Terms & definitions
Plain-language definitions of the security and surveillance terms used in our checklists and guides. Elsewhere on the site, terms with a dotted underline open these definitions in a popup.
A unique ID your phone gives to apps so advertisers can track you across them. Location data tied to it gets sold through Data BrokerA company that collects personal information like your address, phone number, and relatives from public records and other sources, then sells it. Cops, stalkers, and people trying to Doxxing (or Doxing)When someone publishes your private information, like your legal name, home address, phone number, or workplace, so others can harass or intimidate you online (and sometimes in person). It's an increasingly common tactic used against activists.Learn more: Doxxing Defense Checklist can buy this data.Learn more: Doxxing Defense Checklist, and ICE and other agencies use tools built on that data to track phones. It's on by default on Android.
Learn more: Security Essentials
An app on your phone that generates the login codes for Two-Factor Authentication (2FA)An extra login step: after your password, you also verify your identity a second way. This could be a 6-digit code from an Authenticator AppAn app on your phone that generates the login codes for two-factor authentication. It's safer than getting codes by text message, which attackers can intercept. Ente Auth and 1Password both have one.Learn more: Security Essentials, a text message, or sometimes a PasskeyA newer way to log in that replaces your password. Your phone, computer, or password manager stores a secret key for the account and unlocks it with your face, fingerprint, or passcode. There's no password to type, so there's nothing for a phishing site to steal. Security keys work in a similar way, but are physical devices you plug in or tap.Learn more: EFF. It's like needing both a key and an alarm code to get into your house. Even if someone steals your password, they can't get into your account without the second step.Learn more: Security Essentials. It's safer than getting codes by text message, which attackers can intercept. Ente Auth and 1Password both have one.
Learn more: Security Essentials
Cameras that automatically photograph every passing license plate and record the time and location. Flock is the most popular brand. They're common on highways, toll booths, bridges, and police cars. They give the cops a way to track your car without a warrant. Data is often shared with other law enforcement agencies.
Learn more: EFF Street Level Surveillance
Unlocking your phone with your face or fingerprint instead of a passcode. It's convenient, but cops can force you to look at your phone or press your finger to it. You have more legal protections when you use a passcode.
Learn more: Prepare for a Protest
A way of tracking you by the unique combination of your browser's settings, like your screen size, fonts, and language. It works even if you clear your cookies or use a VPN (Virtual Private Network)An app on your phone or computer that redirects and encrypts all internet traffic through its servers. This keeps your internet browsing hidden from your internet provider, and keeps your IP AddressA number that identifies your internet connection, kind of like your home address on the internet. Every website and app you connect to can see it. An IP address can often point back to you personally. With a court order, your internet provider can match it to your name and location. A VPN gives you an IP address shared by thousands of people so it's harder to identify your activity.Learn more: VPNs for Activists hidden from websites you visit. It doesn't hide who you are from sites and apps you're logged into. And it doesn't offer total anonymity or internet security.Learn more: VPNs for Activists. Tor Browser is designed to make everyone's fingerprint look the same.
Learn more: EFF Surveillance Self-Defense
A phone that is completely disconnected from your identity, bought with cash and used only a handful of times before it's destroyed. Keeping a burner truly anonymous takes a great deal of work, so for most people we recommend a Secondary Phone ("burner phone" lite)A second phone with as little personal data on it as possible, used for protests and sensitive organizing. If cops seize it, there's much less for them to find. It isn't truly anonymous like a Burner PhoneA phone that is completely disconnected from your identity, bought with cash and used only a handful of times before it's destroyed. Keeping a burner truly anonymous takes a great deal of work, so for most people we recommend a secondary phone instead.Learn more: Secondary Phone Checklist, and you can reuse it across many actions.Learn more: Secondary Phone Checklist instead.
Learn more: Secondary Phone Checklist
A device that pretends to be a cell tower. It tricks nearby phones into connecting to it. Police can use one to log every phone at a protest, track a specific phone's location, and intercept calls and texts.
Learn more: EFF Street Level Surveillance
A company that collects personal information like your address, phone number, and relatives from public records and other sources, then sells it. Cops, stalkers, and people trying to Doxxing (or Doxing)When someone publishes your private information, like your legal name, home address, phone number, or workplace, so others can harass or intimidate you online (and sometimes in person). It's an increasingly common tactic used against activists.Learn more: Doxxing Defense Checklist can buy this data.
Learn more: Doxxing Defense Checklist
A setting in Signal and WhatsApp that automatically deletes messages from everyone's phones after a set amount of time. If a phone is seized or hacked later, there's much less to find. It can't stop someone from taking a screenshot first.
Learn more: Signal Security Checklist
When someone publishes your private information, like your legal name, home address, phone number, or workplace, so others can harass or intimidate you online (and sometimes in person). It's an increasingly common tactic used against activists.
Learn more: Doxxing Defense Checklist
Scrambling information so that only someone with the right key, like your password or passcode, can read it. To anyone else, encrypted data looks like random, unreadable text.
