The main message of the book is that only structural changes to the computers, networks and services we use can really help to protect our privacy. There is however something that you as a user can do to protect your privacy.

Stay informed

Keep up to date with technological, societal and political developments, and consider, with a critical but open eye, how these might have an impact on our (digital) freedoms and privacy in particular. Look beyond the current trends like machine learning and AI to also consider developments in biotechnology, nanotechnology, economics or psychology. If there is one message this book aims to get across, it is this: technology never develops in a vacuum but is always shaped by societal developments, economic incentives and political convictions (and subsequently influences these developments, incentives and convictions).

Your choices do matter

Always remember that you do have a choice, although admittedly this choice is often limited and/or difficult to make. Nevertheless, markets do respond to consumer choices provided enough consumers make that choice. And politicians do respond to citizen demands, provided enough citizens put their vote where their mouth is. This is not to say that we should leave the whole privacy issue to be decided by the market or the politicians. To the contrary (as we will discuss below). But every bit of incentive will help to speed up the process.

Finally, also in your professional career you can make a difference. If you are an entrepreneur, carefully consider your business model. If you aim for a start up, do not focus on the buy out, but actually focus on the product you are designing and consider how society (not your company) can benefit. If you work for a company, voice your privacy concerns and convince your co-workers and management to change course.

General advice

Even as an individual you can protect your privacy to some extent, by taking certain precautions and carefully deciding which services and applications to use. A detailed description is beyond the scope, and would not be very meaningful anyway as software and services changes so fast that the recommended settings may not even exist anymore once this book gets actually published. So we refer to a few good online resources for details (see below) and only discuss some of the general ideas here.

In essence, there are three parties that constitute a potential threat to your privacy: you yourself, the providers of the devices, applications and services you use, and third parties that try to gather personal information about you. Let us consider the latter first.

Third party surveillance

At a very basic level, protecting your own privacy is a form personal security. Which means that all the basic security precautions will help to protect your privacy too, if only to prevent theft or inadvertent loss of personal data (pictures, financial documents, etc.). This means installing updates to your PC, tablet or smartphone as soon as they come out (both for the operating system, i.e. Windows, MacOS, iOS or Android, as well as any apps or applications you use). Enable the virus scanner and firewall provided by your operating system (most modern operating systems do so by default).

Use disc encryption to ensure personal data on external storage (like your hard drive or solid state drive) cannot be accessed if your laptop gets stolen or your tablet or smartphone gets lost. Again, modern operating systems provide disc encryption solutions out of the box. Disc encryption ensures that as soon as your device is locked the decryption key (that is necessary to access any data stored) vanishes. It is only regenerated or recovered if the correct passcode or password is entered or when you unlock your device with your fingerprint for example.

Be careful with any metadata in documents or pictures that you share, as discussed in the chapter "It's Merely Metadata".

Use different passwords for each and every service you are using. This ensures that if one service is careless and somehow leaks your password in a data breach, all your other accounts on other services are still secure. Also make sure that your passwords are strong enough (ten random characters or, even better, a five word pass phrase). In essence this means you have to use a password manager that generates and stores such passwords for you (as nobody can remember that many strong passwords). Use a strong password to protect the password manager. Finally, use two-factor authentication (as discussed in chapter "We Always Need To Know Who You Are") for accounts that you strongly care about. Consider using a separate physical dongle, like a YubiKey which you can insert in an USB port and that securely generates one time access code when pressed. In particular use it for the email account that you use to send password reset requests to, in case you forgot the password.

When browsing the web, make sure you connect securely to each website you visit (as discussed in chapter "I've Got Nothing To Hide"). You achieve this by only visiting websites whose URL (i.e. hyperlink) starts with https:// (instead of the insecure http://) - i.e. the s stands for secure. You can also tell whether you are visiting a website securely by checking that an image of a small padlock is shown in your browser alongside the hyperlink of the page you are visiting. You can force your browser to always visit a website securely (and warn you if this is not possible) by installing the HTTPS Everywhere browser extension.

Some people suggest to use secure email, like PGP (Pretty Good Privacy), an oldie), for additional privacy protection. But this is fraught with problems and hard to use really securely. In fact it is easier (and more secure) to transmit a document with an end-to-end encrypted messaging app like Signal (which also has a desktop app). The downside is that this restricts the people you can communicate with to those that have the same messaging app installed. Also, the archiving options sometimes leave something to be desired.

