Morgan Creamin
04-11-26, 13:24
After the recent drama around the demise of Asian Pink (still don't actually know what happened) I revisited my security posture and looked at where I was vulnerable. Starting this thread because I don't see one on this topic to get input from everyone on their tips / tricks / thoughts on how to stay safe. Everyone has their own risk tolerance, obviously, so pick and choose what works for you.
Some of you are going to think a lot of this is paranoid, and it probably is but we also hate paying for insurance until you actually need it which is what all this is. Writing this to have a discussion and exchange of ideas not get into debates about the best approach or what's ridiculous or not. Just exploring possibilities and options. Everything here is YMMV and you should verify anything anyone says because we're all open to being wrong.
The three main areas of vulnerability to being found out that I see are your cell carrier tracking your device physically and logging data (including sms), data stored on your device and that you send, and cctv on the streets and inside locations.
Device tracking-.
A burner phone is something we've all heard of but they are not as perfect as some would think and to use one in the most anonymous way possible is a huge pain in the ass. And for those of us that have partners at home, it's a potential discovery that the woman in your life will definitely not like. Every device has an IMEI number that can easily be used to track your movements once it's been associated with you so it works until it doesn't. Touching on a couple topics- if they can correlate the movement of the burner to your license plate on traffic cameras, that's potentially a significant piece of evidence.
There is also no way around your (standard) provider tracking you, it happens automatically and they log everything.
I recently found out about Cape Cellular. (Not affiliated with them) It's a privacy focused cell provider that doesn't log your info (still trying to verify the accuracy and reliability of their claims), end to end encrypts sms, and, this is a big one, changes your IMEI every 24 hrs making it vastly more difficult for you to be tracked by LEO. If this is all legit, it feels like a very good layer of obfuscation between you and the pigs. So far, this is the only thing I've found other than shutting your phone off or not taking it that will impact your phone's location tracking. You also get secondary, text-only numbers that might be useful of all the claims are true.
Downside is that it's a little more expensive at $100/ month. It also piggybacks on other carriers towers so logs are likely still being kept by them, that's where the IMEI swap comes in handy. HOWEVER- if you bring your phone home everyday you're still going be traceable because that new IMEI will show up at your address....and if they search by location vs IMEI then you're fucked. So this is far from perfect and still needs some workarounds.
https://www.cape.co/our-features#minimal-data-collection.
For wifi and cell data, an always-on VPN is a no-brainer. Private Internet Access has been subpoenaed in the past to hand over user logs and they had none so their no logging claims appear to be accurate.
Device data searches-.
The vast majority of mobile operating systems are apple or android and these are comically easy for LEO to search when then get the physical device and the companies deliberately put backdoors in for them anyway.
Graphene OS is the best answer I've found though I don't know what hardening you can do on non-android linux-based phones that use something other than Graphene. This is a highly modified version of android that strips out all the google services, sandboxes apps, can create fully separate user profiles, and, most importantly, can disable data extraction by local LEO tools. You are able to relock the bootloader after installing and disable the USB port to charging only so even if they hook into it directly they won't get a response. This will defeat the vast majority of invasive data extraction methods.
GOS even allows you to configure a duress PIN that when entered immediately starts to hard wipe and reset the phone. While that might get you an obstruction charge in some circumstances, which is maybe worse than a soliciting charge, it's an option that might be valid for some of you.
Of course, nothing is 100% secure but this can add a boatload of roadblocks that hopefully aren't going to be worth it for a typical monger. Ironically, GOS is currently only supported on Pixel phones because google is the only manufacturer whose hardware meets the security requirements of GOS. GOS is free and open source. There will be some minor inconveniences but it's probably worth it for everyone even outside the hobby to stop the fuckers from stealing all our information.
https://grapheneos.org/
It goes without saying that you should never set up any biometric unlocking regardless of using a device in the hobby. Police are legally allowed to press your finger to the fingerprint unlock or hold the phone up to your face but they cannot force your PIN out of you without a warrant. It's stupid and should be unconstitutional because it's a search but that's a different conversation.
If you have a burner app disable it being able to send notifications to your lock screen. If you're being questioned and they send a text to that number to verify if it's you it won't show up and you have plausible deniability in the moment.
And a good general rule for those apps that do have permission be sure to hide previews or sensitive notifications so no one can read the context of a text or email.
Now there is also the data you send to providers and pimps. There is nothing you can do about this from a technical perspective, once you send it it's like a bullet- it can't be called back.