Learn more: EFF Surveillance Self-Defense
A type of EncryptionScrambling information so that only someone with the right key, like your password or passcode, can read it. To anyone else, encrypted data looks like random, unreadable text.Learn more: EFF Surveillance Self-Defense where only you and the people you're talking to can read your messages. The company running the app can't read them, so it has nothing to hand over to the cops if they ask. It usually doesn't hide who you talk to or when, and it can't protect messages on a phone that's been unlocked or hacked.
Learn more: EFF Surveillance Self-Defense
A Warrant vs. SubpoenaBoth are legal orders that can force a company to hand over your data. A warrant must be signed by a judge who agrees there's probable cause of a crime, and it can also let police search your home or phone. Many subpoenas need no judge at all, but they don't give the investigator access to as much information. ICE often uses "administrative warrants" signed by an ICE officer, not a judge. These don't give them the right to enter your home without your permission. that makes a company like Google hand over data on every device that was in a certain area during a certain time. Cops have used them to identify people who were near a protest.
Learn more: EFF
A number that identifies your internet connection, kind of like your home address on the internet. Every website and app you connect to can see it. An IP address can often point back to you personally. With a court order, your internet provider can match it to your name and location. A VPN gives you an IP address shared by thousands of people so it's harder to identify your activity.
Learn more: VPNs for Activists
A support role during an arrestable action or protest. These people support arrestees during and after an action. They track who's been arrested, stay in touch with lawyers, wait outside the jail, and bring people their phones, food, and a ride home once they're released.
Any software designed to harm your device or steal from you. It's often installed by tricking you into clicking a link or opening a file. SpywareSoftware that secretly infects your phone or computer to steal your data. It can often read your messages (even on Signal), track your location, and turn on your camera or microphone. The most advanced spyware is expensive, and is mostly used against high-profile activists, journalists, and lawyers.Learn more: Protecting Against Spyware is one type of malware.
Learn more: EFF Surveillance Self-Defense
A newer way to log in that replaces your password. Your phone, computer, or Password ManagerAn app that creates and remembers a strong, unique password for every account you have, so you only need to remember one master password. If one site gets hacked, the attacker won't be able to reuse a password across a bunch of your accounts because you were using unique passwords for each.Learn more: Security Essentials stores a secret key for the account and unlocks it with your face, fingerprint, or passcode. There's no password to type, so there's nothing for a PhishingA scam that tricks you into giving up your password and two-factor authentication code. It often looks like a real message from someone you trust, like a fake email from Google or a fake message from "Signal Support."Learn more: EFF Surveillance Self-Defense site to steal. Security KeyA small physical device (like a YubiKey) that you plug in or tap to log in to an account. Someone who steals your password still can't get in without it, which makes it one of the strongest protections against PhishingA scam that tricks you into giving up your password and two-factor authentication code. It often looks like a real message from someone you trust, like a fake email from Google or a fake message from "Signal Support."Learn more: EFF Surveillance Self-Defense. PasskeyA newer way to log in that replaces your password. Your phone, computer, or password manager stores a secret key for the account and unlocks it with your face, fingerprint, or passcode. There's no password to type, so there's nothing for a phishing site to steal. Security keys work in a similar way, but are physical devices you plug in or tap.Learn more: EFF work in a similar way, but live on your phone or in your password manager.Learn more: EFF Surveillance Self-Defense work in a similar way, but are physical devices you plug in or tap.
Learn more: EFF
An app that creates and remembers a strong, unique password for every account you have, so you only need to remember one master password. If one site gets hacked, the attacker won't be able to reuse a password across a bunch of your accounts because you were using unique passwords for each.
Learn more: Security Essentials
The routine that shows up in your location and activity data: where you sleep, work, and hang out, and who you're often near. If you have a secondary phone that you're trying to keep separate from your main identity and you turn it on at the same locations and times as your primary devices, these pattern of life correlations can reveal your identity.
Learn more: Secondary Phone Checklist
Websites that collect and sell personal information (such as your address, phone number, and relatives) to anyone willing to pay for it. Police, stalkers, and people trying to Doxxing (or Doxing)When someone publishes your private information, like your legal name, home address, phone number, or workplace, so others can harass or intimidate you online (and sometimes in person). It's an increasingly common tactic used against activists.Learn more: Doxxing Defense Checklist can buy this data.
Learn more: Doxxing Defense Checklist
A scam that tricks you into giving up your password and two-factor authentication code. It often looks like a real message from someone you trust, like a fake email from Google or a fake message from "Signal Support."
Learn more: EFF Surveillance Self-Defense
Devices that cops and border agents use to break into seized phones and copy the data off them, sometimes including deleted messages. Cellebrite and GrayKey are the best-known brands. A long random passcode and an up-to-date phone make them much less effective.
