Additional citations / formatting

README.md

@@ -75,9 +75,9 @@ From a technological standpoint, they will redirect internet traffic and inject
 
 While I have primarily focused on examples  solely with the tech-industry, financial blockades are also leveraged to censor and snuff out organizations. Wikileaks was perhaps the first example of the integrated power dynamic with both the tech and financial industry alike. They lay out an excellent chronology of the events on their site, but the summary is that their servers being hosted by AWS were pulled, Apple removed their application from the App Store with Paypal, and a financial blockade was set in place between VISA, Mastercard, Bank of America, and Western Union. Bank of America commissioned proposals for a systematic attack against their computer systems with firms of the intelligence community such as Palantir, Berico, and HBGary. Palo Alto, the parent company of Palantir, even came out publicly to apologize and severed all relations with HBGary.[^1] It seems this set the stage as they were the test run. 
 
-More systematic censorship was witnessed in mid 2018 where sites and individuals such as InfoWars, RTNews journalists, and many more were banned without reason from Youtube, Facebook, Instagram, Twitter, Disqus, Flickr, Vimeo, Tumblr, Paypal. They will control Domain Name Service (DNS) records from the main root servers. They will have search engines such as Google blacklist the DNS resolution for websites. An example of this occurred in early February, 2019 where CodeIsFreeSpeech.com was hidden from public domain. The government's relationship with tech-industry oligarchs have become even more apparent in early January, 2021 where the President of the United States (POTUS) was silenced. The platform Parlor, while insecurely coded, offered a censorship resistant platform (by policy). Not only will Google/Apple remove access to platforms such as these, but even those hosting web services (predominantly Amazon and Digital Ocean) can and will pull the plug to shutdown the platforms. Most occurences come from recollection as there is no journal detailing the cases of censorship at large; my recollection is largely incomplete. This being said, we have collectively facilitated their bulk data collection, aggregation, surveillance, and censorship to where it is mere child's play.
+More systematic censorship was witnessed in mid 2018 where sites and individuals such as InfoWars, RTNews journalists, and many more were banned without reason from Youtube, Facebook, Instagram, Twitter, Disqus, Flickr, Vimeo, Tumblr, Paypal. They will control Domain Name Service (DNS) records from the main root servers. They will have search engines such as Google blacklist the DNS resolution for websites. An example of this occurred in early February, 2019 where CodeIsFreeSpeech.com was hidden from public domain. The government's relationship with tech-industry oligarchs have become even more apparent in early January, 2021 where the President of the United States (POTUS) was silenced.[^2] The platform Parlor, while insecurely coded, offered a censorship resistant platform (by policy). Not only will Google/Apple remove access to platforms such as these, but even those hosting web services (predominantly Amazon and Digital Ocean) can and will pull the plug to shutdown the platforms. Most occurences come from recollection as there is no journal detailing the cases of censorship at large; my recollection is largely incomplete. This being said, we have collectively facilitated their bulk data collection, aggregation, surveillance, and censorship to where it is mere child's play.
 
-This is being observed more clearly in modern day where the auspices of surveillance in the name of safety have been habitualized in the public eye. And one should note that this is solely a case example pertaining to American-based companies. There are plenty of private-public engagements in other countries such as the NSO with the Israeli government. Coupling the private-public engagements, embedded relations between other foreign intelligence agencies brings a new depth of maliciousness to light. Think 5 eyes, 9 eyes, 14 eyes, etc. Global collaborative surveillance is an early panacea to the long held prospects of the "New World Order," or stated differently, a global institution subjugating the common man to despotism. 
+This is being observed more clearly in modern day where the auspices of surveillance in the name of safety have been habitualized in the public eye. And one should note that this is solely a case example pertaining to American-based companies. There are plenty of private-public engagements in other countries such as the NSO with the Israeli government.[^3] Coupling the private-public engagements, embedded relations between other foreign intelligence agencies brings a new depth of maliciousness to light. Think 5 eyes, 9 eyes, 14 eyes, etc. Global collaborative surveillance is an early panacea to the long held prospects of the "New World Order," or stated differently, a global institution subjugating the common man to despotism. 
 
 When their suppression campaigns prove incapable to pull something from the public eye, the next tool in the box is slander which will be applied liberally. When one side of the argument deems a propagated idea as "dangerous" to the public well-being, it becomes clear not necessarily who is right, but who is wrong. The most popular MCs, the musicians, the media, actors, journalists become propagandists for the system. Surpassing a set threshold without the consent of the system will not be permitted. The only allowed controversy is that which is controlled.
 
@@ -102,7 +102,7 @@ This section has been prioritized as hardware is at the core of your operations.
 
 Unfortunately, there are no easy solutions in the realm of hardware. There are many rabbit holes one can take in regards to the avoidance of negative ring architecture (layers below the operating system), selecting processors that gut/avoid the use of MinixOS and Intel's management engine (ME), inherent vulnerabilities to the processor, chipsets that require proprietary blobs, and ultimately procuring hardware that isn't subject to side-loading attacks (can weaken device encryption). 
 
-Central processing units (CPU) have a narrowed list of options. For the vast majority of desktops and laptops, the competitors are Intel and AMD. Both of these CPUs have the potential for root level backdoors that are undetectable by your OS. Some privacy-oriented organizations, such as Purism and System76, claim to neutralize Intel's ME (See Purism's technical write-up[^2]). If you are going to select a system with an Intel CPU and detest this critical design, you are limited to a few options. You can shill out the money to System76 (disables ME) and Purism (neutralizes ME by gutting critical components), or you can flash the computer's motherboard with a Raspberry Pi by running the me_cleaner program[^3] (if supported processor/architecture) and installing coreboot[^4] in replace of the BIOS. The novice runs the risk of ruining their device, coupled with the fact that the setup was likely completed for legacy hardware that has unpatched vulnerabilities. This process is not a trivial task and will cause headaches for those who simply want the system to work. If you are not willing to shill out the money to one of these organizations that disables the ME and are not technologically savvy, consider using a CPU by AMD while noting that this is far from a silver bullet.This is not to say AMD's PSP is impervious to exploitation. See [^5].  
+Central processing units (CPU) have a narrowed list of options. For the vast majority of desktops and laptops, the competitors are Intel and AMD. Both of these CPUs have the potential for root level backdoors that are undetectable by your OS. Some privacy-oriented organizations, such as Purism and System76, claim to neutralize Intel's ME (See Purism's technical write-up[^4]). If you are going to select a system with an Intel CPU and detest this critical design, you are limited to a few options. You can shill out the money to System76 (disables ME) and Purism (neutralizes ME by gutting critical components), or you can flash the computer's motherboard with a Raspberry Pi by running the me_cleaner program[^5] (if supported processor/architecture) and installing coreboot[^6] in replace of the BIOS. The novice runs the risk of ruining their device, coupled with the fact that the setup was likely completed for legacy hardware that has unpatched vulnerabilities. This process is not a trivial task and will cause headaches for those who simply want the system to work. If you are not willing to shill out the money to one of these organizations that disables the ME and are not technologically savvy, consider using a CPU by AMD while noting that this is far from a silver bullet.This is not to say AMD's PSP is impervious to exploitation. See [^7].  
 
 ## Operating System
 Researching the right operating system (OS) for your specific operation can be a monstrous task. If Operations Security (OPSEC) is of utmost importance, then operating systems that generate excess logs and call home with telemetry and error reporting should be ruled out. 
@@ -112,20 +112,20 @@ For desktop, this process eliminates Windows, Mac, and ChromiumOS/CloudReady fro
 
 GNU/Linux is one of the few operating system baselines that will not phone home and create excess logs locally. Even after making such a decision, whether that be Linux, BSD, or Xen, there are hundreds of derivatives to sift through. At the time of writing, the only anti-forensic friendly distributions designed to reduce the creation and storage of artifacts are TAILS and Whonix. However, any OS lacking telemetry with properly implemented full-disk encryption (FDE) and physical security is sufficient for the job of anti-forensics. If more persistence is desired while keeping distribution size minimal, hardened variants of Arch, Void, Gentoo, or Alpine are advised. 
 
-One more factor to consider for the OS selection is the service manager being used. There are plenty of security enthusiasts who justifiably denounce the use of the SystemD service manager (used to spawn processes like networking, scheduled tasks, logging, etc)[^6]. There are a variety of service managers that have less bloat and a more simple codebase - OpenRC, runit, etc. The fact that most of these OSs are open-source results in the problem of funding. A side-project that has peaked a developer's interest often go long durations (if not permanantly) without any efforts to maintain/patch. Some recommended OS alternatives without systemD at the time of writing include Artix (Arch variant)[^7], Void Linux[^8], and Alpine Linux[^9].
+One more factor to consider for the OS selection is the service manager being used. There are plenty of security enthusiasts who justifiably denounce the use of the SystemD service manager (used to spawn processes like networking, scheduled tasks, logging, etc).[^8] There are a variety of service managers that have less bloat and a more simple codebase - OpenRC, runit, etc. The fact that most of these OSs are open-source results in the problem of funding. A side-project that has peaked a developer's interest often go long durations (if not permanently) without any efforts to maintain/patch. Some recommended OS alternatives without systemD at the time of writing include Artix (Arch variant)[^9], Void Linux[^10], and Alpine Linux[^11].
 
 >Note: Ideally, an operating system running a microkernel (minimal core) such as seL4 could be in the running. These alternatives are still too adolescent to advise with little community support. 
 
-For mobile devices, options are extraordinarily limited. Phones are designed to constantly ping telecommunications infrastructure and receive incoming packets by design. The core purpose is to be reached. Google, Apple, and other players in the telecommunications industry have taken this to an intrusive extent. Android stock phones home an average of 90 times per hour. Apple accounts for at least 18 times per hour.[^10] Both operating systems do not operate in a manner that is conducive to privacy. It seems that the only remaining options are to disable all sync capabilities on iPhone, or flash an open-source operating system to an Android. 
+For mobile devices, options are extraordinarily limited. Phones are designed to constantly ping telecommunications infrastructure and receive incoming packets by design. The core purpose is to be reached. Google, Apple, and other players in the telecommunications industry have taken this to an intrusive extent. Android stock phones home an average of 90 times per hour. Apple accounts for at least 18 times per hour.[^12] Both operating systems do not operate in a manner that is conducive to privacy. It seems that the only remaining options are to disable all sync capabilities on iPhone, or flash an open-source operating system to an Android. 
 
