Phone Hardening for High-Risk Situations
Replaces: Default phone security for travel, protests, border crossings, or surveillance threats
Four escalating threat levels — from everyday basics to detention scenarios. Apply only the measures for your situation.
Sources
Phase
Major Lifestyle Migration — high commitment, disruptive
General
**Level 1 — Everyday essentials (also in Phase 0 cards):**
- Keep OS updated (security patches are meaningless if outdated)
- Long passwords (3 random objects, combined)
- Regular backups (so you can wipe fast)
- Turn off lockscreen message previews
- Remove data broker apps (PayPal, Snapchat, Google apps)
- Use privacy-focused messengers, mail, and alt OS if possible
**Level 2 — Risky places (airports, borders, protests):**
- Turn off voice assistant (can be used against you)
- Enable auto-lock (1-5 min timeout)
- Turn off biometrics (face/finger can be forced). Use lockdown mode (Android/Pixel) or press power+volume to temporarily disable biometrics
- Enable disappearing messages in Signal (30 days or less)
- Black background wallpaper (photos of loved ones or yourself link back to you)
- Turn off Location, Bluetooth, Wi-Fi when not actively needed
- Download offline maps (Organic Maps/OsmAnd)
- Log out of non-essential accounts
**Level 3 — Being targeted (journalist, dissident, stalking victim):**
- Carry a burner device you can discard
- Phone stays in airplane mode unless actively needed
- Faraday bag (blocks all signals when not in use)
- Set up a duress PIN (different from real PIN — triggers instant wipe)
- Reboot before entering any sensitive environment (puts phone in BFU — Before First Unlock — state, much harder to crack)
**Level 4 — Detained or arrested:**
- Input duress PIN to wipe device
- You can restore from backup later
- Know your rights: US — cannot be compelled to hand over password (5th Amendment), but CAN be compelled for biometrics. UK, India, France — can be compelled for both
- Know your location — legal rights vary by jurisdiction
- Shut up. Say nothing without a lawyer
Related Cards
Research Findings
Proton identifies four escalating threat states: (1) everyday basics, (2) risky environments, (3) active surveillance, (4) physical detention. Key technical details: BFU (Before First Unlock) state is cryptographically much harder to access than AFU (After First Unlock) — rebooting a phone puts it in BFU. Duress PIN: a separate PIN that instantly wipes the device (available on GrapheneOS, some Samsung devices). Biometrics are weaker than PINs for compulsion scenarios — in the US, biometrics can be legally forced but passwords cannot (5th Amendment). Faraday bags block all RF but phone may cache data and upload when signal returns. Disappearing messages reduce forensic surface area. Meta Ray-Ban glasses can capture footage even when taken off — Nearby Glasses app detects their Bluetooth signature.