a pretty sensible take on the problem with various privacy autists whose advice, instead of helping you protect yourself from digital surveillance, literally tells their readers to write
"I'M ANONYMOUS, YOU CAN'T TOUCH ME HAHAHA"
across their forehead.
of course, if you want to be private and more anonymous, you try to blend into the crowd as much as possible and not draw attention to yourself.
that's all there is to it, and that's the whole point. below is a summary of 3 of his articles [1], [2], [3], which in short cover how to do this in practice:
Most privacy advice online starts with a cartoon villain. "Your ISP is watching everything you do." "Governments are spying on you." "Big Tech wants your data." It's comforting and it gives you someone to hate. But it sounds like a YouTuber ad read for a crappy VPN, and it's also strategically useless.
Your ISP isn't your enemy. They're an observer with incentives, and if you don't understand those incentives, you'll build the wrong defenses, trust the wrong tools, and feel very secure while being quietly exposed. ISPs don't wake up thinking about you. They care about regulatory compliance, network performance, billing disputes, copyright notices, and subpoenas that arrive pre-filled. They log data because it's cheaper than not logging data, and because someone else told them to.
This changes how you should respond. You don't beat bureaucracy with paranoia, you beat it with boring, correct threat models.
Your ISP can't see the contents of HTTPS traffic, what you typed into Signal, or what file you sent over an encrypted tunnel. They CAN see when you connected, how long you stayed connected, how much data moved, which IPs you talked to, and traffic patterns that shout "this is not normal web browsing."
Metadata is the main character, not a footnote. If your privacy strategy only encrypts content and ignores metadata, congrats! You installed a lock on a glass house. Metadata is the loudest language of surveillance. Use consistent, locally plausible data practices: make your account creation timings, friend graphs, and activity rhythms look normal for your demographic.
VPNs are not magic cloaks, they are traffic relocation services. They are not "hiding" you, they are changing who sees what. Without a VPN, your ISP sees destinations and volume, and websites see your IP. With a VPN, your ISP sees a VPN connection and volume, the VPN sees destinations and volume, and websites see a VPN IP.
A VPN is useful when you trust the VPN provider more than you trust your ISP, when you understand jurisdictional differences, and if you're migrating a specific threat (not just chasing vibes). A VPN is harmful when you treat it as a privacy silver bullet, stack them randomly for "extra security", or when you stop thinking after you install the app. Privacy doesn't come from tools, it comes from intentional tradeoffs.
Use privacy tech in ways that mirror normal behavior. Route your traffic through a VPN that exits in the same country and uses widely used providers so your IP footprints don't scream "foreign proxy." Prefer tools and workflows with broad adoption. If everyone uses commercial cloud storage, using the same vendor (but with stronger encryption) draws less attention than using an obscure provider.
ISPs don't need content if your behavior is distinctive. Always-on tunnels, perfectly regular traffic, consistent volumes at odd hours. This isn't stealth, it's uniquely you.
Your goal shouldn't be to disappear, it should be to blend in. Normal browsing mixed with protected traffic, variability instead of religious rituals, and occasional failure instead of perfect uptime. Counterintuitively, messy humans can be harder to profile than disciplined machines. Avoid sudden spikes in encrypted comms or Tor use. Instead, spread sensitive comms across channels and time. If you must use high-surveillance-visibility tools (Tor, niche VPN), stagger use and pair with normal-looking browsing sessions.
Now imagine you wake up and the world has changed overnight. Digital ID required for work. A "safety" app on everyone's phone. Payment rails that tag transactions to a score. The state asks for "proof" to access services. Everyone normalizes it. You don't want to vanish into the new normal. You want to keep breathing: live, work, love, organize. You want to dissent sometimes. Welcome to the real problem: opt-out looks like an admission. Standing apart is often louder than fitting in.
Two truths. Normalization is a weapon: when everyone else accepts a surveillance token, refusing it draws attention, and the system uses deviation as a signal. Safety is tradeoffs: you can be invisible or you can be pure, rarely both. Your job is to pick the right compromises, and make them deliberate.
Think of your choices on three axes: blend, compartmentalize, resist. Blend: use enough sanctioned systems so you don't stand out. Compartmentalize: split your life into sealed compartments so damage in one place doesn't collapse everything else. Resist: perform activism and risky acts under separate operational conditions with explicit exit plans.
Every few months, some government rolls out the same idea: "We're installing a mandatory cyber-security app on every new phone... for safety." It's always framed as anti-fraud, anti-scam, anti-crime. Sometimes they retreat after backlash, but the idea itself never dies. Because the moment a government can force undeletable code onto your phone, the phone stops being your device.
So everyone asks: "How do I disable it? How do I block permissions? How do I stop it?" Here's the uncomfortable truth: you don't. If the state can put an app on your phone, they can silently reenable permissions, push updates, and monitor anomalies. If the law requires a digital check-in app that 90% of people run, run it. Not because you trust it, but because being the only person without it is a neon sign. Comply to the letter; don't volunteer extra data.
Don't wage war against the spyware. You will lose, and losing makes noise. Disabling permissions, force-stopping the app, deleting logs, all of that creates forensic red flags. Your adversary isn't some bored data analyst. It's the system that detects patterns. A long string of "noncompliant behavior" is more suspicious than anything you could say.
Keep the government-surveillance phone and use it exactly how they expect. This is your identity phone, your public phone, your grocery store phone. Do your banking, WhatsApp with your mom, food delivery, wholesome vanilla memes, doctor appointments. Make it aggressively normal. In surveillance systems, the safest signal is boringly predictable. Trying to "go dark" is like shouting at them that you're a person they should be interested in.