Learn more: EFF Street Level Surveillance
A second phone with as little personal data on it as possible, used for protests and sensitive organizing. If cops seize it, there's much less for them to find. It isn't truly anonymous like a Burner PhoneA phone that is completely disconnected from your identity, bought with cash and used only a handful of times before it's destroyed. Keeping a burner truly anonymous takes a great deal of work, so for most people we recommend a Secondary Phone ("burner phone" lite)A second phone with as little personal data on it as possible, used for protests and sensitive organizing. If cops seize it, there's much less for them to find. It isn't truly anonymous like a burner phone, and you can reuse it across many actions.Learn more: Secondary Phone Checklist instead.Learn more: Secondary Phone Checklist, and you can reuse it across many actions.
Learn more: Secondary Phone Checklist
A small physical device (like a YubiKey) that you plug in or tap to log in to an account. Someone who steals your password still can't get in without it, which makes it one of the strongest protections against PhishingA scam that tricks you into giving up your password and two-factor authentication code. It often looks like a real message from someone you trust, like a fake email from Google or a fake message from "Signal Support."Learn more: EFF Surveillance Self-Defense. PasskeyA newer way to log in that replaces your password. Your phone, computer, or Password ManagerAn app that creates and remembers a strong, unique password for every account you have, so you only need to remember one master password. If one site gets hacked, the attacker won't be able to reuse a password across a bunch of your accounts because you were using unique passwords for each.Learn more: Security Essentials stores a secret key for the account and unlocks it with your face, fingerprint, or passcode. There's no password to type, so there's nothing for a PhishingA scam that tricks you into giving up your password and two-factor authentication code. It often looks like a real message from someone you trust, like a fake email from Google or a fake message from "Signal Support."Learn more: EFF Surveillance Self-Defense site to steal. Security KeyA small physical device (like a YubiKey) that you plug in or tap to log in to an account. Someone who steals your password still can't get in without it, which makes it one of the strongest protections against phishing. Passkeys work in a similar way, but live on your phone or in your password manager.Learn more: EFF Surveillance Self-Defense work in a similar way, but are physical devices you plug in or tap.Learn more: EFF work in a similar way, but live on your phone or in your password manager.
Learn more: EFF Surveillance Self-Defense
When an attacker convinces your phone carrier to move your phone number to a SIM card they control. They then receive your calls and texts, including login codes, and can use them to take over your accounts.
Learn more: Yubico
Software that secretly infects your phone or computer to steal your data. It can often read your messages (even on Signal), track your location, and turn on your camera or microphone. The most advanced spyware is expensive, and is mostly used against high-profile activists, journalists, and lawyers.
Learn more: Protecting Against Spyware
An extra login step: after your password, you also verify your identity a second way. This could be a 6-digit code from an Authenticator AppAn app on your phone that generates the login codes for Two-Factor Authentication (2FA)An extra login step: after your password, you also verify your identity a second way. This could be a 6-digit code from an authenticator app, a text message, or sometimes a passkey. It's like needing both a key and an alarm code to get into your house. Even if someone steals your password, they can't get into your account without the second step.Learn more: Security Essentials. It's safer than getting codes by text message, which attackers can intercept. Ente Auth and 1Password both have one.Learn more: Security Essentials, a text message, or sometimes a PasskeyA newer way to log in that replaces your password. Your phone, computer, or Password ManagerAn app that creates and remembers a strong, unique password for every account you have, so you only need to remember one master password. If one site gets hacked, the attacker won't be able to reuse a password across a bunch of your accounts because you were using unique passwords for each.Learn more: Security Essentials stores a secret key for the account and unlocks it with your face, fingerprint, or passcode. There's no password to type, so there's nothing for a PhishingA scam that tricks you into giving up your password and two-factor authentication code. It often looks like a real message from someone you trust, like a fake email from Google or a fake message from "Signal Support."Learn more: EFF Surveillance Self-Defense site to steal. Security KeyA small physical device (like a YubiKey) that you plug in or tap to log in to an account. Someone who steals your password still can't get in without it, which makes it one of the strongest protections against phishing. Passkeys work in a similar way, but live on your phone or in your password manager.Learn more: EFF Surveillance Self-Defense work in a similar way, but are physical devices you plug in or tap.Learn more: EFF. It's like needing both a key and an alarm code to get into your house. Even if someone steals your password, they can't get into your account without the second step.
Learn more: Security Essentials
An app on your phone or computer that redirects and encrypts all internet traffic through its servers. This keeps your internet browsing hidden from your internet provider, and keeps your IP AddressA number that identifies your internet connection, kind of like your home address on the internet. Every website and app you connect to can see it. An IP address can often point back to you personally. With a court order, your internet provider can match it to your name and location. A VPN gives you an IP address shared by thousands of people so it's harder to identify your activity.Learn more: VPNs for Activists hidden from websites you visit. It doesn't hide who you are from sites and apps you're logged into. And it doesn't offer total anonymity or internet security.
Learn more: VPNs for Activists
Both are legal orders that can force a company to hand over your data. A warrant must be signed by a judge who agrees there's probable cause of a crime, and it can also let police search your home or phone. Many subpoenas need no judge at all, but they don't give the investigator access to as much information. ICE often uses "administrative warrants" signed by an ICE officer, not a judge. These don't give them the right to enter your home without your permission.