-For Android, the best operating system to date is GrapheneOS.[^11] This operating system can only be flashed to Google Pixel variants. This is a security-centric OS that accounts for many hardening mechanisms from software to hardware. GrapheneOS encrypts the entire device using block-level encryption, unlike most Android versions which use file-level encryption. If physical forensics of the handset is an issue, GrapheneOS is the best solution. 
+For Android, the best operating system to date is GrapheneOS.[^13] This operating system can only be flashed to Google Pixel variants. This is a security-centric OS that accounts for many hardening mechanisms from software to hardware. GrapheneOS encrypts the entire device using block-level encryption, unlike most Android versions which use file-level encryption. If physical forensics of the handset is an issue, GrapheneOS is the best solution. 
 
-GNU/Linux based phones, such as Pine64's Pine Phone[^12] or Purism's Librem 5,[^13] are now hitting the market. These devices are inherently insecure in early conception. One could consider these devices private but not secure. If an injection could reach the device, then all privacy is lost. 
+GNU/Linux based phones, such as Pine64's Pine Phone[^14] or Purism's Librem 5,[^15] are now hitting the market. These devices are inherently insecure in early conception. One could consider these devices private but not secure. If an injection could reach the device, then all privacy is lost. 
 
 ## Disable Logging
 Disabling logs at the source is the best solution to ensure excess logs are not being stored. Daemons or processes can automate the process of log collection. This has its useful functions for both debugging and security (auditing), however it is detrimental to the idea of information retention. It is strongly advised to periodically shred the log files if not disabling the logging daemons entirely. 
 Some pro
-Some developers have created simple bash and python scripts that remove and disable the logging daemons such as CoverMyAss.[^14] Scripts aren't necessarily needed, however they could automate a manual process and identify logging components of your system that you did not know were present. 
+Some developers have created simple bash and python scripts that remove and disable the logging daemons such as CoverMyAss.[^16] Scripts aren't necessarily needed, however they could automate a manual process and identify logging components of your system that you did not know were present. 
 