Anything sensitive should never touch that phone, not even once. Don't use your main phone for political discussion, dissent, whistleblowing, activist planning, vulnerable conversations, private research, or anything that would harm you if logged. Modern phones are snitches by design. Mandatory apps just formalize it. So don't feed the snitch.
Create at least two distinct identity stacks: one public/legal (work, bank, family, ID) and one private/activist (pseudonyms, burner accounts, separate devices, self-custody crypto). Build a separate environment for your real life, quietly. This is not getting a second SIM card. This is not your "encrypted apps" folder. I mean a second device that lives outside the surveillance graph: an old phone bought second hand, wiped clean, used only on Wi-Fi; a minimalist laptop with no personal accounts; an offline-first notes system; a Tor-only environment (like a Tails OS boot key); anything that never intersects with your identity phone's personal metadata trail. If you can't afford two, use robust isolation: VMs, separate browser profiles, and disciplined login practices. Separate creds: different password vaults or distinct vault folders, distinct recovery emails, different phone numbers/SIMs.
Think of it like this. Your main phone is the front window. Your second device is the room with the curtains closed. Different spaces, different rules, no shared footprints. Ideally, you won't even use them in the same physical locations.
Never let your two worlds touch. This is the part where people slip. No sending files between them, no logging into the same accounts, no using the same phone numbers, no syncing across clouds, no cross-referencing contacts, no browsing the same links. Intersection = correlation. Correlation = identification. Keep your two identities as separate as two strangers on a train.
Don't concentrate your dissent in one place or one persona. Use small, distributed actions: letters to the editor, community-level safe offline meetings, encrypted DM groups with rotating membership and short-lived tokens. Prefer in-person organizing when possible, or hybrid models where sensitive planning happens offline and public-facing activity is low-risk.
Trust is fragile. Use trust but verify: any newcomer earns privileges slowly. Use capstone actions to verify commitment (in-person verification, mutual contacts). Use buffers: people you trust for activism should not be the same people who handle critical personal accounts.
Metadata hygiene for groups: use ephemeral tokens for sign-ups. Don't collect real names unless you must. Keep meeting notes out of mainstream cloud services; use encrypted files, air-gapped backups, or devices wiped after sessions. Require "no photos" and "no public posting" policies for sensitive gatherings.
Camouflage your resistance as harmless civic participation. Organize art projects, petitions, local community events; things that are easy to explain and hard to immediately criminalize. Use plausible, low-risk cover activities for logistics ("we're meeting for a neighborhood cleanup" as cover for a planning session), but use cover only when legal/ethical.
Keep a paper trail of conformity: screenshots of your app showing you checked-in, scanned, filed, or complied. If someone later accuses you of noncompliance, you have evidence you met the baseline. Maintain visible, low-risk profiles that look "normal": a LinkedIn with modest activity, a bank account used for rent and utilities, registered vehicles if needed. When asked why you use privacy tech, default to the bland, non-combative reasons: "work requirements", "security best practices", "too many scams".
A quick plausible-participation script, when asked why you use privacy tools: "Mostly because of scams and account security. I travel a lot for work, so I use a VPN and keep some burner numbers for short-term contracts. Nothing political."
Don't be a public martyr. Quiet compliance reduces social friction. Cultivate plausible excuses for minimal compliance ("I keep copies for my records," "I travel for work and the app helps with bookings."). Be the person who is cooperative in public and careful in private. That's less suspicious than grandstanding.
High visibility = higher risk: if you're a teacher, health worker, or public servant, your threshold for risky tactics is lower. Adjust accordingly. Overcompartmentalizing can isolate you: extreme isolation makes recovery harder if something goes wrong. Keep one trusted, real-world contact who knows an emergency plan. Legal exposure vs moral obligation: sometimes the right moral action carries legal risk. Decide ahead of time what risks you accept and how you'll handle legal pressure. Don't improvise under arrest.
Move sensitive chats to an encrypted platform you control. Rotate high-risk passwords and isolate affected accounts. Back up critical documents to an air-gapped local drive stored in a Faraday bag. Inform one trusted contact with a secure phrase and emergency plan. If you expect device seizure, power down and follow your pre-written compromise protocol.
Real privacy isn't dramatic. It looks like understanding which adversaries you actually have, minimizing data exhaust instead of hoarding security tools, accepting that some visibility is inevitable, and designing systems that fail gracefully instead of catastrophically. It's boring, quiet, and it works. And most importantly, it doesn't make you feel like a spy in a movie. That feeling is a trap.
If your privacy setup feels powerful but collapses the moment you explain it out loud, it's probably theatre. Mandatory government apps don't make your life unlivable. They make your phone a stage. You smile onstage. You act normal onstage. Your private life happens backstage, off-device, off-network, off-pattern. Your phone becomes your costume. Your self lives somewhere else.
Living inside a surveillance-first state means surviving with your dignity, not preserving a heroic purity. The moral choices are messy. The smart ones are deliberate. Blend enough to be invisible. Compartmentalize enough to survive a breach. Resist enough to matter. And above all: plan, practice, and keep one small corner of your life completely offline, a place nobody can reach or monetize. That's where you keep your mind, your jokes, and the stubborn kernel of self that no ID system can catalog. Privacy isn't about hiding from everyone. It's about not being interesting to the wrong group. Design accordingly.
[1] Your ISP Is Not Your Enemy
[2] Mandatory government apps are coming
[3] So you woke up in an authoritarian privacy nightmare. Now what?