The OPSEC Podcast

Summary:

Samuel Tunick triggered a GrapheneOS duress wipe on his Google Pixel during a warrantless but lawful CBP border search. He's now charged with destroying property to prevent lawful seizure.

This episode rejects two easy narratives. First, that Tunick is a victim: he made a deliberate choice with foreseeable consequences, and agents operated within their authority. Second, that the privacy tool is the villain: GrapheneOS, like Signal, is legitimate infrastructure. Blaming encryption for occasionally protecting a bad actor is an old deflection.

Key Points:

Accountability, not victimhood - Tunick configured a feature designed to destroy data, knew what it did, and triggered it during an authorized search. That was a choice.

The tool is never the strategy - A duress wipe defends against thieves, stalkers, or abusers. Triggered during a lawful search, the same feature becomes evidence destruction.

Tools aren't the bad guys - Blaming the OS is the same trick: a tool that protects everyone sometimes protects a bad actor, therefore the tool is the threat. It's deflection. The fix they want removes protection from all of us.

Law enforcement isn't the enemy - Treating the agent as a personal adversary leads to emotional, losing decisions where the law is most stacked against you.

The real enemy is warrantless mass collection - Ad bidstream, data brokers, Big Tech retention, and license plate reader dragnets like Flock collect on everyone with no warrant because it's built into commerce.

The real risk is getting swept into someone else's investigation - Geofence warrants order providers to hand over every device in an area during a window, sweeping up bystanders.

Aim your OPSEC at the machine, not the badge and not your tools - Keep the tools, respect them, and deny the collection machine your data in daily life. Fight the system where it's vulnerable: local contracts, the courts, and your platform choices.

Not Legal Advice: This episode discusses criminal cases and legal risk for general education. It is not legal advice, and Allen is not a lawyer. If you're ever in a situation like this, consult a licensed attorney.**

Sources:

- [US accuses American of wiping his phone with a duress password during a border search (TechCrunch)](https://techcrunch.com/2026/07/24/us-accuses-american-of-allegedly-wiping-his-phone-using-a-duress-password-during-border-search/)

- [A man gave border agents his passcode. It wiped everything. Now he faces federal charges (Decrypt)](https://decrypt.co/374394/border-agents-phone-duress-passcode-grapheneos)

- [Google tracked his bike ride past a burglarized home and made him a suspect (NBC News)](https://www.nbcnews.com/news/us-news/google-tracked-his-bike-ride-past-burglarized-home-made-him-n1151761)

- [Google changes Location History to limit geofence warrants (The Register)](https://www.theregister.com/2023/12/15/google_location_history_geofence/)

- [Get the Flock Out campaign (ACLU)](https://www.aclu.org/campaigns-initiatives/get-the-flock-out)

- [Why some cities are ditching their Flock license plate readers (NPR)](https://www.npr.org/2026/02/17/nx-s1-5612825/flock-contracts-canceled-immigration-survillance-concerns)

- [Digital privacy at the US border (EFF)](https://www.eff.org/issues/border-searches)

Call To Action:

Two things this week. First, examine the tools you rely on. For each one, ask not just what it protects you from, but when could it become a liability.

Second, aim at the machine. Pick one source of ambient collection and cut it: reset your mobile ad ID, add DNS-level blocking, or find out whether your town runs Flock cameras and show up to the contract vote.

For more visit OPSECPodcast.com.

Your privacy and your security is your responsibility.

Summary: Every financial transaction creates a permanent record: at the bank, the card network, the payment app, the data broker who purchased it, and the government reporting infrastructure mandated by the Bank Secrecy Act. This episode maps the complete architecture of financial surveillance—from 78,000 government reports filed daily, to Mastercard's transaction data sales, to Plaid's middleware granting hundreds of apps access to your full banking history.