 Here is a quick example of disabling logging daemons on GNU/Linux with the SystemD service manager: 
 ```
@@ -143,7 +143,7 @@ There are various caches containing sensitive information on both mobile devices
 Due to Android sandbox implementations, caches can no longer be centrally erased; caches must be cleared on individual applications. System logging is also sprawled across various directories.  Reducing locally generated logs on Android is comparable to removing telemetry from Windows OS variants. Clearing caches on Android provides no serious benefit, but it does remove the amount of data present on the device. For proper privacy, only trusted applications should be used - preferably Free and Open-Source (FOSS). 
 
 ## Secure Deletion
-Deletion of files in most operating systems today is a loose version of the term. Deletion implies the eradication of the selected file. Rather, this is deletion of the file's reference. To truly delete a file from the drive, one must completely overwrite the data. This can be done over time by passive dumb luck or it could be a conscious effort. There are existing tools for secure deletion (wiping over the file) on most platforms. On GNU/Linux systems, there is a tool in the "secure-delete" package called shred that will zero over the file. This performs deletion using the Gutmann method. Another tool called Bleachbit is known to clean the caches of the system. Built into the tool is an option to overwrite all free space on the disk. This could be a routine cleanup procedure for the concerned. On Windows, there is a tool included in the SysInternals package called SDelete that will provide a similar function to GNU/Linux's shred.
+Deletion of files in most operating systems today is a loose version of the term. Deletion implies the eradication of the selected file. Rather, this is deletion of the file's reference. To truly delete a file from the drive, one must completely overwrite the data. This can be done over time by passive dumb luck or it could be a conscious effort. There are existing tools for secure deletion (wiping over the file) on most platforms. On GNU/Linux systems, there is a tool in the "secure-delete" package called shred that will zero over the file. This performs deletion using the Gutmann method. Another tool called Bleachbit[^17] is known to clean the caches of the system. Built into the tool is an option to overwrite all free space on the disk. This could be a routine cleanup procedure for the concerned. On Windows, there is a tool included in the SysInternals[^18] package called SDelete that will provide a similar function to GNU/Linux's shred.
 A simple shred command in a Linux bash shell: `shred -n 32 -z -u <FILE>`
 This command would use GNU coreutils shred function to wipe over the designated file with 32 iterations. The -z adds a final overwrite to hide the shredding process, and the -u unlinks the file completely. 
 	
@@ -152,7 +152,7 @@ This command would use GNU coreutils shred function to wipe over the designated
 The NSA has in the past developed malicious firmware for HDDs that can create secret copies of user-written data. SSDs which make use of wear-leveling cannot have information securely erased by the user.  However, SSDs with wear leveling also pose a significant annoyance, and even create difficulty for, forensic investigators. Such annoyance cannot be considered a security guarantee. In short, wear-leveling, garbage collection, and trim operations are largely outside of the user's control, therefore "secure" deletion should not be assumed to be possible. Regarding SSDs, trim operations should always be enabled as it stands to make files unreadable using "Deterministic Read After Trim" or "Deterministic Zeroes After Trim." Consider trim as an unreliable backup mitigation to FDE. 
 
 ## MAC Randomization
-Media access control (MAC) addresses are unique identifiers for network interface controllers/cards (NIC). These identifiers exist at Layer 2 of the OSI model.[^15] As one could expect, unique identifiers can be problematic. Proprietary router firmware such as Netgear and other vendors can attempt to correlate static MACs to individuals. Your MAC could also be correlated between different routers and subsequently different router SSIDs. Wardriving is a method by which organizations will scan for SSIDs around different areas to collect MAC addresses and SSIDs.
+Media access control (MAC) addresses are unique identifiers for network interface controllers/cards (NIC). These identifiers exist at Layer 2 of the OSI model.[^19] As one could expect, unique identifiers can be problematic. Proprietary router firmware such as Netgear and other vendors can attempt to correlate static MACs to individuals. Your MAC could also be correlated between different routers and subsequently different router SSIDs. Wardriving is a method by which organizations will scan for SSIDs around different areas to collect MAC addresses and SSIDs.
 
 All anti-forensic operating systems  spoof or randomize the MAC address by default. A GNU/Linux utility called `macchanger` can alter and randomize the MAC address.
 Set MAC to one by the same vendor: `macchanger -a <interface (i.e. eth0)>`
@@ -178,43 +178,43 @@ If you are more concerned with a traffic leakage, leak prevention of traffic (me
 As it stands today, there are three avenues for anonymization and encryption of internet packets: VPN, TOR, and Mixnets.
 
 Each avenue possesses pitfalls. Virtual Private Networks (VPN) can provide privacy from the local internet service providers (ISP). Internet traffic will be encrypted based on designated configurations and protocols. OpenVPN is subject to various attacks.
-Wireguard is currently the most secure. Unfortunately, it has faced little scrutiny. Often security defects are uncovered with the right amount of time. Disregarding its adolescence, the Wireguard protocol has been formally verified. Also, the reduced complexity of the protocol makes it easier to properly implement than OpenVPN. Easier implementation reduces room for error that could lead to compromise. The primary issue with VPNs today lies with the inherent trust given to the provider. If you decide a VPN is desired for your operation(s), you should be searching for a provider that has strict privacy laws, a no logging policy, and jurisdiction being outside of the known growing number of eyes (collaborative government intelligence community). This intelligence community went from 5 eyes to 9 eyes to 14 eyes. I suspect the number will continue its pattern of growth as discussed in the Philosophy section of the book. VPNs are rarely suitable against powerful (government or corporate) attackers; VPNs cannot grant anonymity.[^16]
+Wireguard is currently the most secure. Unfortunately, it has faced little scrutiny. Often security defects are uncovered with the right amount of time. Disregarding its adolescence, the Wireguard protocol has been formally verified. Also, the reduced complexity of the protocol makes it easier to properly implement than OpenVPN. Easier implementation reduces room for error that could lead to compromise. The primary issue with VPNs today lies with the inherent trust given to the provider. If you decide a VPN is desired for your operation(s), you should be searching for a provider that has strict privacy laws, a no logging policy, and jurisdiction being outside of the known growing number of eyes (collaborative government intelligence community). This intelligence community went from 5 eyes to 9 eyes to 14 eyes. I suspect the number will continue its pattern of growth as discussed in the Philosophy section of the book. VPNs are rarely suitable against powerful (government or corporate) attackers; VPNs cannot grant anonymity.[^20]
 
 The Onion Router (TOR) has faced the most scrutiny of all protocols and provides the most anonymity. While facing the most scrutiny from various individuals and governments, TOR has many overarching issues yet to be addressed. Someone with a God's eye view of the telecommunications traffic could deanonymize users by sending out certain sized packets to different destinations. This is something to keep in mind while hosting infrastructure, however the standard user sending out typical sized packets from web requests has little concern of this deanonymization tactic. TOR does not add timing obfuscations or decoy traffic to hinder traffic pattern analysis which can be used to deanonymize users. 
 
-Both of these channels have some pitfalls, so why not combine them for layered security? There have been numerous articles published by Whonix[^17] and TAILS[^18] developers along with other Information Security professionals highlighting the ineffectiveness of the VPN / TOR combination. The synopsis of their articles is that at best it doesn't help you, at worst, it hurts you. I find it useful if I am trying to mask the fact that I am using TOR from the ISP. Bridges can also be used for this purpose, but they are likely easier to identify by the Intelligence Community (IC). While on public WiFi, I recommend solely using TOR. 
+Both of these channels have some pitfalls, so why not combine them for layered security? There have been numerous articles published by Whonix[^21] and TAILS[^22] developers along with other Information Security professionals highlighting the ineffectiveness of the VPN / TOR combination. The synopsis of their articles is that at best it doesn't help you, at worst, it hurts you. I find it useful if I am trying to mask the fact that I am using TOR from the ISP. Bridges can also be used for this purpose, but they are likely easier to identify by the Intelligence Community (IC). While on public WiFi, I recommend solely using TOR. 
 
-I2P[^19] or the Invisible Internet Project spawned in 2003. This is an encrypted private network layer designed to mask user identity. I2P is not the same concept as TOR, although some concepts cross over. I2P users cannot officially communicate with clearnet sites like TOR users can; all I2P traffic stays internal to the I2P network. Without having the exit of traffic via exit nodes or outproxies to the internet, this reduces usability and enhances privacy. I2P can prove useful at limiting the information captured by global passive adversaries. I should note that some mixnets have called I2P legacy technology claiming that it opens up users to a number of attacks that can isolate, misdirect, and deanonymize users. Therefore I2P should not be solely relied on. If one is adament about using I2P, there are configurations that facilitate the use of I2P via TOR.  
+I2P[^23] or the Invisible Internet Project spawned in 2003. This is an encrypted private network layer designed to mask user identity. I2P is not the same concept as TOR, although some concepts cross over. I2P users cannot officially communicate with clearnet sites like TOR users can; all I2P traffic stays internal to the I2P network. Without having the exit of traffic via exit nodes or outproxies to the internet, this reduces usability and enhances privacy. I2P can prove useful at limiting the information captured by global passive adversaries. I should note that some mixnets have called I2P legacy technology claiming that it opens up users to a number of attacks that can isolate, misdirect, and deanonymize users. Therefore I2P should not be solely relied on. If one is adament about using I2P, there are configurations that facilitate the use of I2P via TOR.  
 
-Mixnets have the goal of anonymizing packets through uniformity. The design is to obscure and craft packets of the same size despite the amount of data being transmitted. Often times mixnets have technology that address time-based attacks, provide decoy or cover traffic, and implement uniformity of packets, however the pitfalls tend to be lack of scrutiny and adoption. Anonymity loves company, and most mixnets lack that component, especially in their early conceptions. Due to the lack of scrutiny with early conception and lack of adoption, I cannot provide any recommendations. Even if one is to involve themselves with the use of a mixnet, they should be on guard. Intelligence agencies are not ones to shy away from a good honeypot. While not a perfect example as this wasn't a mixnet, the FBI ran an operation with an operating system called ArcaneOS and a built-in messaging platform called anom[.]io[^20] designed for organized crime. ANOM was an application that opened as a calculator which had the user enter a pin to reach the hidden messenger. All communications were intercepted. The morale of the story is that the slightest amount of skepticism into the website communications, hosting platform, or the closed-source application could've prevented the downfall of multiple criminal enterprises globally. The same skepticism should be applied to any organization unwilling to address their shortcomings and model their potential attack vectors. Many are willing to route your traffic, and node-based cryptocurrency projects with a model that resembles that of a ponzi-scheme could always be a source of both black budget funds and traffic analysis for letter agencies. I have no fingers to point or organizations to accuse. However, it is far from a half-cocked conspiracy that intelligence agencies would engage in this type of activity. 
+Mixnets have the goal of anonymizing packets through uniformity. The design is to obscure and craft packets of the same size despite the amount of data being transmitted. Often times mixnets have technology that address time-based attacks, provide decoy or cover traffic, and implement uniformity of packets, however the pitfalls tend to be lack of scrutiny and adoption. Anonymity loves company, and most mixnets lack that component, especially in their early conceptions. Due to the lack of scrutiny with early conception and lack of adoption, I cannot provide any recommendations. Even if one is to involve themselves with the use of a mixnet, they should be on guard. Intelligence agencies are not ones to shy away from a good honeypot. While not a perfect example as this wasn't a mixnet, the FBI ran an operation with an operating system called ArcaneOS and a built-in messaging platform called anom[.]io[^24] designed for organized crime. ANOM was an application that opened as a calculator which had the user enter a pin to reach the hidden messenger. All communications were intercepted. The morale of the story is that the slightest amount of skepticism into the website communications, hosting platform, or the closed-source application could've prevented the downfall of multiple criminal enterprises globally. The same skepticism should be applied to any organization unwilling to address their shortcomings and model their potential attack vectors. Many are willing to route your traffic, and node-based cryptocurrency projects with a model that resembles that of a ponzi-scheme could always be a source of both black budget funds and traffic analysis for letter agencies. I have no fingers to point or organizations to accuse. However, it is far from a half-cocked conspiracy that intelligence agencies would engage in this type of activity. 
 
 In regards to implementation, there are a variety of options. Host-based virtualization with pre-configured systems like Whonix can be used. This routes all of the Whonix workstation's traffic through the Whonix gateway to prevent leakage. A bootable TAILS USB is also preconfigured to allow only TOR traffic, excluding the exempt or whitelisted insecure browser designed for getting your device through WiFi portals. Open-source operating systems, such as OpenWRT, on a travel router can force certain subnets to use a VPN configuration or route via TOR. 
 
-As previously stated in the Traffic Leakage section, software-based routing should not be relied on. If it is to be implemented, it should be viewed as adding an additional layer of security. There are applications such as Orbot[^21] which allows the use of the TOR network, a variety of VPN applications (which are primarily wrappers for OpenVPN), and there are scripts that configure local packet filters to "torrify" all traffic. While I have no basis in saying all software-based leak prevention mechanisms are prone to failure, historically leak prevention has been inadequate. Even Whonix reports that they "cannot do the impossible and magically prevent every kind of protocol leak and identifier disclosure." [^22] Hardware routing adds more architecture into the mix, but it provides the bulletproof assurance that there is no leakage of traffic. For critical operations, consider hardware mechanisms. For the privacy-centric individual, software-based kill switches should be more than sufficient. 
+As previously stated in the Traffic Leakage section, software-based routing should not be relied on. If it is to be implemented, it should be viewed as adding an additional layer of security. There are applications such as Orbot[^25] which allows the use of the TOR network, a variety of VPN applications (which are primarily wrappers for OpenVPN), and there are scripts that configure local packet filters to "torrify" all traffic. While I have no basis in saying all software-based leak prevention mechanisms are prone to failure, historically leak prevention has been inadequate. Even Whonix reports that they "cannot do the impossible and magically prevent every kind of protocol leak and identifier disclosure." [^26] Hardware routing adds more architecture into the mix, but it provides the bulletproof assurance that there is no leakage of traffic. For critical operations, consider hardware mechanisms. For the privacy-centric individual, software-based kill switches should be more than sufficient. 
 	
 ## Browsing
 ### Browser Configuration
 It is no secret that governments deliver malware based on anomalous internet activity, alternately put, flagged activity. While the common forms of investigations are typically conducted via physical device seizure, security mechanisms should be taken into account to stunt "passive" investigations. Browsers can be configured to disable the installation of extensions, device storage usage, setting alterations, theme changes, cookie restrictions, and cache deletions. The most important facets of private internet browsing include the browser security model, fingerprinting mitigations, and reliance on JavaScript. 
-For the security model, ungoogled variants of Chromium[^23] are advised. The security model exists unlike Gecko-based browser derivatives (i.e. Firefox). 
-Browser security and anti-fingerprinting do not always align. For instance, the TOR Browser is not unique based on fingerprinting. Tor Browser with JavaScript disabled is generally a secure setup despite being based on Gecko. Most browser-based vulnerabilities require JavaScript or some other browser-run code (fonts, WebGL, etc). Tor Browser on security setting "Safest" reduces this attack surface significantly. While Chromium browsers may have upped the ante in terms of security, many do not have any built-in anti-fingerprinting mechanisms. Some projects have taken the initiative to provide anti-fingerprinting configurations such as Bromite[^24] or Brave Browser[^25]. Using a privacy-tweaked configuration of Brave Browser is the best option for those who are not technical. However, many of the problems that plague vanilla Chromium can be mitigated with the right appended flags for process execution.
+For the security model, ungoogled variants of Chromium[^27] are advised. The security model exists unlike Gecko-based browser derivatives (i.e. Firefox). 
+Browser security and anti-fingerprinting do not always align. For instance, the TOR Browser is not unique based on fingerprinting. Tor Browser with JavaScript disabled is generally a secure setup despite being based on Gecko. Most browser-based vulnerabilities require JavaScript or some other browser-run code (fonts, WebGL, etc). Tor Browser on security setting "Safest" reduces this attack surface significantly. While Chromium browsers may have upped the ante in terms of security, many do not have any built-in anti-fingerprinting mechanisms. Some projects have taken the initiative to provide anti-fingerprinting configurations such as Bromite[^28] or Brave Browser[^29]. Using a privacy-tweaked configuration of Brave Browser is the best option for those who are not technical. However, many of the problems that plague vanilla Chromium can be mitigated with the right appended flags for process execution.
 To further elaborate, whenever Chromium is executed, it can be ran by typing the following into terminal: 
 ```
 /usr/bin/chromium %U --disable-reading-from-canvas --disable-3d-apis --disable-component-update --disable-background-networking --user-agent="" --no-default-browser-check --incognito --disable-breakpad --no-crash-upload --no-report-upload --disable-crash-reporter --disable-speech-synthesis-api --disable-speech-api --disable-cloud-policy-on-signin --disable-print-preview --disable-drive --disable-full-history-sync --disable-sync
 ```
 
-These flags can also be appended directly to the `/usr/bin/Chromium` file so every execution forces the use of the flags. (See browser hardening configurations from Anonymous Planet[^26]).
+These flags can also be appended directly to the `/usr/bin/Chromium` file so every execution forces the use of the flags. (See browser hardening configurations from Anonymous Planet[^30]).
 
 ### Search Engine Selection 
 #### DuckDuckGo
-DuckDuckGo (DDG)[^27] has long been used as an alternative to Google. It is worth mentioning that DDG is TOR Projects default selection. This has granted them significant notoriety and trust. There are some underlying problems with DDG such as being based in the US, and they are not completely open-source. Without having reviewable source code, there is no way of validating their seemingly well-intentioned privacy mission statement. However, source code review becomes a moot point when you consider the fact that you are using their centralized services. Odds are that the providers of the service do not make the entirety of their systems publicly reviewable/auditable. Arbitrary code or excess applications could exist on their servers. 
+DuckDuckGo (DDG)[^31] has long been used as an alternative to Google. It is worth mentioning that DDG is TOR Projects default selection. This has granted them significant notoriety and trust. There are some underlying problems with DDG such as being based in the US, and they are not completely open-source. Without having reviewable source code, there is no way of validating their seemingly well-intentioned privacy mission statement. However, source code review becomes a moot point when you consider the fact that you are using their centralized services. Odds are that the providers of the service do not make the entirety of their systems publicly reviewable/auditable. Arbitrary code or excess applications could exist on their servers. 
 
 #### Searx
-Searx instances[^28] are decentralized search engines that can be stood up by anyone. Decentralization with Searx doesn't remove the issue of inherent trust that must be placed in the instances, but it ensures that you have control in where you place your trust. This also enables people to stand up their own instances and configure them with better protections. Decentralization is preferred, however some of the instances are likely ran by intelligence agencies. 
+Searx instances[^32] are decentralized search engines that can be stood up by anyone. Decentralization with Searx doesn't remove the issue of inherent trust that must be placed in the instances, but it ensures that you have control in where you place your trust. This also enables people to stand up their own instances and configure them with better protections. Decentralization is preferred, however some of the instances are likely ran by intelligence agencies. 
 
 >Note: There are certainly more variants of search engines that I have not covered that are further from the beaten path. The landscape is often changing, and it is advised to practice due dilligence when researching alternate search engines. 
 
 ## Live Boot
-Live media (USB or CD) can be booted from in a process called Live Boot. Data is prevented from being stored on the hard drive of your computer (so long as you do not attempt to decrypt your hard drive that is detected). Nothing lives in permenance from the live boot. This is a useful tool for the privacy conscious as there is little to no cleanup process of your actions. Some operating systems such as The Amnesiac Incognito Live System (TAILS)[^29] are forensicly conscious and wipe the data from the device's physical memory once the USB is removed or the system is shutdown. This is not always the case for live media. Be conscious of network activity living on in permenance. This is where the use of strong cryptography can come into play from Virtual Private Network (VPN) configurations to the use of TOR. Live booting reduces the effectiveness of the Cold Boot attacks. Cold boot is heavily reliant upon data that is temporarily stored in Random Access Memory (RAM).
+Live media (USB or CD) can be booted from in a process called Live Boot. Data is prevented from being stored on the hard drive of your computer (so long as you do not attempt to decrypt your hard drive that is detected). Nothing lives in permenance from the live boot. This is a useful tool for the privacy conscious as there is little to no cleanup process of your actions. Some operating systems such as The Amnesiac Incognito Live System (TAILS)[^33] are forensicly conscious and wipe the data from the device's physical memory once the USB is removed or the system is shutdown. This is not always the case for live media. Be conscious of network activity living on in permenance. This is where the use of strong cryptography can come into play from Virtual Private Network (VPN) configurations to the use of TOR. Live booting reduces the effectiveness of the Cold Boot attacks. Cold boot is heavily reliant upon data that is temporarily stored in Random Access Memory (RAM).
 	
 >Note: Cold boot attacks require a system to be under attacker control. DDR3 memory modules lose data within 3 seconds of losing power under normal circumstances. DDR4 loses data within 1 second (more like a fraction of a second) after losing power under normal conditions.
 Sufficient mitigation against cold boot attacks is generally to simply remove memory before control of the system is released.
@@ -240,7 +240,7 @@ Destroying SSDs:
 - Open the drive
 - Break/Crush the board and memory cells
 - Burn the remains
-- Separate and scatter the debris[^30]
+- Separate and scatter the debris[^34]
 	
 >Note:
 	The DoD generally cites a drive wiping policy of 7 passes using random data. Each pass is performed on the entire drive.
@@ -248,12 +248,12 @@ Destroying SSDs:
 	
 
 ## Cryptography 
-Cryptography is a monolith of a topic that is included with the anti-forensics threat model. If the cryptography cannot be broken, forensic investigations are stunted in their tracks. Cryptography can range from encryption of individual files or messages to Full Disk Encryption (FDE). As Simon Singh has said in The Code Book, "I must mention a problem that faces any author who tackles the subject of cryptography: the science of secrecy is largely a secret science."[^31]
+Cryptography is a monolith of a topic that is included with the anti-forensics threat model. If the cryptography cannot be broken, forensic investigations are stunted in their tracks. Cryptography can range from encryption of individual files or messages to Full Disk Encryption (FDE). As Simon Singh has said in The Code Book, "I must mention a problem that faces any author who tackles the subject of cryptography: the science of secrecy is largely a secret science."[^35]
 History goes back and forth favoring both codemakers and codebreakers through different eras. While there are algorithms that exist (and yet to be created) that could be unbreakable for the necessary classification time (at least outside the statute of limitations) against codebreakers. Such encryption could involve the use of multiple algorithms such as Serpent((Twofish)(AES)) with the hash algorithm of Whirlpool, Streebog-512, or SHA512. Do be warned that there are threats imposed from the use of cascading algorithms or the use of multiple algorithms with the same key. 
 
 All this being said, there is only one form of unbreakable encryption that will stand the test of time. This is a one-time pad (OTP) cipher. This encrypts the message based on completely randomized data. This cannot be digitally or mentally generated; this needs pure randomness to be bulletproof. 
 
-"The security of the onetime pad cipher is wholly due to the randomness of the key. The key injects randomness into the ciphertext, and if the ciphertext is random then it has no patterns, no structure, nothing the cryptanalyst can latch onto. In fact, it can be mathematically proved that it is impossible for a cryptanalyst to crack a message encrypted with a onetime pad cipher. In other words, the onetime pad cipher is not merely believed to be unbreakable, just as the Vigenère cipher was in the nineteenth century, it really is absolutely secure. The onetime pad offers a guarantee of secrecy: the Holy Grail of cryptography." - Simon Sughes, The Code Book[^31]
+"The security of the onetime pad cipher is wholly due to the randomness of the key. The key injects randomness into the ciphertext, and if the ciphertext is random then it has no patterns, no structure, nothing the cryptanalyst can latch onto. In fact, it can be mathematically proved that it is impossible for a cryptanalyst to crack a message encrypted with a onetime pad cipher. In other words, the onetime pad cipher is not merely believed to be unbreakable, just as the Vigenère cipher was in the nineteenth century, it really is absolutely secure. The onetime pad offers a guarantee of secrecy: the Holy Grail of cryptography." - Simon Sughes, The Code Book[^35]
 	
 >Note:
 	An OTP using a CSPRNG (cryptographically secure pseudo-random number generator) still maintains the security of the CSPRNG used, although isn't really an OTP anymore. Instead, it acts as a stream cipher.
@@ -272,7 +272,7 @@ Randomness or entropy is the complement to cryptography, or rather a fundamental
 	For systems with a TRNG, `cat /dev/random` will produce output continuously, appearing to behave the same as `cat /dev/urandom`.
 	(on some systems with TRNGs, `cat /dev/random` will actually produce output faster than `cat /dev/urandom`).
 	
-For systems with TRNGs, the /dev/random and /dev/urandom devices provide no security difference from each other. However, /dev/urandom performs additional processing on the random data which could help mitigate certain hardware (mis)trust issues, specifically the risk of a backdoored TRNG (while there's no evidence TRNGs have ever been backdoored, this is a concern for some). To increase entropy on GNU/Linux systems, the packages `haveged` and `jitterentropy` can be used along with the boot parameter `random.trust_cpu=off` in the `/etc/default/grub` file. See Madaidan's Linux hardening guide for more details on increasing system entropy.[^32]
+For systems with TRNGs, the /dev/random and /dev/urandom devices provide no security difference from each other. However, /dev/urandom performs additional processing on the random data which could help mitigate certain hardware (mis)trust issues, specifically the risk of a backdoored TRNG (while there's no evidence TRNGs have ever been backdoored, this is a concern for some). To increase entropy on GNU/Linux systems, the packages `haveged` and `jitterentropy` can be used along with the boot parameter `random.trust_cpu=off` in the `/etc/default/grub` file. See Madaidan's Linux hardening guide for more details on increasing system entropy.[^36]
 	
 ### Key Usage
 Properly implemented cryptographic usage of keys provides a substantial barrier to overcome for the assigned analyst. Key usage renders bruteforce password cracking ineffective. The randomness or entropy contained in the key allows for much stronger encryption than could be created by a simple or complex password (especially since the keys are typically password protected in implementation). 
@@ -301,20 +301,20 @@ Comment:
 ```
 Now you will type characters in the terminal to generate entropy (randomness) for the encryption. You will then be prompted to enter a passphrase.
 
