Investigative device and network security establishes the technical and procedural baseline that protects an analyst's identity, sources, and unpublished work from surveillance, interception, and targeted attack. The approach separates investigative activity from personal and institutional digital life using dedicated hardware, encrypted communications, and network isolation. The key principle is compartmentalisation: each investigation uses its own environment, accounts, and communications channel.
This methodology applies when establishing a secure environment before a sensitive investigation, configuring devices for source contact in restricted jurisdictions, separating investigative accounts from personal digital life, or reviewing an existing workflow for exposure points before publication. No single control is sufficient on its own. The controls, applied in combination and maintained consistently, are.
OPS-001 sets out the methodology for configuring, operating, and auditing investigative devices and networks to evidentiary standard.
Eight workflow steps, seven tooling sources, five false-positive checks, five chain-of-custody requirements.
|
01
Required Tools
Seven platforms covering encrypted messaging, VPN, email, and endpoint security.
|
02
OPSEC
Device separation, VPN discipline, credential hygiene, and encrypted communications requirements.
|
|
03
Workflow
Eight-step sequence from threat modelling to post-session review.
|
04
False Positives
Five common misreadings of security tool outputs and their limitations.
|
|
05
Chain of Custody
Five requirements for documenting device state, VPN confirmation, and account provenance.
|
06
Key Queries
Six operator references covering Signal, Mullvad, ProtonMail, Tails, and spyware detection.
|
Download the card.
A PDF version of OPS-001 is available below for Signal subscribers.