In general your risks increase as soon as you connect your device to a network and start using Internet-based services (as we saw in "You Have Zero Privacy Anyway - Get Over It"). Despite the scaremongering surrounding the insecurity of using public, unsecured, wireless (WiFi) networks, this is in fact a general problem: even if the WiFi network is secured, or if you use a wired, Ethernet, network the risks are similar. The fact of the matter is simply that you do not know, and therefore cannot trust, the person running the network. Moreover almost all networks in principle operate in `broadcast mode' which means that they either shout your messages to anybody on the local network or can easily be tricked to forward your messages to anybody else on the local network. Visiting websites only over a secure connection (explained above) solves this problem. Alternatively you can use a Virtual Private Network (VPN, discussed in chapter "I've Got Nothing To Hide"). Many commercial offerings for VPNs exist. Often your ISP provides one you can use, or your work will most likely have one to allow you to connect to the enterprise Intranet securely. A VPN encrypts all your network traffic (up to the servers of the VPN provider) and shields your identity (i.e. your IP address) from the websites you visit. Note though that the VPN provider now gets to see all your Internet traffic, which websites you visits, and thus learns a lot about your surfing habits (and much more if you websites that do not offer secure connections over https). It is therefore important you select a VPN provider you can trust. If you this really is concern to you, a more privacy friendly alternative is to use Tor, The Onion Router, discussed extensively in chapter "It's Merely Metadata". Using Tor prevents anyone from learning which websites you are visiting. But you pay for this strong form of privacy protection with high latency and low bandwidth.

First and Second Party Surveillance

Above we discussed how to protect yourself against third party surveillance. Now lets turn our attention to things you can do to prevent first and second party surveillance, i.e. to protect your privacy against your own devices and the apps, application or online services you use. The most basic (yet hardest) advice is this: simply stop using applications and services that collect your personal data. It is not always clear whether personal data is being collected and what it is subsequently being used for (although the situation is improving with new laws like the GDPR that require more transparency), but a clear sign is whether the application or service is free. If the service is free, then often you are not the user, but the product being sold. In other words: stop using free applications or services if at all possible, especially when their privacy policy is unclear. (This is not always easy. For example, you need a browser to surf the web. All of them are free. But all of them require a significant amount of resources to develop, maintain and keep up to date. Google Chrome is considered by many to be a secure browser, yet its pedigree is by itself a privacy concern. The default search engine is Google. And as soon as you sign in to your Google account everything you do within Chrome is shared with Google. Firefox is a more privacy friendly alternative, but has issues as well.) For social networks like Facebook or Instagram, there are really no realistic alternatives (yet). If you use them, regularly check and update your privacy settings as these services tend to update their privacy policies every few years, and prefer to offer you the non-privacy friendly defaults whenever they introduce a new functionality. For Google search, there are alternatives, like Startpage or DuckDuckGo.

Stop using free email services like Gmail and switch to a email provider you can trust, like ProtonMail. (If your company or institution uses Google for email, cloud storage, and collaboration, try to convince them to stop.) Typically an email service is part of your Internet subscription (and you will need to trust your Internet Service Provider for the most part anyway). For full autonomy, register your own domain and create an email account under that domain. This ensures that your email address remains the same and remains yours forever, even if you switch Internet service provider, or if your ISP goes bankrupt.

Many people use cloud services (Dropbox, Google Drive, Microsoft's OneDrive, Apple's iCloud or Amazon Web Services) to share documents with others, or to sync their documents over the different devices they use. Although these cloud services offer strong protection of your documents to prevent access by others, they themselves do have access to your data. Your only option is to switch to cloud providers that offer end-to-end encryption of data (like Teamdrive or go for a self-hosted solution (like NextCloud where you run the cloud hosting software on a server under your own control, as discussed in chapter "I've Got Nothing To Hide".

In any case, use sharing services sparingly and do not store data `in the cloud' just in case. Reconsider the use of such cloud based services critically, and ask yourself whether you really need to share your calendar, pictures, notes, contacts etc, with other people (or your other devices) and if so, use a service provider you can trust or use a self-hosted solution. Collaboration through Google Docs or Microsoft Office 365 indeed works like a charm, but again all your (sensitive) data is stored and processed by the provider of that service. There are a few self-hosted alternatives, like CryptPad. Even the non-self-hosted variant of CryptPad uses end-to-end encryption, guaranteeing that the hosting server does not get to see the contents of the documents you are collaborating on. And cryptpad also allows you to create privacy friendly polls and task lists.