-Now you can use commands via terminal with gpg/gpg2, or you can use a tool with a Graphical User Interface (GUI) such as GNU Privacy Assistant (GPA)[^33] to sign, validate, and encrypt messages to your affiliates. 
+Now you can use commands via terminal with gpg/gpg2, or you can use a tool with a Graphical User Interface (GUI) such as GNU Privacy Assistant (GPA)[^37] to sign, validate, and encrypt messages to your affiliates. 
 ex. Signing the file `plaintext.txt` via terminal
 `gpg -s plaintext.txt`
 
 For the party trying to validate the signature, they can issue the following command:
 `gpg --check-signatures plaintext.txt.gpg`
 
-Minisign[^34] is an incredibly simple tool developed in python for the purpose of signature validation. It is a more modern tool than PGP that is user-friendly.
+Minisign[^38] is an incredibly simple tool developed in python for the purpose of signature validation. It is a more modern tool than PGP that is user-friendly.
 Generate key pair: `minisign -G`
 The public key can be distributed as needed, while the private key should remain strictly under user control for signing files. 
 `minisign -S [-x sigfile] [-s seckey] -m file [file ...]`
 
 #### Encrypting Drives and Files
-To date, Linux Unified Key Setup (LUKS) and Veracrypt[^35] are the two most notable options. 
+To date, Linux Unified Key Setup (LUKS) and Veracrypt[^39] are the two most notable options. 
 - LUKS: Primarily used for FDE
 - Veracrypt: Primarily container-based encrypt for file storage and plausible deniability with hidden volumes
 - PGP: Used for file-based encryption
@@ -323,7 +323,7 @@ To date, Linux Unified Key Setup (LUKS) and Veracrypt[^35] are the two most nota
 	
 #### Offline Password Managers
 Security often comes down to the basics; Make your devices/accounts/services hard to crack. Feds & private forensics companies may be able to allocate ridiculous amounts of computing power against your services to see logs and compromise your accounts, but their brute forcing efforts can be rendered useless. 
-Consider offline variants of KeePass[^36] for secure password storage, then consider placing the KeePass database inside of a hidden veracrypt. Having a password with an absurd amount of characters such as `dHK&*/4pk_!i??5R=^K}~FU!kxF{fG}*&>oMdRt([);7?=v(e^,ch_n)r()]:&k$D@f4#G"Y\v_5-*i$E[+)"bT*@BF+{hkvn7[B]{qq'[~]3@+-Ju6C(@<]=TEM6a\h$c+:W[k$=;Jy[Un7&~NtvK*{Bn` is enough to stunt any brute force attempt. Cryptographic security can only be as strong as the key being used. 
+Consider offline variants of KeePass[^40] for secure password storage, then consider placing the KeePass database inside of a hidden veracrypt. Having a password with an absurd amount of characters such as `dHK&*/4pk_!i??5R=^K}~FU!kxF{fG}*&>oMdRt([);7?=v(e^,ch_n)r()]:&k$D@f4#G"Y\v_5-*i$E[+)"bT*@BF+{hkvn7[B]{qq'[~]3@+-Ju6C(@<]=TEM6a\h$c+:W[k$=;Jy[Un7&~NtvK*{Bn` is enough to stunt any brute force attempt. Cryptographic security can only be as strong as the key being used. 
 	
