Despite his widely read criticism of Tor, The Gruqq — a legendary, pseudonymous security expert — uses it as first and last line of defense in keeping your secret, activist Twitter account a secret.
The Gruqq's comprehensive Twitter opsec guide advises you to create an anonymous email account, using Tor, outside the USA, to create your Twitter account; validate it with a burner phone and a burner SIM. Only access Twitter over Tor, and not with your phone (your phone leaks a lot of data about you — your IP address is easily tied to your location and phone number).
Use your Twitter as a one-way communications tool: don't get into back and forth with other people (especially people you consort with via your public Twitter accounts). Never click links sent to your account. Don't tweet screenshots or other potentially identifying info. Don't tweet pictures taken with a camera you use to capture photos for publication by your other accounts.
Never tell anyone about your secret Twitter — except, possibly, a psychotherapist who respects and is protected by client-patient confidentiality, who can help you hold it all together. Use a parody style, not your usual writing style (think of all those Twitter Hulk accounts!).
The AdversaryThere are a number of major adversaries that could lead to deanonymization of the account user. These include, but are probably not limited to:
1. Twitter
2. Email / Phone, linked to the account
3. Law Enforcement (or other nation state powers)
4. News media / investigative journalists
5. Colleagues / friends / family
The capabilities, intent, and opportunity are different for each of them, and require different techniques to prevent exposure and protect yourself. Although it may seem daunting to face this much investigative power, there is a great deal of control that you have to protect yourself. Much of it does not require a lot of hard work, although maintaining a strong security posture for prolonged periods of time will require discipline.
Do: remember that most of the time authoritarian regimes don’t bother with going after small fry. It is unlikely that the full force of the state will be brought against you unless you are perceived as a problem. Your biggest threat is probably going to be talking too much, and your biggest risk is probably going to be losing your job (or similar) along with some public attention and scrutiny for a newscycle or two. It may be unpleasant, but you’ll survive. Fear of the thing is worse than the thing itself, try not to stress over it.
Twitter Activist Security [The Gruqq/Medium]