---

What Your Financial Data Reveals:
- Health conditions (pharmacy patterns, clinic visits)
- Political activity (donations, event venues)
- Religious practice (charitable giving, places of worship)
- Relationship status (dining, travel, shared accounts)
- Financial stress (overdrafts, payday lenders, credit utilization)
- Daily schedule and location patterns
- Household composition

---

Key Takeaways:
- The Bank Secrecy Act generates massive surveillance as a compliance byproduct—most unrelated to actual crime
- Structuring laws mean using cash incorrectly can itself be a federal crime, regardless of intent
- Card networks (Mastercard, Visa) sell transaction data commercially; "anonymization" claims are disputed
- Plaid aggregates your banking history and shares it with every connected app—most users don't know what they've authorized
- Your financial profile is more detailed than your own memory of spending, accessible to multiple commercial and government actors

---

Key Actions:
1. Audit Plaid connections: Visit plaid.com/connections to see every app with bank access. Revoke anything unused or unrecognized.
2. Get virtual cards: Use Privacy.com to generate merchant-specific card numbers with spending limits. Free tier available.
3. Read your bank's privacy notice: Exercise your legal right to opt out of third-party data sharing. Banks must offer it; few customers do.
4. Use cash strategically: For medical, personal, and sensitive purchases where you don't want a commercial record.
5. Don't structure deposits: Breaking up cash deposits below $10,000 to avoid Currency Transaction Reports is a federal crime—regardless of whether any underlying crime exists.

---

Resources:
- FinCEN: Bank Secrecy Act Overview
- FinCEN: Currency Transaction Report FAQ
- Privacy.com: Virtual Cards
- Plaid: Manage Your Connections
- PIRG: Mastercard Data Sales Practices
- Cato Institute: BSA Reporting Volume FY2025

---

Call To Action:
This week, go to plaid.com/connections and revoke every app you don't actively use. It takes five minutes, and you'll almost certainly find connections you forgot you created.
Then read your bank's annual privacy notice and opt out of third-party data sharing. It's required to be offered. Exercise it.
Your financial record is a behavioral profile. The question is who has access to it.
Head to OPSECPodcast.com for everything else.
Your privacy and your security is your responsibility.

An update from Allen on where the show is headed. Production has been handled by our friends and partners at Grey Dynamics up to this point. Their production engineer is moving on to other opportunities, which gives us the chance to bring the full production process in-house. The show is taking about a month off to set that up, the style and quality are staying exactly the same, and the release schedule is growing: biweekly deep dives through the end of 2026, then a weekly show in 2027 that keeps the deep dives every two weeks and adds shorter "OPSEC Essentials" episodes in between. Paid member-only content is planned for later, and if sponsors ever come aboard, they stay out of the content. The core podcast stays free and stays in your feed.

Public schools have become one of the softest, highest-value targets in the ransomware economy. They hold enormous amounts of sensitive data on children, run on tight budgets with little security staff, and depend on third-party vendors that keep getting breached. This episode maps the current threat landscape: the PowerSchool breach that exposed roughly 62 million students and 9.5 million teachers, the Canvas breach that became the largest education breach on record, the always-on monitoring software watching half the students in the country, and the collapse of the federal support that many districts relied on. Then it covers what districts have to do and, more importantly, what parents and students can actually control. The single highest-leverage action for a parent: freeze your child's credit.

Defenses and Resources

For districts (CISA guidance):
Protecting Our Future: Cybersecurity for K-12 (CISA)
Cybersecurity for K-12 Education (CISA)
K-12 Ransomware Resources (CISA StopRansomware)
K-12 Cyber Incident Map (K12 SIX)

For parents and students:
How to protect your child from identity theft, including freezing a child's credit (FTC)
FERPA and your rights over education records (U.S. Dept. of Education)
Children's privacy and COPPA (FTC)

Priority Actions
1. Freeze your child's credit at all three bureaus (Equifax, Experian, TransUnion). Free, and it blocks new accounts opened with a stolen SSN.
2. Treat any breach notice as real. Take the free monitoring, but know the freeze is what actually prevents fraud.
3. Ask your district what SIS, LMS, and monitoring software it uses, what data each holds, and for how long.
4. Use the opt-outs you already have (FERPA directory information; COPPA protections for younger kids).
5. Decline optional apps and accounts. You cannot leak what was never collected.
6. Talk to your kid: a school device is not private, and what they type on it is recorded.