 >Note: 
 A 20-character random password (letters, numbers, and symbols) provides 132.877 bits of security (compare to 128 bit symmetric encryption keys).
@@ -374,13 +374,13 @@ Every introduced system creates a larger fingerprint and attack vector, ultimate
 Depending on your threat model, not all operations can be conducted from a coffee shop. There are an increasing amount of cameras, and facial recognition technology is already being deployed, along with license plate scanners at every street light. If operations are sensitive and must be conducted from the same location consistently, preparation should always lean towards the worst-case scenario. 
 While some of these proposed methods may be unconventional, these are unconventional times. Mechanisms can be put in place to ensure that your systems are sent shutdown signals that will lock them behind disk encryption. Shutdown signals are the most common, however we are not limited to the commands we issue. The use of radio transmitters to issue shutdowns have some level of intricacy that surpasses skills of the novice user. 
 ### Dead Man's Switch
-A physical wired dead man's switch reduces attack surface and intricacy. After the dead man's switch aka killswitch is configured, we can move on to the commands to issue. If we wanted to securely wipe the random access memory before shutting down, we could issue the "sdmem -v" command to verbosely clean the RAM as the killswitch is activated. The killswitch can be activated from a system event. Any form of shell command that is compatible with the particular GNU/Linux system can be ran based on a specified system behavior. See resources at the end of this section [^37], [^38], and [^39] for USB dead man's switch. In a nutshell, this is configured to watch system USB events. When a change occurs, the switch commands are invoked. Panic buttons are another form of a killswitch that essentially remains active on your display and is ready to select at any moment. (Centry.py[^40] is a good example of a panic button). There are USB devices known as "Mouse Jigglers" that are used by forensic teams after device seizure. These jigglers are serial devices plugged in to interface with the system to keep the screenlock from being invoked. 
-There are easy preventative software-based solutions such as USBCTL[^41] that can prevent these devices for operating, however this will likely be picked up on and human mouse jigglers can take their place. Ideally a process can be utilized to detect such a device and invoke a shutdown process. A mitigation for the human mouse jigglers could be implementing forced authentication every half hour to an hour. If the credentials have not been entered, the user session could be terminated, memory could be cleared, or the shutdown command could even be invoked. 
+A physical wired dead man's switch reduces attack surface and intricacy. After the dead man's switch aka killswitch is configured, we can move on to the commands to issue. If we wanted to securely wipe the random access memory before shutting down, we could issue the "sdmem -v" command to verbosely clean the RAM as the killswitch is activated. The killswitch can be activated from a system event. Any form of shell command that is compatible with the particular GNU/Linux system can be ran based on a specified system behavior. See resources at the end of this section [^41], [^42], and [^43] for USB dead man's switch. In a nutshell, this is configured to watch system USB events. When a change occurs, the switch commands are invoked. Panic buttons are another form of a killswitch that essentially remains active on your display and is ready to select at any moment. (Centry.py[^44] is a good example of a panic button). There are USB devices known as "Mouse Jigglers" that are used by forensic teams after device seizure. These jigglers are serial devices plugged in to interface with the system to keep the screenlock from being invoked. 
+There are easy preventative software-based solutions such as USBCTL[^45] that can prevent these devices for operating, however this will likely be picked up on and human mouse jigglers can take their place. Ideally a process can be utilized to detect such a device and invoke a shutdown process. A mitigation for the human mouse jigglers could be implementing forced authentication every half hour to an hour. If the credentials have not been entered, the user session could be terminated, memory could be cleared, or the shutdown command could even be invoked. 
 
 Remote switches are interesting devils, and their utility should be placed under high consideration if the size of the operation warrants it. Panic buttons such as Centry.py can be used to broadcast or propagate a panic signal to all nodes on the network. 
 	
 ## Play on Resources
-Earlier, it was said that these groups have unlimited resources; this is not entirely true. The one resource which they lack is time. While they have infinite funds to allocate towards password and key cracking methods, so long as quantum physics strays behind computing, time is their main constraint. Taking methods from obscurity, the use of non-default encryption algorithms and hashing mechanisms for keys substantially increases the amount of time the analyst must expend on cracking. If the analyst cannot identify the hash function or cipher, they must try all possible options. Even if the correct password is obtained, this becomes useless without the proper cipher. For instance, Veracrypt uses over fifteen combinations of individual encryption algorithms and cascaded/stacked ciphers. Complement this with the five supported hash functions, and we are looking at 75 possible combinations of symmetric ciphers and one-way hash functions. As stated by ElcomSoft,[^42] "Trying all possible combinations is about 175 times slower compared to attacking a single combination of AES+SHA-512."
+Earlier, it was said that these groups have unlimited resources; this is not entirely true. The one resource which they lack is time. While they have infinite funds to allocate towards password and key cracking methods, so long as quantum physics strays behind computing, time is their main constraint. Taking methods from obscurity, the use of non-default encryption algorithms and hashing mechanisms for keys substantially increases the amount of time the analyst must expend on cracking. If the analyst cannot identify the hash function or cipher, they must try all possible options. Even if the correct password is obtained, this becomes useless without the proper cipher. For instance, Veracrypt uses over fifteen combinations of individual encryption algorithms and cascaded/stacked ciphers. Complement this with the five supported hash functions, and we are looking at 75 possible combinations of symmetric ciphers and one-way hash functions. As stated by ElcomSoft,[^46] "Trying all possible combinations is about 175 times slower compared to attacking a single combination of AES+SHA-512."
 Hypothetically, if the algorithm/hash combination is known by the attacker, here is where the cascading algorithms display their value:
 "Whether they choose to encrypt with AES, Serpent, Twofish or any other single algorithm, the speed of the attack will remain the same. Attacks on cascaded encryption with two algorithms (e.g. AES(Twofish)) work at half the speed, while cascading three algorithms slows them down to around 1/3 the speed."
 	
@@ -402,7 +402,7 @@ When feasible, radio transmitters should be physically removed from devices. Fro
 For an adversary who gains a foothold on your system(s) without the physically removed hardware, they could activate certain frequencies to create a persistent foothold and compromise your system even further.
 For critical operations, reduce reliance on wireless radio transmissions. Consider the process of removing all radio transmitter chipsets, otherwise known as airgapping, to mitigate a medley of threats.
 	
-Methods of "jumping" airgaps have been found in the past.[^43] One must be sure to remove all hardware which could be used for communication. This includes Wi-Fi cards (often Bluetooth and Wi-Fi are within the same physical card), Bluetooth card (if you have a Bluetooth card separate from your Wi-Fi card), microphones (communications protocols have been devised to transmit data through ultrasonic audio). Many modern OSs still have the drivers to support these protocols, and the attacks surface therefore still exists), speakers (usable for data exfiltration using the same means), physical ports (USB, SD, headphone jack). Even power cords have been used as a means of compromise (on both laptop and desktop systems).
+Methods of "jumping" airgaps have been found in the past.[^47] One must be sure to remove all hardware which could be used for communication. This includes Wi-Fi cards (often Bluetooth and Wi-Fi are within the same physical card), Bluetooth card (if you have a Bluetooth card separate from your Wi-Fi card), microphones (communications protocols have been devised to transmit data through ultrasonic audio). Many modern OSs still have the drivers to support these protocols, and the attacks surface therefore still exists), speakers (usable for data exfiltration using the same means), physical ports (USB, SD, headphone jack). Even power cords have been used as a means of compromise (on both laptop and desktop systems).
 	
 The traditional methods of interfacing with the internet stand to be the most secure. Systems using direct ethernet connection is optimal. While this is not a technical "airgap," this does prevent packet communications from being analyzed over the air.
 	
@@ -454,7 +454,7 @@ Perhaps it's a side project of some sort, or some harmless hobby. If there is no
 
 Regarding the creation of online accounts and personas, don't use identifiable names. Your operations should be treated as a second life that should be appropriately segmented. While you may find some of your ideas to be profound/esoteric and want to reuse and redistribute across platforms - refrain. You're only creating a trail that could come back to bite you. Not only should you segment your usernames creative talents, but ensure that projects also become segmented. The more you divulge into separate projects, the less connection you want to have - unless of course they are related and you desire the marketing crossover. 
 
-The physical use of your device, from pinging telecommunications infrastructure to local area network (LAN) connections will rat you out. Geofencing requests have gained increasing popularity with American law enforcement. Google self-reported, "Year over year, Google has observed over a 1,500% increase in the number of geofence requests it received in 2018 compared to 2017; and to date, the rate has increased over 500% from 2018 to 2019."[^44]
+The physical use of your device, from pinging telecommunications infrastructure to local area network (LAN) connections will rat you out. Geofencing requests have gained increasing popularity with American law enforcement. Google self-reported, "Year over year, Google has observed over a 1,500% increase in the number of geofence requests it received in 2018 compared to 2017; and to date, the rate has increased over 500% from 2018 to 2019."[^48]
 After the physical side is dealt with, the digital side can start to be addressed. Just like scripts can be implemented to increase efficiency, they can also be used to aid and/or create alibis.
 
 Consider the creation of python scripts to engage your devices to perform certain functions. For instance, create a wordlist that your browser searches for on demand (with a hint of randomness). Program your music player to play certain songs at certain times. The goal of these actions is to emulate real activity that could provide that alibi for you. 
@@ -462,20 +462,21 @@ Often times a double-edged pendulum comes to swing. If an investigator were to b
 
 You will likely not come out unscathed from the psychological toll of withholding secrets. Not only do fabrications add unneeded complexity into your relationships by forcing you to drain energy keeping narratives intact, but they place you in a state of isolation from others. All tyranny stems from deceit, and your own psyche can stand to be a worse tyrant than the state. Make sure the endeavor is worth the burden. 
 	
