent residents "generally also must be let back into the country," and for other non-citizens "refusal to comply may result in being denied entry" (verified 2026-07-07)
47. GrapheneOS: features: Auto Reboot "timer is set to 18 hours by default, but can be set to values between 10 minutes and 72 hours, or turned off"; "by default the USB-C port and pogo pins block new connections as soon as the device is locked" (verified 2026-07-07)
48. EFF: Digital Privacy at the U.S. Border: under United States v. Cotterman "a manual search of a digital device is 'routine' and so a warrantless and suspicionless search is 'reasonable' under the Fourth Amendment," which is why EFF argues "all border searches of digital devices should require a probable cause warrant" (verified 2026-07-15)
49. FTC staff report: A Look At What ISPs Know About You: Examining the Privacy Practices of Six Major Internet Service Providers (2021-10-21): two ISPs in the study "use web browsing information to target ads to consumers"; "at least three ISPs in our study report combining consumers' personal information, app usage information, and/or browsing information for advertising purposes"; and "there is a trend in the ISP industry to offer real-time location data about specific subscribers to the ISPs' third-party customers" (verified 2026-07-15)