Editing Operational Security (OPSEC) (section)

== <span id="communication-hygiene"></span>Communication Hygiene ==

* '''Encrypt end-to-end:''' Use forward-secure protocols (e.g., [[#tools|SimpleX]], Signal, XMPP with OMEMO/OTR). Avoid services with server-side decryption.  
* '''Strip metadata:''' Clean files of EXIF, DOCX, and PDF metadata before sending. Tools: [[#tools|MAT2]], ExifTool, `exiv2`, LibreOffice export-as-flattened-PDF.  
* '''Timing obfuscation:''' Vary message timing, content length, and sending patterns to evade traffic analysis. Avoid fixed intervals and bursts.  
* '''Anonymous infrastructure:''' Route messages via Tor hidden services, I2P, or mixnets where applicable.  
* '''Covert channels:''' Host C2 over domain-fronted HTTPS, CDN edges, or using steganographic data in benign-looking files.  
* '''Session ephemerality:''' Prefer clients with disappearing messages, no history retention, and encrypted local storage.  
* '''Avoid link previews and read receipts:''' Disable these to prevent passive metadata leaks and timing confirmation.  
* '''Compartmentalisation:''' One comms channel per operation. Never mix real and operational identities or contacts.  
* '''Out-of-band fallback:''' Always plan for out-of-band emergency communication (e.g., signed static key drop servers or dead man's switch).


----