Austrian government seeks to eliminate internet anonymity, with severe penalties

They are two different philosophies, and thinking about how they'll play off one another is kind of interesting.

The US philosophy is to do passive surveillance and assemble the pieces after the fact, rather than mandating ahead of time requirements. Which means that US-based services will continue to be unhindered by such requirements, appearing "anonymous" to the rest of the world.

As more people globally are turned off by ID requirements, if they're able to flee to US services, then they're actually walking into a more sophisticated passive surveillance flytrap. USG will have ever more surveillance over other countries, without even having to clandestinely place taps.

Close allies will be given access through FVEY and the like, making that relationship even more lopsided. But allies' domestic law enforcement won't be, so they'll still be clamoring for more simplistic mandates requiring ID, further driving the process.

A simple setup is to leave local PDs in the dark as they can always ask for the FBI's help for serious cases. Then the FBI gets access to tools provided by the NSA that look innocuous. For instance, lets assume the NSA snoops enough TOR to do packet correlation attacks. Imagine a simple tool where an FBI agent can enter an IP address or two, and get a list of "associated" IP addresses. Each IP can then be followed as its own lead. Once you've found the needle in a haystack, it's very easy to construct a false narrative of how it was found.

Politically, I don't know how it's possible to look at the current climate and think it will work against mass surveillance. Politicians will just shy away from directly confronting the issue. Whenever any spotlight gets close, the agencies will continue categorize it as national security / tough on crime / etc. The best political ally is seemingly the judiciary, and that itself will only slow things down.

Its not the solution, its the defence. I'd love to have the laws not inacted in the first place, but thats unrealistic IMO.

tbh I'd rather not considering how easy it is to give the wrong advise. OpSec is a deeply personal affair very everything you do (and don't do) needs to be tailored to what you're trying to protect and consistently (!!) revised.

I did a writeup that was aimed to illustrate the insane complexity of OpSec and for people to follow along to achieve better privacy (e.g. first install some browser plugins, then /etc/hosts blocking, then pi-hole, then Tor, etc ... so it gradually introduces people to the idea, until eventually the steps become too hard or impractical for them). Also be warned about the psychological pitfalls of what secrets/compartmentalization can do to the brain and remember that cops and spooks have specialists to support them while a lone wolf trying to protect themselves remains exposed to these dangers this can do to your mind.

some of the first couple of "Steps" from the document should be ignored in 2019 (or moved to the bottom - to where the more difficult points are listed - because people will get it wrong) and are no longer useful but the final points of the document give some tricks on how to hide completely. Things like sending a friend around the world with a budget of monthly $50,- debit card for beer money (under your name) remain highly relevant.

Other things are totally missing such as what to do if you think your phone is compromised or how to do damage control in general.

Again be warned that certain points are very dated and may not give you the protection they promise in 2019:

https://web.archive.org/web/20180714043311/https://iotdarwin...

> Use a burner phone with a prepaid SIM to safely enable 2-Factor Authentication (2FA) without leaking your primary mobile number to any «cloud based data-krakens». Nokia’s relaunch of the 3110 is OK for that purpose and doesn’t immediately out you as somebody holding a burner phone in their hands. But the problem is that it has a GPS chip and camera. Probably a show-stopper for stricter scenarios. Just get any cheap phone that doesn’t include the word «smart» in the name. You want to be able to text and that’s it. Consider buying a used prepaid SIM for a few extra bucks from somebody not associated to you and who hasn’t advertised this to you before either. In some countries this might be your only choice meanwhile. Immigrants are usually happy to sell their prepaid SIM for some extra cash. This gives you a number including all existing metadata (call and movement history visible to the operator and the spooks) already associated to that device and its previous owner. You have now purchased the «cover» of a whole network of people connected to the previous owner. This adds plausible deniability to what would otherwise be a pristine dataset (starting from zero). You will also inherit any active tracking that the original device owner themselves might have already accumulated. So if you’re unlucky you may buy the phone from someone under active surveillance. However the idea is that as data-sets age they increase in value to anyone studying them (and people who do are never your friends regardless if you have anything to hide). In other words, what we did above with TrackMeNot/AdNauseum, we’re now repeating with a prepaid SIM from a stranger.

The ID is for age verification, not Name or any other details.