Practical privacy, security, and speech
UK Privacy Survival Guide
A working field guide for anyone who wants to keep their data, their devices and their voice their own, written for the specific legal and technical realities of living in the UK today.
Section 0
Section 1
- 1. Foundations and threat modelling
- What is a “threat model” in ordinary life?
- Assets, adversaries, and your boundaries
- Context shapes risk
- Threat modelling by example
- Common misunderstandings that weaken security
- Understanding how data moves
- Risk, friction, and the reality of trade‑offs
- Failure modes and how they show up
- Trust is part of the model
- Setting a personal baseline
- Freedom of speech and the cost of visibility
- Where to go next
- 1.1 Understanding threats
- 1.2 Privacy, security and anonymity
- 1.3 Thoughtcrime and intent inference
Section 2
- 2. Identity, authentication and access control
- Identity is a claim, not a fact
- Authentication: proving the claim
- Passwords and their limits
- Two-factor and multi-factor checks
- Biometrics: useful but not magic
- Access control: deciding what you can do
- Least privilege and its practical limits
- Identity proofing: linking the digital to the real
- Session management and the quiet mechanics of access
- Single sign-on and its ripple effects
- Everyday friction and real-world compromises
- Myths and misunderstandings
- Practical choices in a monitored world
- 2.1 Passwords done properly
- 2.2 Password managers
- 2.3 Multi-factor authentication (MFA) — Strengthening identity without adding fragility
- 2.4 Hardware security keys
- 2.5 Biometrics: convenience vs coercion
- The irreversible factor
- Fingerprints, face recognition, and voice
- Why biometrics cannot be changed
- Legal differences: knowledge vs body‑based authentication
- Forced unlocking risks
- Why biometrics suit devices better than accounts
- Combining biometrics safely
- Common misunderstandings
- Practical, UK‑context examples
- Operational practices
Section 3
- 3. Encryption and data at rest — Protecting what already exists
- Protecting what already exists
- What “at rest” really covers
- Full-disk encryption: the blunt but effective tool
- File and folder encryption: precision and flexibility
- Phones and tablets: convenience with sharp edges
- Cloud storage: encryption depends on who holds the keys
- Backups: the most forgotten risk
- Keys, passwords, and recovery: the human factor
- Common myths and misunderstandings
- Limits you cannot encrypt away
- 3.1 Encryption fundamentals
- 3.2 Full disk encryption
- 3.3 Plausible deniability and hidden volumes
- 3.4 File-level and container encryption
Section 4
- 4. Devices and operating systems — Your platform defines your exposure
- Your platform defines your exposure
- The OS as a gatekeeper
- Phones: convenience by design
- Laptops and desktops: flexibility and exposure
- Updates: the uncomfortable trade‑off
- Accounts, identity, and device binding
- Pre‑installed software and the unseen surface
- Encryption and storage realities
- Network radios and the trail they leave
- Alternative operating systems and custom builds
- Shared and managed devices
- Choosing devices with context in mind
- What to revisit regularly
- 4.1 Desktop and laptop operating systems
- Control and convenience on the same machine
- Linux, Windows and macOS: trade-offs in practice
- Linux: flexible, inspectable, but uneven
- Windows: broad compatibility with tight vendor control
- macOS: integrated design, good default security, limited inspection
- Telemetry and forced updates
- Auditability and trust
- Software ecosystem risks
- Choosing with context in mind
- 4.2 Mobile operating systems
- 4.3 Hardware trust and firmware
- 4.4 Securing iPhone and Android phones
- What mobile security means
- The iPhone security model
- The Android security model
- iPhone versus Android: practical pros and cons
- A strong baseline for every phone
- Hardening an iPhone
- Lockdown Mode
- Tracking, permissions, and sharing
- Hardening an Android phone
- Android Advanced Protection
- Permissions and app control
- Backups and cloud accounts
- Mobile data security
- Free and public Wi-Fi
- The benefits and limits of a VPN on a phone
- High-risk and emergency actions
- Mobile security checklists
- Official sources
Section 5
- 5. Network privacy and traffic control — What your connections reveal
- What your connections reveal
- The shape of a connection
- IP addresses, location, and identification
- DNS as the internet’s address book
- Traffic control in everyday networks
- Encryption: what it protects and what it does not
- Virtual private networks in practice
- Proxies, Tor, and layered routing
- Mobile networks and always-on signalling
- Wi‑Fi realities: hotspots and shared networks
- Device and browser fingerprints
- Traffic analysis and inference
- Monitoring in workplaces and schools
- Balancing privacy, functionality, and trust
- 5.1 What your connection reveals
- 5.2 VPNs in reality
- 5.3 Safer networking habits
Section 6
- 6. Browsing and information access — Observation without participation
- What gets recorded when you read
- Seeing without being seen
- Search engines and discovery
- Encrypted connections and what they do not hide
- DNS and the map of where you go
- Public Wi‑Fi and shared networks
- Content blockers and the limits of consent
- Cookies, local storage, and persistence
- Reading without interaction
- Remote viewing and the difference between content and access
- Social platforms and logged-in browsing
- Local devices and the people around you
- When anonymity is not the goal
- 6.1 Browsers and search engines
- 6.2 Research under surveillance
Section 7
- 7. Communications and messaging
- What actually travels when you send a message
- Encryption, and what it does and does not solve
- Choosing a channel: convenience, coverage, and control
- Device security: the weak link by default
- Contact lists and social graphs
- Groups, forwards, and the risk of drift
- Voice and video calls
- Disappearing messages and their limits
- When you should worry about telecommunications data
- Identity, accounts, and phone numbers
- Bridging work and personal life
- Operational habits that make a real difference
- Knowing when to accept risk
- 7.1 Messaging applications
- 7.2 Email privacy
Section 8
Section 9
Section 10
Section 11
Section 12
Section 13
Section 14
Section 15
Section 16
- 16. Freedom of Speech in the Digital Age
- What it means, where it applies, and how it erodes
- Freedom of speech is not a single rule
- Where freedom of speech applies in practice
- How digital systems reshape speech
- Everyday speech and the friction of identity
- Common myths and misunderstandings
- How speech erodes without anyone banning it
- Risks, trade-offs, and how to manage them
- UK context: rights, limits, and uncertainty
- Everyday scenarios that show the stakes
- What durable freedom of speech looks like online
- 16.1 What freedom of speech actually is
- 16.2 Law, jurisdiction and reality
- 16.3 Platforms as speech gatekeepers
- 16.4 Surveillance and the chilling effect
- 16.5 Thoughtcrime and intent enforcement
- 16.6 Deplatforming and digital exile
- 16.7 Speech vs identity
- 16.8 Speaking safely
- Audience control
- Choosing the right channel
- Managing identity and linkage
- Group dynamics and trust boundaries
- Avoiding virality
- Writing for the right scale
- Designing posts to resist spread
- De‑escalation
- Recognising escalation signals
- Shifting the channel
- Using clarity instead of volume
- Setting limits and exiting
- Aftercare and documentation
- 16.9 Anonymity and pseudonymity
- 16.10 Speech under surveillance states
- 16.11 Ethics and self-preservation
- 16.12 Practical guidance
- 16.13 Protest anonymity and public-order law
Section 17
- 17. UK digital restrictions and government overreach
- 17.1 The Online Safety Act in practice
- 17.2 Age verification and age assurance
- 17.3 Government digital ID
- 17.4 Threats to VPNs and circumvention
- 17.5 Encryption under pressure
- 17.6 Social media restrictions and bans
- 17.7 Practical responses to UK restrictions
- 17.8 UK data rights and remedies