Scenario guides

Attending a protest

The main risks are being identified afterwards (from your phone, your face, your photos or your posts) and having your phone taken or searched if you are detained.

Before you go

• Decide which phone comes. The safest choice is a cheap, clean phone with nothing on it, or no phone. If you bring your everyday phone, assume it can be searched if it is taken.
• Use a long alphanumeric passcode, and turn off Face ID or fingerprint unlock for the day. In many places police can force a face or finger far more easily than a passcode. On an iPhone, holding the side button and a volume button together for a moment turns biometrics off until the next passcode entry. Android has a "Lockdown" option on the power menu.
• Update the phone and make sure it is encrypted. Current iPhones and most current Android phones are encrypted once a passcode is set. Older phones may not be.
• Back up anything you care about first, then remove it from the phone if you can. A phone that is taken should not hold your only copy.
• Set up messaging in advance. Use an end-to-end encrypted app such as Signal, and turn on disappearing messages for the group. Give a trusted person the details of where you are going and agree a time when you will check in.
• Write down a lawyer or legal-support number on your body or on paper, in case you cannot use your phone.
• Think about what identifies you: distinctive clothing, tattoos, hair, a bag or shoes you post about. Plain clothing helps. Pay for transport in cash, since a travel card or bank card ties you to a place and time.
• Turn off things that broadcast. Check location sharing in your family and friends apps, and switch off Wi-Fi auto-join and Bluetooth. Our settings checklists show where.

During

• Put the phone in airplane mode unless you need it. Your carrier records which cell towers your phone connected to, so airplane mode stops new records while it is on. It does not erase any that already exist. A signal-blocking pouch is stronger, but a phone you cannot use is a trade-off you must choose.
• Be careful whose face is in your pictures. Faces and number plates can be identified later by software, even in the background of a video.
• If you are stopped or detained: stay calm, and give only what the law requires, usually your name and sometimes ID. Ask whether you are free to go. You can say that you do not consent to a search and that you want a lawyer. Do not unlock your phone or hand over passwords without a lawyer. What you must do varies by country, so check yours beforehand.

Afterwards

• Wait before you post. Later is safer than live.
• Clean the photos first. Remove hidden location and device data with the photo metadata stripper, and cover faces, plates and signs with photo redaction. Do not tag people, and do not name a person who has not agreed.
• Assume a phone that was taken from you is compromised. Change your important passwords from another device, and sign out of everything on the phone. See Mobile Privacy and Security Cameras for more on being watched.

Crossing a border

At a border you have fewer rights than at home, and officers in many countries can look through your phone and laptop, sometimes without any suspicion. The goal is a boring crossing with nothing worth arguing about. The full explanation is in Cell Phones and International Travel. This is the short checklist.

Before you travel

• Pick the phone: a cheap, clean travel phone with only what the trip needs is the easiest answer. If you must bring your real phone, move sensitive files off it and delete them for good, as the guide describes.
• Look up your destination's rules, including any rules about VPNs and encryption, and about being asked for social media accounts or passwords. They vary widely.
• Sort out two-factor sign-in in advance. Add the travel phone as a trusted device, or save backup codes, before you leave.
• Keep sensitive files off the laptop you carry, or encrypt them with a passphrase. Our encryption tool can lock a file before you travel.

At the checkpoint

• Turn off Face ID or fingerprint unlock and power the phone off or put it in airplane mode before you reach the officer. A phone that has been restarted needs the passcode, not your face.
• Be polite, calm and truthful. Do not lie to an official. In many countries that is a crime and makes things worse. You can decline to answer or to unlock, but be aware of the price: a visitor may be refused entry, and a citizen or resident may have the device kept for a while. Decide beforehand how much delay you can accept.
• Do not hand over a passcode unless you are prepared to hand over everything on the device. If a device is taken, ask for a receipt and a way to get it back.

Afterwards

• Treat a device that left your sight as compromised. Change your important passwords from a different device, sign out of accounts on it, and consider a factory reset before trusting it again.
• Reconnect on a network you trust and only then restore what you need.

Reporting from a risky place

For journalists, researchers and fixers working where surveillance is heavy or where sources could be punished. The people most at risk are often your contacts, not you, so most of the effort is about protecting them.

Before you go

• Make a plan with an expert. Free, confidential help exists: Access Now Digital Security Helpline, the Digital First Aid Kit, and press-freedom groups such as CPJ and RSF. Ask them before you travel, not after something goes wrong.
• Write down who could be hurt if your device is read: sources, colleagues, fixers, drivers. Then decide what you will never carry.
• Use separate devices and accounts for the job. New, clean accounts and a work-only phone keep a compromise from spreading. Keep them apart from your personal life.
• Use encrypted messaging, and know that metadata still shows who you contacted and when. Signal and similar apps hide the content. They do not hide that a conversation happened. Set disappearing messages.
• Check the law on VPNs and encryption for the country. In some places these tools are illegal or draw attention. Our VPN/TOR guide and VPN comparison explain the trade-offs, and Tor is the alternative when a VPN is blocked.
• Agree a check-in schedule with someone at home, and what they will do if you miss it.
• Find out if SIM cards must be registered. In some countries a local SIM is tied to your passport, so anything you do on it is linked to you. Decide whether that matters for this trip.

While you work

• Treat hotel, café and office Wi-Fi as watched. Do not sign in to sensitive accounts on them without a tested private connection.
• Do not keep source names, phone numbers or notes on the device. Use a code name and store the key elsewhere. Encrypt what you must keep, using a passphrase you have memorized (see the passphrase generator).
• Meet in person for the most sensitive conversations, and leave phones behind or powered off. A phone's location history can show who was in the same place.
• Clean photos and video before you send them. Strip location and device data with the metadata stripper, and cover faces and identifying details with redaction. Remember that a background sign or view can give away the place.
• Beware of unexpected links, attachments and QR codes. Targeted people are often approached with a convincing one. Check with the QR inspector and link cleaner, and ask the sender through another channel if in doubt.

If you are detained or questioned

• Do not unlock devices or give passwords, and ask to contact your embassy, editor and a lawyer. Local law may not protect you, so decide beforehand what you will do and tell your editor.
• Assume anything on a seized device is now known, and warn the people it concerns as soon as you safely can.

Afterwards

• Have the devices checked or replaced before you plug them into anything at home. Change every password from a clean device.
• Keep the material you carried out safe. Store it encrypted, with the passphrase kept separately.