-"As we have seen, every personal secret has the effect of a sin or of guilt—whether or not it is, from the standpoint of popular morality, a wrongful secret. Now another form of concealment is the act of "withholding"—it being usually emotions that are withheld. As in the case of secrets, so here also we must make a reservation: self-restraint is healthful and beneficial; it is even a virtue. This is why we find self-discipline to have been one of man's earliest moral attainments. Among primitive peoples it has its place in the initiation ceremonies, chiefly in the forms of ascetic continence and the stoical endurance of pain and fear. Self-restraint, however, is here practised within the secret society as something undertaken in company with others. But if self-restraint is only a private matter, and perhaps devoid of any religious aspect, then it may be as harmful as the personal secret." - C. G. Jung, Modern Man in Search of a Soul[^45]
+"As we have seen, every personal secret has the effect of a sin or of guilt—whether or not it is, from the standpoint of popular morality, a wrongful secret. Now another form of concealment is the act of "withholding"—it being usually emotions that are withheld. As in the case of secrets, so here also we must make a reservation: self-restraint is healthful and beneficial; it is even a virtue. This is why we find self-discipline to have been one of man's earliest moral attainments. Among primitive peoples it has its place in the initiation ceremonies, chiefly in the forms of ascetic continence and the stoical endurance of pain and fear. Self-restraint, however, is here practised within the secret society as something undertaken in company with others. But if self-restraint is only a private matter, and perhaps devoid of any religious aspect, then it may be as harmful as the personal secret." - C. G. Jung, Modern Man in Search of a Soul[^49]
 
 
 ## False Compromise
 Malware with computing is still in the early stages. It truly is the wild west in many regards. For an extra layer of plausible deniabilty, embed a tailored backdoor or malware variant. This method will not protect you if there are logs that correlate your activity and no logs correlating connection attempts.
 The vast majority of cases related to online operations become unsolved mysteries in the archives of law enforcement. Most happenings become heresay or mere hunches. Take APT groups and nation-states as an example; the majority of cyberwarfare that occurs today is between state-funded APT groups with a primary focus of non-attribution. Despite how many correlating clues lead back to the APT groups and their communications with nation-states, the water remains murky. In replacement or in conjunction with the killswitch, consider weaponizing your own variant of ransomware. You could create a maintain ownership of the key or you could accept the loss of your data. The malware could also perform shred functions as with any script that you could program. Not only does the embedded malware render your data inaccessible, but it provides another level of plausible deniability. "I was not aware my infrastructure was being used for that." Technically, "malware" implies the application of code that will create adverse or undesired action to the system. This is not truly malware, but rather programmed code designed to mimic malicious function.
 
-On GNU/Linux, there are many ways to embed malware on the system. Some of which leverage crontabs or other variants of scheduling tools. Aliases can be altered to perform malicious functions rather than the desired results. System process in `bin/` directories can perform unintended tasks, or simply be swapped out and/or linked to alternate processes. Some files such as `/etc/rc.local` or `/home/$USER/.bashrc` can contain commands to execute upon booting to the disk or logging into a user account respectively. Analyzing the newest trends of threat actors can useful to determine indicators of compromise (IOC). Kinsing[^46] and other threat actors that leverage new vulnerabilities to compromise internet-facing systems and embed cryptominers provide insight into the world of persistence, along with a competitive nature that stunts competition. The sub-sections listed below identify remnance that could indicate past compromise. 
+On GNU/Linux, there are many ways to embed malware on the system. Some of which leverage crontabs or other variants of scheduling tools. Aliases can be altered to perform malicious functions rather than the desired results. System process in `bin/` directories can perform unintended tasks, or simply be swapped out and/or linked to alternate processes. Some files such as `/etc/rc.local` or `/home/$USER/.bashrc` can contain commands to execute upon booting to the disk or logging into a user account respectively. Analyzing the newest trends of threat actors can useful to determine indicators of compromise (IOC). Kinsing[^50] and other threat actors that leverage new vulnerabilities to compromise internet-facing systems and embed cryptominers provide insight into the world of persistence, along with a competitive nature that stunts competition. The sub-sections listed below identify remnance that could indicate past compromise. 
 
 ### Cron example
 `echo "*/30 * * * * sh /etc/.newinit.sh >/dev/null 2>&1" > /etc/$crondir`
 
 ### Service Creation
 Make a file under `/etc/systemd/system/$service_name.service`
+
 If using a runit service manager, create a file under `/etc/sv/$service_name`.
 
 ### /tmp/ executions
@@ -498,30 +499,30 @@ Zcash (ZEC) was ground-breaking in the implementation of a protocol known as Suc
 
 Monero is often hailed as the privacy king of cryptocurrency. While it has commendable features with its RingCT protocol, the overarching theme is obscurity rather than traceless transactions. 
 "The fundamental problem of coin mixing methods though is that transaction data is not being hidden through encryption. RingCT is a system of disassociation where information is still visible in the blockchain. Mind that a vulnerability might be discovered at some point in the future which allows traceability since Monero’s blockchain provides a record of every transaction that has taken place."
-This operates similar to a mixnet where it is difficult to discern the originating address from a transaction. One of Monero's developers publicly admits that "zk-SNARKs provides much stronger untraceability characteristics than Monero (but a much smaller privacyset and much higher systemic risks)." Intelligence agencies have placed their eyes on Monero for some time. The United States has even brought in a private firm called CipherTrace who claims to have built tools capable of tracing transactions.[^47] At the time of writing, these are unsubstantiated claims; there is no evidence to suggest that Monero has been deobfuscated. 
+This operates similar to a mixnet where it is difficult to discern the originating address from a transaction. One of Monero's developers publicly admits that "zk-SNARKs provides much stronger untraceability characteristics than Monero (but a much smaller privacyset and much higher systemic risks)." Intelligence agencies have placed their eyes on Monero for some time. The United States has even brought in a private firm called CipherTrace who claims to have built tools capable of tracing transactions.[^51] At the time of writing, these are unsubstantiated claims; there is no evidence to suggest that Monero has been deobfuscated. 
 
 Pirate Chain's ARRR addresses the fungibility problem of Zcash by removing the transparent address schema (t-tx) and forcing all transactions to use Sapling shielded transactions (z-tx). "By consistently utilizing zk-SNARKs technology, Pirate leaves no usable metadata of user’s transactions on its blockchain." This means that even if the blockchain was compromised down the line, the adversary would obtain little to no useful metadata. The transactions contain no visible amount to no visible address from no visible address. The underlying cryptography would have to be broken or the viewing/spending keys would have to be intercepted in order to peer into the transactions. For an adversary without key possession, the trace is baseless. "A little bit of math can accomplish what all the guns and barbed wire can’t: a little bit of math can keep a secret." - Edward Snowden
 
 While I could write mounds of literature diving into the depths of cryptocurrency, I have brought forth only what is useful to the aims of anti-forensics. There is no real purpose in regurgitating quotations from various whitepapers and protocol designs. Any further research into the matter is up to you. If this has peaked your interest, consider diving into the various communities, protocol specifications, and whitepapers.
 
-- Further information pertaining to zk-SNARKs - [^48]
-- Monero (XMR) Whitepaper - [^49]
-- Pirate Chain Whitepaper - [^50]
+- Further information pertaining to zk-SNARKs - [^52]
+- Monero (XMR) Whitepaper - [^53]
+- Pirate Chain Whitepaper - [^54]
 
 	
 ## Defensive Mechanisms
-System security or hardening is vital for successful operations. Lack of hardening could result in your machines being cut through like hot butter. Center for Internet Security (CIS)[^51]  and Defense Information Systems Agency (DISA) with Standard Technical Implementation Guides[^52] both have decent system hardening standards that are to be applied to all DoD contractor, government, and affiliated nodes. For Linux and Unix systems, Kernel Self-Protection Project (KSPP)[^53] is a great resource for kernel configuration settings. 
+System security or hardening is vital for successful operations. Lack of hardening could result in your machines being cut through like hot butter. Center for Internet Security (CIS)[^55]  and Defense Information Systems Agency (DISA) with Standard Technical Implementation Guides[^56] both have decent system hardening standards that are to be applied to all DoD contractor, government, and affiliated nodes. For Linux and Unix systems, Kernel Self-Protection Project (KSPP)[^57] is a great resource for kernel configuration settings. 
 Hardening procedures fall in line with the concept of minimizing architecture and running processes on a system. This makes each system easier to audit with less noise/clutter, and reduces the attack surface for exploitation. Hardening should encompass patches, scans with most recent virus definitions, restrictive permissions, kernel hardening, purging unnecessary software, and disabling physical ports, unnecessary users, filesystems, firmware modules, compilers, and network protocols.
 System hardening is far from a quick and easy process, unless you have preconfigured images for systems. For small operations lacking technical prowess, preconfigured operating systems such as TAILS or Whonix mentioned in the Operating System section assure the greatest security and the least hassle. 
 If the goal is to run a more persistent lightweight OS with minimal functionality, I suggest running a variant of Arch Linux that does not use SystemD (Consider runit, OpenRC, or s6). If wide community support is needed, Arch with a hardened configuration will be your best bet. For the tech-savvy, hardened variants of Gentoo are ideal.
-The more persistence desired for the operation increases the complexity of the hardening. Some projects have been introduced to rival Xen-based hypervisors with minimalist GNU/Linux systems. Some development towards Whonix Host[^54] was started but has not yet come to fruition. PlagueOS[^55] is based on the Void musl build with numerous hardening mechanisms. This is designed to act strictly as a locked down hypervisor with all system activities conducted inside of Kicksecure/Whonix VMs. The VMs also are restricted by AppArmor profiles and are ran inside a `bwrap`[^56] sandboxed container. See the PARSEC repository for examples of how to implement bubblewrap profiles.[^57]. Do note that the listed hardening is incomplete and will not fit all operations and GNU/Linux systems. This is not meant to be a book on methods for defensive cybersecurity. For those concerned with exploitation of GNU/Linux systems, see the reference to Madaidan's hardening guide.[^58]
+The more persistence desired for the operation increases the complexity of the hardening. Some projects have been introduced to rival Xen-based hypervisors with minimalist GNU/Linux systems. Some development towards Whonix Host[^58] was started but has not yet come to fruition. PlagueOS[^59] is based on the Void musl build with numerous hardening mechanisms. This is designed to act strictly as a locked down hypervisor with all system activities conducted inside of Kicksecure/Whonix VMs. The VMs also are restricted by AppArmor profiles and are ran inside a `bwrap`[^60] sandboxed container. See the PARSEC repository for examples of how to implement bubblewrap profiles.[^61]. Do note that the listed hardening is incomplete and will not fit all operations and GNU/Linux systems. This is not meant to be a book on methods for defensive cybersecurity. For those concerned with exploitation of GNU/Linux systems, see the reference to Madaidan's hardening guide.[^62]
 
 
 ## Physical Precautions 
 
 This wouldn't be a complete work on anti-forensics without some mention of physical precautions. While wireless transmitters are ill-advised, wireless technology can prove useful when larger proximity is needed. Directional antennas could allow you to stay hidden from cameras and remotely authenticate to a network. 
 
