Physical OPSEC
Digital privacy breaks down the moment someone can physically access your device or see your screen.
Disk Encryption: Your Last Line of Defence
If someone steals your laptop or phone and can read your files without your password, every other privacy measure you've taken is irrelevant. Full disk encryption is non-negotiable.
Built into Windows 10/11 Pro. Home edition: search "Device Encryption" in settings.
Built into all Macs. Encrypts the entire drive. Enabled by default on Apple Silicon Macs.
iPhones with a passcode are automatically encrypted. Ensure you have a strong PIN (6+ digits or alphanumeric).
Android 6.0+ encrypts by default when a PIN is set. Verify it's on in settings.
Physical OPSEC Checklist
Selling or Disposing of Devices
Deleting files is not enough. "Deleted" files are recoverable with free tools. Proper wipe procedures are essential before selling, donating, or recycling any device.
- Enable BitLocker first (if not already on)
- Settings → Recovery → Reset this PC
- Choose "Remove everything"
- Choose "Remove files and clean the drive" (slow but thorough)
- For maximum security: boot DBAN from USB before selling
- Sign out of iCloud: Apple menu → System Settings → Apple ID → Sign Out
- Restart in Recovery Mode (hold Cmd+R on Intel, hold power on M1+)
- Disk Utility → Erase the drive
- Reinstall macOS from Recovery
- Don't set it up: leave it at the setup screen for the new owner
- Settings → General → Transfer or Reset iPhone
- Erase All Content and Settings
- This also removes Activation Lock: new owner can set up fresh
- Because of encryption, erasing is cryptographically complete
- Ensure encryption is on (Settings → Security)
- Remove SD card if present: wipe or keep separately
- Settings → General Management → Reset → Factory Data Reset
- Sign out of Google account first
- Encrypted + factory reset = data is unrecoverable