Never use your real name. Obviously never use your main, linked directly to you phone number. Never agree to anything via text or phone call. For K and C orgs that want a copy of your I'd, learn how to photoshop that shit to change address, picture, QR code, etc. Never send money electronically even afterward or with a 'trusted' provider, that shit must, by law, be traceable and recorded and might come back to bite you.
WA law states that you only have to AGREE to a transaction to be guilty or prostitution. "A person age eighteen or older is guilty of prostitution if such person engages or agrees or offers to engage in sexual conduct with another person in return for a fee. " So never agree to anything over text or voice, negotiate in person. You're obviously fucked if it's a sting and she's mic'd but there's not much that can be done about that other than trusting your spidey sense.
CCTV-.
This is the hardest one to overcome especially with license plates. Swapping plates is an option but that will land you in some serious legal shit if you get pulled over for a traffic violation and isn't going to be worth the risk. I've looked at tests for a lot of the covers, stickers, and sprays that supposedly make a license plate hard to read by cameras and so far they've all been debunked as useless or close to it.
The only real way to create reasonable doubt is to find places without camera coverage and only ever park there, but those are becoming more and more challenging to find. Even so this isn't perfect as it puts you in the area and your plate has definitely been caught on some cameras on the trip over. Ideally, if you can find a parking spot without a camera you have another destination close by that you can claim you were going to to create plausible deniability. Also if you park outside of video range so they can't video you getting out of the car you want to confuse them by changing your appearance. You should wear a hat and jacket / hoodie / something that you can swap once you park. I. e. - wear a red hoodie and green hat when driving which will likely be visible on traffic cams but change to a black hoodie and cap once you park and vice versa when you leave.
Ride-sharing is even more traceable so that's a waste of time.
But then there is tracking you when you walk to the encounter.
Facial and gait recognition are serious problems. Thankfully, in the post-covid world, masks aren't as unusual as they once were so a mask, hoodie, and sunglasses gets you a good way towards being unidentifiable by face without standing out too much in public.
But gait analysis is a thing. It's still not perfect and I honestly have no idea how much it's being used if at all but the tech overlords are working hard to ensure you can be tracked everywhere. Gait analysis is harder to defeat but it (still) can be done with some measure of success. Wearing baggy / heavy clothing changes your gait, a big hoodie will hide many details in your upper body and heavy pants will alter how to move your legs. If you normally wear sneakers, wear big clunky work boots. Carrying something heavy works but probably isn't practical in this context. You can consciously change your gait as well, walk more slowly and deliberately change your foot strike and the length of your stride, things like that.
Some of you are going to think a lot of this is paranoid, and it probably is but we also hate paying for insurance until you actually need it which is what all this is. Writing this to have a discussion and exchange of ideas not get into debates about the best approach or what's ridiculous or not. Just exploring possibilities and options. Everything here is YMMV and you should verify anything anyone says because we're all open to being wrong.
The three main areas of vulnerability to being found out that I see are your cell carrier tracking your device physically and logging data (including sms), data stored on your device and that you send, and cctv on the streets and inside locations.
Device tracking-.
A burner phone is something we've all heard of but they are not as perfect as some would think and to use one in the most anonymous way possible is a huge pain in the ass. And for those of us that have partners at home, it's a potential discovery that the woman in your life will definitely not like. Every device has an IMEI number that can easily be used to track your movements once it's been associated with you so it works until it doesn't. Touching on a couple topics- if they can correlate the movement of the burner to your license plate on traffic cameras, that's potentially a significant piece of evidence.
There is also no way around your (standard) provider tracking you, it happens automatically and they log everything.
I recently found out about Cape Cellular. (Not affiliated with them) It's a privacy focused cell provider that doesn't log your info (still trying to verify the accuracy and reliability of their claims), end to end encrypts sms, and, this is a big one, changes your IMEI every 24 hrs making it vastly more difficult for you to be tracked by LEO. If this is all legit, it feels like a very good layer of obfuscation between you and the pigs. So far, this is the only thing I've found other than shutting your phone off or not taking it that will impact your phone's location tracking. You also get secondary, text-only numbers that might be useful of all the claims are true.
Downside is that it's a little more expensive at $100/ month. It also piggybacks on other carriers towers so logs are likely still being kept by them, that's where the IMEI swap comes in handy. HOWEVER- if you bring your phone home everyday you're still going be traceable because that new IMEI will show up at your address....and if they search by location vs IMEI then you're fucked. So this is far from perfect and still needs some workarounds.
https://www.cape.co/our-features#minimal-data-collection.
For wifi and cell data, an always-on VPN is a no-brainer. Private Internet Access has been subpoenaed in the past to hand over user logs and they had none so their no logging claims appear to be accurate.