-With nuances added from the modern surveillance state, traffic cameras force your hand by revealing every intersection which you have passed through. There are a few methods to circumventing this privacy infringement. Darkened weather covers for your license plate (Warning: This method could result in a fine with the wrong officer) or a well-rigged bicycle rack could prevent cameras from picking up your plate number. Alternatively, if a destination is within a few miles of proximity you could either ride a bicycle (with a disguise), or decide to become a motorcyclist. With motocycles, the plate numbers are significantly smaller and could even be blocked by your feet on certain bikes. The helmet would stand to mask facial features, and the jacket would cover any identifiable features such as tattoos. Palantir has been involved in "predictive policing" leveraging footage obtained from traffic cameras to profile individuals.[^59]
+With nuances added from the modern surveillance state, traffic cameras force your hand by revealing every intersection which you have passed through. There are a few methods to circumventing this privacy infringement. Darkened weather covers for your license plate (Warning: This method could result in a fine with the wrong officer) or a well-rigged bicycle rack could prevent cameras from picking up your plate number. Alternatively, if a destination is within a few miles of proximity you could either ride a bicycle (with a disguise), or decide to become a motorcyclist. With motocycles, the plate numbers are significantly smaller and could even be blocked by your feet on certain bikes. The helmet would stand to mask facial features, and the jacket would cover any identifiable features such as tattoos. Palantir has been involved in "predictive policing" leveraging footage obtained from traffic cameras to profile individuals.[^63]
 
 It should go without saying that any tech devices that you purchase will have some identifier that could lead back to you. Make this a moot point and procure every device (even USBs) anonymously with cash. If you're out on a distant roadtrip, make some of your purchases. Wear a hat accompanied with some baggy clothes. Perform a slight change in your gait as you walk (uncomfortable shoes could help with this). Alternatively, pay that bum off the street to do your bidding. 
 
@@ -549,13 +550,13 @@ It's evident that poking powerful players could result in irreversable consequen
 
 The OS selection should be oriented towards amnesia. TAILS could be leveraged with a USB, and the drive in the system could simply be a dummy (filled with insignificant data, vacation pictures, etc). The physical wireless chipset should be removed and replaced with a wireless dongle and attached only when needed. While I prefer hardware mitigations over software mitigations, you may not wish to fry the USB ports or desolder the SATA ports. The BIOS should be password-protected, and the USB ports at the very least can be disabled from the menu. If you will be operating from public locations, consider running a blank keyboard with a privacy screen covering the LED. 
 
-Fortunately, amnesiac solutions are growing. One can run TAILS with the HiddenVM project.[^60] HiddenVM is precompiled VirtualBox binaries to allow running virtual machines without an installation directly on TAILS. HiddenVM leverages the TAILS amnesiac system with Veracrypt's hidden partitions for plausible deniability. In this way, Whonix can be ran from TAILs and there will not be an overlapping use of TOR.
+Fortunately, amnesiac solutions are growing. One can run TAILS with the HiddenVM project.[^64] HiddenVM is precompiled VirtualBox binaries to allow running virtual machines without an installation directly on TAILS. HiddenVM leverages the TAILS amnesiac system with Veracrypt's hidden partitions for plausible deniability. In this way, Whonix can be ran from TAILs and there will not be an overlapping use of TOR.
 
-If a live USB with minimal processing power is not your niche, consider running a hardened base Linux, preferably using a Windows Manager (WM) over a full Desktop Environment (DE), to act as a hyper-visor that runs amnesiac virtual machines such as Whonix. If the option is taken to avoid live boot, the hardware selection becomes more important. First off, it would be in your best interest to use at least 16 GB of RAM. Secondly, consider using one SSD and one HDD. The HDD will be used to hold files, while the SSD is used for facilitating performance for the host OS. As previously stated, HDDs can be wiped by degaussing or overwriting physical sectors while this should be assumed an impossibility for an SSD. Each VM on the host should have a primary function; separate cases and even processes should have separate VMs. For the more technical, sandboxing applications can be used to add nested layers of security. Consider using a sandboxed profile[^56] for your virtualization software, whether it be KVM[^61] or VirtualBox[^62]. Inside the VM, use sandboxing to isolate your processes. 
+If a live USB with minimal processing power is not your niche, consider running a hardened base Linux, preferably using a Windows Manager (WM) over a full Desktop Environment (DE), to act as a hyper-visor that runs amnesiac virtual machines such as Whonix. If the option is taken to avoid live boot, the hardware selection becomes more important. First off, it would be in your best interest to use at least 16 GB of RAM. Secondly, consider using one SSD and one HDD. The HDD will be used to hold files, while the SSD is used for facilitating performance for the host OS. As previously stated, HDDs can be wiped by degaussing or overwriting physical sectors while this should be assumed an impossibility for an SSD. Each VM on the host should have a primary function; separate cases and even processes should have separate VMs. For the more technical, sandboxing applications can be used to add nested layers of security. Consider using a sandboxed profile[^60] for your virtualization software, whether it be KVM[^65] or VirtualBox[^66]. Inside the VM, use sandboxing to isolate your processes. 
 	
 >Note: Amnesiac computing is highly advised for journalists with state targets on their back. Most malware will not be able to persist through different sessions, and often they will have to interact with hostile platforms and networks. 
 
-If a mobile device is deemed a necessity, leverage GrapheneOS on a Google Pixel. Encrypt all communications through trusted services or peer-to-peer (P2P) applications like Briar.[^63] Route all device traffic through TOR with the use of Orbot. Keep the cameras blacked out with electrical or gorilla tape. The concept of treating all signals as hostile should be emphasized here as the hardware wireless chipset cannot be desoldered. Sensors and microphones can successfully be disabled, but the trend with smaller devices is that they run as a System on a Chip (SoC). In short, multiple functions necessary for the system to work are tied together in a single chip. Even if you managed not to fry the device from the desoldering process, you would have gutted the core mechanisms of the system, resulting in the newfound possession of a paperweight. 
+If a mobile device is deemed a necessity, leverage GrapheneOS on a Google Pixel. Encrypt all communications through trusted services or peer-to-peer (P2P) applications like Briar.[^67] Route all device traffic through TOR with the use of Orbot. Keep the cameras blacked out with electrical or gorilla tape. The concept of treating all signals as hostile should be emphasized here as the hardware wireless chipset cannot be desoldered. Sensors and microphones can successfully be disabled, but the trend with smaller devices is that they run as a System on a Chip (SoC). In short, multiple functions necessary for the system to work are tied together in a single chip. Even if you managed not to fry the device from the desoldering process, you would have gutted the core mechanisms of the system, resulting in the newfound possession of a paperweight. 
 
 ### Market Vendor
 Let's assume the vendor is selling some sort of vice found on the DEA's list of schedule 1 narcotics. Fortunately in this use-case, unlike that of the anonymous activist (or the journalist in some cases), OPSEC is welcomed with open arms. In fact, vendors are even rated with their stealth (both from shipping and processing) as one of the highest criteria in consideration, along with the markets being TOR friendly, leveraging PGP, and ensuring full functionality without Javascript. Given the ongoing nature of these operations, and that they are tailored towards privacy and security, a more persistent system will likely be the best fit. 
@@ -683,65 +684,69 @@ Donations to support projects under https://git.envs.net/WhichDoc are welcome wi
 
