9 min read · Written by Grant Rayner on 02 Jun 2022
Share by emailIf you spend time outdoors, you’ll be familiar with the seven leave no trace principles. These principles are designed to minimise our impact on the environment. They also help to avoid degrading the travel experience.
The seven principles are:
If you’re travelling to higher-risk locations for work or personal reasons, there’s also some utility in adopting a ‘leave no trace’ approach. Of course, the context is a little different…
Before I get into the practical aspects of how you can minimise your footprint while travelling in higher-risk locations, let’s first develop a common understanding of why you might want to do this.
If you’re travelling to a higher-risk location, a key objective is to be able to move in and out of the environment without being noticed, and without ending up in a ‘system’ that may make future assignments more challenging. Systems in this context not only include government databases, but also the devices and memories of the people with whom you’ll be interacting.
Of course, you’ll already exist in a range of systems. The minute you book a flight or hotel, apply for a visa, or enter a country, your personal information will be saved in multiple databases. Fortunately, your records will exist along with those of a host of other people. In aggregate, you’re relatively anonymous. At this early stage, you’re probably not attracting any special attention that may make your life difficult. So what actions can you take to make sure it stays that way?
When it comes to information security, only carry in what you need. Ideally, use dedicated devices that have been specifically set up for travel. These devices should be free of the data that lives on your normal personal or work devices (emails, messages, photos, contacts, calendar schedule, notes, files, social media posts, browsing history, location history, et cetera).
While you’re on the road, maintain good security hygiene by routinely deleting emails and messages. Some applications will allow you to automatically delete data after a certain period (the disappearing messages feature of Signal, for example) or on closing the application (e.g., setting up Firefox to delete your browsing history when you exit the app). Some password managers have a ‘travel mode’. Use these features. In addition, maintain strict compartmentation between devices. If you’re carrying a travel device and a normal device, don’t communicate between these devices. Similarly, don’t communicate with the same people using your travel device and your normal device. In some contexts, you may even want to enforce strict physical separation between devices to avoid association.
Avoid creating, carrying and storing hard copy documents. Where you do need to use hard copy documents, ensure they are appropriately protected. Once you’ve finished with a hard copy document, destroy it by burning it and disposing it down the sink. Do this with all written notes, printed bookings, tickets and receipts. Particularly receipts.
(Burning might sound a bit extreme, but you’re probably not travelling with a cross-cut shredder. In any case, a waste basket full of shredded paper would probably attract attention. Paper is also surprisingly hard to swallow.)
If you’re working with sources and they pass you hard copy information, make sure you know how to securely manage that information to avoid harm to yourself or your sources.
Use cash as much as possible for small purchases around town, particularly for transport and meals. Cash is better for the local shop owners and it leaves less of a trace of you and your activities. Your payment history can reveal preferences and patterns that can be used to target you. Use credit cards for major transactions, such as hotels and flights (that’s expected behaviour–otherwise it may be deemed suspicious if you use cash for everything).
For the same reasons you might avoid using credit cards for local purchases, limit the use of app-based services for transport and food delivery. By doing so, you’ll be able to avoid creating a neatly packaged history of pickup and drop-off locations for transport. Similarly, you’ll be able to avoid providing delivery addresses for food delivery, not to mention food preferences and routines (delivery days and times).
Limit the breadth and depth of your social network. In this context, breadth refers to the number of people you meet and that know you exist. Depth refers to the extent of details that each person you meet learns about you.
In higher-risk locations, everyone you meet may be only a few degrees away from someone who could be a threat to you: a criminal, a member of a militia group, or a member of the local security and intelligence service. The more people that know you exist, where you are from, and what you are doing, the more likely word will get out to the wrong people.
This guideline is particularly apt in more insular societies, where there are fewer people who look and talk like you, and where your mere presence stands out and attracts attention.
That doesn’t mean you shouldn’t interact with people. Rather, it infers mindful engagement. Treat each interaction as a deliberate process designed to achieve specific objectives. Consciously manage the information you release during each interaction.
Make a conscious effort to compartmentalise information and activities. As a simple example, your driver may know your destination, but doesn’t need to know who you’re meeting at that destination. As noted above, you can also compartmentalise your digital activities by using different devices and applications for different purposes.
In addition, you should compartmentalise your social groups. As a simple example, if you’re meeting Person A, that person doesn’t need to know you’re also in regular contact with Person B. This type of basic compartmentation not only protects you, but also protects your contacts. If the authorities question one of your contacts, that contact won’t be able to point the authorities in the direction of your other contacts.