Device data searches-.
The vast majority of mobile operating systems are apple or android and these are comically easy for LEO to search when then get the physical device and the companies deliberately put backdoors in for them anyway.
Graphene OS is the best answer I've found though I don't know what hardening you can do on non-android linux-based phones that use something other than Graphene. This is a highly modified version of android that strips out all the google services, sandboxes apps, can create fully separate user profiles, and, most importantly, can disable data extraction by local LEO tools. You are able to relock the bootloader after installing and disable the USB port to charging only so even if they hook into it directly they won't get a response. This will defeat the vast majority of invasive data extraction methods.
GOS even allows you to configure a duress PIN that when entered immediately starts to hard wipe and reset the phone. While that might get you an obstruction charge in some circumstances, which is maybe worse than a soliciting charge, it's an option that might be valid for some of you.
Of course, nothing is 100% secure but this can add a boatload of roadblocks that hopefully aren't going to be worth it for a typical monger. Ironically, GOS is currently only supported on Pixel phones because google is the only manufacturer whose hardware meets the security requirements of GOS. GOS is free and open source. There will be some minor inconveniences but it's probably worth it for everyone even outside the hobby to stop the fuckers from stealing all our information.
https://grapheneos.org/
It goes without saying that you should never set up any biometric unlocking regardless of using a device in the hobby. Police are legally allowed to press your finger to the fingerprint unlock or hold the phone up to your face but they cannot force your PIN out of you without a warrant. It's stupid and should be unconstitutional because it's a search but that's a different conversation.
If you have a burner app disable it being able to send notifications to your lock screen. If you're being questioned and they send a text to that number to verify if it's you it won't show up and you have plausible deniability in the moment.
And a good general rule for those apps that do have permission be sure to hide previews or sensitive notifications so no one can read the context of a text or email.
Now there is also the data you send to providers and pimps. There is nothing you can do about this from a technical perspective, once you send it it's like a bullet- it can't be called back.
Never use your real name. Obviously never use your main, linked directly to you phone number. Never agree to anything via text or phone call. For K and C orgs that want a copy of your I'd, learn how to photoshop that shit to change address, picture, QR code, etc. Never send money electronically even afterward or with a 'trusted' provider, that shit must, by law, be traceable and recorded and might come back to bite you.
WA law states that you only have to AGREE to a transaction to be guilty or prostitution. "A person age eighteen or older is guilty of prostitution if such person engages or agrees or offers to engage in sexual conduct with another person in return for a fee. " So never agree to anything over text or voice, negotiate in person. You're obviously fucked if it's a sting and she's mic'd but there's not much that can be done about that other than trusting your spidey sense.
CCTV-.
This is the hardest one to overcome especially with license plates. Swapping plates is an option but that will land you in some serious legal shit if you get pulled over for a traffic violation and isn't going to be worth the risk. I've looked at tests for a lot of the covers, stickers, and sprays that supposedly make a license plate hard to read by cameras and so far they've all been debunked as useless or close to it.
The only real way to create reasonable doubt is to find places without camera coverage and only ever park there, but those are becoming more and more challenging to find. Even so this isn't perfect as it puts you in the area and your plate has definitely been caught on some cameras on the trip over. Ideally, if you can find a parking spot without a camera you have another destination close by that you can claim you were going to to create plausible deniability. Also if you park outside of video range so they can't video you getting out of the car you want to confuse them by changing your appearance. You should wear a hat and jacket / hoodie / something that you can swap once you park. I. e. - wear a red hoodie and green hat when driving which will likely be visible on traffic cams but change to a black hoodie and cap once you park and vice versa when you leave.
Ride-sharing is even more traceable so that's a waste of time.
But then there is tracking you when you walk to the encounter.
Facial and gait recognition are serious problems. Thankfully, in the post-covid world, masks aren't as unusual as they once were so a mask, hoodie, and sunglasses gets you a good way towards being unidentifiable by face without standing out too much in public.
But gait analysis is a thing. It's still not perfect and I honestly have no idea how much it's being used if at all but the tech overlords are working hard to ensure you can be tracked everywhere. Gait analysis is harder to defeat but it (still) can be done with some measure of success. Wearing baggy / heavy clothing changes your gait, a big hoodie will hide many details in your upper body and heavy pants will alter how to move your legs. If you normally wear sneakers, wear big clunky work boots. Carrying something heavy works but probably isn't practical in this context. You can consciously change your gait as well, walk more slowly and deliberately change your foot strike and the length of your stride, things like that.