This is the last article in the series and the hardest one to write, because it is the only one that gives advice. And badly calibrated advice on this is not a typo: it is someone in prison.
So I will start with what this text is not.
I cannot promise you safety. Nobody can. A state that controls the only telecommunications operator, the police, the courts and your neighbors has advantages no application offsets.
What I can do is rank the risks by what has actually sent people to prison, according to the cases documented in this series, rather than by what sounds most technical. Reducing risk is possible. Eliminating it is not.
The right order, and why it is backwards almost everywhere
Most digital security guides start with the connection: encrypt this, hide that, install this tunnel. In Cuba, that is the least frequent problem.
Look back at the cases: a barber sentenced to two and a half years over memes in a family group of eleven people; a twenty-two-year-old given four years for sharing a call to protest; Decree-Law 370 allowing your phone to be confiscated without trial. In none of them was traffic intercepted. There was a device, there were people, and there was an elastic law.
Hence the order I propose:
1. The device, assuming it will be searched
Start from that premise and everything else falls into place. The question is not whether they can get in, it is what they will find when they do.
- What is not stored cannot be confiscated. If you sent something, you do not need to keep the copy, the original, or the conversation thread. Deleting after sending is the simplest and most effective measure. Remember to empty the trash or the “recently deleted” album too, which is where everything sits for a month.
- A memorized code protects more than a fingerprint. A finger or a face can be physically placed in front of your phone in an instant. A code that exists only in your head cannot be extracted by hand.
- Turn off lock screen previews. If messages can be read without unlocking, your phone talks even when you do not.
- Think about the contact list, not just the content. What is most useful to whoever searches your phone is usually not one particular message: it is the list of who you talk to. A confiscated device hands over far more people than its owner.
2. People, which is where it almost always breaks
- A private group is not private. It is the sum of the discretion of all its members. Eleven relatives were too many. Not because family fails, but as arithmetic: every person added is one more probability.
- Tell only what needs telling. Someone who does not know something cannot hand it over, under pressure or by carelessness. Protecting someone sometimes means telling them nothing.
- Encryption protects the message, not the recipient. WhatsApp is end-to-end encrypted and that saved nobody in the cases I have described, because the message arrived intact on a phone that later talked.
3. What you publish, before you publish it
- Photos carry more inside them than you see. An image file can include the coordinates of where it was taken, the date, the time and the device model. That data travels with the photo even though you never see it. If you are publishing something sensitive, do it from a clean copy, not the original file.
- Faces identify. Yours and everyone else’s in the frame. At a protest, publishing a wide shot can be very costly for people who never chose to appear.
- Real time places you at the scene. Publishing while you are there confirms you were there. Waiting is not always possible, but when it is, it helps.
4. And only now, the connection
It serves for access: for reaching what is blocked. Tools like Psiphon do that and do it well, as the million and a half Cubans of 11J demonstrated. Cloudflare WARP solves a different problem, that of sites shutting the door on you for having a Cuban IP.
What none of those tools does is erase what you published under your own name, protect a confiscated phone, or stop someone from talking. Regaining access and being safe are not the same thing.
The safest thing is not silence: it is not signing
It is worth saying what I am not saying, because it lends itself to that. Keeping quiet is not what I recommend, and it is not safer either. What comes out from inside cannot be replaced by anyone outside: without it there is no case file, no news story and nothing to show anyone. Speaking out is what keeps opening cracks, and that is why the regime charges so much for the nerve.
What I am saying is that the name signing it does not have to be yours.
Get the material out and let someone beyond the reach of that court publish it. You remain the source, not the author. The complaint goes out just the same, the world sees it just the same, and the name signing it is not on the island.
This is not surrender. It is understanding where the risk sits and placing it where it can be borne. Every exile newsroom works this way, and it works because the dangerous part is carried by whoever can carry it.
What I owe you about myself
I am writing this from Tampa. I can put my full name on every one of these articles because nobody is coming for me tonight, and whoever reads this from the island does not have that comfort.
That is why I have tried not to dress anything up, not to promise protections that do not exist, and to say when I do not know something. I would rather this text were less reassuring and more true. Anyone deciding how much risk to take has to do it with real information, not with the information I would like to be able to give them.
And if you have any doubt about any of this, or you think I got something wrong, write to me. Correcting an article is cheap. The other thing is not.