There should be nothing about you that would cause another person to lock you away in their memory. Your physical appearance should not cause anyone to look twice. The conversations you have when in social settings should not make someone think “wow, that’s really interesting — I really want to know more about this person!” In general, try not to vocalise strong opinions. Don’t express your love or hate for anything or anyone. Everything “is okay” or “could be better”. Don’t let your body language reveal your true thoughts about someone or something. Be neutral on issues, unless it’s clearly best for you to pick a side (which sometimes does happen).
People with flamboyant personalities tend to be less forgettable. If that’s you, you’ll need to learn to consciously tone things down. Of course, it’s situational.
Next time you’re outside, survey the scene. Who stands out? What makes them stand out? Your aim is to learn from these observations to shape how people might perceive you in social settings. (I’ve written about the benefits of being boring here.)
As a point of principle, try to avoid getting yourself in a video surveillance database. Staying out of surveillance databases is getting more and more difficult. I’d suggest it’s becoming almost impossible in some travel contexts (at airports, for example). Here’s a few thoughts on how you might avoid ending up in a surveillance database:
What you’re trying to avoid is amassing location-based data that enables your activities to be monitored over time. Data is persistent. Even if you’re not working on anything sensitive on your current trip, you may be working on sensitive projects on future trips.
Persons of interest are more likely to be under surveillance by the domestic intelligence and security services. Some may also be surveilled by third-country intelligence services.
The definition of who may be considered a ‘person of interest’ will depend on the country. As a rule of thumb, you could consider politicians, diplomats and activists to be people of interest. In some contexts, prominent people in certain business sectors or academic fields may also be people of interest and may be monitored.
If you’re seen meeting persons of interest, you may be photographed or otherwise recorded as a known contact. Your description will be noted in a surveillance log and your photo will be run through facial recognition software. If the respective agency decides that your profile or activities appear to be suspicious, additional efforts will be made to find out who you are and what you’re up to. You may be placed under physical surveillance. Your devices and accounts may be targeted. Your hotel room may be searched.
Therefore, you should avoid persons of interest whereever possible. If your task is to engage with persons of interest, you’ll need to carefully develop a plan to do so that minimises risk to you and them.
Don’t intervene in local issues, particularly altercations. Just keep moving, regardless of what happens. If you feel strongly that you need to do something, get the attention of a passerby and ask them to intervene.
If you do decide to involve yourself in a local issue, not only could you place yourself at risk, but you may also be highly visible to large groups of people. People are more likely to remember you in such contexts. You may be brought in by law enforcement as a witness. You could even be interviewed by the media. Overall, as a foreigner, there’s a good chance that any intervention on your part will have unpredictable outcomes.
Following from the point above, avoid altercations whenever possible. Don’t let any situation escalate to the point where it turns into an incident that attracts the attention of passersby. You don’t need to win arguments and you certainly don’t need to get into yelling matches. Stay calm, apologise, make reparations if needed, and get on with your day.
If asked for information about yourself or your work, be vague. As touched on above, make your life and work sound so uninteresting that it isn’t worth someone’s time and emotional energy to bother learning more about you.
Be particularly vague (or even outright dishonest if need be) when it comes to details that relate to your personal safety. Be very selective when sharing information about where you are staying and what your plans are over the coming days.
As all an adversary needs to be able to target you is a time and place. Your job is to make targeting as difficult as possible, by making it difficult for anyone to obtain that information.
After spending time in any location, you’ll exchange messages and calls with people, take photos with them, and may post about each other on social media. By doing so, you’re now residing in the digital memory of your environment. Someone doesn’t need to try to remember who you are if interviewed by the authorities — they can show them a photo. Even if you use good security hygiene by deleting emails and messages on your own device, your contacts may not apply the same practices.
Minimise your digital interactions. Use messages instead of emails (use a secure messaging application with a disappearing messages feature). Where you can, use secure voice instead of messages. If you’re interacting with a sensitive contact, coach them in effective security practices, particularly security hygiene and compartmentation.
Of course, balance this approach with considerations for your personal safety. In some contexts, it may be safer for you to message a contact rather than meet them face to face.
Try to avoid allowing people to take photos with you. If you’re unable to avoid the situation, offer to take the photo yourself on your device. You can then choose whether you want to share that photo later (or just delete it). If someone does take your photo, politely request that they don’t post that photo to social media.
Leaving no trace is a good principle to follow if you plan to move in and out of higher-risk locations and want to stay off the radar (and out of the databases) of the local security and intelligence service. As with all advice, the recommendations contained in this article are contextual and need to be carefully tailored to your reasons for travel and your operating environment. Use what works in your current situation and file the rest away for other purposes.
Thanks for reading.