“Turkey coup plotters' use of 'amateur' app helped unveil their network”

another(from a gulenist it seems) says, guys don't use the same app for communications over and over, try to be more diverse (talk about an app called kakao)

Having said that, I stayed up watching the whole thing, and it never felt very real. There's no way you're going to fire on people in the streets with a helicopter but not shoot down the president's plane. Hell, they didn't even arrest the Parliament.

However somewhat foreign press is trying hard to see it other way. Many foreign journalists even supported the coup instead of condemning until failure is imminent. Some reasons can be that they just dislike the current president and often their information sources are people who are affiliated with the cleric's movement.

Clearly this coup attempt gave a golden opportunity to the president to purge Gulen followers from the state and nobody is denying this. But that is the expected behavior, whether or not it is justified. To me, Gulen and his upper hierarchy just blindly pushed all their low rank followers to the fire (most probably did not have a clue about the coup).

But now, the coup needs a way to communicate. E-mail's because we know it's insecure. Now what? You research, and find this app, and then....

Feel like this isn't very actionable advice.

It really depends on who you are trying to depose. I wouldn't trust any device if you were going against the interests of America / NATO, there are just too many opportunities for side channels. Likewise if it were using Chinese hardware against China. Assume you're compromised in either situation regardless of how secure your encryption seems to be.

Shut the fuck up and wait for instruction.

When you're in the conspiracy stage, you need a cell like structure to protect the conspiracy against double agents and detection.

When you go live, you decapitate the local flavor of secret police, arrest the leader, and start rounding up or killing the key players.

Then talk.

But remember that Turkey is a NATO ally, so you're up against the NSA, CIA and MI6 for starters (in addition to the fine intelligence service of Turkey).

So I would think that Signal would have to hand out all registered phone numbers in Turkey - a list which could be checked against all military personnel. Given that they've detained thousands of teachers, I don't think they'd be above detaining thousands of suspected troops, even at the risk of waterboarding loyalists.

You don't need an accurate list, just some help "short listing" people.

Similar issue with Tor - if you're in the military and your mobile device used Tor before/during the coup, you'd be on a watch-list (or shot).

The best op-sec is the terrorist/stay-behind/contras: small independent cells, with no knowledge or communication with each other. Obviously some plan is needed to set up a command and control structure when the coup is "won". I don't think there are any great solutions here, that also doesn't leak enough meta-data to get you tortured and killed in the event of a failed coup.

Signal also had some sort of work towards preventing contact list disclosure.

At a state level, there's also traffic analysis. If you find Target A then look at their traffic, you might be able to time-coordinate messages sent to other users. (Target->Signal Servers->Recipient)

Guess they could take the Signal source and run their own copy of it, too, eh? I'd also add a time-based auto-wipe function to Signal, which is useful if your are suddenly captured. Doing it by hand is tedious, so people don't. Signal doesn't do this because they don't want people to think it implements a secure remote wipe. But they should consider the problem of an activist having their phone recovered. If the app would delete on time, it'd mitigate some damage.

Telegram shouldn't be touched.

OTR messaging is encrypted (only intended recipients can read your messages), authenticated (you can verify intended recipients identity), deniable (anyone can forge messages after a conversation to look like you sent them), and forward-secret (if you loose your keys, previous conversations aren't compromised).

Also, it is wise to communicate as little as possible. Chatter can be detected to see who are involved. It often doesn't matter what you said, if you were involved or engaged with the wrong people, you may find yourself zip-tied in a stress position.

[1] https://otr.cypherpunks.ca/