As we saw in chapter "You Have Zero Privacy Anyway" service providers are able to track and profile you through browser fingerprinting}, using cookies, or through scripts embedded in web pages. To stop tracking and profiling when surfing the web thus means using a safe browser and blocking cookies, scripts and adds using an add or content blocker. Unfortunately, some websites detect whether you have an add blocker installed and refuse to serve their content in this case. Also review the browser extensions that are installed: some malicious extensions are designed to track you or trick you into using their service. Most browsers offer the option to block cookies, or to delete them automatically when you close the browser or after a certain period. Blocking all cookies may prevent certain websites from working correctly. But certainly blocking third party cookies should pose no problems and will significantly improve your privacy. Also, most browsers offer a private or incognito browsing mode which means that once you close the browser (or the particular browser window) all browsing history is erased and all cookies are destroyed. It is recommended to make private browsing the default if possible. In any case, check your browsing history every once in a while and clean it when needed.

Smartphone advice

Beyond this general advice, there are certain things you could (and should) do when using a smartphone or tablet. The reason is that smartphones are much more personal devices than laptops or PCs (see chapter "You Have Zero Privacy Anyway"). People often carry them with them all the time, and keep them next to their beds when they sleep. Smartphones also contain many sensors (location, motion, microphone, camera, ...) that allow a lot of personal details to be determined about the person carrying them. These sensors are in principle accessible to the apps you install on your smartphone. But not all apps need access to all these sensors, nor do they need access to all information stored on your smartphone (like your contacts, your messages, your pictures or your calendar events). Maps need access to your location, to show you where you are. But they have no business with your contacts. And if you use a navigation app that downloads the maps once beforehand, the map or app provider does not get to track your location in real time (and you save on cellular data costs as a bonus). A simple flashlight app needs no access to anything but the ability to switch your flashlight on or off to shine a little light in the darkness. These days most smartphone operating systems allow you to restrict app access to these sensors and data through their app permission system. Review these permissions regularly, and think twice before installing apps that request permission to access certain sensors, information or capabilities (like sending messages or making phone calls) that you would not expect them to need. Do you really need this app installed?

A fundamental decision to make is which messaging app (like iMessage, WhatsApp, or Telegram) to use. Up until recently, these apps offered a limited form of security: the messages where encrypted when transmitted over the network, but stored in plaintext on the servers of the messaging service. This in principle allowed the messaging service providers to analyze the content of the messages, which was a concern especially when Facebook acquired WhatsApp in 2014. Then came Signal, a truly secure messaging app offering end-to-end encryption (as discussed in chapter "I've Glt Nothing To Hide"). Soon other followed suit, even though it is not always the default (Google Messages) and some us non-standard, dubious, forms of encryption (Telegram). Even though this now protects the content of your messages, end-to-end encryption does nothing to protect your metadata, i.e. with whom you are texting, how much and when. (This is similar to the fact that browsing the web securely using TLS does not prevent the collection of which websites you visit.) Facebook uses this data it gets through WhatsApp use to recommend new connections. Signal states that it does not collect or use such metadata, and even promises not to store your contact list when it checks whether your friends are also on Signal. But this is only a promise and not something that is (or easily can be) enforced through technical means.

Many security and privacy experts prefer Apple phones over Google phones because Apple has stronger control over the hardware, closer integration of hardware and its operating system (updates to Android do not necessarily reach all Android phones), tighter control over the apps on the app store (which means you have to be more careful to avoid malware when installing apps from Google's Play Store), stronger privacy features, and in particular a business model that does not depend on collecting your personal data. Having said that, others prefer Google's Android over Apple's iOS because Android is open source and iOS isn't, and because Android really allows the owner of the device to have full administrator privileges on the phone so they can install their own software outside the Google Play store (see here). Also, Apple's tight control over the App Store raise censorship concerns.

A final word of warning concerns wearables (like smart watches or fitness tracking devices). These are potentially even more intrusive than smart watches because they are literally on your skin, and have sensors that can measure your hearth rate and other health related indicators (like detecting seizures). These wearables often upload this very sensitive information to the servers of the manufacturer of the device regardless of whether you configured the device to work in private mode because you do not intend to share your health data with others. Consider buying a wearable that does not sync your data to a central server by default, but allows you to keep all your data locally on your PC or smartphone. A similar warning and recommendation applies to other Internet connected devices, like those used for home automation.

Online resources

Here are some pointers to online resources that may be helpful.

• EFF's Surveillance Self Defense.
• Bits of Freedom's Internet­vrijheid Toolbox (in Dutch only).
• Tactical Tech's Data Detox Kit.
• Or consult these lists of alternatives to well known software and services: ethical alternatives & resources, switching.software and privacy tools.