 ## References
 [^1]: https://www.forbes.com/sites/andygreenberg/2011/02/11/palantir-apologizes-for-wikileaks-attack-proposal-cuts-ties-with-hbgary/
-[^2]: Purism technical writeup for IME - https://puri.sm/posts/deep-dive-into-intel-me-disablement/
-[^3]: https://github.com/corna/me_cleaner
-[^4]: Coreboot - https://www.coreboot.org
-[^5]: AMD PSP Vulnerability: https://hackaday.com/2021/10/01/flaw-in-amd-platform-security-processor-affects-millions-of-computers/
-[^6]: Site detailing reasons against SystemD usage - https://nosystemd.org/
-[^7]: Artix Linux - https://artixlinux.org
-[^8]: Void Linux - https://voidlinux.org
-[^9]: Alpine Linux - https://alpinelinux.org/
-[^10]: Smartphone Data Collection - https://www.statista.com/chart/15207/smartphone-data-collection-by-google-and-apple/
-[^11]: GrapheneOS - https://grapheneos.org
-[^12]: Pine64 Pinephone - https://www.pine64.org/pinephone/
-[^13]: Purism Librem 5 - https://puri.sm/products/librem-5/
-[^14]: Cover your track on UNIX systems - https://github.com/sundowndev/covermyass
-[^15]: OSI Model - https://en.wikipedia.org/wiki/OSI_model
-[^16]: ProtonVPN threat model - https://protonvpn.com/blog/threat-model/
-[^17]: Whonix VPN leakage - https://www.whonix.org/wiki/Tunnels/Connecting_to_Tor_before_a_VPN
-[^18]: Tails VPN article - https://gitlab.tails.boum.org/tails/blueprints/-/wikis/vpn_support
-[^19]: I2P - https://geti2p.net/en/
-[^20]: URLScan of anom[.]io - https://urlscan.io/result/f7b4c5ae-3864-4b3f-be0e-ad10e39276bc/#summary
-[^21]: Orbot - https://guardianproject.info/apps/org.torproject.android/
-[^22]: Whonix leak protection - https://www.whonix.org/wiki/Protocol-Leak-Protection_and_Fingerprinting-Protection
-[^23]: Ungoogled Chromium binaries - https://ungoogled-software.github.io/ungoogled-chromium-binaries/
-[^24]: Bromite Browser - https://www.bromite.org
-[^25]: Brave Browser - https://brave.com
-[^26]: The Hitchhikers Guide to Anonymity (Browser Hardening) - https://anonymousplanet.org/guide.html#appendix-v1-hardening-your-browsers
-[^27]: DuckDuckGo - https://duckduckgo.com
-[^28]: Searx instances - https://searx.space/
-[^29]: TAILS - https://tails.boum.org
-[^30]: Drive Destruction - https://anonymousplanet.org/guide.html#how-to-securely-wipe-your-whole-laptopdrives-if-you-want-to-erase-everything
-[^31]: Singh, S. (1999). The code book: the secret history of codes and codebreaking (Vol. 366). London: Fourth Estate.
-[^32]: Linux Entropy - https://madaidans-insecurities.github.io/guides/linux-hardening.html#entropy
-[^33]: GNU Privacy Assistant - gnupg.org/related_software/gpa/index.html
-[^34]: Minisign - https://github.com/jedisct1/minisign/
-[^35]: Veracrypt - https://www.veracrypt.fr/code/VeraCrypt/
-[^36]: KeepassXC - https://keepassxc.org
-[^37]: USB dead man's switch - https://tech.michaelaltfield.net/2020/01/02/buskill-laptop-kill-cord-dead-man-switch/
-[^38]: USBKill - https://github.com/hephaest0s/usbkill/blob/master/usbkill/usbkill.py
-[^39]: Silk Guardian - https://github.com/NateBrune/silk-guardian
-[^40]: Centry Panic Button - https://github.com/AnonymousPlanet/Centry
-[^41]: USBCTL - https://github.com/anthraxx/usbctl
-[^42]: Elcomsoft Forensics - https://blog.elcomsoft.com/2020/03/breaking-veracrypt-containers/
-[^43]: Jumping Airgaps - https://arxiv.org/pdf/2012.06884.pdf
-[^44]: Geofence Requests - https://assets.documentcloud.org/documents/6747427/2.pdf
-[^45]: Jung, C. G. (2014). Modern man in search of a soul. Routledge.
-[^46]: Kinsing Crypto-Miner - https://blog.aquasec.com/threat-alert-kinsing-malware-container-vulnerability
-[^47]: CipherTrace - https://ciphertrace.com/ciphertrace-announces-worlds-first-monero-tracing-capabilities/
-[^48]: ZkSnarks - https://z.cash/technology/zksnarks 
-[^49]: Monero Whitepaper - https://www.getmonero.org/resources/research-lab/pubs/whitepaper_annotated.pdf
-[^50]: Pirate Chain Whitepaper - https://pirate.black/files/whitepaper/The_Pirate_Code_V2.0.pdf
-[^51]: CIS - https://www.cisecurity.org
-[^52]: DISA STIGs - https://public.cyber.mil/stigs
-[^53]: KSPP - https://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project/Recommended_Settings
-[^54]: Whonix Host - https://www.whonix.org/wiki/Whonix-Host
-[^55]: PlagueOS- https://git.envs.net/whichdoc/plagueos
-[^56]: BubbleWrap Sandbox - https://github.com/containers/bubblewrap
-[^57]: SalamanderSecurity's PARSEC repository - https://codeberg.org/SalamanderSecurity/PARSEC
-[^58]: Linux Hardening -  https://madaidans-insecurities.github.io/guides/linux-hardening.html
-[^59]: FOIA request for Palantir operations -https://www.documentcloud.org/search/projectid:51061-Palantir-September-2020
-[^60]: HiddenVM - https://github.com/aforensics/HiddenVM
-[^61]: KVM - https://www.linux-kvm.org/
-[^62]: Oracle VirtualBox -  https://virtualbox.org
-[^63]: Briar P2P Messenger - https://briarproject.org
+[^2]: Social Media Ban - https://www.newsweek.com/trump-has-now-been-suspended-four-six-most-popular-social-media-platforms-1559830
+[^3]: NSO targets journalists - https://threatpost.com/apple-emergency-fix-nso-zero-click-zero-day/169416/
+[^4]: Purism technical writeup for IME - https://puri.sm/posts/deep-dive-into-intel-me-disablement/
+[^5]: https://github.com/corna/me_cleaner
+[^6]: Coreboot - https://www.coreboot.org
+[^7]: AMD PSP Vulnerability: https://hackaday.com/2021/10/01/flaw-in-amd-platform-security-processor-affects-millions-of-computers/
+[^8]: Site detailing reasons against SystemD usage - https://nosystemd.org/
+[^9]: Artix Linux - https://artixlinux.org
+[^10]: Void Linux - https://voidlinux.org
+[^11]: Alpine Linux - https://alpinelinux.org/
+[^12]: Smartphone Data Collection - https://www.statista.com/chart/15207/smartphone-data-collection-by-google-and-apple/
+[^13]: GrapheneOS - https://grapheneos.org
+[^14]: Pine64 Pinephone - https://www.pine64.org/pinephone/
+[^15]: Purism Librem 5 - https://puri.sm/products/librem-5/
+[^16]: Cover your track on UNIX systems - https://github.com/sundowndev/covermyass
+[^17]: Bleachbit software - https://www.bleachbit.org/
+[^18]: Sysinternals - https://docs.microsoft.com/en-us/sysinternals/
+[^19]: OSI Model - https://en.wikipedia.org/wiki/OSI_model
+[^20]: ProtonVPN threat model - https://protonvpn.com/blog/threat-model/
+[^21]: Whonix VPN leakage - https://www.whonix.org/wiki/Tunnels/Connecting_to_Tor_before_a_VPN
+[^22]: Tails VPN article - https://gitlab.tails.boum.org/tails/blueprints/-/wikis/vpn_support
+[^23]: I2P - https://geti2p.net/en/
+[^24]: URLScan of anom[.]io - https://urlscan.io/result/f7b4c5ae-3864-4b3f-be0e-ad10e39276bc/#summary
+[^25]: Orbot - https://guardianproject.info/apps/org.torproject.android/
+[^26]: Whonix leak protection - https://www.whonix.org/wiki/Protocol-Leak-Protection_and_Fingerprinting-Protection
+[^27]: Ungoogled Chromium binaries - https://ungoogled-software.github.io/ungoogled-chromium-binaries/
+[^28]: Bromite Browser - https://www.bromite.org
+[^29]: Brave Browser - https://brave.com
+[^30]: The Hitchhikers Guide to Anonymity (Browser Hardening) - https://anonymousplanet.org/guide.html#appendix-v1-hardening-your-browsers
+[^31]: DuckDuckGo - https://duckduckgo.com
+[^32]: Searx instances - https://searx.space/
+[^33]: TAILS - https://tails.boum.org
+[^34]: Drive Destruction - https://anonymousplanet.org/guide.html#how-to-securely-wipe-your-whole-laptopdrives-if-you-want-to-erase-everything
+[^35]: Singh, S. (1999). The code book: the secret history of codes and codebreaking (Vol. 366). London: Fourth Estate.
+[^36]: Linux Entropy - https://madaidans-insecurities.github.io/guides/linux-hardening.html#entropy
+[^37]: GNU Privacy Assistant - gnupg.org/related_software/gpa/index.html
+[^38]: Minisign - https://github.com/jedisct1/minisign/
+[^39]: Veracrypt - https://www.veracrypt.fr/code/VeraCrypt/
+[^40]: KeepassXC - https://keepassxc.org
+[^41]: USB dead man's switch - https://tech.michaelaltfield.net/2020/01/02/buskill-laptop-kill-cord-dead-man-switch/
+[^42]: USBKill - https://github.com/hephaest0s/usbkill/blob/master/usbkill/usbkill.py
+[^43]: Silk Guardian - https://github.com/NateBrune/silk-guardian
+[^44]: Centry Panic Button - https://github.com/AnonymousPlanet/Centry
+[^45]: USBCTL - https://github.com/anthraxx/usbctl
+[^46]: Elcomsoft Forensics - https://blog.elcomsoft.com/2020/03/breaking-veracrypt-containers/
+[^47]: Jumping Airgaps - https://arxiv.org/pdf/2012.06884.pdf
+[^48]: Geofence Requests - https://assets.documentcloud.org/documents/6747427/2.pdf
+[^49]: Jung, C. G. (2014). Modern man in search of a soul. Routledge.
+[^50]: Kinsing Crypto-Miner - https://blog.aquasec.com/threat-alert-kinsing-malware-container-vulnerability
+[^51]: CipherTrace - https://ciphertrace.com/ciphertrace-announces-worlds-first-monero-tracing-capabilities/
+[^52]: ZkSnarks - https://z.cash/technology/zksnarks 
+[^53]: Monero Whitepaper - https://www.getmonero.org/resources/research-lab/pubs/whitepaper_annotated.pdf
+[^54]: Pirate Chain Whitepaper - https://pirate.black/files/whitepaper/The_Pirate_Code_V2.0.pdf
+[^55]: CIS - https://www.cisecurity.org
+[^56]: DISA STIGs - https://public.cyber.mil/stigs
+[^57]: KSPP - https://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project/Recommended_Settings
+[^58]: Whonix Host - https://www.whonix.org/wiki/Whonix-Host
+[^59]: PlagueOS- https://git.envs.net/whichdoc/plagueos
+[^60]: BubbleWrap Sandbox - https://github.com/containers/bubblewrap
+[^61]: SalamanderSecurity's PARSEC repository - https://codeberg.org/SalamanderSecurity/PARSEC
+[^62]: Linux Hardening -  https://madaidans-insecurities.github.io/guides/linux-hardening.html
+[^63]: FOIA request for Palantir operations -https://www.documentcloud.org/search/projectid:51061-Palantir-September-2020
+[^64]: HiddenVM - https://github.com/aforensics/HiddenVM
+[^65]: KVM - https://www.linux-kvm.org/
+[^66]: Oracle VirtualBox -  https://virtualbox.org
+[^67]: Briar P2P Messenger - https://briarproject.org