Operational security begins with a realistic threat model
Personal operational security means deciding which information could create meaningful harm, who might seek it, how they could obtain it, and which precautions are proportionate. A public official facing targeted harassment, a survivor hiding from an abuser, and a family avoiding routine scams should not follow the same playbook. Trying to become invisible can consume time, isolate people, and still fail because public records, other people’s posts, and breached data remain.
AI changes parts of the threat: it can help turn scattered facts into a tailored pretext, translate messages, and create plausible voice, image, and video impersonation. It does not make every person the subject of continuous intelligent surveillance. The durable response is data minimization, access control, independent verification, and a plan for the specific harms that matter.
This is general U.S. household guidance, not legal advice or a safety plan for stalking, domestic violence, witness protection, or a targeted cyberattack. If another person may monitor your accounts or devices, changing passwords, location sharing, or family settings can alert them. Use a safer device and contact a qualified advocate, attorney, or security professional before acting.
Map information to harm
List the information that would enable a concrete action against the household: home and work locations, real-time travel, children’s school and custody schedule, phone numbers, relatives’ names, voice and face recordings, account-recovery details, medical routines, and financial-authority relationships. Then mark where each appears: social profiles, public records, data brokers, business websites, club rosters, fitness apps, calendars, vehicle or home apps, and relatives’ accounts.
Prioritize combinations. A pet’s name may be harmless alone but useful when it is also a password hint; a vacation photo becomes more consequential when posted live with an address and an empty-home signal. Reduce the combination that enables the harm, not every ordinary fact.
Delay location and routine disclosure
Post travel, events, and children’s activities after leaving rather than in real time. Disable precise location in camera and social apps unless needed. Review shared albums, map check-ins, fitness routes, vehicle apps, delivery profiles, and family-location services. A private account reduces casual visibility but does not prevent screenshots or access by a compromised follower.
Do not publish a child’s school, uniform, daily route, pickup time, full birth date, and regular caregiver together. Ask schools, sports teams, houses of worship, and clubs how photos, names, and rosters are shared. Give relatives a clear posting preference and respect children’s age-appropriate choices about their likeness.
Real-time location sharing can be valuable for safety. Share it with named people for a defined purpose and review access after trips, relationship changes, and device upgrades. Avoid permanent links in group chats whose membership changes.
Treat voice and face as reusable data
You do not need to stop every video call or family photo. Assume, however, that clear public recordings could support impersonation. Use private audiences for sustained audio or video of children and older relatives when practical. Remove unnecessary public voicemail details. Avoid public prompts that invite people to state their full name, birthday, address, or account information on camera.
The FBI has warned that criminals use publicly available photos and AI-generated voices to impersonate known people and advises families to independently confirm contacts and use a secret phrase. Its current malicious-messaging alert lists those precautions.
Limiting media is friction, not immunity. A determined person may obtain samples elsewhere, and even a real voice can be replayed. The stronger control is that no familiar voice, face, caller ID, or account alone can authorize money, credentials, private information, or a changed meeting place.
Remove easy aggregation points
People-search sites compile public records, social profiles, and brokered information. Search for each adult using name, former addresses, phone numbers, and close relatives. Use the site’s own removal process when appropriate; the FTC explains how people-search sites work and how to locate opt-outs.
Opt-outs may be incomplete, may not affect the source record, and may require repetition. Keep a dated list of requests and alternate names. Provide only the verification information required, redact nonessential details where accepted, and avoid an unfamiliar service that demands extensive identity documents without explaining protection and retention.
Also review the source: voter, property, corporate, court, professional-license, or other records may have a lawful address-confidentiality or correction process, especially for protected people. Availability varies by jurisdiction; consult the relevant agency or advocate rather than filing false information.
Separate audiences and roles
Use different email aliases or addresses for public inquiries, shopping, sensitive recovery, and work where manageable. Do not use an employer address as the only recovery method for personal accounts. Consider a separate public-facing phone number for a business, campaign, listing, or volunteer role, but secure its carrier and voicemail account.
Keep administrator and everyday accounts separate on shared devices. Give guests and smart-home products their own network when supported — Home Network and Device Security covers how to configure that guest and IoT segmentation in practice. Do not let a public social profile reveal which email is the recovery anchor for financial accounts.
Separation reduces cross-linking and makes an exposed channel easier to replace; it is not a promise of anonymity. Companies and brokers may still correlate identifiers. Use it to limit consequences, not to make claims you cannot verify.
Make pretext resistance a household habit
A pretext combines true details with a false identity or purpose: a “school employee” who knows a child’s name, an “IT technician” who knows an employer, or a “relative” who knows travel plans. Fluency and personal knowledge are not authentication.
For unexpected contact involving money, access, secrecy, files, or personal data:
- Ask for the person’s name, organization, and purpose without confirming information.
- End the contact.
- Find the institution’s number or app independently.
- Contact a known person or verified department.
- Require a second review before an irreversible action.
Never disclose a one-time code, recovery code, password, or family phrase to an incoming caller. Do not install software or open a document at their direction. A real institution can tolerate an independent callback.
Train without testing relatives deceptively. Explain the shared rule and praise the pause. A person who refuses a request is following policy, not being rude.
Prepare for doxxing and impersonation
Write a small response plan before an incident. Identify who documents posts, who contacts platforms or employers, who speaks publicly if necessary, and who checks on children or older relatives. Preserve URLs, usernames, timestamps, screenshots, and original messages without repeatedly engaging the harasser.
Tell close contacts not to amplify false content while trying to rebut it. Use a known channel to publish a short correction only when doing so reduces harm. Contact a platform through its official reporting route. Threats, stalking, swatting, intimate-image abuse, and identity theft may require law enforcement, an attorney, school safety personnel, or a victim advocate; response depends on facts and jurisdiction.
If an online post contains home details, review physical safety calmly: household contacts, locks, cameras, school pickup authorization, workplace reception, and mail handling. Do not make public threats or attempt to identify the actor through risky confrontation.
Protect recovery and evidence
OPSEC fails if account recovery routes remain public or stale. Secure primary email, password manager, mobile-carrier account, cloud-photo account, and social platforms with unique credentials and phishing-resistant MFA where possible. Review sessions and recovery contacts. Digital Identity Hardening covers passkeys, backup authenticators, and credit freezes.
Keep an offline list of platform reporting links, financial fraud numbers, and trusted contacts. If compromise occurs, work from a device you have reason to trust, revoke unknown sessions, and preserve evidence before deleting accounts. Report internet-enabled crime through IC3.gov where appropriate, typing the address directly rather than following an advertisement or unsolicited “agent” link.
Reassess without living on alert
Review high-risk disclosures after a move, separation, new job, public controversy, child’s school change, or harassment event. For ordinary households, a twice-yearly check of privacy settings, people-search exposure, shared locations, public posts, and account recovery is generally more sustainable than daily monitoring.
Good personal OPSEC does not require fear of every camera or silence online. It means that the household knows which information combinations create leverage, reveals them deliberately, and refuses to let realism or urgency replace verification.