Short answer: OPSEC asks which actions leak sensitive data — not which tool is trendy. Start with the threat model, then identities, metadata, and appropriate software. Tor cannot compensate for organizational mistakes.
Operational security (OPSEC) is not a shopping list of tools. It answers first who wants to know about you, what information must stay protected, and what happens if protection fails.
1. Write a threat model
Three questions are enough to start:
- What data must not be linked (name, location, research topic, accounts)?
- Who could link it (ISP, website, roommate, state)?
- What are the consequences (harassment, job loss, danger to sources)?
Without answers, Tor often creates false confidence: the browser protects network metadata, not the document on your desk.
2. Separate identities
An identity is the sum of accounts, writing style, time patterns, and devices. Researching a sensitive topic should not use personal logins, recognizable usernames, or a mixed device profile.
Tor Browser isolates websites from each other. It does not isolate your operating system. Malware with device access sees input before encryption applies.
3. Take metadata seriously
Files contain authors, GPS, software versions. Text contains favorite phrases. Calendar times reveal time zones. OPSEC audits these channels as carefully as the IP address.
In practice: strip documents to plain text, avoid screenshots with taskbars, do not reuse the same avatar across contexts.
4. Choose tools for the model
| Model | Typical setup | Not enough for |
|---|---|---|
| Everyday, less tracking | Tor Browser, current updates | malware on the PC |
| Journalism / sources | Tor Browser + separate workflows | physical device access |
| High risk | Tails or Whonix, clear roles | your own procedural mistakes |
See profiles for Tor Browser and Tails, and the longer Tails live USB guide.
5. Treat mistakes as a system
OPSEC rarely fails on one click; it fails on repetition: the same pseudonym, writing style, time of day. Record which role uses which device — and when you deviated from the plan.
What OPSEC is not
OPSEC is not instructions for crime and not legal advice. It is the discipline of aligning protection promises with actual behavior. Next reads: What is Tor? and Detecting phishing.
Sources
- Electronic Frontier Foundation: Surveillance Self-Defense
- Tor Project: Tor Browser User Manual
- OWASP: Threat Modeling