Security for Journalists, Activists, and Privacy Advocates¶

You operate in spaces where privacy is not a consumer preference but a matter of safety. Perhaps you are a journalist protecting sources who could face retaliation if exposed. Perhaps you are an activist organizing in a country where political opposition is criminalized. Perhaps you are a whistleblower holding evidence that powerful institutions want suppressed. Perhaps you simply live under a regime that considers privacy itself suspicious, where encrypted communications mark you as someone with something to hide.

Your threat model includes adversaries with capabilities most security advice does not contemplate. State-level actors who can compel service providers, conduct physical surveillance, and apply legal or extralegal pressure. Sophisticated attackers who can exploit technical vulnerabilities that most users never encounter. Adversaries willing to use coercion, intimidation, and force to obtain information. You need security that functions against these threats, not merely against opportunistic criminals.

The Adversary Profile¶

The journalist's adversary may be a government that imprisons reporters. The activist's adversary may be a regime that disappears dissidents. The whistleblower's adversary may be a corporation with vast legal resources and questionable ethics. Each faces an adversary with three key capabilities that ordinary security advice ignores.

First, legal compulsion. Your adversary can demand that service providers turn over data, issue subpoenas for your records, and use the legal system as an attack vector. Any service that can comply will eventually be compelled to do so. Zero-knowledge architecture is not a nice-to-have but an essential requirement, because services that possess your data in usable form will eventually be forced to surrender it.

Second, physical capability. Your adversary can raid your home, seize your devices, detain you at borders, and interrogate you. Technical security that assumes your devices and person remain inviolate provides no protection when the adversary can simply take your devices and demand your passwords. Security must account for scenarios where you lose physical control.

Third, willingness to use coercion. Your adversary may not be constrained by ethical considerations you would apply to yourself. Torture exists. Threats against family exist. Blackmail exists. Security that depends on your willpower to keep secrets fails against sufficient pressure. Security must function even when you are compelled to cooperate.

Zero-Knowledge: Defeating Legal Compulsion¶

UnoLock implements zero-knowledge architecture where the service itself cannot access user data. Your vault contents are encrypted client-side before upload. The encryption keys exist only on your devices. UnoLock's servers store encrypted blobs that they cannot decrypt.

When legal demands arrive, and they will arrive for services that gain any meaningful adoption in the privacy space, UnoLock can provide only what it possesses: encrypted data indistinguishable from random noise without the keys. There are no keys to surrender. There is no master access to invoke. The architecture makes compliance with impossible demands impossible.

This is not mere policy or promise. It is mathematical constraint. The encryption is not something UnoLock chooses not to break; it is something UnoLock cannot break. The legal demand that would compromise a conventional service produces nothing useful against a zero-knowledge architecture.

TimeLock and DuressDecoy: Defeating Physical Capability¶

When adversaries have physical access to you and your devices, technical security must account for human limitations. You can be forced to authenticate. You can be observed entering passwords. You can be detained until you comply. TimeLock and DuressDecoy address these physical threat scenarios.

TimeLock creates temporal windows where access is architecturally impossible. Before entering a high-risk situation, whether a border crossing, a protest, a sensitive meeting, or simply travel through hostile territory, you activate TimeLock for an appropriate duration. While active, you cannot access your vault regardless of what you say or do. You cannot be forced to provide access because access does not exist.

DuressDecoy provides strategic deception when total inaccessibility might itself raise suspicion. In the Sovereign tier, a safeword PIN opens the same Safe with the Spaces you have marked as sensitive hidden, leaving plausible non-sensitive content visible. Under coercion, you enter the safeword PIN while your sensitive Spaces remain hidden. The adversary sees what appears to be cooperation.

The appropriate tool depends on the scenario. TimeLock suits situations where you can credibly explain temporal inaccessibility: "I use a security service that locks during travel; I cannot access it until tomorrow." DuressDecoy suits situations where you must show something: an inspection that expects to find data and would escalate if it found nothing.

For complete DuressDecoy configuration instructions, see the setup guide.

Configure DuressDecoy for Coercion Protection

Vault Messaging: Secure Communication¶

Journalism and activism often require communication with others. Sources need to transmit documents securely. Collaborators need to coordinate across hostile territory. Networks need to share information without exposing the network.

Vault Messaging implements zero-knowledge messaging between UnoLock users. Messages are encrypted end-to-end with no possibility of server-side interception. One-time view options ensure messages can be read exactly once before cryptographic deletion. Expiration timers automatically destroy messages after configured periods. There is no message history for adversaries to harvest, no communications log to be subpoenaed.

For receiving sensitive materials from sources who may not be UnoLock users, the vault messaging system allows incoming transmissions from anyone with your vault address. The source does not need an account; they can transmit one-way to your vault. You receive their materials encrypted with your keys alone.

Plausible Deniability: Safeword Deletion¶

The HighRisk tier implements plausible deniability through LifeSafe. You mark selected Spaces as sensitive and configure a safeword PIN distinct from your normal PIN. Entering the safeword PIN opens the same Safe and permanently deletes the marked Spaces, while non-sensitive Spaces remain available.

Under interrogation, you can open your Safe with the safeword PIN and show what remains. The marked material is no longer there to be extracted, and UnoLock cannot restore it. The Sovereign tier's DuressDecoy works the same way but hides the marked Spaces instead of deleting them, so they can be shown again with normal access.

This is the final layer of defense: not merely hiding content but removing it. Deletion cannot erase copies held elsewhere, such as downloads, screenshots, or Shared Space copies owned by other Safes, or information an adversary already obtained, so plan your sensitive Spaces with that in mind.

Implementation for Privacy Advocates¶

Your requirements likely call for the HighRisk tier. Choose HighRisk for plausible deniability through LifeSafe, which permanently deletes the Spaces you have marked as sensitive when the safeword PIN is used. If you do not require irreversible deletion, Sovereign provides DuressDecoy, which hides those Spaces instead. Both tiers include Spaces, TimeLock, and Vault Messaging at the same price.

Establish operational security practices around your UnoLock use. Do not discuss your vault configuration even with trusted colleagues, as they may be compromised. Do not access your vault from devices you do not fully control. Do not reveal the existence of features like TimeLock or DuressDecoy to anyone who does not need to know.

Maintain the Spaces that stay visible under your safeword as carefully as your sensitive ones. Adversaries are sophisticated. Visible Spaces that look unused or implausible will fail to deceive. Populate it with realistic content appropriate to your cover story. Update it periodically. Make it look like the vault of someone who has nothing to hide.

Configure TimeLock protocols for high-risk activities before you need them. Know the duration appropriate to your typical risk scenarios. Practice activation until it becomes automatic. In a crisis, you may not have time to figure out the interface.

If you work with sources, establish Vault Messaging communication channels before you need them. Teach sources how to transmit materials to your vault. Test the process to ensure it works. When a source needs to reach you urgently, the infrastructure should already exist.

The Broader Picture¶

Individual security tools matter, but they exist within broader operational security practices that this guide cannot fully address. Your UnoLock vault is one component of a security posture that includes device security, communication security, physical security, and operational discipline.

Consider consulting with digital security organizations like the Electronic Frontier Foundation, Committee to Protect Journalists, or Access Now. Consider security training from organizations that specialize in protecting journalists and activists. Your threat model may require expertise beyond what any single tool can provide.

UnoLock provides infrastructure for sovereign digital existence. Using that infrastructure effectively in high-threat environments requires understanding both the capabilities and the limitations, both what the technology enables and what operational practices must supplement it.