If your child is in school, freeze their credit this week. It is free, it takes about an hour across the three bureaus, and it closes the exact door a data breach opens. Do that first.

Then send one email to your district and ask three questions: what student information system do you use, what monitoring software runs on my child's device, and how long is my child's data retained. You are entitled to ask, and asking tells them parents are paying attention.

Head to OPSECPodcast.com for the full episode and every link.

Your privacy and your security is your responsibility.

Most people think of their smart home devices as tools they control. They're not. Echo speakers, Ring cameras, smart TVs, and Google Nest devices are surveillance nodes operated by companies whose business model depends on the data they generate — stored on infrastructure you don't own, accessible to law enforcement through legal channels you didn't agree to, and governed by policies that can change without your consent. In March 2025, Amazon removed the local voice processing option from Echo devices. In February 2026, the FBI recovered footage from a Google Nest camera that had been thought to be offline. This episode documents what each major smart home ecosystem actually does with your data — and what you can do to reduce the exposure.

Key Settings to Change Right Now

Amazon Echo / Alexa:

Alexa App → More → Settings → Alexa Privacy → Manage Your Alexa Data → enable "Don't Save Recordings"
-Set voice history auto-deletion to 3 months
-Delete voice history manually at: alexa.amazon.com
Alexa App → More → Settings → Account Settings → Amazon Sidewalk → **toggle off**
Do not place Echo devices in bedrooms, home offices, or rooms where sensitive conversations occur

Ring:

Ring App → Control Center → Law Enforcement → review and configure sharing settings
For warrant-required camera alternatives: Arlo, Apple Home Camera, Wyze, Eufy (Anker)

Smart TVs:

Samsung: Settings → Support → Terms & Policies → disable "Viewing Information Services"
LG:Settings → All Settings → General → Additional Settings → disable "Live Plus"
Vizio: Menu → System → Reset & Admin → disable "Smart Interactivity"
Sony → Settings → Device Preferences → Usage & Diagnostics → disable; also Settings → Apps → See All Apps → SambaTV → disable or uninstall

Google Nest

Google Home App → Account → Privacy settings → review recording and storage settings
Enable two-step verification on your Google account
Review and delete camera history in Google Home

Home Network Hardening

Segment IoT devices onto a separate network: put all smart home devices (Echo, Ring, smart TVs, thermostats, cameras) on a dedicated network isolated from your computers, phones, and storage. Guest network is the easy entry point; a dedicated IoT VLAN with firewall rules (allow internet, block LAN) is the proper approach. Note: full VLAN segmentation breaks mDNS-dependent integrations (Chromecast, Sonos, HomeKit, Matter) unless you configure mDNS bridging.

Add DNS-level blocking at the router — configure NextDNS or Pi-hole as your router's DNS server to block adtech, tracking, and data broker domains across every device on the network — including smart TVs, Alexa, and Ring — without per-device configuration.

Hardware option: Firewalla — a dedicated network security appliance that plugs between your modem and router. Provides per-device traffic monitoring, DNS-level blocking, intrusion detection, and IoT segmentation through a mobile app. No router replacement required.

Two things to do this week. First: find your smart TV's ACR setting and turn it off — five minutes, done. Second: check whether your router supports a separate guest or IoT network. Put your smart home devices on it. That one step limits what a compromised Echo or smart TV can reach on the rest of your network.

If you want to go further, add NextDNS or Pi-hole as your router's DNS — fifteen minutes, whole-network coverage without touching a single device setting.

None of these are the default. That's not an accident.

All the settings and tools are in these notes.

Head to OPSECPodcast.com for everything else.

Your privacy and your security is your responsibility.

Hosted on Acast. See acast.com/privacy for more information.