SIM Card Forces All of Your Mobile Data Through Tor

Your thinking is going in the right direction here, but you should consider some deeper analysis of your behavior ...

In your example, 1.2B people access gmail - so far, so good.

But how many people access gmail and HN ? How about gmail and HN and MeFi ? All during US timezone waking hours ? You can see where I am going with this.

Now let's look at a different angle - you only visit gmail, so you're safely back in the 1.2B herd, right ? But how many people visit gmail with OSX ? With OSX vX.Y ? With your screen resolution, your enabled fonts, and your patch level? You might be very surprised at how unique your web hit really is.[1]

The point being made here is that if you funnel all of your usage (traffic ?) everywhere, you create a usage "fingerprint" that can then be noticed or logged or tracked or correlated anywhere else you go.

It's not hopeless - you could spin up a throwaway VM that you would only use for gmail and nothing else, but again - there are opsec considerations there that can sink the whole operation, just like above, if you aren't very, very careful.

[1] https://panopticlick.eff.org/

Let’s think what privacy actually is, privacy in the broadest sense is your sovereignty over yourself.

What does privacy means? Privacy means that you control how you interact with the environment, how you think who you interact with, what do you do etc.

Let’s take the least private environment one can think of in the western world which is prisons.

Now prisons dont have privacy not because they monitor your calls that’s just one part of it, they lack privacy because prison requires you to surrender nearly all of your agency to a higher power.

Prisons take control over your entire daily routine, who you can talk to, when and how, what information you can access, anything you own can be searched and taken from you at any time and while you can still have confidential discussions with say a lawyer these discussion aren’t really private as they can only be had under predetermined conditions which you have no agency over.

Now let’s take a descrete case for example communications what properties do they need to exhibit to ensure privacy?

With email specifically you need to be able to establish an identity which is unique to you that can be used to establish trust with the party you communicate with.

You need to be fairly certain that the provider would deliver your correspondence to the intended recipient.

You need to be fairly certain that the email provider would not impersonate you or modify the contents of your correspondence.

You need to be fairly certain that the email provider would not access your correspondence.

You need to be fairly certain that the link betweeen you and your provider is secure and that 3rd parties can not intercept the communications between you and the email provider.

Now there can be a bunch of more requirements extrapolated form this but this will be too long.

Now again in the descrete case of email what are the technical controls needed to support these requirements?

So for the first one it would be mainly account control the provider need to support registration, account security they shouldn’t recycle inactive addresses.

The 2nd one is usually implied trust in the competency of the provider meaning that if you send an email to johnsmith@email.com it would go to that address and only to that address.

The 3rd and 4th ones are more complicated this can be solved with an implicit trust in the provider or if that trust is not sufficient then through other means like using PGP for your emails.

The 5th one is also “tricky” because it expands the model to involve more parties which some can be adversarial but in the most basic approach you need a private link between you and your provider if that private link is established over a public one for example the internet you need some sort of mechanism to validate the identity of your provider and ensure the confidentiality and integrity of the communications this is essentially what SSL/TLS does as it allows parties to prove that they are who they say they are and exchange keys securely.

Now in nearly all your cases there was some sort of a technical failure that adversely affected the ability of the email provider to allow you to communicate in private with another party.

Keep in mind that anonymity isn’t Eve not knowing that Alice is talking to Bob but that Alice doesn’t know that it’s Bob who is talking to her regardless of what Eve knows.

I called 311 at 2am once, and had to give the address to the 911 operator because she had no data at all. This was from an AT&T phone, so it's a miracle I got through at all.

(AT&T, Verizon, and T-Mobile are all 1-bar for the 50,000 people near where I live, and they constantly complain about it on the neighborhood web sites. Only Sprint has a good signal, and that's because of old Nextel gub'mint contract towers.)

Emergency services would have your GPS coordinates these days, or at least could as its integrated into the spec.